Apple Inc. v. NSO Group Technologies Limited

• Court: District Court, N.D. California
• Decided: January 23, 2024
• Docket: 3:21-cv-09078
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 APPLE INC., Case No. 3:21-cv-09078-JD 7 Plaintiff, 8 ORDER RE MOTION TO DISMISS v. AND FURTHER PROCEEDINGS 9 NSO GROUP TECHNOLOGIES 10 LIMITED, et al., 11 Defendants.

12 13 Plaintiff Apple Inc. (Apple) has sued defendants NSO Group Technologies Limited and Q 14 Cyber Technologies Limited (together, NSO) for breach of contract, violations of the Computer 15 Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a), and the California Unfair Competition Law, 16 Business and Professions Code § 1700 (UCL), and for unjust enrichment. Apple says that 17 defendants are “notorious hackers” who created and distribute “Pegasus,” which is said to be 18 malware that enables users “to remotely and covertly extract valuable intelligence from virtually 19 any mobile device.” Dkt. No. 1 ¶¶ 2, 40. Apple alleges that defendants created fake Apple IDs 20 used to access Apple’s servers, and attacked Apple consumer devices through a hack called 21 “FORCEDENTRY,” which “is known as a ‘zero-click’ exploit, meaning that it allowed 22 Defendants or their clients to hack into the victim’s devices without any action or awareness by 23 the victim.” Id. ¶¶ 49-51. Apple says it has incurred substantial losses and damages for recovery 24 and prevention efforts in responding to NSO’s conduct. The damages and losses are said to be 25 ongoing because “Defendants are constantly updating their malware and exploits to overcome 26 Apple’s own security upgrades.” Id. ¶ 60. 27 1 NSO asks to dismiss the complaint under Federal Rules of Civil Procedure 12(b)(6) and 2 12(b)(7).1 Dkt. No. 48. NSO says that the case as a whole should be dismissed under the doctrine 3 of forum non conveniens because defendants are based in Israel and Apple should have sued them 4 there. NSO also contends that the CFAA, UCL, and unjust enrichment claims were not plausibly 5 alleged, and that Apple did not join necessary parties under Rule 19, namely “NSO’s foreign- 6 government customers,” id. at 8, who are said to have used NSO’s products for “transnational 7 repression” of dissidents and others, Dkt. No. 1 ¶ 3. The parties’ familiarity with the record is 8 assumed, and dismissal is denied in all respects. 9 I. FORUM NON CONVENIENS 10 The parties agree that defendants are based in Israel. In NSO’s view, this means that an 11 Israeli court is a more appropriate and convenient forum for hearing Apple’s claims, and that the 12 case should be terminated here on the ground of forum non conveniens. NSO did not challenge 13 personal jurisdiction in this District. 14 The doctrine of forum non conveniens is “a supervening venue provision” that permits the 15 Court to decline jurisdiction when circumstances indicate that an alternative forum abroad would 16 be a better location for the litigation. Sinochem Int’l Co., Ltd. v. Malaysia Int’l Shipping Corp., 17 549 U.S. 422, 429-30 (2007) (internal citation omitted). The Court may dismiss a case under the 18 doctrine “when an alternative forum has jurisdiction to hear [the] case, and . . . trial in the chosen 19 forum would establish . . . oppressiveness and vexation to a defendant . . . out of all proportion to 20 plaintiff’s convenience, or . . . the chosen forum [is] inappropriate because of considerations 21 affecting the court’s own administrative and legal problems.” Id. at 429 (quoting American 22 Dredging Co. v. Miller, 510 U.S. 443, 447-48 (1994) (quoting in turn Piper Aircraft v. Reyno, 454 23 U.S. 235, 241 (1981) and Koster v. (American) Lumbermens Mut. Casualty Co., 330 U.S. 518, 524 24

25 1 In the caption of a reply brief, NSO added a reference to Rule 12(b)(1) and (b)(3) as purported 26 grounds for dismissal. Dkt. No. 51. NSO’s opening brief made no mention of these provisions, and the reply also did not discuss them in any way. NSO did not present any arguments under 27 Rule 12(b)(1) or (b)(3) in an appropriate manner, and certainly cannot raise them for the first time in a reply brief. Standing Order for Civil Cases ¶ 15; see also Friends of Del Norte v. California 1 (1947))) (ellipses in original). “A defendant invoking forum non conveniens ordinarily bears a 2 heavy burden in opposing plaintiff’s chosen forum.” Id. at 430. Forum non conveniens “is a non- 3 merits ground for dismissal.” Id. at 431 (internal citation omitted). Application of the doctrine is 4 entrusted to the Court’s sound discretion. American Dredging, 510 U.S. at 455; see also Loya v. 5 Starwood Hotels & Resorts Worldwide, Inc., 583 F.3d 656, 663-64 (9th Cir. 2009) (same). 6 “A party moving to dismiss on grounds of forum non conveniens must show two things: 7 (1) the existence of an adequate alternative forum, and (2) that the balance of private and public 8 interest factors favor dismissal.” Loya, 583 F.3d at 664 (internal citation omitted). As our circuit 9 has stated, the private interest factors “include (1) relative ease of access to sources of proof; (2) 10 the availability of compulsory process for attendance of hostile witnesses, and cost of obtaining 11 attendance of willing witnesses; (3) possibility of viewing subject premises; (4) all other factors 12 that render trial of the case expeditious and inexpensive.” Id. (internal citation omitted). The 13 public interest factors include “(1) administrative difficulties flowing from court congestion; (2) 14 imposition of jury duty on the people of a community that has no relation to the litigation; (3) 15 local interest in having localized controversies decided at home; (4) the interest in having a 16 diversity case tried in a forum familiar with the law that governs the action; (5) the avoidance of 17 unnecessary problems in the conflict of laws.” Id. (internal citation omitted). See also Lueck v. 18 Sundstrand Corp., 236 F.3d 1137, 1145-47 (9th Cir. 2001) (listing similar factors). 19 The parties agree that an Israeli court is a potential alternative forum, which the Court will 20 accept for present purposes. Consequently, the fight is about the balance of the private and public 21 considerations. Not all of these factors are present in every case, and that is the situation here. 22 The parties did not address each and every factor because some of them are not applicable, and the 23 Court will follow suit. 24 For the factors that the parties debate, NSO has not demonstrated that the circumstances of 25 this lawsuit overcome the “great deference” due to a plaintiff who has sued in its home forum, as 26 Apple has done here. Loya, 583 F.3d at 664 (“convenience by a party who has sued in his home 27 forum will usually outweigh the inconvenience that defendant may have shown”) (internal citation 1 concerns. See Dkt. No. 48 at 4-7. These factors are a wash. NSO’s ostensible burdens with 2 respect to witnesses and evidence in this District are neatly balanced by equivalent burdens Apple 3 would face if this case were litigated in Israel. Witnesses and evidence are likely to be located in 4 here and abroad in fairly equal measure, and one side or the other will face some challenges. NSO 5 has not demonstrated otherwise. NSO also overlooks the fact that the challenges will be amenable 6 to a number of mitigating practices. For example, current discovery practices such as the 7 production of documents in electronic form and the use of remote video depositions and similar 8 techniques will contribute substantially to reducing burdens on each side. The Court has handled 9 a number of cases, including multi-district litigation matters, that involved witnesses and evidence 10 located far outside of the United States, sometimes exclusively so, without undue difficulties or 11 unfair burdens on a party. NSO has not shown that this case will be different. With respect to a 12 final judgment, it may be, as NSO suggests in a reply brief, Dkt. No. 51 at 4, that enforcement of a 13 United States judgement is not “automatic” in Israel, but that is a far cry from saying it would be 14 so problematic as to warrant dismissal of this case. 15 So too for the public interest factors that NSO discusses. See Dkt. No. 48 at 7-8. There is 16 no question that the Court’s familiarity with the claims Apple alleges under United States federal 17 law and California state law exceeds that of any court in Israel, which greatly enhances the fair 18 and efficient disposition of the case. The local interest and relation of this case to this District and 19 potential jurors are equally self-evident. The gravamen of the complaint is that Apple servers and 20 devices have been hacked here, and that Apple is engaged here in a costly, ongoing defense 21 against NSO. Although it is certainly true that Apple’s claims will be subject to proof down the 22 road, these allegations amply demonstrate local interest. 23 Overall, NSO has not met its heavy burden of demonstrating that the circumstances of this 24 litigation warrant dismissal on forum non conveniens grounds. Other courts in this District have 25 reached the same conclusion in similar cases. See WhatsApp Inc. v. NSO Grp. Techs. Ltd., Case 26 No. 19-cv-07123-PJH, 2023 WL 7726411 (N.D. Cal. Nov. 15, 2023). 27 NSO’s supplemental briefing does not point to a different outcome. The Court departed 1 NSO used as an opportunity to make arguments that could and should have been made in its 2 opening brief, and that involve purported facts that were available in many instances before that 3 brief was filed. Dkt. No. 74.2 The gist of the supplemental brief is that legal developments in 4 Israel could complicate discovery. The key word is “could” because discovery has not started in 5 this litigation, and it is entirely speculative for NSO to say that an Israeli court or Israeli law would 6 necessarily stymie discovery to NSO’s disadvantage in this case. Apple’s reply to the 7 supplemental brief adduced a number of facts indicating that discovery may be considerably less 8 burdensome than NSO suggests, particularly with the use of protective orders and judicial 9 oversight here and abroad. See Dkt. No. 75 at 3-4. Apple also indicated that Israeli courts have 10 not unduly burdened discovery in similar cases against NSO in this District, see id. at 5-6, and that 11 NSO concerns are again a wash in terms of balancing the forum non conveniens factors because 12 they may be in play irrespective of whether discovery is done in this case or in Israel, id. at 8. The 13 Court need not formally decide these facts in advance of the start of discovery, but Apple’s 14 presentation makes clear there is at least a serious question about NSO’s parade of discovery 15 horribles. The parties are perfectly free to bring any discovery issue to the Court if developments 16 establish a substantial impediment or hardship for either side. 17 As a closing observation, the Court notes that Apple raised a forum selection clause in its 18 iCloud terms of service that provides “for mandatory and exclusive jurisdiction here,” in Apple’s 19 view. Dkt. No. 50 at 3. A valid “forum-selection clause [must] be ‘given controlling weight in all 20 but the most exceptional cases.’” Atlantic Marine Const. Co. v. U.S. Dist. Ct. for the Western 21 Dist. of Texas, 571 U.S. 49, 61 (2013) (quoting Stewart Org., Inc. v. Ricoh Corp., 487 U.S. 22, 33 22 (1988) (Kennedy, J., concurring)). Forum selection clauses between international parties are 23 “prima facie valid and should not be set aside unless the party challenging enforcement of such a 24 provision can show it is ‘unreasonable under the circumstances.’” Argueta v. Banco Mexicano, 25 S.A., 87 F.3d 320, 325 (9th Cir. 1996) (citing Bremen v. Zapata Off-Shore Co., 407 U.S. 1, 10 26

27 2 This docket entry and Dkt. No. 75, Apple’s reply to NSO’s supplemental brief, refer to the 1 (1972)). A forum selection clause may be raised in the context of forum non conveniens. Atlantic 2 Marine, 571 U.S. at 60-61. 3 The Court declines to take up the question of the forum selection clause at this time. 4 Apple alleges “on information and belief” that NSO created Apple IDs and so accepted the iCloud 5 terms of service. See Dkt. No. 1 ¶ 22. NSO did not expressly agree that this is so. Apple’s 6 complaint is sufficient to state a claim for breach of contract, and NSO did not suggest otherwise. 7 But for purposes of forum non conveniens, the questions of NSO’s acceptance of the iCloud terms 8 of service, and the nature and scope of its forum selection clause, entail disputed issues of fact that 9 cannot be resolved on the current record. Apple may raise the forum selection issue again as 10 circumstances and discovery warrant. 11 II. RULE 19 12 In a rather cursory manner, NSO faults Apple for not naming as defendants all of NSO’s 13 customers as indispensable parties under Rule 19. Dkt. No. 48 at 8-9. In NSO’s view, Apple’s 14 prayer for an injunction in the complaint necessarily reaches information harvested by NSO’s 15 customers, and so the Court cannot award complete relief in their absence. Id. 16 The point is not well taken. NSO puts far too much weight on a cursory and boilerplate 17 prayer for relief in the complaint. It is not at all clear from the prayer that Apple is seeking 18 anything other than relief against NSO for its own conduct and actions with respect to Apple’s 19 servers and users’ devices. It is certainly not the case that the prayer necessarily demands the 20 presence of NSO’s customers. The scope and terms of an injunction, if any, will be determined in 21 light of the claims Apple might win, and the record as a whole at the end of the case. All of that is 22 unknown as of now. In addition, Rule 19 expressly contemplates “shaping the relief” and using 23 “other measures” to avoid undue complications should concerns arise along the lines NSO 24 suggests. Fed. R. Civ. P. 19(b)(2)(B) and (C). A mere prayer for an injunction of undefined scope 25 and content is not enough to declare NSO’s customers to be essential parties. 26 III. CFAA, UCL, UNJUST ENRICHMENT 27 The CFAA authorizes civil suits by plaintiffs who suffer “damage or loss” resulting from 1 CFAA is “‘aimed at preventing the typical consequences of hacking’” and covers damages and 2 losses arising from the “technological harms” that hackers cause by making unauthorized access to 3 computer systems and data. Van Buren v. United States, 141 S.Ct. 1648, 1660 (2021) (quoting 4 Royal Truck & Trailer Sales & Serv. Inc. v. Kraft, 974 F.3d 756, 760 (6th Cir. 2020)); see also 5 Andrews v. Sirius XM Radio, Inc., 932 F.3d 1253, 1263 (9th Cir. 2019) (“CFAA is an anti-hacking 6 statute”) (internal quotation omitted). 7 The anti-hacking purpose of the CFAA fits Apple’s allegations to a T, and NSO has not 8 shown otherwise. NSO initially objected that “the only ‘protected computers’ the complaint 9 identifies” are Apple’s user’s devices, which Apple does not own and could not sue on. Dkt. No. 10 48 at 10. NSO subsequently acknowledged, albeit somewhat obliquely, that this is not so. See 11 Dkt. No. 51 at 6 (citing Theofel v. Farey-Jones, 359 F.3d 1066, 1078 (9th Cir. 2004)). The 12 complaint also makes clear that Apple alleges that NSO exploited Apple’s own servers and 13 services to place Pegasus on user devices. See, e.g., Dkt. No. 1 ¶¶ 51, 67-68, 74-76. 14 NSO objects that Apple has not sustained damages or losses within the purview of the 15 CFAA. Dkt. Nos. 48 at 10-12. Also not so. The statute permits a private right of action when a 16 party has suffered a loss of at least $5,000 during a one-year period. 18 U.S.C. § 17 1030(c)(4)(A)(i)(I). A “loss” is “any reasonable cost to any victim, including the cost of 18 responding to an offense, conducting a damage assessment, and restoring the data, program, 19 system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or 20 other consequential damages incurred because of interruption of service.” Id. § 1030(e)(11); see 21 also Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1066 (9th Cir. 2016). That is 22 precisely the loss Apple has alleged here. See Dkt. No. 1 ¶ 57 (Apple was forced “to incur costs 23 and to devote personnel, resources, and time to identifying and investigating [NSO’s] attacks and 24 exploits, developing and deploying security patches and software upgrades; communicating with 25 Apple personnel and users regarding such attacks, exploits, patches, and upgrades, increasing 26 security measures to detect and prevent future attacks; and assessing and responding to legal 27 exposure.”); id. ¶ 72 (loss exceeds $5,000 in one year). NSO’s passing suggestion that Apple 1 at 11, does not diminish the CFAA claim. Apple alleges that it retains ownership of the operating 2 || system on all devices, Dkt. No. 1 § 70, and the definition of “loss” expressly includes the cost of 3 investigating and restoring a “program” or “system.” To be clear, NSO is not barred from raising 4 || adefense with respect to a “protected computer” as the developed record warrants, but Apple has 5 said enough in the complaint to plausibly allege a CFAA claim for purposes of Rule 12(b)(6). 6 With respect to Apple’s claim under the unlawful prong of the UCL, NSO has not shown 7 || that the application of the UCL will necessarily extend to conduct occurring outside of California. 8 || Whether and to what extent extraterritoriality might come into play remains to be seen as the 9 || record and facts are developed. Consequently, the claim will not be dismissed at this time. NSO 10 || may revisit the issue as developments in the case warrant. 11 For the unjust enrichment claim, Apple expressly alleged it in the alternative to the breach 12 || of contract claim. That is enough to maintain the claim at this stage of the case. See Astiana v. 13 || Hain Celestial Grp., Inc. ,783 F.3d 753, 762 (9th Cir. 2015) (permitting unjust enrichment claim as 14 a quasi-contract claim); Lundy v. Facebook Inc., No. 18-CV-06793-JD, 2021 WL 4503071, at *2 3 15 (N.D. Cal. Sept. 30, 2021). Whether and to what extent there is a question of equitable restitution A 16 || versus legal damages is better left for a fully developed record. At this time, the Court cannot say 2 17 that both measures are the same or overlapping, and so dismissal on that ground, as NSO urges, is Z 18 || denied. 19 CONCLUSION 20 NSO’s motion to dismiss is denied in all respects. As next steps, NSO will answer Apple’s 21 complaint by February 14, 2024. A case management conference is set for April 4, 2024, at 10:00 22 a.m. 23 IT IS SO ORDERED. 24 || Dated: January 23, 2024 25 26 JAMES/JPONATO 27 Unitedf$tates District Judge 28