FRANCESCO CORALLO, Case No. 22-cv-05229-RS Plaintiff, v. ORDER GRANTING MOTIONS TO NSO GROUP TECHNOLOGIES LIMITED, et al., Defendants.
Plaintiff Francesco Corallo is a native of Italy and a naturalized citizen of the Netherlands, who resided in Sint Maarten in the Dutch Caribbean at the time of the events alleged in the complaint in this action. Corallo describes himself as a successful businessman with interests across the Caribbean and in Italy. Defendants NSO Group Technologies Limited and its sole shareholder Q Cyber Technologies Limited (collectively “NSO”) are Israeli companies, who allegedly develop, market, and distribute “highly invasive surveillance technology or spyware and related products and services, including software called Pegasus and a “security exploit” known as FORCEDENTRY.” Corallo owned an Apple iPhone and stored data in an iCloud account. He alleges NSO used the FORCEDENTRY exploit to deploy the Pegasus software on devices of Apple customers on behalf of NSO’s governmental clients, including Italy and the Netherlands. Corallo asserts this action, Corallo brings one set of claims against NSO, and a separate set of claims against Apple, Inc. NSO moves to dismiss for lack of personal jurisdiction or on forum non conveniens grounds, and for failure to state a claim. Apple moves to dismiss for failure to state a claim. Both motions will be granted. 1. Rule 12(b)(2) A federal court may dismiss an action under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction. When resolving a motion to dismiss under Rule 12(b)(2) on written materials, the court accepts uncontroverted facts in the complaint as true and resolves conflicts in affidavits in the plaintiffs’ favor. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011). The party seeking to invoke a federal court’s jurisdiction bears the burden of demonstrating jurisdiction. Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015). “Federal courts ordinarily follow state law in determining the bounds of their jurisdiction over persons.” Daimler AG v. Bauman, 571 U.S. 117, 125 (2014); see Fed. R. Civ. P. 4(k)(1)(a). As California’s long arm statute permits exercise of personal jurisdiction to the fullest extent permissible under the U.S. Constitution, the court’s inquiry “centers on whether exercising jurisdiction comports with due process.” Picot, 780 F.3d at 1211; see Cal. Code Civ. P. § 410.10. The Due Process Clause of the Fourteenth Amendment “limits the power of a state’s courts to exercise jurisdiction over defendants who do not consent to jurisdiction.” Martinez v. Aero Caribbean, 764 F.3d 1062, 1066 (9th Cir. 2014). Due process requires that the defendant “have certain minimum contacts with it such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice.” Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (internal quotation marks omitted). Under the “minimum contacts” analysis, a court can exercise either “general or all-purpose jurisdiction,” or “specific or conduct-linked jurisdiction.” Daimler, 571 U.S. at 121–22 (citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). A court may exercise specific jurisdiction over a defendant if its less-substantial contacts with the forum give rise to the claim or claims pending before the court—that is, if the cause of action “arises out of” or has a substantial connection with that activity. Hanson v. Denckla, 357 U.S. 235, 250–53 (1958); see also Goodyear, 564 U.S. at 924–25. The inquiry into whether a forum state may assert specific jurisdiction over a nonresident defendant focuses on the relationship among the defendant, the forum, and the litigation. Walden v. Fiore, 571 U.S. 277, 283–84 (2014) (citation omitted). To determine whether a defendant’s contacts with the forum state are sufficient to establish specific jurisdiction, the Ninth Circuit employs a three-part test: (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates to the defendant’s forum-related activities; and (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable. Morrill v. Scott Fin. Corp., 873 F.3d 1136, 1142 (9th Cir. 2017). A plaintiff bears the burden of satisfying the first two prongs. Id. If the plaintiff does so, then the burden shifts to the defendant to “set forth a ‘compelling case’ that the exercise of jurisdiction would not be reasonable.” CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1076 (9th Cir. 2011) (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 477–78 (1985)).1 2. Forum Non-Conveniens Under the doctrine of forum non conveniens, the district court has discretion to dismiss an action, even if jurisdiction and venue are properly established, when (1) a foreign country also has jurisdiction to hear the case, and either (2) trial in the chosen American forum would establish 1 Corallo was given the opportunity to conduct jurisdictional discovery. As explained in a prior order, that process was terminated once it became clear Corallo was unwilling or unable to focus on the material issues. Dkt. No. 94. oppressiveness and vexation to a defendant out of all proportion to plaintiff’s convenience; or (3) the chosen American forum is inappropriate because of considerations affecting the court’s own administrative and legal problems. See American Dredging Co. v. Miller, 510 U.S. 443, 447-49 and n.2 (1994) More generally, “[a] district court has discretion to decline to exercise jurisdiction in a case where litigation in a foreign forum would be more convenient for the parties.” Lueck v. Sundstrand Corp., 236 F.3d 1137, 1142 (9th Cir. 2001) (citing Gulf Oil Corp. v. Gilbert, 330 U.S. 501, 504 (1947)). Courts employ a two-step analysis in determining whether to dismiss based on forum non conveniens. The defendant must first “satisfy a heavy burden of proof” to establish that there is an adequate alternative forum where the case can be litigated. Lueck, 236 F.3d at 1143; Piper Aircraft Co. v. Reyno, 454 U.S. 235, 255 n. 22 (1981). Then, the defendant must show that the balance of the applicable private and public factors “is strongly in favor of the defendant.” Cheng v. Boeing Co., 708 F.2d 1406, 1410 (9th Cir. 1983) (quoting Gulf Oil, 330 U.S. at 508). Courts consider the following private interest factors: (1) the residence of the parties and the witnesses; (2) the forum’s convenience to the litigants; (3) acces
Free access — add to your briefcase to read the full text and ask questions with AI
FRANCESCO CORALLO, Case No. 22-cv-05229-RS Plaintiff, v. ORDER GRANTING MOTIONS TO NSO GROUP TECHNOLOGIES LIMITED, et al., Defendants.
Plaintiff Francesco Corallo is a native of Italy and a naturalized citizen of the Netherlands, who resided in Sint Maarten in the Dutch Caribbean at the time of the events alleged in the complaint in this action. Corallo describes himself as a successful businessman with interests across the Caribbean and in Italy. Defendants NSO Group Technologies Limited and its sole shareholder Q Cyber Technologies Limited (collectively “NSO”) are Israeli companies, who allegedly develop, market, and distribute “highly invasive surveillance technology or spyware and related products and services, including software called Pegasus and a “security exploit” known as FORCEDENTRY.” Corallo owned an Apple iPhone and stored data in an iCloud account. He alleges NSO used the FORCEDENTRY exploit to deploy the Pegasus software on devices of Apple customers on behalf of NSO’s governmental clients, including Italy and the Netherlands. Corallo asserts this action, Corallo brings one set of claims against NSO, and a separate set of claims against Apple, Inc. NSO moves to dismiss for lack of personal jurisdiction or on forum non conveniens grounds, and for failure to state a claim. Apple moves to dismiss for failure to state a claim. Both motions will be granted. 1. Rule 12(b)(2) A federal court may dismiss an action under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction. When resolving a motion to dismiss under Rule 12(b)(2) on written materials, the court accepts uncontroverted facts in the complaint as true and resolves conflicts in affidavits in the plaintiffs’ favor. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011). The party seeking to invoke a federal court’s jurisdiction bears the burden of demonstrating jurisdiction. Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015). “Federal courts ordinarily follow state law in determining the bounds of their jurisdiction over persons.” Daimler AG v. Bauman, 571 U.S. 117, 125 (2014); see Fed. R. Civ. P. 4(k)(1)(a). As California’s long arm statute permits exercise of personal jurisdiction to the fullest extent permissible under the U.S. Constitution, the court’s inquiry “centers on whether exercising jurisdiction comports with due process.” Picot, 780 F.3d at 1211; see Cal. Code Civ. P. § 410.10. The Due Process Clause of the Fourteenth Amendment “limits the power of a state’s courts to exercise jurisdiction over defendants who do not consent to jurisdiction.” Martinez v. Aero Caribbean, 764 F.3d 1062, 1066 (9th Cir. 2014). Due process requires that the defendant “have certain minimum contacts with it such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice.” Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (internal quotation marks omitted). Under the “minimum contacts” analysis, a court can exercise either “general or all-purpose jurisdiction,” or “specific or conduct-linked jurisdiction.” Daimler, 571 U.S. at 121–22 (citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). A court may exercise specific jurisdiction over a defendant if its less-substantial contacts with the forum give rise to the claim or claims pending before the court—that is, if the cause of action “arises out of” or has a substantial connection with that activity. Hanson v. Denckla, 357 U.S. 235, 250–53 (1958); see also Goodyear, 564 U.S. at 924–25. The inquiry into whether a forum state may assert specific jurisdiction over a nonresident defendant focuses on the relationship among the defendant, the forum, and the litigation. Walden v. Fiore, 571 U.S. 277, 283–84 (2014) (citation omitted). To determine whether a defendant’s contacts with the forum state are sufficient to establish specific jurisdiction, the Ninth Circuit employs a three-part test: (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates to the defendant’s forum-related activities; and (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable. Morrill v. Scott Fin. Corp., 873 F.3d 1136, 1142 (9th Cir. 2017). A plaintiff bears the burden of satisfying the first two prongs. Id. If the plaintiff does so, then the burden shifts to the defendant to “set forth a ‘compelling case’ that the exercise of jurisdiction would not be reasonable.” CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1076 (9th Cir. 2011) (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 477–78 (1985)).1 2. Forum Non-Conveniens Under the doctrine of forum non conveniens, the district court has discretion to dismiss an action, even if jurisdiction and venue are properly established, when (1) a foreign country also has jurisdiction to hear the case, and either (2) trial in the chosen American forum would establish 1 Corallo was given the opportunity to conduct jurisdictional discovery. As explained in a prior order, that process was terminated once it became clear Corallo was unwilling or unable to focus on the material issues. Dkt. No. 94. oppressiveness and vexation to a defendant out of all proportion to plaintiff’s convenience; or (3) the chosen American forum is inappropriate because of considerations affecting the court’s own administrative and legal problems. See American Dredging Co. v. Miller, 510 U.S. 443, 447-49 and n.2 (1994) More generally, “[a] district court has discretion to decline to exercise jurisdiction in a case where litigation in a foreign forum would be more convenient for the parties.” Lueck v. Sundstrand Corp., 236 F.3d 1137, 1142 (9th Cir. 2001) (citing Gulf Oil Corp. v. Gilbert, 330 U.S. 501, 504 (1947)). Courts employ a two-step analysis in determining whether to dismiss based on forum non conveniens. The defendant must first “satisfy a heavy burden of proof” to establish that there is an adequate alternative forum where the case can be litigated. Lueck, 236 F.3d at 1143; Piper Aircraft Co. v. Reyno, 454 U.S. 235, 255 n. 22 (1981). Then, the defendant must show that the balance of the applicable private and public factors “is strongly in favor of the defendant.” Cheng v. Boeing Co., 708 F.2d 1406, 1410 (9th Cir. 1983) (quoting Gulf Oil, 330 U.S. at 508). Courts consider the following private interest factors: (1) the residence of the parties and the witnesses; (2) the forum’s convenience to the litigants; (3) access to physical evidence and other sources of proof; (4) whether unwilling witnesses can be compelled to testify; (5) the cost of bringing witnesses to trial; (6) the enforceability of the judgment; and (7) all other practical problems that make trial of a case easy, expeditious, and inexpensive. Lueck, 236 F.3d at 1145 (internal citations omitted). Courts also consider the following public interest factors: (1) local interest of lawsuit; (2) the court’s familiarity with governing law; (3) burden on local courts and juries; (4) congestion in the court; and (5) the costs of resolving a dispute unrelated to this forum. Lueck, 236 F.3d at 1147. 3. Rule 12(b)(6) A complaint must contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). While “detailed factual allegations” are not required, a complaint must have sufficient factual allegations to state a claim that is “plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. v. Twombly, 550 U.S. 544, 555, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556). This standard asks for “more than a sheer possibility that a defendant has acted unlawfully.” Id. The determination is a context-specific task requiring the court “to draw on its judicial experience and common sense.” Id. at 679. Claims sounding in fraud must meet a somewhat higher specificity standard as provided by Rule 9 of the Federal Rules of Civil Procedure. A motion to dismiss a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the legal sufficiency of the claims alleged in the complaint. See Conservation Force v. Salazar, 646 F.3d 1240, 1241-42 (9th Cir. 2011). Dismissal under Rule 12(b)(6) may be based on either the “lack of a cognizable legal theory” or on “the absence of sufficient facts alleged under a cognizable legal theory.” Id. at 1242 (internal quotation marks and citation omitted). When evaluating such a motion, the court must accept all material allegations in the complaint as true and construe them in the light most favorable to the non-moving party. In re Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). A. Personal Jurisdiction as to NSO There is no dispute that NSO has no actual presence in California, or anywhere else in the United States. Corallo argues it is nevertheless subject to specific personal jurisdiction here based on his allegations that NSO effectively “hacked” into servers owned and operated by Apple in California, to access his confidential information. Under the Calder effects test, plaintiffs must show that defendants (1) committed an intentional act, (2) expressly aimed at the forum state, (3) caused harm that the defendant knew was likely to be suffered in the forum state. Calder v. Jones, 465 U.S. 783, 789–90 (1984). NSO argues that all of the alleged “hacking” was carried out by foreign governments. While those governments may have utilized NSO’s software, NSO insists that its license agreements do not permit use of the software against systems in the United States, and that it cannot be held liable for the conduct of its customers. At least at this stage, however, Corallo has adequately alleged NSO’s involvement in the purported hacking to satisfy the prong requiring an “intentional act.” What Corallo cannot show, however, is that NSO’s alleged conduct was expressly aimed at California and caused harm that NSO knew likely would be suffered in California. Although specific jurisdiction analysis focuses on the relationship between the conduct and the forum, rather than on the particular plaintiff, the fact that Corallo had absolutely no connection to, or presence in, California undermines any argument that the conduct was targeted at California or that harm was likely to be suffered here. Corallo’s insistence that NSO targeted Apple’s servers in California is not only speculative as a factual matter, but legally insufficient to give rise to personal jurisdiction over NSO. See Alhathloul v. DarkMatter Grp., No. 3:21-CV-01787-IM, 2023 WL 2537761, at *6 (D. Or. Mar. 16, 2023) (“Rather than showing that Defendants purposefully directed their conduct at the forum, Plaintiff’s allegation, at most, shows that Defendants purposefully directed their conduct at a third party—Apple, whose choice to host their servers in the United States is entirely unrelated to the conduct at issue in Plaintiff’s complaint.” ).2 Finally, even if Corallo had made a showing that his claims arise from jurisdictionally significant activities of NSO in this forum (he has not), NSO has made a “compelling case” that exercising jurisdiction would not be reasonable here. Corallo is a foreign citizen suing other foreign citizens for conduct initiated from foreign locations. The litigation does not belong in the courts of this state.
2 WhatsApp Inc. v. NSO Grp. Techs. Ltd., 472 F. Supp. 3d 649 (N.D. Cal. 2020), on which Corallo heavily relies, does not support a different result. WhatsApp expressly grounded its finding of jurisdiction on the fact that NSO was alleged to have attacked the plaintiffs’ own servers and equipment in California, distinguishing cases where “the servers in question were incidental to the alleged conduct and owned by third parties.” Id. at 672. By negative implication, therefore, WhatsApp supports the finding that jurisdiction is absent here. B. Forum Non Conveniens Dismissal is alternatively appropriate under the doctrine of forum non conveniens. There is no real dispute that Israel is an adequate alternative forum. For substantially similar reasons as those compelling the conclusion that personal jurisdiction is lacking, the balance of the forum non conveniens factors weighs in favor of applying the doctrine to dismiss. Again, the contrary conclusion reached in WhatsApp serves only to underscore the critical difference that defendants were alleged to have attacked the plaintiff’s own California servers in that case. C. Failure to state a claim as to Apple The two claims Corallo advances against Apple are completely separate from those he alleges against NSO. Corallo attempts to hold Apple liable under a negligence theory, and for false advertising. Both counts are based generally on allegations that Apple failed to protect Corallo’s iPhone and iCloud data from the alleged hacking. Neither theory states a claim as presently alleged. Apple first challenges the negligence count by arguing it is a tort claim barred by the economic loss rule. Corallo responds that he has pleaded a variety of non-economic damages arising from the hacking. At least in its present form, however, the complaint fails to tie any non- economic damages to Apple’s supposed negligence, as opposed to the allegedly tortious conduct of NSO. While that defect is conceivably curable, it is more difficult to envision how Corallo will be able to allege facts sufficient to support a legal duty on the part of Apple to prevent the kind of hacking alleged to have taken place here, or breach by Apple of any such duty. The allegations of the present complaint boil down to nothing more than “because the hacking took place, Apple must have been negligent.” At a minimum, any amended complaint will have to set forth a specific factual basis to show that Apple failed to take reasonably prudent steps that could and would have protected against an attack of this nature, and that a technology company in its position ordinarily would have taken. 1 It is also difficult to see how Corallo will cure his false advertising claim. The fact that 2 Apple’s advertising material may tout the security features and performance of its technology 3 cannot reasonably be understood as a guarantee that technologically sophisticated individuals and 4 companies will never be able to devise means for circumventing that security. Any amended 5 complaint must allege with specificity false or misleading statements by Apple and sufficient facts 6 to show how the statements were false or misleading. 7 9 NSO’s motion to dismiss for lack of personal jurisdiction and its motion to dismiss on 10 forum non conveniens grounds are granted.* Apple’s motion to dismiss for failure to state a claim 11 is granted. If Corallo has a good faith basis for doing so, Corallo may file an amended complaint 12 as to Apple only within 20 days of the date of this order. If no amended complaint is filed within 13 that time, the case will be dismissed in its entirety without further notice. The Case Management 14 Conference is continued to January 16, 2025.
a 16 || ITISSO ORDERED.
18 Dated: September 30, 2024 . 19 RICHARD SEEBORG 20 Chief United States District Judge 21 22 23 24 25 ——— 6 3 Because the court lacks jurisdiction over NSO in this action, it would not be appropriate to reach the merits of NSO’s alternate motion to dismiss for failure to state a claim. The pending sealing 97 motion is granted. CASE No. 22-cv-05229-RS