Yahya Assiri, a pro-democracy and human rights activist, just scored a significant legal victory in the UK. He can now take Saudi Arabia to court after his phones were hacked using surveillance software. The High Court in London ruled that Assiri could pursue a claim for damages against the Saudi government for allegedly using Israeli spyware to monitor him.
This is the first case reaching this stage involving QuaDream, an Israeli-developed spyware that specifically targets iPhones. Monika Sobiecki from Bindmans LLP, who represents Assiri, noted that the high court recognized a solid chance of success for his case. She emphasized that the court sent a strong message: governments cannot hide behind secrecy to evade accountability, especially when it comes to repressing their dissenters.
Assiri has been living in England since 2013. He co-founded the Saudi opposition group National Assembly Party and established ALQST, an organization dedicated to advocating for human rights in Saudi Arabia. He has collaborated with well-known critics of the Saudi regime, such as journalist Jamal Khashoggi, who was murdered in 2018, and poet Abdullah Hamid Ali al-Hamid, who died in detention in 2020.
Between 2018 and 2020, Assiri’s phone was hacked by both Pegasus and QuaDream spyware. Independent tests by Citizen Lab at the University of Toronto confirmed these findings. This spyware potentially allowed the Saudi government access to a broad range of information: texts, calls, photos, and even real-time tracking of his movements.
Assiri’s claims against Saudi Arabia include misuse of private information and harassment. He entered the UK as a refugee in 2014 after serving as an officer in the Royal Saudi Air Force. He has been openly critical of Saudi Arabia’s human rights record.
In May 2018, Assiri fell victim to a phishing attack—he clicked a link in a text that caused his iPhone to freeze. Investigations revealed that the link originated from a server connected to Pegasus spyware, believed to be associated with Saudi Arabia. Later that year, a replacement phone he used got hacked as well, attributed once again to QuaDream, resulting in unauthorized access to his data.
Assiri received another phishing link in July 2020 that led to an attack using Pegasus, exploiting “zero-click” vulnerabilities to hack his device without any action required on his part. At that time, he was focused on advocating for sanctions against Saudi officials in the aftermath of Khashoggi’s murder.
His iPhone contained sensitive documents, contacts, and information related to human rights defenders. The Pegasus spyware has capabilities that include monitoring messages, recording calls, and tracking locations, all while leaving no trace behind.
QuaDream, the now-defunct Israeli company behind this technology, marketed its spyware under the name Reign. There’s scant information available about its ongoing usage or operations.
Assiri’s case follows a similar legal action against Saudi Arabia by Ghanem Al-Masarir, who also claims damage from the Saudi government’s use of Pegasus spyware. In January, Saudi Arabia lost an appeal to dismiss Al-Masarir’s case when it failed to meet court orders.
In another twist, the Metropolitan Police are currently investigating claims from several activists, alleging spyware targeting from Saudi Arabia, the UAE, and Bahrain. The lawsuits target NSO Group, the Israeli company behind Pegasus, as well as others involved in the spyware’s sale.
Assiri expressed concern that Saudi authorities might retaliate against those connected to him, including victims of human rights violations. He condemned their tactics, saying that it is outrageous for the Saudi government to put innocent individuals at risk simply because they had contact with him.
Saudi Arabia is likely to claim state immunity during the trial, a legal position currently being challenged in Al-Masarir’s case. Assiri plans to argue that state immunity should not apply here, particularly in incidents involving personal harm.