Corallo v. NSO Group Technologies Limited

1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 FRANCESCO CORALLO, 10 Case No. 22-cv-05229-RS Plaintiff, 11 v. ORDER GRANTING MOTIONS TO 12 DISMISS NSO GROUP TECHNOLOGIES 13 LIMITED, et al., 14 Defendants. 15 16 I. INTRODUCTION 17 Plaintiff Francesco Corallo is a native of Italy and a naturalized citizen of the Netherlands, 18 who resided in Sint Maarten in the Dutch Caribbean at the time of the events alleged in the 19 complaint in this action. Corallo describes himself as a successful businessman with interests 20 across the Caribbean and in Italy. Defendants NSO Group Technologies Limited and its sole 21 shareholder Q Cyber Technologies Limited (collectively “NSO”) are Israeli companies, who 22 allegedly develop, market, and distribute “highly invasive surveillance technology or spyware and 23 related products and services, including software called Pegasus and a “security exploit” known as 24 FORCEDENTRY.” 25 Corallo owned an Apple iPhone and stored data in an iCloud account. He alleges NSO 26 used the FORCEDENTRY exploit to deploy the Pegasus software on devices of Apple customers 27 on behalf of NSO’s governmental clients, including Italy and the Netherlands. Corallo asserts 1 this action, Corallo brings one set of claims against NSO, and a separate set of claims against 2 Apple, Inc. NSO moves to dismiss for lack of personal jurisdiction or on forum non conveniens 3 grounds, and for failure to state a claim. Apple moves to dismiss for failure to state a claim. Both 4 motions will be granted. 5 6 II. LEGAL STANDARDS 7 1. Rule 12(b)(2) 8 A federal court may dismiss an action under Federal Rule of Civil Procedure 12(b)(2) for 9 lack of personal jurisdiction. When resolving a motion to dismiss under Rule 12(b)(2) on written 10 materials, the court accepts uncontroverted facts in the complaint as true and resolves conflicts in 11 affidavits in the plaintiffs’ favor. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 12 (9th Cir. 2011). The party seeking to invoke a federal court’s jurisdiction bears the burden of 13 demonstrating jurisdiction. Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015). “Federal courts 14 ordinarily follow state law in determining the bounds of their jurisdiction over persons.” Daimler 15 AG v. Bauman, 571 U.S. 117, 125 (2014); see Fed. R. Civ. P. 4(k)(1)(a). 16 As California’s long arm statute permits exercise of personal jurisdiction to the fullest 17 extent permissible under the U.S. Constitution, the court’s inquiry “centers on whether exercising 18 jurisdiction comports with due process.” Picot, 780 F.3d at 1211; see Cal. Code Civ. P. § 410.10. 19 The Due Process Clause of the Fourteenth Amendment “limits the power of a state’s courts to 20 exercise jurisdiction over defendants who do not consent to jurisdiction.” Martinez v. Aero 21 Caribbean, 764 F.3d 1062, 1066 (9th Cir. 2014). Due process requires that the defendant “have 22 certain minimum contacts with it such that the maintenance of the suit does not offend traditional 23 notions of fair play and substantial justice.” Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 24 (1945) (internal quotation marks omitted). Under the “minimum contacts” analysis, a court can 25 exercise either “general or all-purpose jurisdiction,” or “specific or conduct-linked jurisdiction.” 26 Daimler, 571 U.S. at 121–22 (citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 27 915, 919 (2011)). 1 A court may exercise specific jurisdiction over a defendant if its less-substantial contacts 2 with the forum give rise to the claim or claims pending before the court—that is, if the cause of 3 action “arises out of” or has a substantial connection with that activity. Hanson v. Denckla, 357 4 U.S. 235, 250–53 (1958); see also Goodyear, 564 U.S. at 924–25. The inquiry into whether a 5 forum state may assert specific jurisdiction over a nonresident defendant focuses on the 6 relationship among the defendant, the forum, and the litigation. Walden v. Fiore, 571 U.S. 277, 7 283–84 (2014) (citation omitted). 8 To determine whether a defendant’s contacts with the forum state are sufficient to establish 9 specific jurisdiction, the Ninth Circuit employs a three-part test: (1) The non-resident defendant 10 must purposefully direct his activities or consummate some transaction with the forum or resident 11 thereof; or perform some act by which he purposefully avails himself of the privilege of 12 conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) 13 the claim must be one which arises out of or relates to the defendant’s forum-related activities; and 14 (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be 15 reasonable. Morrill v. Scott Fin. Corp., 873 F.3d 1136, 1142 (9th Cir. 2017). 16 A plaintiff bears the burden of satisfying the first two prongs. Id. If the plaintiff does so, 17 then the burden shifts to the defendant to “set forth a ‘compelling case’ that the exercise of 18 jurisdiction would not be reasonable.” CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 19 1076 (9th Cir. 2011) (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 477–78 (1985)).1 20 21 2. Forum Non-Conveniens 22 Under the doctrine of forum non conveniens, the district court has discretion to dismiss an 23 action, even if jurisdiction and venue are properly established, when (1) a foreign country also has 24 jurisdiction to hear the case, and either (2) trial in the chosen American forum would establish 25 1 Corallo was given the opportunity to conduct jurisdictional discovery. As explained in a prior 26 order, that process was terminated once it became clear Corallo was unwilling or unable to focus 27 on the material issues. Dkt. No. 94. 1 oppressiveness and vexation to a defendant out of all proportion to plaintiff’s convenience; or (3) 2 the chosen American forum is inappropriate because of considerations affecting the court’s own 3 administrative and legal problems. See American Dredging Co. v. Miller, 510 U.S. 443, 447-49 4 and n.2 (1994) 5 More generally, “[a] district court has discretion to decline to exercise jurisdiction in a case 6 where litigation in a foreign forum would be more convenient for the parties.” Lueck v. 7 Sundstrand Corp., 236 F.3d 1137, 1142 (9th Cir. 2001) (citing Gulf Oil Corp. v. Gilbert, 330 U.S. 8 501, 504 (1947)). Courts employ a two-step analysis in determining whether to dismiss based on 9 forum non conveniens. The defendant must first “satisfy a heavy burden of proof” to establish that 10 there is an adequate alternative forum where the case can be litigated. Lueck, 236 F.3d at 1143; 11 Piper Aircraft Co. v. Reyno, 454 U.S. 235, 255 n. 22 (1981). Then, the defendant must show that 12 the balance of the applicable private and public factors “is strongly in favor of the defendant.” 13 Cheng v. Boeing Co., 708 F.2d 1406, 1410 (9th Cir. 1983) (quoting Gulf Oil, 330 U.S. at 508). 14 Courts consider the following private interest factors: (1) the residence of the parties and 15 the witnesses; (2) the forum’s convenience to the litigants; (3) access to physical evidence and 16 other sources of proof; (4) whether unwilling witnesses can be compelled to testify; (5) the cost of 17 bringing witnesses to trial; (6) the enforceability of the judgment; and (7) all other practical 18 problems that make trial of a case easy, expeditious, and inexpensive. Lueck, 236 F.3d at 1145 19 (internal citations omitted). Courts also consider the following public interest factors: (1) local 20 interest of lawsuit; (2) the court’s familiarity with governing law; (3) burden on local courts and 21 juries; (4) congestion in the court; and (5) the costs of resolving a dispute unrelated to this forum. 22 Lueck, 236 F.3d at 1147. 23 24 3. Rule 12(b)(6) 25 A complaint must contain “a short and plain statement of the claim showing that the 26 pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). While “detailed factual allegations” are not 27 required, a complaint must have sufficient factual allegations to state a claim that is “plausible on 1 its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. v. Twombly, 550 U.S. 544, 2 555, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that 3 allows the court to draw the reasonable inference that the defendant is liable for the misconduct 4 alleged.” Id. (citing Twombly, 550 U.S. at 556). This standard asks for “more than a sheer 5 possibility that a defendant has acted unlawfully.” Id. The determination is a context-specific task 6 requiring the court “to draw on its judicial experience and common sense.” Id. at 679. Claims 7 sounding in fraud must meet a somewhat higher specificity standard as provided by Rule 9 of the 8 Federal Rules of Civil Procedure. 9 A motion to dismiss a complaint under Rule 12(b)(6) of the Federal Rules of Civil 10 Procedure tests the legal sufficiency of the claims alleged in the complaint. See Conservation 11 Force v. Salazar, 646 F.3d 1240, 1241-42 (9th Cir. 2011). Dismissal under Rule 12(b)(6) may be 12 based on either the “lack of a cognizable legal theory” or on “the absence of sufficient facts 13 alleged under a cognizable legal theory.” Id. at 1242 (internal quotation marks and citation 14 omitted). When evaluating such a motion, the court must accept all material allegations in the 15 complaint as true and construe them in the light most favorable to the non-moving party. In re 16 Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). 17 18 III. DISCUSSION 19 A. Personal Jurisdiction as to NSO 20 There is no dispute that NSO has no actual presence in California, or anywhere else in the 21 United States. Corallo argues it is nevertheless subject to specific personal jurisdiction here based 22 on his allegations that NSO effectively “hacked” into servers owned and operated by Apple in 23 California, to access his confidential information. Under the Calder effects test, plaintiffs must 24 show that defendants (1) committed an intentional act, (2) expressly aimed at the forum state, (3) 25 caused harm that the defendant knew was likely to be suffered in the forum state. Calder v. Jones, 26 465 U.S. 783, 789–90 (1984). 27 NSO argues that all of the alleged “hacking” was carried out by foreign governments. 1 While those governments may have utilized NSO’s software, NSO insists that its license 2 agreements do not permit use of the software against systems in the United States, and that it 3 cannot be held liable for the conduct of its customers. At least at this stage, however, Corallo has 4 adequately alleged NSO’s involvement in the purported hacking to satisfy the prong requiring an 5 “intentional act.” 6 What Corallo cannot show, however, is that NSO’s alleged conduct was expressly aimed at 7 California and caused harm that NSO knew likely would be suffered in California. Although 8 specific jurisdiction analysis focuses on the relationship between the conduct and the forum, rather 9 than on the particular plaintiff, the fact that Corallo had absolutely no connection to, or presence 10 in, California undermines any argument that the conduct was targeted at California or that harm 11 was likely to be suffered here. Corallo’s insistence that NSO targeted Apple’s servers in California 12 is not only speculative as a factual matter, but legally insufficient to give rise to personal 13 jurisdiction over NSO. See Alhathloul v. DarkMatter Grp., No. 3:21-CV-01787-IM, 2023 WL 14 2537761, at *6 (D. Or. Mar. 16, 2023) (“Rather than showing that Defendants purposefully 15 directed their conduct at the forum, Plaintiff’s allegation, at most, shows that Defendants 16 purposefully directed their conduct at a third party—Apple, whose choice to host their servers in 17 the United States is entirely unrelated to the conduct at issue in Plaintiff’s complaint.” ).2 18 Finally, even if Corallo had made a showing that his claims arise from jurisdictionally 19 significant activities of NSO in this forum (he has not), NSO has made a “compelling case” that 20 exercising jurisdiction would not be reasonable here. Corallo is a foreign citizen suing other 21 foreign citizens for conduct initiated from foreign locations. The litigation does not belong in the 22 courts of this state. 23 24 2 WhatsApp Inc. v. NSO Grp. Techs. Ltd., 472 F. Supp. 3d 649 (N.D. Cal. 2020), on which Corallo heavily relies, does not support a different result. WhatsApp expressly grounded its finding of 25 jurisdiction on the fact that NSO was alleged to have attacked the plaintiffs’ own servers and equipment in California, distinguishing cases where “the servers in question were incidental to the 26 alleged conduct and owned by third parties.” Id. at 672. By negative implication, therefore, 27 WhatsApp supports the finding that jurisdiction is absent here. 1 B. Forum Non Conveniens 2 Dismissal is alternatively appropriate under the doctrine of forum non conveniens. There is 3 no real dispute that Israel is an adequate alternative forum. For substantially similar reasons as 4 those compelling the conclusion that personal jurisdiction is lacking, the balance of the forum non 5 conveniens factors weighs in favor of applying the doctrine to dismiss. Again, the contrary 6 conclusion reached in WhatsApp serves only to underscore the critical difference that defendants 7 were alleged to have attacked the plaintiff’s own California servers in that case. 8 9 C. Failure to state a claim as to Apple 10 The two claims Corallo advances against Apple are completely separate from those he 11 alleges against NSO. Corallo attempts to hold Apple liable under a negligence theory, and for false 12 advertising. Both counts are based generally on allegations that Apple failed to protect Corallo’s 13 iPhone and iCloud data from the alleged hacking. Neither theory states a claim as presently 14 alleged. 15 Apple first challenges the negligence count by arguing it is a tort claim barred by the 16 economic loss rule. Corallo responds that he has pleaded a variety of non-economic damages 17 arising from the hacking. At least in its present form, however, the complaint fails to tie any non- 18 economic damages to Apple’s supposed negligence, as opposed to the allegedly tortious conduct 19 of NSO. 20 While that defect is conceivably curable, it is more difficult to envision how Corallo will 21 be able to allege facts sufficient to support a legal duty on the part of Apple to prevent the kind of 22 hacking alleged to have taken place here, or breach by Apple of any such duty. The allegations of 23 the present complaint boil down to nothing more than “because the hacking took place, Apple 24 must have been negligent.” At a minimum, any amended complaint will have to set forth a specific 25 factual basis to show that Apple failed to take reasonably prudent steps that could and would have 26 protected against an attack of this nature, and that a technology company in its position ordinarily 27 would have taken. 1 It is also difficult to see how Corallo will cure his false advertising claim. The fact that 2 Apple’s advertising material may tout the security features and performance of its technology 3 cannot reasonably be understood as a guarantee that technologically sophisticated individuals and 4 || companies will never be able to devise means for circumventing that security. Any amended 5 complaint must allege with specificity false or misleading statements by Apple and sufficient facts 6 || to show how the statements were false or misleading. 7 8 IV. CONCLUSION 9 NSO’s motion to dismiss for lack of personal jurisdiction and its motion to dismiss on 10 || forum non conveniens grounds are granted.* Apple’s motion to dismiss for failure to state a claim 11 is granted. If Corallo has a good faith basis for doing so, Corallo may file an amended complaint 12 as to Apple only within 20 days of the date of this order. If no amended complaint is filed within 5 13 that time, the case will be dismissed in its entirety without further notice. The Case Management 14 Conference is continued to January 16, 2025. a 16 || ITISSO ORDERED. 18 Dated: September 30, 2024 . 19 RICHARD SEEBORG 20 Chief United States District Judge 21 22 23 24 25 || ——— 6 3 Because the court lacks jurisdiction over NSO in this action, it would not be appropriate to reach the merits of NSO’s alternate motion to dismiss for failure to state a claim. The pending sealing 97 || motion is granted. CASE No. 22-cv-05229-RS