Apple Inc. v. NSO Group Technologies Limited et al

Filing 87

ORDER RE MOTION TO DISMISS AND FURTHER PROCEEDINGS. Signed by Judge James Donato on 1/23/2024. (jdlc3, COURT STAFF) (Filed on 1/23/2024)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
7

APPLE INC.,

Case No. 3:21-cv-09078-JD
Plaintiff,

8

ORDER RE MOTION TO DISMISS
AND FURTHER PROCEEDINGS

v.
9
10

United States District Court
Northern District of California

11

NSO GROUP TECHNOLOGIES
LIMITED, et al.,
Defendants.

12
13

Plaintiff Apple Inc. (Apple) has sued defendants NSO Group Technologies Limited and Q

14

Cyber Technologies Limited (together, NSO) for breach of contract, violations of the Computer

15

Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a), and the California Unfair Competition Law,

16

Business and Professions Code § 1700 (UCL), and for unjust enrichment. Apple says that

17

defendants are “notorious hackers” who created and distribute “Pegasus,” which is said to be

18

malware that enables users “to remotely and covertly extract valuable intelligence from virtually

19

any mobile device.” Dkt. No. 1 ¶¶ 2, 40. Apple alleges that defendants created fake Apple IDs

20

used to access Apple’s servers, and attacked Apple consumer devices through a hack called

21

“FORCEDENTRY,” which “is known as a ‘zero-click’ exploit, meaning that it allowed

22

Defendants or their clients to hack into the victim’s devices without any action or awareness by

23

the victim.” Id. ¶¶ 49-51. Apple says it has incurred substantial losses and damages for recovery

24

and prevention efforts in responding to NSO’s conduct. The damages and losses are said to be

25

ongoing because “Defendants are constantly updating their malware and exploits to overcome

26

Apple’s own security upgrades.” Id. ¶ 60.

27
28

NSO asks to dismiss the complaint under Federal Rules of Civil Procedure 12(b)(6) and

1
2

12(b)(7).1 Dkt. No. 48. NSO says that the case as a whole should be dismissed under the doctrine

3

of forum non conveniens because defendants are based in Israel and Apple should have sued them

4

there. NSO also contends that the CFAA, UCL, and unjust enrichment claims were not plausibly

5

alleged, and that Apple did not join necessary parties under Rule 19, namely “NSO’s foreign-

6

government customers,” id. at 8, who are said to have used NSO’s products for “transnational

7

repression” of dissidents and others, Dkt. No. 1 ¶ 3. The parties’ familiarity with the record is

8

assumed, and dismissal is denied in all respects.
I.

9

The parties agree that defendants are based in Israel. In NSO’s view, this means that an

10

United States District Court
Northern District of California

FORUM NON CONVENIENS

11

Israeli court is a more appropriate and convenient forum for hearing Apple’s claims, and that the

12

case should be terminated here on the ground of forum non conveniens. NSO did not challenge

13

personal jurisdiction in this District.

14

The doctrine of forum non conveniens is “a supervening venue provision” that permits the

15

Court to decline jurisdiction when circumstances indicate that an alternative forum abroad would

16

be a better location for the litigation. Sinochem Int’l Co., Ltd. v. Malaysia Int’l Shipping Corp.,

17

549 U.S. 422, 429-30 (2007) (internal citation omitted). The Court may dismiss a case under the

18

doctrine “when an alternative forum has jurisdiction to hear [the] case, and . . . trial in the chosen

19

forum would establish . . . oppressiveness and vexation to a defendant . . . out of all proportion to

20

plaintiff’s convenience, or . . . the chosen forum [is] inappropriate because of considerations

21

affecting the court’s own administrative and legal problems.” Id. at 429 (quoting American

22

Dredging Co. v. Miller, 510 U.S. 443, 447-48 (1994) (quoting in turn Piper Aircraft v. Reyno, 454

23

U.S. 235, 241 (1981) and Koster v. (American) Lumbermens Mut. Casualty Co., 330 U.S. 518, 524

24
25
26
27
28

1

In the caption of a reply brief, NSO added a reference to Rule 12(b)(1) and (b)(3) as purported
grounds for dismissal. Dkt. No. 51. NSO’s opening brief made no mention of these provisions,
and the reply also did not discuss them in any way. NSO did not present any arguments under
Rule 12(b)(1) or (b)(3) in an appropriate manner, and certainly cannot raise them for the first time
in a reply brief. Standing Order for Civil Cases ¶ 15; see also Friends of Del Norte v. California
Dep't of Transportation, No. 18-CV-00129-JD, 2023 WL 2351649, at *5 (N.D. Cal. Mar. 3,
2023).
2

United States District Court
Northern District of California

1

(1947))) (ellipses in original). “A defendant invoking forum non conveniens ordinarily bears a

2

heavy burden in opposing plaintiff’s chosen forum.” Id. at 430. Forum non conveniens “is a non-

3

merits ground for dismissal.” Id. at 431 (internal citation omitted). Application of the doctrine is

4

entrusted to the Court’s sound discretion. American Dredging, 510 U.S. at 455; see also Loya v.

5

Starwood Hotels & Resorts Worldwide, Inc., 583 F.3d 656, 663-64 (9th Cir. 2009) (same).

6

“A party moving to dismiss on grounds of forum non conveniens must show two things:

7

(1) the existence of an adequate alternative forum, and (2) that the balance of private and public

8

interest factors favor dismissal.” Loya, 583 F.3d at 664 (internal citation omitted). As our circuit

9

has stated, the private interest factors “include (1) relative ease of access to sources of proof; (2)

10

the availability of compulsory process for attendance of hostile witnesses, and cost of obtaining

11

attendance of willing witnesses; (3) possibility of viewing subject premises; (4) all other factors

12

that render trial of the case expeditious and inexpensive.” Id. (internal citation omitted). The

13

public interest factors include “(1) administrative difficulties flowing from court congestion; (2)

14

imposition of jury duty on the people of a community that has no relation to the litigation; (3)

15

local interest in having localized controversies decided at home; (4) the interest in having a

16

diversity case tried in a forum familiar with the law that governs the action; (5) the avoidance of

17

unnecessary problems in the conflict of laws.” Id. (internal citation omitted). See also Lueck v.

18

Sundstrand Corp., 236 F.3d 1137, 1145-47 (9th Cir. 2001) (listing similar factors).

19

The parties agree that an Israeli court is a potential alternative forum, which the Court will

20

accept for present purposes. Consequently, the fight is about the balance of the private and public

21

considerations. Not all of these factors are present in every case, and that is the situation here.

22

The parties did not address each and every factor because some of them are not applicable, and the

23

Court will follow suit.

24

For the factors that the parties debate, NSO has not demonstrated that the circumstances of

25

this lawsuit overcome the “great deference” due to a plaintiff who has sued in its home forum, as

26

Apple has done here. Loya, 583 F.3d at 664 (“convenience by a party who has sued in his home

27

forum will usually outweigh the inconvenience that defendant may have shown”) (internal citation

28

omitted). For the private interest factors, NSO focuses primarily on witness and evidence
3

United States District Court
Northern District of California

1

concerns. See Dkt. No. 48 at 4-7. These factors are a wash. NSO’s ostensible burdens with

2

respect to witnesses and evidence in this District are neatly balanced by equivalent burdens Apple

3

would face if this case were litigated in Israel. Witnesses and evidence are likely to be located in

4

here and abroad in fairly equal measure, and one side or the other will face some challenges. NSO

5

has not demonstrated otherwise. NSO also overlooks the fact that the challenges will be amenable

6

to a number of mitigating practices. For example, current discovery practices such as the

7

production of documents in electronic form and the use of remote video depositions and similar

8

techniques will contribute substantially to reducing burdens on each side. The Court has handled

9

a number of cases, including multi-district litigation matters, that involved witnesses and evidence

10

located far outside of the United States, sometimes exclusively so, without undue difficulties or

11

unfair burdens on a party. NSO has not shown that this case will be different. With respect to a

12

final judgment, it may be, as NSO suggests in a reply brief, Dkt. No. 51 at 4, that enforcement of a

13

United States judgement is not “automatic” in Israel, but that is a far cry from saying it would be

14

so problematic as to warrant dismissal of this case.

15

So too for the public interest factors that NSO discusses. See Dkt. No. 48 at 7-8. There is

16

no question that the Court’s familiarity with the claims Apple alleges under United States federal

17

law and California state law exceeds that of any court in Israel, which greatly enhances the fair

18

and efficient disposition of the case. The local interest and relation of this case to this District and

19

potential jurors are equally self-evident. The gravamen of the complaint is that Apple servers and

20

devices have been hacked here, and that Apple is engaged here in a costly, ongoing defense

21

against NSO. Although it is certainly true that Apple’s claims will be subject to proof down the

22

road, these allegations amply demonstrate local interest.

23

Overall, NSO has not met its heavy burden of demonstrating that the circumstances of this

24

litigation warrant dismissal on forum non conveniens grounds. Other courts in this District have

25

reached the same conclusion in similar cases. See WhatsApp Inc. v. NSO Grp. Techs. Ltd., Case

26

No. 19-cv-07123-PJH, 2023 WL 7726411 (N.D. Cal. Nov. 15, 2023).

27
28

NSO’s supplemental briefing does not point to a different outcome. The Court departed
from its usual practice to allow NSO to file a supplemental brief for the motion to dismiss, which
4

United States District Court
Northern District of California

1

NSO used as an opportunity to make arguments that could and should have been made in its

2

opening brief, and that involve purported facts that were available in many instances before that

3

brief was filed. Dkt. No. 74.2 The gist of the supplemental brief is that legal developments in

4

Israel could complicate discovery. The key word is “could” because discovery has not started in

5

this litigation, and it is entirely speculative for NSO to say that an Israeli court or Israeli law would

6

necessarily stymie discovery to NSO’s disadvantage in this case. Apple’s reply to the

7

supplemental brief adduced a number of facts indicating that discovery may be considerably less

8

burdensome than NSO suggests, particularly with the use of protective orders and judicial

9

oversight here and abroad. See Dkt. No. 75 at 3-4. Apple also indicated that Israeli courts have

10

not unduly burdened discovery in similar cases against NSO in this District, see id. at 5-6, and that

11

NSO concerns are again a wash in terms of balancing the forum non conveniens factors because

12

they may be in play irrespective of whether discovery is done in this case or in Israel, id. at 8. The

13

Court need not formally decide these facts in advance of the start of discovery, but Apple’s

14

presentation makes clear there is at least a serious question about NSO’s parade of discovery

15

horribles. The parties are perfectly free to bring any discovery issue to the Court if developments

16

establish a substantial impediment or hardship for either side.

17

As a closing observation, the Court notes that Apple raised a forum selection clause in its

18

iCloud terms of service that provides “for mandatory and exclusive jurisdiction here,” in Apple’s

19

view. Dkt. No. 50 at 3. A valid “forum-selection clause [must] be ‘given controlling weight in all

20

but the most exceptional cases.’” Atlantic Marine Const. Co. v. U.S. Dist. Ct. for the Western

21

Dist. of Texas, 571 U.S. 49, 61 (2013) (quoting Stewart Org., Inc. v. Ricoh Corp., 487 U.S. 22, 33

22

(1988) (Kennedy, J., concurring)). Forum selection clauses between international parties are

23

“prima facie valid and should not be set aside unless the party challenging enforcement of such a

24

provision can show it is ‘unreasonable under the circumstances.’” Argueta v. Banco Mexicano,

25

S.A., 87 F.3d 320, 325 (9th Cir. 1996) (citing Bremen v. Zapata Off-Shore Co., 407 U.S. 1, 10

26
27
28

This docket entry and Dkt. No. 75, Apple’s reply to NSO’s supplemental brief, refer to the
redacted versions currently available to the public. The unredacted versions were filed under seal
and are subject to a sealing request that the Court will decide separately.
5
2

1

(1972)). A forum selection clause may be raised in the context of forum non conveniens. Atlantic

2

Marine, 571 U.S. at 60-61.

3

The Court declines to take up the question of the forum selection clause at this time.

4

Apple alleges “on information and belief” that NSO created Apple IDs and so accepted the iCloud

5

terms of service. See Dkt. No. 1 ¶ 22. NSO did not expressly agree that this is so. Apple’s

6

complaint is sufficient to state a claim for breach of contract, and NSO did not suggest otherwise.

7

But for purposes of forum non conveniens, the questions of NSO’s acceptance of the iCloud terms

8

of service, and the nature and scope of its forum selection clause, entail disputed issues of fact that

9

cannot be resolved on the current record. Apple may raise the forum selection issue again as

10

United States District Court
Northern District of California

11

circumstances and discovery warrant.
II.

RULE 19

12

In a rather cursory manner, NSO faults Apple for not naming as defendants all of NSO’s

13

customers as indispensable parties under Rule 19. Dkt. No. 48 at 8-9. In NSO’s view, Apple’s

14

prayer for an injunction in the complaint necessarily reaches information harvested by NSO’s

15

customers, and so the Court cannot award complete relief in their absence. Id.
The point is not well taken. NSO puts far too much weight on a cursory and boilerplate

16
17

prayer for relief in the complaint. It is not at all clear from the prayer that Apple is seeking

18

anything other than relief against NSO for its own conduct and actions with respect to Apple’s

19

servers and users’ devices. It is certainly not the case that the prayer necessarily demands the

20

presence of NSO’s customers. The scope and terms of an injunction, if any, will be determined in

21

light of the claims Apple might win, and the record as a whole at the end of the case. All of that is

22

unknown as of now. In addition, Rule 19 expressly contemplates “shaping the relief” and using

23

“other measures” to avoid undue complications should concerns arise along the lines NSO

24

suggests. Fed. R. Civ. P. 19(b)(2)(B) and (C). A mere prayer for an injunction of undefined scope

25

and content is not enough to declare NSO’s customers to be essential parties.

26
27
28

III.

CFAA, UCL, UNJUST ENRICHMENT
The CFAA authorizes civil suits by plaintiffs who suffer “damage or loss” resulting from

access to a “protected computer” that is forbidden by the statute. 18 U.S.C. § 1030(g). The
6

1

CFAA is “‘aimed at preventing the typical consequences of hacking’” and covers damages and

2

losses arising from the “technological harms” that hackers cause by making unauthorized access to

3

computer systems and data. Van Buren v. United States, 141 S.Ct. 1648, 1660 (2021) (quoting

4

Royal Truck & Trailer Sales & Serv. Inc. v. Kraft, 974 F.3d 756, 760 (6th Cir. 2020)); see also

5

Andrews v. Sirius XM Radio, Inc., 932 F.3d 1253, 1263 (9th Cir. 2019) (“CFAA is an anti-hacking

6

statute”) (internal quotation omitted).

United States District Court
Northern District of California

7

The anti-hacking purpose of the CFAA fits Apple’s allegations to a T, and NSO has not

8

shown otherwise. NSO initially objected that “the only ‘protected computers’ the complaint

9

identifies” are Apple’s user’s devices, which Apple does not own and could not sue on. Dkt. No.

10

48 at 10. NSO subsequently acknowledged, albeit somewhat obliquely, that this is not so. See

11

Dkt. No. 51 at 6 (citing Theofel v. Farey-Jones, 359 F.3d 1066, 1078 (9th Cir. 2004)). The

12

complaint also makes clear that Apple alleges that NSO exploited Apple’s own servers and

13

services to place Pegasus on user devices. See, e.g., Dkt. No. 1 ¶¶ 51, 67-68, 74-76.

14

NSO objects that Apple has not sustained damages or losses within the purview of the

15

CFAA. Dkt. Nos. 48 at 10-12. Also not so. The statute permits a private right of action when a

16

party has suffered a loss of at least $5,000 during a one-year period. 18 U.S.C. §

17

1030(c)(4)(A)(i)(I). A “loss” is “any reasonable cost to any victim, including the cost of

18

responding to an offense, conducting a damage assessment, and restoring the data, program,

19

system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or

20

other consequential damages incurred because of interruption of service.” Id. § 1030(e)(11); see

21

also Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1066 (9th Cir. 2016). That is

22

precisely the loss Apple has alleged here. See Dkt. No. 1 ¶ 57 (Apple was forced “to incur costs

23

and to devote personnel, resources, and time to identifying and investigating [NSO’s] attacks and

24

exploits, developing and deploying security patches and software upgrades; communicating with

25

Apple personnel and users regarding such attacks, exploits, patches, and upgrades, increasing

26

security measures to detect and prevent future attacks; and assessing and responding to legal

27

exposure.”); id. ¶ 72 (loss exceeds $5,000 in one year). NSO’s passing suggestion that Apple

28

incurred these costs in connection with the iOS operating system and not a computer, Dkt. No. 48
7

1

at 11, does not diminish the CFAA claim. Apple alleges that it retains ownership of the operating

2

system on all devices, Dkt. No. 1 ¶ 70, and the definition of “loss” expressly includes the cost of

3

investigating and restoring a “program” or “system.” To be clear, NSO is not barred from raising

4

a defense with respect to a “protected computer” as the developed record warrants, but Apple has

5

said enough in the complaint to plausibly allege a CFAA claim for purposes of Rule 12(b)(6).
With respect to Apple’s claim under the unlawful prong of the UCL, NSO has not shown

6
7

that the application of the UCL will necessarily extend to conduct occurring outside of California.

8

Whether and to what extent extraterritoriality might come into play remains to be seen as the

9

record and facts are developed. Consequently, the claim will not be dismissed at this time. NSO

10

may revisit the issue as developments in the case warrant.
For the unjust enrichment claim, Apple expressly alleged it in the alternative to the breach

United States District Court
Northern District of California

11
12

of contract claim. That is enough to maintain the claim at this stage of the case. See Astiana v.

13

Hain Celestial Grp., Inc.¸783 F.3d 753, 762 (9th Cir. 2015) (permitting unjust enrichment claim as

14

a quasi-contract claim); Lundy v. Facebook Inc., No. 18-CV-06793-JD, 2021 WL 4503071, at *2

15

(N.D. Cal. Sept. 30, 2021). Whether and to what extent there is a question of equitable restitution

16

versus legal damages is better left for a fully developed record. At this time, the Court cannot say

17

that both measures are the same or overlapping, and so dismissal on that ground, as NSO urges, is

18

denied.
CONCLUSION

19
20

NSO’s motion to dismiss is denied in all respects. As next steps, NSO will answer Apple’s

21

complaint by February 14, 2024. A case management conference is set for April 4, 2024, at 10:00

22

a.m.

23
24

IT IS SO ORDERED.
Dated: January 23, 2024

25
26
JAMES DONATO
United States District Judge

27
28
8