Global Human Rights | Cybersecurity Laws | Technology

Introduction: Judge Allows Claims Under U.S. Hacking Law to Advance

In a pivotal development for digital rights litigation, U.S. District Judge Karin J. Immergut in Oregon has permitted Saudi human rights activist Loujain al‑Hathloul to move forward with her hacking lawsuit against the DarkMatter Group and several former executives. This marks the first time a human rights case of this nature will advance under the Computer Fraud and Abuse Act (CFAA)—signaling a potential shift in how U.S. courts handle transnational spyware cases.

Background and Core Allegations

Loujain al‑Hathloul, renowned for championing women’s rights in Saudi Arabia, alleges she was targeted through her iPhone by spyware developed by the UAE-linked DarkMatter Group, exploiting vulnerabilities even while she was physically in the United States. The hacking purportedly facilitated her arrest, rendition to Saudi Arabia, and subsequent torture, including electric shocks and threats.(Electronic Frontier Foundation, The Washington Post)

Filed in December 2021, the lawsuit asserts that DarkMatter and three former U.S. intelligence officials used U.S.-origin exploits and tools to install the spyware—underscoring the connection between U.S. technologies and gross human rights violations.(Electronic Frontier Foundation, CJA)

Judge Advances CFAA Claim, Dismisses Alien Tort Statute Claims

In a ruling unsealed in August 2025, Judge Immergut held that al‑Hathloul’s claims under the CFAA may proceed, finding sufficient “forum-related contacts” to satisfy personal jurisdiction. These include:

1. The exfiltration of data from her iPhone while she was in the U.S.;
2. Use and enhancement of U.S.-sourced hacking tools to commit the alleged offense.(Electronic Frontier Foundation, The News Intel)

However, claims brought under the Alien Tort Statute (ATS) were dismissed—a reminder of the ATS’s increasingly limited scope.

Legal and Human Rights Significance

This decision carries profound implications:

• New Legal Avenues for Human Rights Defendants
  It is the first human rights case to advance under the CFAA, potentially laying a foundation for other victims of digital authoritarianism to seek justice in U.S. courts.
• Combating Forum Non Conveniens Defenses
  DarkMatter’s attempt to dismiss the case based on jurisdiction has failed, reflecting growing judicial willingness to resist procedural dismissals in transnational rights cases.(American Bar Association, Courthouse News Service)
• Accountability for Exported Surveillance Tools
  The ruling highlights the ability of U.S. law to reach conduct involving U.S.-based cyber tools, even when orchestrated by foreign actors and governments.

EFF’s Role and Wider Context

Al‑Hathloul is represented by a coalition including the Electronic Frontier Foundation (EFF), Center for Justice and Accountability, Foley Hoag, and Tonkon Torp LLP. EFF’s Civil Liberties Director, David Greene, emphasized that the order is “the first to let a lawsuit filed by the victim of a foreign government’s human rights abuses, enabled by U.S. spyware … proceed in our federal courts.”(Electronic Frontier Foundation)

The decision emerges amid broader scrutiny of spyware’s misuse by repressive regimes—such as the Pegasus spyware cases—where courts and regulators are increasingly demanding accountability.(Reuters)

---

Moving Forward: Enforcement and Impact

With the CFAA claim reinstated, the case may yet:

• Provide compensatory or injunctive relief to a globally recognized dissident;
• Establish judicial precedent for liability in export-related spyware abuses;
• Encourage legislative or policy reform around cybersurveillance exports and tech-human rights nexus.

For the legal community, it underscores the importance of civil litigation as a tool for enforcing human rights in the digital age.

Conclusion: An Important Jurisprudential Global Shift

The court’s decision to allow Loujain al‑Hathloul’s case to proceed signals an important jurisprudential shift—one that holds spyware companies and their actors accountable under U.S. hacking laws, even in contexts marked by foreign abuse.

This will be a case to watch closely, as it continues through discovery and trial, with implications that extend across international human rights and cyber law.