Opinion
3:21-cv-09078-JD
01-23-2024
APPLE INC., Plaintiff, v. NSO GROUP TECHNOLOGIES LIMITED, et al., Defendants.
ORDER RE MOTION TO DISMISS AND FURTHER PROCEEDINGS
Plaintiff Apple Inc. (Apple) has sued defendants NSO Group Technologies Limited and Q Cyber Technologies Limited (together, NSO) for breach of contract, violations of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a), and the California Unfair Competition Law, Business and Professions Code § 1700 (UCL), and for unjust enrichment. Apple says that defendants are “notorious hackers” who created and distribute “Pegasus,” which is said to be malware that enables users “to remotely and covertly extract valuable intelligence from virtually any mobile device.” Dkt. No. 1 ¶¶ 2, 40. Apple alleges that defendants created fake Apple IDs used to access Apple's servers, and attacked Apple consumer devices through a hack called “FORCEDENTRY,” which “is known as a ‘zero-click' exploit, meaning that it allowed Defendants or their clients to hack into the victim's devices without any action or awareness by the victim.” Id. ¶¶ 49-51. Apple says it has incurred substantial losses and damages for recovery and prevention efforts in responding to NSO's conduct. The damages and losses are said to be ongoing because “Defendants are constantly updating their malware and exploits to overcome Apple's own security upgrades.” Id. ¶ 60.
NSO asks to dismiss the complaint under Federal Rules of Civil Procedure 12(b)(6) and 12(b)(7). Dkt. No. 48. NSO says that the case as a whole should be dismissed under the doctrine of forum non conveniens because defendants are based in Israel and Apple should have sued them there. NSO also contends that the CFAA, UCL, and unjust enrichment claims were not plausibly alleged, and that Apple did not join necessary parties under Rule 19, namely “NSO's foreign-government customers,” id. at 8, who are said to have used NSO's products for “transnational repression” of dissidents and others, Dkt. No. 1 ¶ 3. The parties' familiarity with the record is assumed, and dismissal is denied in all respects.
In the caption of a reply brief, NSO added a reference to Rule 12(b)(1) and (b)(3) as purported grounds for dismissal. Dkt. No. 51. NSO's opening brief made no mention of these provisions, and the reply also did not discuss them in any way. NSO did not present any arguments under Rule 12(b)(1) or (b)(3) in an appropriate manner, and certainly cannot raise them for the first time in a reply brief. Standing Order for Civil Cases ¶ 15; see also Friends of Del Norte v. California Dep't of Transportation, No. 18-CV-00129-JD, 2023 WL 2351649, at *5 (N.D. Cal. Mar. 3, 2023).
I. FORUM NON CONVENIENS
The parties agree that defendants are based in Israel. In NSO's view, this means that an Israeli court is a more appropriate and convenient forum for hearing Apple's claims, and that the case should be terminated here on the ground of forum non conveniens. NSO did not challenge personal jurisdiction in this District.
The doctrine of forum non conveniens is “a supervening venue provision” that permits the Court to decline jurisdiction when circumstances indicate that an alternative forum abroad would be a better location for the litigation. Sinochem Int'l Co., Ltd. v. Malaysia Int'l Shipping Corp., 549 U.S. 422, 429-30 (2007) (internal citation omitted). The Court may dismiss a case under the doctrine “when an alternative forum has jurisdiction to hear [the] case, and . . . trial in the chosen forum would establish . . . oppressiveness and vexation to a defendant . . . out of all proportion to plaintiff's convenience, or . . . the chosen forum [is] inappropriate because of considerations affecting the court's own administrative and legal problems.” Id. at 429 (quoting American Dredging Co. v. Miller, 510 U.S. 443, 447-48 (1994) (quoting in turn Piper Aircraft v. Reyno, 454 U.S. 235, 241 (1981) and Koster v. (American) Lumbermens Mut. Casualty Co., 330 U.S. 518, 524 (1947))) (ellipses in original). “A defendant invoking forum non conveniens ordinarily bears a heavy burden in opposing plaintiff's chosen forum.” Id. at 430. Forum non conveniens “is a nonmerits ground for dismissal.” Id. at 431 (internal citation omitted). Application of the doctrine is entrusted to the Court's sound discretion. American Dredging, 510 U.S. at 455; see also Loya v. Starwood Hotels & Resorts Worldwide, Inc., 583 F.3d 656, 663-64 (9th Cir. 2009) (same).
“A party moving to dismiss on grounds of forum non conveniens must show two things: (1) the existence of an adequate alternative forum, and (2) that the balance of private and public interest factors favor dismissal.” Loya, 583 F.3d at 664 (internal citation omitted). As our circuit has stated, the private interest factors “include (1) relative ease of access to sources of proof; (2) the availability of compulsory process for attendance of hostile witnesses, and cost of obtaining attendance of willing witnesses; (3) possibility of viewing subject premises; (4) all other factors that render trial of the case expeditious and inexpensive.” Id. (internal citation omitted). The public interest factors include “(1) administrative difficulties flowing from court congestion; (2) imposition of jury duty on the people of a community that has no relation to the litigation; (3) local interest in having localized controversies decided at home; (4) the interest in having a diversity case tried in a forum familiar with the law that governs the action; (5) the avoidance of unnecessary problems in the conflict of laws.” Id. (internal citation omitted). See also Lueck v. Sundstrand Corp., 236 F.3d 1137, 1145-47 (9th Cir. 2001) (listing similar factors).
The parties agree that an Israeli court is a potential alternative forum, which the Court will accept for present purposes. Consequently, the fight is about the balance of the private and public considerations. Not all of these factors are present in every case, and that is the situation here. The parties did not address each and every factor because some of them are not applicable, and the Court will follow suit.
For the factors that the parties debate, NSO has not demonstrated that the circumstances of this lawsuit overcome the “great deference” due to a plaintiff who has sued in its home forum, as Apple has done here. Loya, 583 F.3d at 664 (“convenience by a party who has sued in his home forum will usually outweigh the inconvenience that defendant may have shown”) (internal citation omitted). For the private interest factors, NSO focuses primarily on witness and evidence concerns. See Dkt. No. 48 at 4-7. These factors are a wash. NSO's ostensible burdens with respect to witnesses and evidence in this District are neatly balanced by equivalent burdens Apple would face if this case were litigated in Israel. Witnesses and evidence are likely to be located in here and abroad in fairly equal measure, and one side or the other will face some challenges. NSO has not demonstrated otherwise. NSO also overlooks the fact that the challenges will be amenable to a number of mitigating practices. For example, current discovery practices such as the production of documents in electronic form and the use of remote video depositions and similar techniques will contribute substantially to reducing burdens on each side. The Court has handled a number of cases, including multi-district litigation matters, that involved witnesses and evidence located far outside of the United States, sometimes exclusively so, without undue difficulties or unfair burdens on a party. NSO has not shown that this case will be different. With respect to a final judgment, it may be, as NSO suggests in a reply brief, Dkt. No. 51 at 4, that enforcement of a United States judgement is not “automatic” in Israel, but that is a far cry from saying it would be so problematic as to warrant dismissal of this case.
So too for the public interest factors that NSO discusses. See Dkt. No. 48 at 7-8. There is no question that the Court's familiarity with the claims Apple alleges under United States federal law and California state law exceeds that of any court in Israel, which greatly enhances the fair and efficient disposition of the case. The local interest and relation of this case to this District and potential jurors are equally self-evident. The gravamen of the complaint is that Apple servers and devices have been hacked here, and that Apple is engaged here in a costly, ongoing defense against NSO. Although it is certainly true that Apple's claims will be subject to proof down the road, these allegations amply demonstrate local interest.
Overall, NSO has not met its heavy burden of demonstrating that the circumstances of this litigation warrant dismissal on forum non conveniens grounds. Other courts in this District have reached the same conclusion in similar cases. See WhatsApp Inc. v. NSO Grp. Techs. Ltd., Case No. 19-cv-07123-PJH, 2023 WL 7726411 (N.D. Cal. Nov. 15, 2023).
NSO's supplemental briefing does not point to a different outcome. The Court departed from its usual practice to allow NSO to file a supplemental brief for the motion to dismiss, which NSO used as an opportunity to make arguments that could and should have been made in its opening brief, and that involve purported facts that were available in many instances before that brief was filed. Dkt. No. 74. The gist of the supplemental brief is that legal developments in Israel could complicate discovery. The key word is “could” because discovery has not started in this litigation, and it is entirely speculative for NSO to say that an Israeli court or Israeli law would necessarily stymie discovery to NSO's disadvantage in this case. Apple's reply to the supplemental brief adduced a number of facts indicating that discovery may be considerably less burdensome than NSO suggests, particularly with the use of protective orders and judicial oversight here and abroad. See Dkt. No. 75 at 3-4. Apple also indicated that Israeli courts have not unduly burdened discovery in similar cases against NSO in this District, see id. at 5-6, and that NSO concerns are again a wash in terms of balancing the forum non conveniens factors because they may be in play irrespective of whether discovery is done in this case or in Israel, id. at 8. The Court need not formally decide these facts in advance of the start of discovery, but Apple's presentation makes clear there is at least a serious question about NSO's parade of discovery horribles. The parties are perfectly free to bring any discovery issue to the Court if developments establish a substantial impediment or hardship for either side.
This docket entry and Dkt. No. 75, Apple's reply to NSO's supplemental brief, refer to the redacted versions currently available to the public. The unredacted versions were filed under seal and are subject to a sealing request that the Court will decide separately.
As a closing observation, the Court notes that Apple raised a forum selection clause in its iCloud terms of service that provides “for mandatory and exclusive jurisdiction here,” in Apple's view. Dkt. No. 50 at 3. A valid “forum-selection clause [must] be ‘given controlling weight in all but the most exceptional cases.'” Atlantic Marine Const. Co. v. U.S. Dist. Ct. for the Western Dist. of Texas, 571 U.S. 49, 61 (2013) (quoting Stewart Org., Inc. v. Ricoh Corp., 487 U.S. 22, 33 (1988) (Kennedy, J., concurring)). Forum selection clauses between international parties are “prima facie valid and should not be set aside unless the party challenging enforcement of such a provision can show it is ‘unreasonable under the circumstances.'” Argueta v. Banco Mexicano, S.A., 87 F.3d 320, 325 (9th Cir. 1996) (citing Bremen v. Zapata Off-Shore Co., 407 U.S. 1, 10 (1972)). A forum selection clause may be raised in the context of forum non conveniens. Atlantic Marine, 571 U.S. at 60-61.
The Court declines to take up the question of the forum selection clause at this time. Apple alleges “on information and belief” that NSO created Apple IDs and so accepted the iCloud terms of service. See Dkt. No. 1 ¶ 22. NSO did not expressly agree that this is so. Apple's complaint is sufficient to state a claim for breach of contract, and NSO did not suggest otherwise. But for purposes of forum non conveniens, the questions of NSO's acceptance of the iCloud terms of service, and the nature and scope of its forum selection clause, entail disputed issues of fact that cannot be resolved on the current record. Apple may raise the forum selection issue again as circumstances and discovery warrant.
II. RULE 19
In a rather cursory manner, NSO faults Apple for not naming as defendants all of NSO's customers as indispensable parties under Rule 19. Dkt. No. 48 at 8-9. In NSO's view, Apple's prayer for an injunction in the complaint necessarily reaches information harvested by NSO's customers, and so the Court cannot award complete relief in their absence. Id.
The point is not well taken. NSO puts far too much weight on a cursory and boilerplate prayer for relief in the complaint. It is not at all clear from the prayer that Apple is seeking anything other than relief against NSO for its own conduct and actions with respect to Apple's servers and users' devices. It is certainly not the case that the prayer necessarily demands the presence of NSO's customers. The scope and terms of an injunction, if any, will be determined in light of the claims Apple might win, and the record as a whole at the end of the case. All of that is unknown as of now. In addition, Rule 19 expressly contemplates “shaping the relief” and using “other measures” to avoid undue complications should concerns arise along the lines NSO suggests. Fed.R.Civ.P. 19(b)(2)(B) and (C). A mere prayer for an injunction of undefined scope and content is not enough to declare NSO's customers to be essential parties.
III. CFAA, UCL, UNJUST ENRICHMENT
The CFAA authorizes civil suits by plaintiffs who suffer “damage or loss” resulting from access to a “protected computer” that is forbidden by the statute. 18 U.S.C. § 1030(g). The CFAA is “‘aimed at preventing the typical consequences of hacking'” and covers damages and losses arising from the “technological harms” that hackers cause by making unauthorized access to computer systems and data. Van Buren v. United States, 141 S.Ct. 1648, 1660 (2021) (quoting Royal Truck & Trailer Sales & Serv. Inc. v. Kraft, 974 F.3d 756, 760 (6th Cir. 2020)); see also Andrews v. Sirius XM Radio, Inc., 932 F.3d 1253, 1263 (9th Cir. 2019) (“CFAA is an anti-hacking statute”) (internal quotation omitted).
The anti-hacking purpose of the CFAA fits Apple's allegations to a T, and NSO has not shown otherwise. NSO initially objected that “the only ‘protected computers' the complaint identifies” are Apple's user's devices, which Apple does not own and could not sue on. Dkt. No. 48 at 10. NSO subsequently acknowledged, albeit somewhat obliquely, that this is not so. See Dkt. No. 51 at 6 (citing Theofel v. Farey-Jones, 359 F.3d 1066, 1078 (9th Cir. 2004)). The complaint also makes clear that Apple alleges that NSO exploited Apple's own servers and services to place Pegasus on user devices. See, e.g., Dkt. No. 1 ¶¶ 51, 67-68, 74-76.
NSO objects that Apple has not sustained damages or losses within the purview of the CFAA. Dkt. Nos. 48 at 10-12. Also not so. The statute permits a private right of action when a party has suffered a loss of at least $5,000 during a one-year period. 18 U.S.C. § 1030(c)(4)(A)(i)(I). A “loss” is “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” Id. § 1030(e)(11); see also Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1066 (9th Cir. 2016). That is precisely the loss Apple has alleged here. See Dkt. No. 1 ¶ 57 (Apple was forced “to incur costs and to devote personnel, resources, and time to identifying and investigating [NSO's] attacks and exploits, developing and deploying security patches and software upgrades; communicating with Apple personnel and users regarding such attacks, exploits, patches, and upgrades, increasing security measures to detect and prevent future attacks; and assessing and responding to legal exposure.”); id. ¶ 72 (loss exceeds $5,000 in one year). NSO's passing suggestion that Apple incurred these costs in connection with the iOS operating system and not a computer, Dkt. No. 48 at 11, does not diminish the CFAA claim. Apple alleges that it retains ownership of the operating system on all devices, Dkt. No. 1 ¶ 70, and the definition of “loss” expressly includes the cost of investigating and restoring a “program” or “system.” To be clear, NSO is not barred from raising a defense with respect to a “protected computer” as the developed record warrants, but Apple has said enough in the complaint to plausibly allege a CFAA claim for purposes of Rule 12(b)(6).
With respect to Apple's claim under the unlawful prong of the UCL, NSO has not shown that the application of the UCL will necessarily extend to conduct occurring outside of California. Whether and to what extent extraterritoriality might come into play remains to be seen as the record and facts are developed. Consequently, the claim will not be dismissed at this time. NSO may revisit the issue as developments in the case warrant.
For the unjust enrichment claim, Apple expressly alleged it in the alternative to the breach of contract claim. That is enough to maintain the claim at this stage of the case. See Astiana v. Hain Celestial Grp., Inc.,783 F.3d 753, 762 (9th Cir. 2015) (permitting unjust enrichment claim as a quasi-contract claim); Lundy v. Facebook Inc., No. 18-CV-06793-JD, 2021 WL 4503071, at *2 (N.D. Cal. Sept. 30, 2021). Whether and to what extent there is a question of equitable restitution versus legal damages is better left for a fully developed record. At this time, the Court cannot say that both measures are the same or overlapping, and so dismissal on that ground, as NSO urges, is denied.
CONCLUSION
NSO's motion to dismiss is denied in all respects. As next steps, NSO will answer Apple's complaint by February 14, 2024. A case management conference is set for April 4, 2024, at 10:00 a.m.
IT IS SO ORDERED.