Alhathloul v. DarkMatter Group

 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON LOUJAIN HATHLOUL ALHATHLOUL, Case No. 3:21-cv-01787-IM Plaintiff, OPINION AND ORDER GRANTING DEFENDANTS’ MOTION TO DISMISS v. DARKMATTER GROUP, MARC BAIER, RYAN ADAMS, and DANIEL GERICKE, Defendants. Bridget M. Donegan, Boise Matthews, L.L.P., 805 SW Broadway, Suite 1900, Portland, OR 97205. Christopher E. Hart and Anthony D. Mirenda. Foley Hoag, L.L.P., 155 Seaport Boulevard, Boston, MA 02210. David Greene, Mukund Rathi, Electronic Frontier Foundation, 815 Eddy Street, San Francisco, CA 94109. Attorneys for Plaintiff Loujain Hathloul Alhathloul. Nicholas F. Aldrich, Schwabe, Williamson & Wyatt, P.C., 1211 SW 5th Ave., Suite 1900, Portland, OR 97204. Anthony T. Pierce, Caroline L. Wolverton, Akin Gump Strauss Hauer & Feld L.L.P., 1333 New Hampshire Avenue, N.W., Washington, DC 22036. Natasha G. Kohne, Akin Gump Strauss Hauer & Feld, L.L.P., 580 California St., Suite 1500, San Francisco, CA 94104. Attorneys for Defendant DarkMatter Group. Clifford S. Davidson, Snell & Wilmer L.L.P., 1455 SW Broadway, Suite 1750, Portland, OR 97201. Attorney for Defendants Marc Baier, Ryan Adams, and Daniel Gericke. IMMERGUT, District Judge. Before this Court is Defendants DarkMatter Group, Marc Baier, Ryan Adams, and Daniel Gericke’s (collectively “Defendants”) Motion to Dismiss. ECF 28. Defendants argue that this Court lacks personal jurisdiction over Defendants or, in the alternative, that Plaintiff Loujain Hathloul Alhathloul (“Plaintiff”) has failed to state a claim upon which relief can be granted. Plaintiff brings three federal claims against Defendants, based on allegations that Defendants hacked Plaintiff’s iPhone, surveilled her movements, and exfiltrated her confidential communications for use against her by the security services of the United Arab Emirates (“UAE”). ECF 1 at ¶¶ 1, 134, 165, 171. According to Plaintiff, Defendants’ actions led to her arrest by the UAE security services and rendition to Saudi Arabia, where Plaintiff states that she was detained, imprisoned, and tortured. Id. Plaintiff’s allegations of political retaliation and torture are highly concerning. Nevertheless, this Court is bound by jurisdictional limits and grants Defendants’ Motion to Dismiss for lack of personal jurisdiction.1 BACKGROUND Plaintiff is a Saudi human rights activist and leader of the movement to promote the rights of women and girls in the Kingdom of Saudi Arabia (“Saudi Arabia”). ECF 1 at ¶ 1. Defendant DarkMatter is an Emirati company. Id. at ¶ 6. Defendants Marc Baier, Ryan Adams, 1 Because this Court finds that it cannot exercise personal jurisdiction over any of the named Defendants, it declines to consider whether Plaintiff has adequately stated a claim upon which relief can be granted. and Daniel Gericke are former senior executives at DarkMatter. Id. at ¶ 1. Plaintiff alleges, on information and belief, that Defendant Baier is domiciled in the UAE and that Defendant Gericke is domiciled in Singapore. Id. at ¶¶ 7–8. Plaintiff also alleges that Defendant Adams is domiciled in the state of Oregon, id. at ¶ 9, an allegation that Defendants contest, ECF 28 at 13.2 Plaintiff alleges that beginning in or about 2008, the UAE sought out U.S. corporations to build a cyber-surveillance program known as Project Raven, the purpose of which was to target and hack perceived dissidents from the UAE and Saudi Arabia, including human rights activists. ECF 1 at ¶ 51. In or about 2009, Plaintiff alleges that a Maryland-based company known as CyberPoint International, LLC (“CyberPoint”) became the UAE’s primary contractor on Project Raven. Id. at ¶ 52. Plaintiff alleges that Defendants Baier, Adams, and Gericke all worked for CyberPoint at various periods between 2012 and 2015. Id. at ¶¶ 57–59. Plaintiff further alleges that while working at CyberPoint, Defendants Baier, Adams, and Gericke “developed and operated Project Raven to target and hack individuals and organizations designated by the UAE.” Id. at ¶ 60. Plaintiff alleges that beginning in or about late 2015 or early 2016, the UAE transitioned cyber services under Project Raven from CyberPoint to Defendant DarkMatter. Id. at ¶ 67. Plaintiff further alleges that on or about December 31, 2015, CyberPoint terminated its employment with Defendants Baier, Adams, and Gericke and that Defendants Baier, Adams, and 2 In their Motion to Dismiss, Defendants state that “Adams is not domiciled in Oregon.” ECF 28 at 13. Defendants do not state where Adams is domiciled, but argue that “Rule 4(k)(2) does not provide jurisdiction over Adams for the same reasons that it does not provide jurisdiction over Baier and Gericke.” Id. at 14. For the purposes of this Opinion and Order, and consistent with Plaintiff’s jurisdictional argument, this Court will proceed to analyze all Defendants under Rule 4(k)(2). See ECF 35 at 12, n.3 (“Accordingly, and similar to the other Individual Defendants, Ryan Adams would be subject to jurisdiction under Rule 4(k)(2) if his contacts satisfy the minimum contacts test with the U.S. as a whole.”). Gericke subsequently became employees of DarkMatter. Id. at ¶ 69. Plaintiff alleges that when they joined DarkMatter, Defendants Baier, Adams, and Gericke transferred technology and knowhow developed at CyberPoint to DarkMatter, in violation of U.S. law. ECF 35, Ex. A at ¶¶ 32–33.3 Plaintiff further alleges that Defendants Baier, Adams, and Gericke recruited U.S. employees to join them at DarkMatter. Id. at ¶ 35. In September of 2021, Defendants Baier, Adams, and Gericke entered into a Deferred Prosecution Agreement (“DPA”) with the U.S. Department of Justice arising out of their conduct while employees at CyberPoint and DarkMatter. ECF 1 at ¶ 131; see generally ECF 35, Ex. A. Through Defendants Baier, Adams, and Gericke, Plaintiff alleges that Defendant DarkMatter began running “zero-click” exploits, which can install unwanted code on a target’s phone without the target’s awareness or authorization. Id. at ¶¶ 78–80. Plaintiff further alleges that Defendants purchased these “zero-click” exploits from other U.S. companies. ECF 35, Ex. A at ¶¶ 45, 66; ECF 1 at ¶ 84. The technology purchased from other U.S. companies “had features that limited [its] effectiveness as a computer hacking tool.” ECF 35, Ex. A at ¶¶ 47, 54. Plaintiff alleges that Defendants later “modified” and “upgraded” this technology to create the specific type of “zero-click” exploit used to hack Plaintiff’s phone. ECF 35, Ex. A at ¶¶ 49, 56; ECF 1 at ¶¶ 84, 168. These upgrades included combining the technology with “other malicious software,” creating a “graphic operator interface,” creating anonymous delivery mechanisms, and creating 3 Though not attached to Plaintiff’s Complaint, Plaintiff submitted the Deferred Prosecution Agreement (“DPA”) between the Individual Defendants and the U.S. Department of Justice and asks this Court to take judicial notice of the DPA pursuant to Federal Rule of Evidence 201(b), which allows a court to “judicially notice of a fact that is not subject to reasonable dispute because it. . .can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” ECF 35 at 2 n.1. Defendants do not address Plaintiff’s request in their Reply In Support of Defendants’ Motion to Dismiss. Accordingly, this Court takes judicial notice of the facts contained in the DPA. “anonymized . . . pathways to exfiltrate data and information.” ECF 35, Ex. A at ¶¶ 56, Once upgraded, these “zero-click” exploits, Plaintiff alleges, allowed Defendant DarkMatter to deploy iMessages—messages sent through the Apple operating system to Apple devices—to install malware on a target’s iPhone and obtain, among other things, a target’s emails, location data, text messages, and photographs. ECF 1 at ¶¶ 78, 82–83. Plaintiff alleges, based on information and belief, that the “zero-click” exploit utilized servers located in the United States to reach Plaintiff’s device located in the UAE. Id. at ¶¶ 87, 108. Plaintiff further alleges that to execute these exploits, Defendants must interact with Apple’s servers in the United States in several ways. First, the attacker must obtain the target’s encryption and routing information from Apple’s servers. Id. at ¶ 89. Next, the attacker encrypts the iMessage using the information from the identity servers and sends the iMessage to the Apple Push Notification Service, which temporarily stores and sends data to Apple device users. Id. at ¶ 90. Finally, Plaintiff alleges that because malware is a large attachment, the attachment is encrypted and uploaded to Apple’s storage servers. Id. at ¶ 92. As such, Plaintiff alleges that any exploit sent to a foreign target must interact with Apple’s servers, which Plaintiff alleges are based in the United States, “several times.” Id. at ¶ 93. Notably, Plaintiff alleges that Defendants used a custom program to do this that “sends a specifically crafted iMessage, containing an exploit and malware, to servers located in the United States to reach the target’s device.” Id. at ¶ 88. Plaintiff alleges that Defendant DarkMatter hacked her iPhone using this “zero-click” exploit, surveilled her movements, and exfiltrated her confidential communications to the UAE’s security services. Id. at ¶¶ 108–115. Following the hack, Plaintiff alleges that the UAE limited her international travel solely to Saudi Arabia, arbitrarily detained her, and forcibly rendered her to Saudi Arabia in March of 2018. Id. at ¶¶ 114, 117–18. While in the custody of Saudi Arabia, Plaintiff alleges that she was subjected to interrogation and torture. Id. at ¶¶ 124–25. Plaintiff filed the instant case on December 9, 2021. Id. at 39. Plaintiff alleges three claims under federal law against all Defendants. First, Plaintiff alleges four separate violations of the Computer Fraud and Abuse Act (“CFAA”). Second, Plaintiff alleges conspiracy to violate the CFAA. Third, Plaintiff alleges persecution as a crime against humanity under the Alien Tort Statute. LEGAL STANDARD A. Motion to Dismiss for Lack of Personal Jurisdiction “Where a defendant moves to dismiss a complaint for lack of personal jurisdiction, the plaintiff bears the burden of demonstrating that jurisdiction is appropriate.” Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004) (citation omitted). “Where . . . a defendant’s motion to dismiss is based on a written record and no evidentiary hearing is held, ‘the plaintiff need only make a prima facie showing of jurisdictional facts.’” Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015) (citation omitted). Uncontroverted allegations in the complaint must be taken as true. Boschetto v. Hansing, 539 F.3d 1011, 1015 (9th Cir. 2008). However, a court need not accept as true “threadbare recitals of a cause of action’s elements, supported by mere conclusory statements” Ashcroft v. Iqbal, 556 U.S. 662, 663 (2009). Under Federal Rule of Civil Procedure 4(k)(2), “[f]or a claim that arises under federal law,” a court may exercise personal jurisdiction over a defendant “not subject to jurisdiction in any state’s courts of general jurisdiction” if “exercising jurisdiction is consistent with the United States Constitution and laws.” Fed. R. Civ. P. 4(k)(2). Rule 4(k)(2) requires (1) a federal claim, (2) a defendant not subject to personal jurisdiction in any state, and (3) that “the federal court’s exercise of personal jurisdiction . . . comport[s] with due process.” Holland Am. Line Inc. v. Wartsila N. Am., Inc., 485 F.3d 450, 461 (9th Cir. 2007). A federal court’s exercise of personal jurisdiction comports with due process where a defendant has “certain minimum contacts” with the forum state “such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’” Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945). From this general principle, courts have recognized two distinct categories of personal jurisdiction: general, or “all-purpose” jurisdiction, and specific, or “case-linked” jurisdiction. Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1024 (2021) (citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). A court can exercise general jurisdiction over a defendant in any forum where the defendant “is ‘essentially at home’ . . . .” Id. (quoting Goodyear, 564 U.S. at 919). An individual is subject to general jurisdiction in their place of domicile, while a corporation is subject to general jurisdiction in its place of incorporation and principal place of business. Id. (citations omitted). A court can exercise specific jurisdiction over a defendant, by contrast, only where the “defendant’s suit-related conduct [] create[s] a substantial connection with the forum State.” Walden v. Fiore, 571 U.S. 277, 284 (2014). The Ninth Circuit uses a three-part test to evaluate whether a defendant has sufficient “minimum contacts” with the forum state such that exercise of specific jurisdiction comports with due process: (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates to the defendant’s forum-related activities; and (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e., it must be reasonable. CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1076 (9th Cir. 2011) (quoting Schwarzenegger, 374 F.3d at 802). The personal jurisdiction analysis under Rule 4(k)(2) is “nearly identical to the traditional personal jurisdiction analysis with one significant difference: rather than considering contacts between [the defendant] and the forum state, [courts] consider contacts with the nation as a whole.” AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1208 (quoting Holland Am. Line, 485 F.3d at 462). The first part of the Ninth Circuit’s specific jurisdiction analysis refers to both purposeful direction and purposeful availment. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1228 (9th Cir. 2011). Courts apply the purposeful direction analysis, also known as the “effects test,” to conduct that occurs outside of the forum state but whose effects are felt within the forum state. Freestream Aircraft (Bermuda) Ltd. v. Aero Law Grp., 905 F.3d 597, 605 (9th Cir. 2018). For conduct that occurs within the forum state, by contrast, courts within the Ninth Circuit apply the purposeful availment test. Id. at 604. The plaintiff “bears the burden of satisfying the first two prongs.” CollegeSource, 653 F.3d at 1076. If the plaintiff does so, the burden shifts to the defendant at prong three “to set forth a ‘compelling case’ that the exercise of jurisdiction would not be reasonable.” Id. (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 476–78 (1985)). ANALYSIS A. This Court Cannot Exercise Personal Jurisdiction over Defendants Though Plaintiff names Defendant DarkMatter and Defendants Baier, Adams, and Gericke as separate defendants, the conduct underpinning this Court’s jurisdictional analysis is the same for all named defendants. As such, this Court will evaluate whether it can exert personal jurisdiction over Defendants collectively. Defendants argue Plaintiff alleges no jurisdictionally significant connection between Defendants, the present litigation, and the United States, save for the fact that certain text messages allegedly sent by Defendant DarkMatter from a foreign location passed through U.S. servers on their way to Plaintiff’s phone abroad. ECF 28 at 1. Plaintiff counters that Defendants contacts with the United States are jurisdictionally significant because Defendants caused Apple’s U.S. servers to transmit malicious code to Plaintiff’s phone. ECF 35 at 13. For the following reasons, this Court concludes that it cannot exercise personal jurisdiction over Defendants. 1. Defendants Did Not Purposefully Direct Their Actions at the United States a. Purposeful Direction, Rather than Purposeful Availment, Guides this Court’s Jurisdictional Analysis As an initial matter, Plaintiff urges this Court to apply the purposeful availment analysis to her jurisdictional claim. ECF 35 at 13. Existing Ninth Circuit precedent, however, dictates that the purposeful direction test, and not the purposeful availment test, applies to tortious conduct that occurs outside of the forum. Freestream, 905 F.3d at 605. Plaintiff argues that the purposeful availment inquiry is appropriate in the present case because part of the allegedly tortious conduct—Defendants’ transmission of the message that resulted in the hack of Plaintiff’s phone through a server based in the United States—took place in the United States. ECF 35 at 14. To support her argument, Plaintiff points to language from the CFAA which states that it is a crime for anyone to “knowingly cause[] the transmission of a program, information, code, or command” which “intentionally causes damage without authorization, to a protected computer.” ECF 35 at 15; 18 U.S.C. § 1030(a)(5)(A). At the outset, this Court notes that torts committed in the virtual realm add a layer of complication to the traditional analysis of whether conduct occurs inside or outside of the forum state. As another court in this circuit has noted, courts are split as to whether a tortious act committed virtually occurs at the location where the defendant is “physically typing on the keyboard” (or, in this case, physically pressing send on an iMessage) or at the location “that contains the computer hardware manipulated by the defendant to commit the tort.” HB Prods., Inc. v. Faizan, 603 F. Supp. 3d 910, 922 (D. Haw. 2022). The Ninth Circuit, for its part, has yet to squarely this question. Under either formulation, however, this Court finds that the allegedly tortious conduct took place outside of the forum. If this Court were to base its determination of where the tortious conduct took place on the location where the Defendants sent the message, that location would be outside of the forum. See id. Conversely, if this Court were to base its determination of where the tortious conduct took place on the location “that contain[ed] the hardware manipulated by the defendant to commit the tort,” that location would also be outside of the forum, because the “computer . . . manipulated . . . to commit the tort” was Plaintiff’s phone, not Apple’s servers. See id. As alleged in Plaintiff’s Complaint, the messages transmitted from Defendants to Plaintiffs “contain[ed] an exploit and malware” before they reached Apple’s servers in the United States. ECF 1 at ¶ 88. Further, as alleged in Plaintiff’s Complaint, the exploit is only activated on the target’s phone and only after the phone, and not the server, “receives and processes the attacker’s iMessage.” Id. at ¶ 98. Indeed, Plaintiff does not appear to allege that Defendants manipulate, transform, or otherwise commit any illegal act directly to Apple’s servers, even if the attackers “interact[] with Apple’s U.S.-based servers several times” in the process of sending an exploit and associated malware. Id. at ¶¶ 89–93. As such, this Court finds that the tortious conduct itself took place outside of the forum. In support of her argument that purposeful availment, rather than purposeful direction, applies to the present case, Plaintiff relies heavily on an unpublished 2020 case from this district in which the court found that it could exert personal jurisdiction over foreign defendants who accessed trade secrets from a server in Oregon, even though those defendants were not physically present in Oregon when the tort was committed, because the tortious misappropriation of trade secrets occurred “at least in part . . . in Oregon.” See Climax Portable Machine Tools, Inc. v. Trawema GmbH, No. 3:18-cv-1825-AC, 2020 WL 1304487 (D. Or. Mar. 19, 2020). Climax is distinguishable from the present case. In Climax, the plaintiffs alleged that the defendants obtained secret information stored on an Oregon server for an unauthorized purpose with an improper intent to take that information for a competing entity. Id. at *4. In Climax, in other words, the defendants did not begin the process of misappropriating the trade secrets until they reached out to the servers in Oregon, where they knew the information was stored. Id. at *5. In the present case, by contrast, Defendants began their tort of knowingly transmitting malware in a foreign country, because the message sent to Plaintiff’s phone already contained an exploit and malware before it reached Apple’s U.S.-based servers. See ECF 1 at ¶ 88. Will Co. Ltd. v. Lee, a Ninth Circuit case from August of 2022 that considered personal jurisdiction over foreign defendants who access U.S.-based servers, supports this conclusion. 47 F.4th 917, 919 (9th Cir. 2022). In Will Co. Ltd., the Ninth Circuit applied the purposeful direction test to analyze whether it could properly exercise jurisdiction over the defendants who ran a website that “unlawfully displayed copyrighted videos.” Id. Notably, the servers that the defendants used to host the copyrighted conduct were located in the United States. Id. at 920. Nonetheless, the Court held that “in the context of tort claims . . . a defendant has the requisite minimum contacts with the forum if . . . the defendant ‘purposefully direct[s]’ its activities at the forum . . . .” Id. at 922. In sum, given the Ninth Circuit’s recent application of the purposeful direction test to a case where foreign defendants used U.S.-based servers to commit tortious acts, this Court finds that the purposeful direction test provides the proper framework for analyzing Defendants’ jurisdictional challenge. When considering whether the exercise of jurisdiction is proper under the purposeful direction test, courts within the Ninth Circuit engage in a three-step inquiry: “the defendant allegedly [must] have (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Schwarzenegger, 374 F.3d at 803 (quoting Dole Food Co. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002)). Neither party disputes that Defendants committed an intentional act, but the parties do dispute whether that intentional act was expressly aimed at the United States and caused harm that Defendants knew was likely to be suffered in the United States. This Court considers each in turn. b. Defendants’ Use of Apple’s U.S.-Based Servers Does Not Constitute Express Aiming at the United States Plaintiff argues that Defendants “intentionally aimed their exploit and malware at Apple’s U.S. servers to leverage vulnerabilities in Apple’s iMessage system and reach [Plaintiff’s] iPhone.” ECF 35 at 15. In other words, Plaintiff argues that Defendants’ contacts with the United States were not “fortuitous” because they intended to use Apple’s U.S.-based servers to hack Plaintiff’s phone. But Plaintiff’s argument would force this Court to stretch the Ninth Circuit’s personal jurisdiction caselaw to cover conduct that has never been found sufficient to confer jurisdiction over a foreign-based defendant. The Ninth Circuit “has never decided that personal jurisdiction is proper over a private foreign entity solely because that entity engaged in tortious conduct from a location outside of the United States by remotely accessing servers located in the United States.” Hungerstation LLC v. Fast Choice LLC, 857 F. App’x 349, 351 (9th Cir. 2021). The defendants in Hungerstation were foreign corporations who allegedly accessed remote servers located in the United States and owned by third parties, and copied and transferred confidential source code and proprietary business information to servers leased by the defendants. Id. In affirming the district court’s dismissal based on lack of personal jurisdiction, the Ninth Circuit found that “the location of the servers was fortuitous” such that the defendants’ conduct could not be said to have been expressly aimed at the United States. Id. Here, too, this Court finds that the location of Apple’s servers in the United States is “fortuitous” such that Defendants’ conduct was not expressly aimed at the United States. Plaintiff alleges that Defendants specifically targeted Apple’s servers to exploit vulnerabilities in Apple’s iMessage system. Accepting that allegation as true, it still does not create the type of contact between the United States and Defendants’ conduct that could give rise to personal jurisdiction. Rather than showing that Defendants purposefully directed their conduct at the forum, Plaintiff’s allegation, at most, shows that Defendants purposefully directed their conduct at a third party—Apple, whose choice to host their servers in the United States is entirely unrelated to the conduct at issue in Plaintiff’s complaint. Compare WhatsApp Inc. v. NSO Grp. Techs. Ltd., 472 F. Supp. 3d 649, 671 (N.D. Cal. 2020) (finding an out-of-forum defendants’ use of an in-forum server was “fortuitous” where “[n]either party controlled where the third parties placed their servers and the servers were not the ultimate target of the intentional act . . . .”) with Will Co., Ltd. v. Lee, 47 F.4th 917, 924 (9th Cir. 2022) (finding an out-of-forum defendants’ use of an in-forum server was not fortuitous where “Defendants chose to host the website in Utah . . . .”) (emphasis added)); DEX Sys., Inc. v. Deutsche Post AG, 727 Fed. Appx. 276, 278 (9th Cir. 2018) (finding an out-of-forum defendants’ use of in-forum servers was not “fortuitous” where the location of the servers was “pursuant to an agreement reached by the parties.”). Recent Ninth Circuit case law, though unpublished, supports this Court’s finding that a defendant does not target a forum merely because it chooses to target a third party who in turn has chosen to do business in that forum. In 42 Ventures, LLC v. Mav, the Ninth Circuit remanded with leave to amend a district court decision finding no personal jurisdiction where the plaintiff alleged that the defendants used U.S.-based web server companies to host purportedly infringing content. No. 20-17305, 2021 WL 5985018, at *1 (9th Cir. Dec. 16, 2021). The Ninth Circuit noted that while the allegations as pled did not show that the defendants either committed the alleged infringement in the United States or purposefully directed their infringement towards the United States, the plaintiff could potentially show purposeful direction to the United States if they could show that the defendants “deliberately choos[e] servers in the United States to enable faster service to U.S.-based customers.” Id. Notably, the Ninth Circuit focused on the defendants’ purposeful choice of the United States to reach United States customers, placing the focus of the jurisdictional inquiry squarely on the connection to the forum rather than a third party. Id; see also H.B. Prods., Inc., 603 F. Supp. 3d at 932 (finding jurisdiction over a foreign defendant where the plaintiff’s allegations “indicate[d] that Defendant sought a United States- based IP address to circumvent blacklist restrictions, desired a server location that would better serve his United States users, and profited from non-geolocated advertisements tailored to the United States market.”) In the present case, by contrast, Plaintiff has shown only that Defendants sought to target a U.S.-based company, not the United States itself.4 4 The Ninth Circuit also noted that the plaintiff in 42 Ventures, LLC could potentially show purposeful availment by showing that the defendants “us[ed] servers in the United States to store and disseminate infringing content.” No. 20-17305, 2021 WL 5985018, at *1 (9th Cir. Dec. A survey of cases throughout the Ninth Circuit likewise supports this Court’s conclusion that the choice by a third party to operate its servers in the forum is insufficient to show that a foreign defendant who uses those servers purposefully directs their actions at the forum. See, e.g., Republic of Kazakhstan v. Ketebaev, No. 17-CV-00246-LHK, 2017 WL 6539897, at *7 (N.D. Cal. Dec. 21, 2017) (finding no personal jurisdiction because “[t]he mere fact that Google—the company that owns the servers—is headquartered in California is not enough to establish that Khrapunov, a Kazakh citizen who resides in Switzerland, expressly aimed his alleged conduct at California.”); Rosen v. Terapeak, Inc., No. CV-15-00112-MWF (Ex), 2015 WL 12724071, at *9 (C.D. Cal. Apr. 28, 2015) (finding no personal jurisdiction and rejecting “the notion that the mere location of a server may give rise to personal jurisdiction.”); Man-D- Tec, Inc. v. Nylube Products Co., LLC, No. CV-11-1573-PHX-GMS, 2012 WL 1831521, at *2 (D. Ariz. May 18, 2012) (finding no personal jurisdiction and concluding that “[i]f the mere location of a server could create personal jurisdiction, any state where a server is located would have personal jurisdiction over any user of that server.”). By contrast, cases where a court has found purposeful direction often involve either tortious conduct committed in the forum state or servers owned by the plaintiff or defendant, rather than a third party. See e.g., Climax, 2020 WL 1304487 at *4 (finding personal jurisdiction where theft of trade secrets occurred from servers located in Oregon), DEX Sys., Inc., 727 F. App’x at 278 (finding purposeful direction where “the allegedly infringing use of [Plaintiff’s] software occurred in California on [Plaintiff’s] servers in 16, 2021). This finding supports this Court’s finding that purposeful direction, rather than purposeful availment, is the proper analysis for this case. As discussed above, this case is distinct from an infringement action, where the tortious conduct does not begin until the defendant obtains and disseminates the allegedly infringing content. In the present case, the message sent by Defendants included the exploit and malware before it reached the U.S.-based servers, and the exploit and malware did not activate and infect Plaintiff’s phone until it reached her in the foreign location. Camarillo, California”) (emphasis added)); WhatsApp Inc, 472 F. Supp. at 672 (finding purposeful direction where “defendants sought out and accessed plaintiffs’ servers . . . ”) (emphasis added)). Mere knowledge of the location of a third-party’s servers, in sum, is not sufficient to constitute purposeful direction. “Due process requires that a defendant be haled into court in a forum State based on his own affiliation with the State, not based on the ‘random, fortuitous, or attenuated’ contacts he makes by interacting with other persons affiliated with the State.” Walden, 571 U.S. at 286 (citation omitted). Plaintiff’s argument would ask this Court to find personal jurisdiction based on the choice of a third party not before this Court. Such an outcome is foreclosed by existing precedent and this Court declines to find the purposeful direction prong satisfied here. c. Defendants Did Not Know That the Harm to Plaintiff Was Likely to be Suffered in the United States The third element of the purposeful direction test requires a defendant to “caus[e] harm that the defendant knows is likely to be suffered in the forum state.” Schwarzenegger, 374 F.3d at 803 (quoting Dole Food Co. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002)). Within the Ninth Circuit, while “‘the brunt’ of the harm need not be suffered in the forum state,” a plaintiff must nonetheless show that a “jurisdictionally sufficient amount of harm [was] suffered in the forum state.” Yahoo! Inc. v. La Ligue Contre Le Racisme Et L’Antisemitisme, 433 F.3d 1199, 1207 (9th Cir. 2006) (en banc). “A defendant causes harm in a particular forum when the ‘bad acts’ that form the basis of the plaintiff’s complaint occur in that forum.” Will Co., 47 F.4th at 926 (citation omitted). This Court finds that, while the allegations in Plaintiff’s Complaint support the inference that Defendants caused Plaintiff harm outside of the United States, the Complaint does not support the inference that Defendants knew that harm was likely to be suffered in the United State as opposed to some other forum. Plaintiff argues that “[b]y uploading malicious code to Apple’s U.S. servers for delivery to [Plaintiff’s] iPhone, Defendants broke the digital security that is critical to [Plaintiff’s] human rights work and transformed Apple’s secure messaging system into Defendants’ personal malware delivery device.” ECF 35 at 16. But the harm to Plaintiff’s device—the hack itself, and the subsequent surveillance of that device—occurred outside of the forum state. As such, the only harm that Plaintiff alleges actually occurred in the United States is the “transform[ation of] Apple’s secure messaging system into . . . [a] malware delivery device.” Id. Plaintiff cites to no authority to support her theory that harm to a third party in the forum, rather than harm to the plaintiff, constitutes a “jurisdictionally sufficient amount of harm.” Yahoo! Inc., 433 F.3d at 1207. Instead, recent caselaw within the Ninth Circuit makes clear that the focus for this element of the jurisdictional analysis must be on the foreseeability of harm caused in the forum to the plaintiff, not to a third party not otherwise involved in the litigation. In Burri Law PA v. Skurla, for instance, the Ninth Circuit found that Arizona could exercise personal jurisdiction over three non-Arizona residents for making defamatory statements about the plaintiff, a Florida resident, when those defendants knew that the plaintiff was likely to suffer those harms in Arizona. 35 F.4th 1207, 1216 (9th Cir. 2022); see also Dole Food Co., 303 F.3d at 1113 (examining whether plaintiff, “rather than its European subsidiaries,” suffered harm in the forum). Based on this precedent, this Court concludes that showing harm to a third party in the forum—rather than harm to Plaintiff herself—is insufficient to satisfy the third element of the purposeful direction test. 2. Plaintiff’s Claims Do Not Arise Out of Or Relate to Defendants’ Forum-Related Activities In addition to showing that the defendant purposefully directed his activities at the forum, a plaintiff must show that the claim “arise[s] out of or relate[s] to the defendant’s contacts” with the forum such that “there [is] an affiliation between the forum and the underlying controversy.” Ford Motor Co., 141 S. Ct. at 1025 (citations omitted). While this standard does not require the plaintiff to show that the defendant’s actions were the but-for cause of the plaintiff’s claim, “the phrase ‘relate to’ incorporates real limits, as it must to adequately protect defendants foreign to a forum.” Id. at 1026. Plaintiff’s argument that her claim arises out of or relates to Defendants’ contacts with the forum mirrors her argument that Defendants purposefully directed their activities towards the forum: that “Defendants’ contacts with U.S. servers . . . were necessary to infecting [Plaintiff’s] iPhone with malware.” ECF 35 at 22. As discussed above, Plaintiff’s argument fails because it requires this Court to impart the affiliation between a third party and the forum to Defendants. This type of logic is foreclosed by the Supreme Court’s decision in Walden v. Fiore, which emphasized that the relationship between the defendant and the forum “must arise out of contacts that the ‘defendant himself’ creates with the forum State.” 571 U.S. at 284. In reiterating that it had “consistently rejected attempts to satisfy the defendant focused ‘minimum contacts’ inquiry by demonstrating contacts between the plaintiff (or third parties) and the forum State,” id. at 284, the Supreme Court held that a petitioner’s knowledge of the respondent’s “strong forum connections” was insufficient to confer personal jurisdiction over petitioner where none of the tortious conduct at issue occurred in the forum, id. at 288–89. Accepting Plaintiff’s argument would likewise require this Court to exercise personal jurisdiction over Defendants based solely on their knowledge of the third- party’s contacts with the United States. Plaintiff alternatively argues that her claim arises out of or relates to Defendants contacts with the forum because “Defendants[’] other U.S.-based contacts—including the acquisition of exploits, reliance on U.S. technology and knowhow illegally transferred from CyberPoint, employment of U.S. individuals, and U.S. anonymization services—were essential to the operation of Project Raven and thus to the hack against [Plaintiff].” ECF 35 at 22. Defendants counter that these “other U.S.-based contacts” are unrelated to the conduct that ultimately underpins Plaintiff’s claim, which is the allegedly tortious hack of Plaintiff’s phone caused by malware. This Court agrees that Plaintiff has failed to plead with sufficient specificity how this background conduct relates to the use of specific malware to infect Plaintiff’s phone. The technology that Defendants purchased from U.S.-based companies was altered in significant ways before being deployed in the hack of Plaintiff’s phone. Additionally, the fact that Defendants may have developed expertise and knowhow in the forum that was later used to create the malware that infected Plaintiff’s phone is not enough to confer jurisdiction. 3. Exercise of Jurisdiction Over DarkMatter Would be Unreasonable If the plaintiff satisfies the first two prongs of the “minimum contacts” analysis, the burden then shifts to the defendant “to set forth a ‘compelling case’ that the exercise of jurisdiction would not be reasonable.” CollegeSource, 653 F.3d at 1076. To evaluate reasonableness, courts within the Ninth Circuit use a seven-factor balancing test that weighs: (1) the extent of the defendant’s purposeful interjection into the forum state’s affairs; (2) the burden on the defendant of defending in the forum; (3) the extent of conflict with the sovereignty of the defendant’s state; (4) the forum state’s interest in adjudicating the dispute; (5) the most efficient judicial resolution of the controversy; (6) the importance of the forum to the plaintiff’s interest in convenient and effective relief; and (7) the existence of an alternative forum. Freestream, 905 F.3d at 607 (citation omitted). As noted above, this Court finds that Plaintiff has failed to meet either the first or second prong of the “minimum contacts” analysis. Even if Plaintiff had shown that Defendants had sufficient “minimum contacts” with the United States, however, this Court would still find that the exercise of jurisdiction over Defendants would be unreasonable. First, this Court finds that Defendants’ allegedly tortious conduct—sending an iMessage from a foreign location, transmitted through U.S.-based servers, to a foreign phone with intent to hack the phone in the foreign locale—presents no “purposeful interjection” into United States’ affairs, for the reasons discussed above with respect to the “purposeful direction” analysis. See Paccar Int’l, Inc. v. Com. Bank of Kuwait, S.A.K., 757 F.2d 1058, 1065 (9th Cir. 1985) (finding “negligible” purposeful interjection where defendants actions in the forum were “aimed at a nonresident”). As such, the Court finds that this factor weighs in favor of finding that jurisdiction would be unreasonable. Second, this Court finds that Defendants would face at least some burden if they were forced to defend the action in the United States. See id. (finding that the burden placed on a defendant, based in Kuwait, in defending a suit in California, “support[ed] a finding that exercising jurisdiction [was] unreasonable”); accord Asahi Metal Indus. Co. v. Superior Court, 480 U.S. 102, 114 (1987) (“The unique burdens placed upon one who must defend oneself in a foreign legal system should have significant weight in assessing the reasonableness of stretching the long arm of personal jurisdiction over national borders.”). There are, however, several factors that mitigate this burden, at least with respect to Defendants Baier, Gericke, and Adams. All three are U.S. citizens who speak, read, and write English. See Dole Food Co., 303 F.3d at 1115 (finding that the burden on foreign defendants was lessened where the defendants were fluent in English, received degrees from U.S. universities, and had traveled to the United States previously). Plaintiff further argues that all Defendants, including Defendant DarkMatter, are involved in other legal proceedings in the United States. ECF 35 at 23. As such, the second factor cuts against Defendants and in favor of Plaintiff. As to the third factor—the extent of conflict with the sovereignty of the defendant’s state—this Court finds that this factor weighs in favor of finding that jurisdiction would be unreasonable. Although Plaintiff attempts to cast the implications of this suit narrowly, by arguing that it concerns only the determination of U.S. laws against the individual and private corporations involved, Plaintiff also admits that her claims “relate to conduct carried out at the behest of the UAE government.” ECF 35 at 24. This Court must consider both the “procedural and substantive interests of other nations” in deciding whether to exercise jurisdiction. Asahi Metal Indus. Co., 480 U.S. at 115. In this instance, the fact that Plaintiff’s conduct relates to actions carried out at the direct behest of a foreign sovereign counsels against exercising jurisdiction. This Court likewise finds that the fourth factor—the forum’s interest in adjudicating the dispute—weighs against the exercise of jurisdiction. While the United States has a strong interest in providing a forum for its residents who are injured by tortious conduct, Plaintiff is not a United States resident. The United States might have a strong interest in ensuring that its U.S.- based companies who rely on U.S.-based servers are not subject to transmissions of malware, but Apple is not a party to this action and its interests cannot be considered in determining whether jurisdiction is reasonable. The Ninth Circuit has warned against expanding jurisdiction under Rule 4(k)(2) in situations where the foreign defendants have had only limited contacts with the United States. See Glencore Grain Rotterdam B.V. v. Shivnath Rai Harnarain Co., 284 F.3d 1114, 1123, 1126–27 (9th Cir.2002) (quoting Burger King Corp., 471 U.S. at 475) (holding that a defendant should not be haled into court as a result of “random,” “fortuitous,” or “attenuated” contacts and declining to exercise Rule 4(k)(2) jurisdiction when the foreign defendant made fifteen individual shipments to California and seven individual shipments to the East Coast over the course of thirteen years). As to the fifth factor, this Court finds that the United States would not offer the most efficient judicial resolution for the controversy. Plaintiff argues that “Apple’s technology experts and the companies that designed and sold the exploits used by Defendants” are located in the United States, but also admits that “‘relevant parties, documents, and witnesses’” are located abroad. ECF 35 at 25. Though the Ninth Circuit has opined that the burden of adjudicating a dispute based on foreign evidence and witnesses “is no longer weighed heavily given the modern advances in communication and transportation,” Panavision Int’l, L.P. v. Toeppen, 141 F.3d 1316, 1323 (9th Cir. 1998), the almost completely foreign nature of the tortious conduct at issue weighs slightly in favor of Defendants. This Court agrees with Plaintiff that the sixth factor—the importance of the forum to the plaintiff’s interest in convenient and effective relief—weighs in favor of jurisdiction. Plaintiff brings her claims under U.S. law, which heightens Plaintiff’s interest in her claims being adjudicated by a U.S. court. The seventh factor—the availability of an alternative forum—also favors Plaintiff. Plaintiff argues that “the Complaint’s allegations show that the UAE is not a viable alternative forum.” ECF 35 at 25. This Court agrees that Plaintiff’s Complaint alleges conduct by the UAE that, if assumed to be true, would make the UAE a hostile forum to Plaintiff’s claims. See ECF 1 at ¶¶ 32, 74, 113 (alleging that the UAE targets human rights defenders generally and targeted Plaintiff specifically using technology deployed by Defendants). The fact that the second, sixth, and seventh factors favor Plaintiff, however, is not sufficient to overcome the conclusion that the other reasonableness factors weigh against jurisdiction. CONCLUSION For the foregoing reasons, this Court finds that it cannot exercise jurisdiction over Defendants consistent with due process. As such, Defendants’ Motion to Dismiss is GRANTED. This Court notes, however, that there may be certain factual allegations that Plaintiff could add to her Complaint to satisfy the exercise of jurisdiction over Defendants. Plaintiff’s Complaint is therefore dismissed without prejudice and with leave to amend. If Plaintiff chooses to amend, Plaintiff is ordered to notify this Court within fourteen days and file her Amended Complaint within thirty days of the issuance of this Opinion and Order. IT IS SO ORDERED. DATED this 16th day of March, 2023. /s/ Karin J. Immergut Karin J. Immergut United States District Judge