Corallo v. NSO Group Technologies Limited

Background

Francesco Corallo alleged that NSO Group Technologies Limited and its sole shareholder, Q Cyber Technologies Limited, developed and distributed surveillance technology, including Pegasus spyware and the FORCEDENTRY exploit. He alleged that NSO used FORCEDENTRY to deploy Pegasus on Apple customers’ devices on behalf of governmental clients, including Italy and the Netherlands. Corallo alleged that the exploit allowed access to information from his Apple iPhone and iCloud account.

Corallo brought one set of claims against NSO and a separate set against Apple, Inc. NSO moved to dismiss for lack of personal jurisdiction, on forum non conveniens grounds—a request to dismiss because another country is a more appropriate place to litigate—and for failure to state a claim. Apple moved to dismiss for failure to state a claim. The court also noted that Corallo had been allowed jurisdictional discovery, but that process ended after the court determined he was unwilling or unable to focus on the material issues.

NSO: personal jurisdiction

The court granted NSO’s motion to dismiss for lack of personal jurisdiction. The court stated that NSO had no actual presence in California or elsewhere in the United States. Although Corallo alleged that NSO effectively hacked Apple servers in California, the court found that he could not show that NSO’s alleged conduct was expressly aimed at California or that NSO knew harm was likely to occur there.

The court acknowledged that Corallo had adequately alleged, at this stage, that NSO was involved in an intentional act. But it found his claim that NSO targeted California speculative and legally insufficient because the alleged conduct was directed at Apple, a third party whose decision to host servers in the United States was unrelated to the conduct alleged in the complaint. The court also stated that NSO had shown that exercising jurisdiction would not be reasonable, noting that Corallo was a foreign citizen suing foreign defendants over conduct initiated from foreign locations.

Because the court found that it lacked jurisdiction over NSO, it stated that it would not reach NSO’s alternative motion to dismiss for failure to state a claim.

NSO: more appropriate foreign forum

The court also granted NSO’s motion to dismiss on forum non conveniens grounds. It found no real dispute that Israel was an adequate alternative forum. For substantially the same reasons supporting the lack of personal jurisdiction, the court concluded that the relevant private and public factors favored dismissal on that ground.

Apple: failure to state a claim

The court granted Apple’s motion to dismiss for failure to state a claim. Corallo asserted negligence and false advertising claims based generally on allegations that Apple failed to protect his iPhone and iCloud data from the alleged hacking.

As to negligence, the court said Corallo had not connected his alleged non-economic damages to Apple’s conduct rather than NSO’s alleged conduct. The court also questioned whether Corallo could plead facts showing that Apple had a legal duty to prevent this type of hacking or breached such a duty. The court said an amended complaint would need specific facts showing that Apple failed to take reasonably prudent protective steps that could have prevented this type of attack and that a technology company in Apple’s position ordinarily would have taken those steps.

As to false advertising, the court said Apple’s statements about the security features and performance of its technology could not reasonably be understood as a guarantee that technologically sophisticated individuals or companies could never circumvent that security. Any amended complaint would need to identify specific false or misleading statements and facts explaining why they were false or misleading.

Disposition

Judge Richard Seeborg’s order granted NSO’s motion to dismiss for lack of personal jurisdiction and its motion to dismiss on forum non conveniens grounds. It also granted Apple’s motion to dismiss for failure to state a claim. The order allowed Corallo to file an amended complaint against Apple only within 20 days of the order, if he had a good-faith basis to do so. If he did not file one within that period, the case would be dismissed in its entirety without further notice. The case-management conference was continued to January 16, 2025. The court also granted the pending sealing motion.