Corallo v. NSO Group Technologies Limited

Background

Francesco Corallo alleged that NSO Group Technologies Limited and its sole shareholder, Q Cyber Technologies Limited, developed and distributed surveillance technology, including Pegasus software and the FORCEDENTRY security exploit. Corallo alleged that NSO used FORCEDENTRY to deploy Pegasus on Apple customers' devices for governmental clients, including Italy and the Netherlands. He alleged that Apple notified him that his iPhone and iCloud data had been compromised.

The opinion states that Corallo was a native of Italy, a naturalized citizen of the Netherlands, and resided in Sint Maarten at the time of the alleged events. NSO and Q Cyber Technologies were described as Israeli companies.

Pending motions and possible briefing

NSO moved to dismiss for lack of personal jurisdiction, meaning that NSO argued this court lacked sufficient authority over it; under the doctrine of forum non conveniens, meaning that another forum would be more appropriate; and for failure to state a claim. Apple separately moved to dismiss for failure to state a claim.

The court found that Corallo had not made a compelling showing that an earlier case involving NSO supported specific personal jurisdiction here, particularly because Corallo was not a California resident and few of the earlier case's considerations applied. The court also stated that, even if specific personal jurisdiction existed, forum non conveniens might support dismissal. The court did not decide either NSO's or Apple's dismissal motion in this order.

If the court in the earlier related proceeding issued an order by December 29, 2023, dismissing that case on forum non conveniens grounds, Corallo could file a supplemental brief within ten days. The brief could address why this case should not likewise be dismissed and could include further arguments about personal jurisdiction. NSO could respond within one week, after which the matter would be submitted for decision without further briefing or argument unless the court ordered otherwise. If no such ruling issued, the court said it would issue a further order about any additional briefing.

Ruling and case schedule

Judge Richard Seeborg granted Corallo's retroactive motion for leave to exceed the page limit for his reply brief, while stating that the court did not condone the filing practice or imply that the extra pages were necessary. The court continued the initial Case Management Conference to January 25, 2024, with a joint statement due one week before the conference. The motion to dismiss filed by Apple remained submitted. This order did not resolve the parties' underlying claims or the pending dismissal motions.