Hanan Khashoggi v. NSO Group Technologies Limited

USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 1 of 20 PUBLISHED UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT No. 23-2234 HANAN ELATR KHASHOGGI, Plaintiff - Appellant, v. NSO GROUP TECHNOLOGIES LIMITED; Q CYBER TECHNOLOGIES LIMITED, Defendants - Appellees. No. 23-2241 HANAN ELATR KHASHOGGI, Plaintiff - Appellee, v. NSO GROUP TECHNOLOGIES LIMITED; Q CYBER TECHNOLOGIES LIMITED, Defendants - Appellants. Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:23-cv-00779-LMB-LRV) Argued: October 30, 2024 Decided: May 21, 2025 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 2 of 20 Before AGEE and RUSHING, Circuit Judges, and FLOYD, Senior Circuit Judge. Affirmed by published opinion. Senior Judge Floyd wrote the opinion in which Judge Agee and Judge Rushing joined. ARGUED: Michael J. Quirk, MOTLEY RICE LLC, Philadelphia, Pennsylvania, for Appellant/Cross-Appellee. Ashley Charles Parrish, KING & SPALDING LLP, Washington, D.C., for Appellees/Cross-Appellants. ON BRIEF: Michael J. Pendell, MOTLEY RICE LLC, Hartford, Connecticut, for Appellant/Cross-Appellee. Joseph N. Akrotirianakis, Aaron Craig, Matthew H. Dawson, Matthew V.H. Noller, Los Angeles, California, Edmund Power, KING & SPALDING LLP, Washington, D.C., for Appellees/Cross-Appellants. 2 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 3 of 20 FLOYD, Senior Circuit Judge: Hanan Elatr Khashoggi brought this action following the assassination of her husband, Saudi Arabian journalist and human rights activist Jamal Khashoggi. She alleged that at least one cell phone she owned and used to communicate with Jamal had been the subject of unlawful surveillance using a technology developed and licensed by defendant NSO Group Technologies, and that this surveillance culminated in his death. NSO, an Israeli company, moved to dismiss, arguing that the district court lacked personal jurisdiction. The court granted the motion, and Khashoggi1 timely appealed. We agree with the district court, and we therefore affirm its order dismissing Khashoggi’s claims for a lack of personal jurisdiction. I. A. In June 2023, Khashoggi, a citizen of Egypt and lawful resident of the United States who has been granted refugee status, filed a seven-count complaint in the Eastern District of Virginia alleging that NSO was responsible for illegal surveillance of her electronic devices beginning in 2017. She alleged that this surveillance was conducted by agents of the Kingdom of Saudi Arabia and the United Arab Emirates (UAE) using spyware called Pegasus. Pegasus is developed and licensed to users by defendant NSO Group. NSO’s 1 This opinion uses “Khashoggi” to refer to the Plaintiff-Appellant in this case, Hanan Khashoggi. Her late husband, Jamal Khashoggi, is referred to as “Jamal.” 3 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 4 of 20 parent company, Q Cyber Technologies, is also a named defendant; for clarity, we collectively refer to the defendants as “NSO.” Neither Saudi Arabia nor the UAE are parties to this action. According to the complaint, Pegasus is “an advanced surveillance tool designed to be undetectable” that is “installed on the user’s device without their knowledge or consent.” J.A. 15. Once installed, a Pegasus user is purportedly able to view “every piece of data stored on the phone.” Id. The complaint also alleges three means by which Pegasus can be installed on a particular device. First, if a Pegasus user gains physical control over the target’s device, that user can manually install the software on the device. Second, a target might be sent a text message containing a web address accompanied by a message inducing them to click the link, commonly referred to as “phishing.” J.A. 18. Pegasus would then be installed, without the target’s knowledge, if the target clicked the link and visited the associated web address. Finally, a “zero click” feature allows a Pegasus user to install the spyware without any physical interaction with the target’s device. J.A. 15. Khashoggi alleges that attempts to infiltrate her devices began in November 2017, “just as she was growing closer with Jamal.” J.A. 30. She highlights a particular text message she received on November 26, 2017, stating flowers had been sent to her and encouraging her to visit a linked web address to learn more about the supposed delivery. Khashoggi states that later investigation showed the link was in fact to a webpage that would initiate installation of Pegasus on her device. She also alleges at least five more similar attempts were made in November 2017 to induce her to click malicious links that would result in Pegasus being installed on her device. 4 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 5 of 20 In April 2018, when Khashoggi was working as a flight attendant for the UAE- based Emirates airline, she alleges she was detained by Emirati intelligence officers at Dubai International Airport. She states she was blindfolded, handcuffed, and taken to a remote location where she was “questioned about Jamal and his activities for over 17 hours.” J.A. 31. Two cell phones she was carrying at the time were confiscated. Khashoggi alleges that the agents manually installed Pegasus on at least one of those two devices while she was detained. She alleges that UAE agents were involved in the surveillance because Saudi Arabia “leveraged its relationship with a key ally,” the UAE, to “install Pegasus on her phones, which would then allow [Saudi Crown Prince Muhammad bin Salman] to monitor and track Jamal.” Id. Khashoggi alleges that she was then placed under house arrest in the UAE for approximately a month, and following her release, she returned to the United States. In June 2018, Khashoggi and Jamal married in Virginia. She states that although each continued traveling internationally following their wedding, the couple frequently communicated through “text messages, WhatsApp, phone calls, and various other apps,” and “anytime [Khashoggi] was able to be, she was home with Jamal” in Virginia. J.A. 32. Khashoggi alleges that all of her conversations with Jamal by this time—whether “by phone, message, or in person”—were relayed to members of the Saudi Arabian royal family via UAE agents using the Pegasus spyware. J.A. 33. She alleges that this surveillance continued whenever she was in Virginia as well. In late September 2018, Jamal traveled to Turkey. He was last seen visiting the Saudi Arabian consulate in Istanbul on October 2, 2018. Following his disappearance, the 5 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 6 of 20 United States Office of the Director of National Intelligence issued a report concluding that Jamal had been murdered, and that Saudi Arabian Crown Prince Muhammad bin Salman had approved the operation to capture or kill Jamal. B. Khashoggi filed the complaint providing the basis of this appeal in June 2023, alleging seven counts. First, she alleged that NSO intentionally accessed her devices without authorization in violation of the Computer Fraud and Abuse Act, 18 U.S.C. §§ 1030(a)(2)(C), 1030(b). She also alleged NSO committed computer trespass, which is actionable under the Virginia Computer Crimes Act. See Va. Code Ann. § 18.2-152. Lastly, Khashoggi brought Virginia common law claims for negligence, trespass to chattels, negligent and intentional infliction of emotional distress, and she asked the court to require NSO to disclose the identity of any of its clients that used the software to surveil her devices. Relevant to this appeal, NSO moved to dismiss Khashoggi’s claims for a lack of subject matter jurisdiction and personal jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and 12(b)(2). NSO argued the Foreign Sovereign Immunities Act deprived the district court of subject matter jurisdiction because Khashoggi sought relief for acts taken on behalf of foreign sovereigns—Saudi Arabia and the UAE. See 28 U.S.C. § 1604 (“a foreign state shall be immune from the jurisdiction of the courts of the United States”); see also id. § 1603(a) (defining “foreign state” to include “political subdivision of a foreign state or an agency or instrumentality of a foreign state”). 6 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 7 of 20 NSO also contended that it was not subject to personal jurisdiction in Virginia. First, it argued that it lacked systematic contacts with the Commonwealth to render it subject to the district court’s general personal jurisdiction. See Daimler AG v. Bauman, 571 U.S. 117, 122 (2014) (contacts must be “so constant and pervasive ‘as to render [it] essentially at home in the forum State’” (quoting Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011))). Turning to specific personal jurisdiction, NSO similarly argued it had (1) not directed any conduct at Virginia; (2) that it conducted no business in Virginia; and (3) that it would be constitutionally unreasonable to exercise personal jurisdiction over the company. See, e.g., UMG Recordings, Inc. v. Kurbanov, 963 F.3d 344, 351–52 (4th Cir. 2020) (setting forth the requirements for the exercise of specific personal jurisdiction). In an order entered in October 2023, the district court found it possessed subject matter jurisdiction because NSO was not subject to common-law foreign sovereign immunity, which extends to “an individual acting in his official capacity on behalf of a foreign state.” Khashoggi v. NSO Group Techs. Ltd., 700 F. Supp. 3d 384, 393 (E.D. Va. 2023) (quoting Velasco v. Gov’t of Indon., 370 F.3d 392, 398 (4th Cir. 2004)). However, the court granted NSO’s motion to dismiss for a lack of personal jurisdiction. The court found that Khashoggi had not met her burden to “allege plausible facts that indicate a significant connection between NSO Group and its alleged conduct and this forum” to justify asserting personal jurisdiction. Id. at 395. The court weighed whether it could assert specific personal jurisdiction and concluded that it could not. First, it determined that NSO had not “purposefully availed” itself of the privileges of conducting 7 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 8 of 20 business in Virginia as it had not directed activity at the Commonwealth; second, it found that Khashoggi had not “adequately alleged that her claims arose out of conduct defendants directed at and conducted in Virginia”; and third, the court found that exercising jurisdiction over the defendants in this case would not be constitutionally reasonable. See id. at 395–401. Khashoggi timely filed this appeal, arguing the district court erroneously dismissed her complaint for a lack of personal jurisdiction. NSO timely filed a cross-appeal, arguing the district court erred in finding it was not immune to suit. II. A. We resolve this matter on the issue of personal jurisdiction. Dismissals for a lack of jurisdiction are reviewed de novo, and we review the underlying factual findings for clear error. See Grayson v. Anderson, 816 F.3d 262, 270 (4th Cir. 2016). “A finding is clearly erroneous ‘when although there is evidence to support it, the reviewing court on the entire evidence is left with the definite and firm conviction that a mistake has been committed.’” Butts v. United States, 930 F.3d 234, 238 (4th Cir. 2019) (quoting Anderson v. City of Bessemer City, 470 U.S. 564, 573 (1985)). A plaintiff “must establish personal jurisdiction by a preponderance of the evidence but need only make a prima facie showing.” UMG Recordings, 963 F.3d at 350. And a court must “construe all relevant pleading allegations in the light most favorable to the plaintiff, assume credibility, and 8 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 9 of 20 draw the most favorable inferences for the existence of jurisdiction.” Id. (quoting Combs v. Bakker, 886 F.2d 673, 676 (4th Cir. 1989)). This appeal is about specific personal jurisdiction. Its counterpart, general personal jurisdiction, requires “continuous and systematic” contacts with the forum state “such that a defendant may be sued in that state for any reason.” CFA Inst. v. Inst. of Chartered Fin. Analysts of India, 551 F.3d 285, 292 n.15 (4th Cir. 2009). For an assertion of general personal jurisdiction, the physical location of alleged harmful conduct is irrelevant because the defendant’s preexisting, extensive contacts with the forum suffice to establish jurisdiction. See id. But the parties to this case agree that NSO lacks the sort of persistent contacts with the Commonwealth of Virginia to render it subject to the district court’s general personal jurisdiction. Accordingly, the district court was required to assure itself of specific personal jurisdiction over NSO to properly adjudicate Khashoggi’s claims. Rule 4(k)(1) permits the district court to exercise specific personal jurisdiction over a nonresident defendant, like NSO, if the defendant is “subject to the jurisdiction of a court of general jurisdiction in the state where the district court is located.” Fed. R. Civ. P. 4(k)(1). We have held that personal jurisdiction under Rule 4(k)(1) is lawful “if [1] such jurisdiction is authorized by the long-arm statute of the state in which it sits and [2] the application of the long-arm statute is consistent with the due process clause of the Fourteenth Amendment.” UMG Recordings, 963 F.3d at 350 (quoting Consulting Eng’rs Corp. v. Geometric Ltd., 561 F.3d 273, 277 (4th Cir. 2009)). And we have also recognized that Virginia’s long-arm statute, Va. Code Ann. § 8.01-328.1(A), “extends personal jurisdiction over nonresident defendants to the full extent permitted by the Fourteenth 9 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 10 of 20 Amendment’s Due Process Clause.” UMG Recordings, 963 F.3d at 350–51. That means “the statutory and constitutional inquiries merge into one inquiry,” and the district court can exercise personal jurisdiction in this case when such an exercise would not offend due constitutional due process. See id. at 351. A constitutionally permissible exercise of specific personal jurisdiction in this case requires NSO to have “minimum contacts” with Virginia such that “the maintenance of the suit does not offend traditional notions of fair play and substantial justice.” Consulting Eng’rs Corp., 561 F.3d at 277 (quoting Int’l Shoe Co. v. Wash., 326 U.S. 310, 316 (1945)). This inquiry focuses “on the nature and extent of ‘the defendant’s relationship to the forum State.’” Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 592 U.S. 351, 352 (2021) (quoting Bristol-Myers Squibb Co. v. Superior Ct. 582 U.S. 255, 262 (2017)). The due process inquiry for an exercise of specific personal jurisdiction can be distilled to a three-pronged test: “(1) the extent to which the defendant purposefully availed itself of the privilege of conducting activities in the State; (2) whether the plaintiffs’ claims arise out of those activities directed at the State; and (3) whether the exercise of personal jurisdiction would be constitutionally reasonable.” UMG Recordings, 963 F.3d at 352 (quoting Consulting Eng’rs Corp., 561 F.3d at 278). The district court performed this analysis and determined that it lacked personal jurisdiction over NSO because the Israel-based company had not intentionally directed conduct at Virginia, Khashoggi’s claims did not arise out of conduct directed at Virginia, and an exercise of jurisdiction would be constitutionally unreasonable. See Khashoggi, 10 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 11 of 20 700 F. Supp. 3d at 396–401. We agree with the district court and now address Khashoggi’s arguments to the contrary. B. Specific personal jurisdiction can be exercised over a foreign defendant who commits acts outside the forum if the conduct was “expressly aimed” at the forum. Calder v. Jones, 465 U.S. 783, 789 (1984); see also Hawkins v. i-TV Digitalis Tavkozlesi zrt., 935 F.3d 211, 230 (4th Cir. 2019). In Calder, a libel suit, the Supreme Court held that a California court possessed personal jurisdiction over Florida-based reporters for an allegedly libelous article they had written about a California actress. 465 U.S. at 788–89. The Court reasoned that “California [was] the focal point both of the story and of the harm suffered.” Id. at 789. That was because the authors’ “actions were expressly aimed at California” and they were aware that harm from the defamatory article would be felt in California due to the actress’s work there and the fact the publication had extensive circulation in California. Id. at 789–90. The Court concluded that personal jurisdiction may lie because the reporters, due to their actions, could “reasonably anticipate being haled” into a California court. Id. at 790 (quoting World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980)). We have acknowledged the continuing validity of the Calder “effects” test, as well as its limitations. See Hawkins, 935 F.3d at 230 (“It is true that the in-forum effects of out- of-forum conduct can constitute minimum contacts with the forum sufficient to support personal jurisdiction.”). The effects of the act for which a plaintiff seeks relief must create 11 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 12 of 20 a connection to the forum itself, “not just to parties who happen to live there.” Id. The connection must be “substantial,” so that “a person cannot be haled into the forum simply because he knew that his conduct would have incidental effects there.” Id. (quoting Walden v. Fiore, 571 U.S. 277, 284 (2014)). Finally, the charged conduct must be “expressly aimed” at the forum, or, in other words, the forum must be the “focal point” of the conduct. Id. (first quoting Walden, 571 U.S. at 288 n.7; and then quoting Consulting Eng’rs, 561 F.3d at 280). The district court, despite Khashoggi’s assertions that NSO “intentionally target[ed] . . . her devices in Virginia,” found that she had “not support[ed] that allegation with sufficient, non-conclusory facts or plausible assertions.” Khashoggi, 700 F. Supp. 3d at 397 (quoting J.A. 12). The court noted that the complaint failed to allege with sufficient specificity where and how long Khashoggi lived in Virginia during the alleged surveillance. Id. Lastly, the district court found that Khashoggi had not adequately alleged that it was the NSO Group, as opposed to the Saudi or Emirati governments, that conducted surveillance of her devices using the Pegasus spyware. See id. Accordingly, the court determined Khashoggi had not plausibly alleged any “specific Virginia-related conduct by NSO Group.” Id. at 399. Khashoggi raises several arguments on appeal that NSO directed conduct at and committed acts in Virginia. She argues NSO “intentionally accessed her smartphones in Virginia without authorization” based upon the company’s own representations of the Pegasus spyware’s general capabilities. Opening Br. 23. She also alleges that NSO copied data from her devices and rerouted it through their servers to “conceal their surveillance” 12 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 13 of 20 and then ultimately routed it to their client, the UAE—who in turn shared the information with Saudi Arabia. Id. Khashoggi also argues the court erred in finding she had failed to allege where and when she was in Virginia, and that third parties conducted the surveillance. She argues that the acts she alleges NSO committed, taken together, justify an assertion of jurisdiction. We agree with the district court’s reasoning and affirm its judgment on personal jurisdiction. Khashoggi is correct that a single act can support jurisdiction if that act suffices to create a substantial connection with the forum. See Carefirst of Md., Inc. v. Carefirst Pregnancy Ctrs. Inc., 334 F.3d 390, 397 (4th Cir. 2003). But whether one act or many, it is the “quality and nature” of the defendant’s connections with the forum that justify personal jurisdiction, “not merely the number of contacts between the defendant and the forum state.” UMG Recordings, 963 F.3d at 352 (emphasis in original). The quality and nature of the connections between the forum and NSO in this case fail to support an assertion of personal jurisdiction by the district court, and Khashoggi’s arguments to the contrary fail. First, we note that Khashoggi’s allegations regarding how Pegasus was ultimately installed on her device say nothing about whether a Virginia court has personal jurisdiction. The “phishing” text messages sent to Khashoggi, supposedly designed to induce her to install Pegasus, were not alleged to have been sent from NSO itself and Khashoggi’s allegations as to her own location when she received those messages are vague at best and do not place her within Virginia at that time. Indeed, the fact that the link’s domain name was later attributed to an agency of the UAE is suggestive of that country’s agents being 13 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 14 of 20 responsible for those messages. And in any event, Khashoggi’s allegations regarding Pegasus’s eventual installation on her device by Emirati agents places those events in the UAE at the Dubai airport when she was detained there, not Virginia. This leaves Khashoggi’s argument that jurisdiction is justified by her allegations of Pegasus’s general capabilities and surveillance of her devices when she was present in the Commonwealth at various times after she married Jamal. Khashoggi argues that the district court erred in finding she failed to include any “non-conclusory allegations regarding how long and where” she lived in Virginia or “how NSO group specifically participated in the surveillance of her phones while she was in Virginia, as opposed to conduct that may have happened while she was overseas or travelling for work as a flight attendant.” Khashoggi, 700 F. Supp. 3d at 397. However, we need not address the argument as to whether the district court’s conclusion was clearly erroneous. That is because the court also found that, regardless of whether Khashoggi had made more specific allegations regarding the timing of her presence in Virginia, her allegations do not support the conclusion that NSO directed conduct at the Virginia forum. Khashoggi’s allegations that her data was captured and rerouted to the UAE (and ultimately Saudi Arabia) when she was home with Jamal in Virginia do not suffice to create a substantial connection with Virginia for purposes of personal jurisdiction. As the district court found, Khashoggi’s allegations do not suggest that NSO was the “direct actor” who injured her. Id.at 398. Instead, it appears that Saudi Arabia and the UAE directed the targeting of Khashoggi, her detainment at the Dubai airport, the installation of Pegasus on 14 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 15 of 20 her device, and the alleged surveillance of that device during times when Khashoggi was present in Virginia. Our precedent counsels against permitting an exercise of jurisdiction over NSO here. In a similar factual context—the direction of electronic activity at a forum—we have affirmed the district court’s finding it lacked personal jurisdiction when the defendant’s electronic activity in the forum was “at most, passive.” ALS Scan, Inc. v. Digit. Serv. Consultants, Inc., 293 F.3d 707, 714 (4th Cir. 2002). ALS Scan, a Maryland corporation, sued Digital Service Consultants and several of its customers for copyright infringement based upon internet activity. See id. at 709. We fashioned a personal jurisdiction analysis to acknowledge both “due process concepts of personal jurisdiction” and a state’s “limited judicial authority over out-of-state persons” who make electronic contacts with a forum state via the internet. Id. at 713. The first step of this analysis, and the one most relevant here, requires that the defendant have “direct[ed] electronic activity into the State.”2 Id. at 714. We described this test as “not dissimilar” to the Calder analysis—which makes sense, considering their shared requirement of some kind of conduct directed at the forum. Id. Turning to the facts of ALS Scan, Digital had provided internet service to another Georgia-based party, called Alternative Products, 2 Beyond the requirement that a defendant must direct conduct at the forum state, a court may exercise its judicial power over a person outside the state only if it also concludes that person directed that conduct into the state with “manifested intent of engaging in business or other interactions within the State” and that that activity “creates, in a person within the State, a potential cause of action.” ALS Scan, 293 F.3d at 714. But because Khashoggi’s allegations do not signal that NSO expressly aimed conduct at Virginia, we need not and do not address these additional requirements. 15 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 16 of 20 which in turn made a website available online and accessible in Maryland, the forum state. See id. According to the plaintiffs, Digital could be haled into court in Maryland because it facilitated the availability of a website displaying infringing images in the state. See id. at 712. We held that Georgia-based Digital had not directed conduct at Maryland “even though electronic signals from Digital’s facility were concededly received in Maryland.” Id. at 714. Specific personal jurisdiction could not lie because “the only direct contact that Digital had with Maryland” was the “general publication of its website on the Internet.” Id. at 715 (emphasis in original). Accordingly, we affirmed the district court’s order dismissing the case for a lack of personal jurisdiction. Id. at 709. Similarly, in this case, NSO does not appear to have directed electronic activity into Virginia. Instead, its conduct is more analogous to the passive conduct of the internet service provider in ALS Scan. If there was any express aiming of conduct towards Virginia, it was at the direction of Saudi Arabia and the UAE, not NSO. In the same way electronic signals originating from Digital were received in Maryland in ALS Scan, electronic signals—in the form of NSO’s Pegasus spyware—were allegedly directed at Khashoggi’s devices in Virginia, but upon the direction of third parties. 293 F.3d at 714–15. Accordingly, we cannot say upon these facts that NSO “purposefully availed itself” of the Virginia forum by directing conduct at the state. See id. (recognizing Digital did not “select or knowingly transmit infringing photographs specifically to Maryland with the intent of engaging in business or any other transaction in Maryland”). 16 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 17 of 20 Later decisions applying ALS Scan are in accord. See, e.g., Carefirst, 334 F.3d at 401 (no personal jurisdiction in Maryland in trademark infringement action regarding website directed at Chicago, Illinois); Fidrych v. Marriott Int’l, Inc., 952 F.3d 124, 143 (4th Cir. 2020) (no personal jurisdiction in South Carolina in tort action for injury at Italian hotel, despite website’s general availability in the forum). Most importantly for our purposes here, we have continued to emphasize that “the key issue in a specific jurisdiction case” is the extent to which a defendant has purposefully availed itself of the forum, including by directing conduct at the forum. Fidrych, 952 F.3d at 142–43 (“As the Supreme Court has made clear . . . the connection between the defendant and the forum ‘must arise out of contacts that the defendant himself creates with the forum State.’”) (quoting Walden, 571 U.S. at 284) (emphasis in original). And simply put, Khashoggi has not shown that NSO has “create[d] a connection to the forum, not just to parties who happen to live there.” Hawkins, 935 F.3d at 230 (declining to hold that foreign defendant aiding and abetting the violation of an injunction satisfies personal jurisdiction in forum state) (emphasis in original). We agree with the district court and conclude NSO did not expressly aim conduct at the Commonwealth of Virginia. See id. A lawsuit filed by WhatsApp against NSO in the Northern District of California provides helpful contrast here. See WhatsApp Inc. v. NSO Group Techs. Ltd., 472 F. Supp. 3d 649 (N.D. Cal. 2020), aff’d on other grounds, 17 F.4th 930 (9th Cir. 2021), cert. denied, 143 S.Ct. 562 (Mem) (2023). WhatsApp levied claims like those Khashoggi brings against NSO; the company alleged violations of the Computer Fraud and Abuse Act, 18 U.S.C. § 17 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 18 of 20 1030, and a similar California computer privacy statute. See id.at 658–59. WhatsApp also alleged breach of contract and trespass to chattels. Id. at 659. NSO argued that it was beyond the reach of California’s long-arm statute, but the district court found that it possessed personal jurisdiction to adjudicate WhatsApp’s allegations of tortious conduct. See id. at 669–674. The court concluded that NSO had expressly aimed conduct at California. Id. It found that NSO targeted WhatsApp’s California-based servers for the purposes of transmitting malicious computer codes—the Pegasus spyware—through those servers to facilitate the sort of surveillance Pegasus offers to its clients. See id. at 671–72. It emphasized that NSO had “sought out and accessed [WhatsApp’s] servers,” “reverse-engineered the WhatsApp app,” and “developed a program that emulated legitimate WhatsApp network traffic” to transmit the Pegasus Spyware over the company’s servers. Id. at 672. Ultimately, the court held that NSO’s connections to the California forum were substantial owing to this express aiming; the California litigation also shows that NSO’s connections to Virginia are not substantial due to a lack of express aiming. Finally, we are not persuaded by Khashoggi’s arguments that Luis v. Zang, 833 F.3d 619 (6th Cir. 2016), and Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022) support reversing the district court’s finding that it lacked personal jurisdiction. Khashoggi points out that these holdings teach that an unlawful interception of data occurs “where the data is first captured and rerouted.” Opening Br. 27 (emphasis omitted). And that is correct. See Luis, 833 F.3d at 633 (unlawful intercept by spyware occurs at location of user’s device); Popa, 52 F.4th at 131 (same). But neither Luis nor Popa was about the 18 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 19 of 20 district court’s specific personal jurisdiction. The Luis court considered if the plaintiff had adequately stated a claim under Rule 12(b)(6), see 833 F.3d at 633–34, and Popa concerned whether a genuine issue of material fact existed as to exactly where plaintiff’s data had been intercepted for summary judgment purposes. See 52 F.4th at 131–32. Khashoggi places too much weight on the extent to which those considerations bear on specific personal jurisdiction. We have held that “[a]lthough the place that the plaintiff feels the alleged injury is plainly relevant to the [jurisdictional] inquiry, it must ultimately be accompanied by the defendant’s own [sufficient minimum] contacts with the state if jurisdiction . . . is to be upheld.” Carefirst, 334 F.3d at 401 (quoting Young v. New Haven Advoc., 315 F.3d 256, 262 (4th Cir. 2002)). So, while it could be true that an interception of Khashoggi’s data occurred in Virginia, we have explained that NSO has not directed conduct at the Commonwealth so as to create a substantial connection justifying an assertion of specific personal jurisdiction. Neither Popa nor Luis command a different conclusion. Khashoggi’s argument that the district court has personal jurisdiction to adjudicate her claim against NSO “falters on the first prong.” Perdue Foods LLC v. BRF S.A., 814 F.3d 185, 189 (4th Cir. 2016) (resolving personal jurisdiction appeal on purposeful availment). So, we do not address the remaining considerations in our jurisdictional analysis. Khashoggi has not alleged that NSO directed conduct at Virginia so much as she has alleged that NSO licensed its spyware for use by Saudia Arabia and the UAE, who targeted Khashoggi and her late husband, Jamal. We decline to hold that these allegations justify permitting a Virginia district court to assert specific personal jurisdiction. 19 USCA4 Appeal: 23-2241 Doc: 56 Filed: 05/21/2025 Pg: 20 of 20 * * * * * Because we resolve this case on the issue of personal jurisdiction, we need not assess NSO’s arguments regarding the district court’s subject matter jurisdiction. We therefore leave those questions of the applicability of the Foreign Sovereign Immunities Act, 28 U.S.C. § 1604, to an entity like NSO for another day. III. For the foregoing reasons, the judgment of the district court dismissing Hanan Khashoggi’s complaint for a lack of personal jurisdiction is AFFIRMED. 20