Internet Jurisdiction 9/9/12 Internet Jurisdiction Michael I. Shamos, Ph.D., J.D. Institute for Software Research School of Computer Science Carnegie Mellon University LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Internet Personal Jurisdiction Personal jurisdiction is largely based on geography, physical location Acts, parties, physical presence in a state Acts causing damage or injury in the state BUT: the Internet does not respect geography Often can’t tell where someone is Can’t tell routing, cable location, optical fiber, servers, etc. Does it matter? LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

General vs. Special Jurisdiction Personal jurisdiction requires “minimum contacts” with the forum state If the case arose from those contacts, there may be special jurisdiction, that is, the power to hear that particular case. If the defendant has many contacts with the forum, there may be general jurisdiction, that is, the power to hear ANY case against the defendant, even if that case did NOT arise from the contacts. International Shoe is a special jurisdiction case. It had to pay tax to Washington because of its 12 employees in Washington. LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Internet Jurisdiction Issues Where does an Internet company “reside”? Where any of its servers is located? Where the domain is registered? Along the path where messages are routed to it? Where more than 3 employees work? Where its ISP is located? Where computers are located? Where orders are “taken”? Where orders are “filled”? Where goods are stored? What about information goods? Do any of these distinctions make sense? Do we need Internet courts? LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Zippo: Internet Jurisdiction Courts recognize three types of eCommerce activity Doing business over the Internet “the knowing and repeated transmission of computer files over the Internet” (Is that really “doing business”?) Personal jurisdiction proper Passively informational websites “little more than an electronic billboard for the posting of information” (Do any companies have these now?) No personal jurisdiction Gray area: defendant has a website that allows a user to exchange information with a host computer jurisdiction depends on nature of the information transmitted and degree of interaction. LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Zippo Case Zippo Manufacturing v. Zippo Dot Com Inc., 952 F.Supp. 1119 (W.D. Pa. 1997). Full text. Zippo Manufacturing is in Bradford, Pa. Makes Zippo lighters. NEW YORK PENNSYLVANIA LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Zippo Case Zippo.com is in Sunnyvale, California (Silicon Valley). Operated an Internet news service. Had 140,000 subscribers. About 3000 (2%) were in Pa. Subscribers only have password access to a bulletin board Zippo.com had contracts with 7 ISPs in Pa. Zippo Manufacturing sued Zippo.com for trademark infringement HELD, jurisdiction proper because of Pa. contacts “The middle ground is occupied by interactive Web sites where a user can exchange information with the host computer. In these cases, the exercise of jurisdiction is determined by examining the level of interactivity and commercial nature of the exchange of information that occurs on the Web site.” LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Zippo’s Future Zippo has been cited in more than 6000 court decisions. But the principles behind Zippo are now obsolete. Many courts follow Zippo, but now more and more don’t. LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Sioux Transportation, Inc. v. XPO Logistics, Inc. (W.D. Ark., Dec. 22, 2015) The “Bad Chicken Case” Sioux is a freight broker incorporated in Arkansas. It makes deals between manufacturers and shippers XPO Logistics is a trucking company incorporated in Delaware corporation with a principal place of business in Connecticut XPO paid Sioux to arrange shipment of frozen chickens from Alabama to Michigan Sioux hired Original Mamaz Boys as truckers When the chickens arrived in Michigan, their temperature was too high and the shipment was rejected. LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS The “Bad Chicken Case” XPO PRINCIPAL PLACE OF BUSINESS (CONNECTICUT) ROUTE OF THE CHICKENS SIOUX (INC. IN ARKANSAS) XPO (INC. IN DELAWARE) U.S. DISTRICT COURT W.D. ARKANSAS FAYETTEVILLE LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS The “Bad Chicken Case” XPOs insurance company, Travelers, paid for the chickens Travelers then tried to recover its money from Sioux During the dispute, an XPO employee posted defamatory material about Sioux on two websites, carrier411.com and tiawatchdog.com (“TIA” is the Transportation Intermediaries Association”) The posts accused Sioux of negligence Sioux filed a case in Arkansas state court for defamation and violating the Arkansas Deceptive Trade Practices Act XPO removed the case to Federal court LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS The “Bad Chicken Case” XPO says Arkansas has no personal jurisdiction. It is a Delaware corporation with a place of business in Connecticut The Arkansas long-arm statute says that personal jurisdiction extends “to the maximum extent permitted by the due process clause of the 14th amendment” Sioux asserted jurisdiction based on Zippo, that the websites posting the material were interactive XPO said Zippo determines jurisdiction over the operator of the website, not the people who post on it The Court would not apply the Zippo test LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS The “Bad Chicken Case” The Court had “difficulty in considering the Zippo test in the context of the modern internet. The internet has undergone tremendous change since Zippo was decided in 1997 … Cloud computing has eliminated the need for downloading files in many situations, location-based technology has made online interactions that formerly existed only in cyberspace more closely tied to specific geographic locations, and the level of user interaction with websites has exploded with social media. All of this calls into question the modern usefulness of the Zippo test's simplistic tri-parte framework: The transmission of computer files over the internet is perhaps no longer an accurate measurement of a website's contact to a forum state. The Court dismissed the case for lack of personal jurisdiction over XPO If Sioux wanted, it could sue XPO in Delaware or Connecticut It didn’t LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Best Odds v. iBus Media (D. Nev. 2014) Best Odds is a Nevada corporation that provides gambling news and information over the Internet iBus Media is an Isle of Man corporation that does the same thing Both use the trademark MacPoker Best Odds owns a U.S. trademark registration for “MacPoker” When no federal statute governs personal jurisdiction, a federal court applies the law of the forum state. LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Best Odds v. iBus Media (D. Nev. 2014) The iBus website can be viewed from Nevada The Ninth Circuit test for special jurisdiction: (1) Defendant must purposefully direct his activities to the forum; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum; AND (2) the claim must arise out of defendant’s forum-related activities; AND (3) jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable. “Nothing in the interactive features depicted in Plaintiff’s exhibits indicates that Defendants expressly targeted citizens of the United States, let alone Nevadans. In fact, one of the five screenshots shows only links to poker rooms that are ‘Not Accepting US Players’.” No purposeful direction, therefore no jurisdiction. Dismissed. LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Intercon Case Intercon, Inc. v. Bell Atlantic Internet Solutions, Inc., 205 F.3d 1244 (10th Cir., March 9, 2000). Full text. Intercon is an Oklahoma ISP (icon.net) Bell Atlantic Internet Solutions is a Delaware corp. offering dialup ISP service in the northeast US. No presence in Oklahoma Bell Atlantic mistakenly routed its email traffic to icon.net instead of to its subcontractor iconnet.net icon.net was choked with email, severely affecting its ISP service. Took 7 months for Bell Atlantic to correct the problem Intercon sued Bell Atlantic in Oklahoma HELD, jurisdiction proper because “defendant purposefully availed itself of the Oklahoma server for … months after being notified of the erroneous address” (District Court dismissed the case; Court of Appeals reversed.) LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Effect of Forum Selection Clauses Williams v. America OnLine, Inc., (2001 Mass. Super. No. 00- 0962) Software downloaded by AOL damaged Williams’ computer Williams consented to an online “Terms of Service” contract containing the clause: “You expressly agree that exclusive jurisdiction for any claim or dispute with AOL or relating in any way to your membership or your use of AOL resides in the court of Virginia and you further agree and expressly consent to the exercise of personal jurisdiction in the courts of Virginia in connection with any such dispute .…” Williams was already an AOL member; previously agreed to a Virginia forum selection clause Damage to computer occurred before Williams agreed to new contract. New contract governs, but forum selection clause is unenforceable! LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Wilson v. RIU Hotels (E.D. Pa., 2012) Rita Wilson lives in Pennsylvania RIU has headquarters in Mallorca, Spain RIU owns the RIU Palace Hotel in Cabo San Lucas, Mexico Wilson booked a room at the hotel on the Internet through the website of Apple Vacations, a Pennsylvania company Wilson was injured at the hotel and sued in Pennsylvania RIU APPLE VACATIONS WILSON HOTEL

Wilson v. RIU Hotels (E.D. Pa., 2012) The Court found it had subject matter jurisdiction. Amount in dispute > $75K Between citizen of a state and a citizen of a foreign state Personal jurisdiction RIU distributed brochures to a travel agency in PA RIU gave marketing materials to Apple Vacations, which operates in PA Both Apple Vacations and RIU websites can be accessed from PA Wilson claims RIU maintained “systematic and continuous contact” with PA LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Wilson v. RIU Hotels (E.D. Pa., 2012) The Court found: Wilson’s claim did not arise out of any PA contact Injury was in Mexico, unrelated to place of booking) RIU advertising was not specifically directed to PA (advertising nationally is not sufficient – otherwise a company would be subject to jurisdiction everywhere) Apple Vacations website is available everywhere, not just in PA HELD, no personal jurisdiction over RIU in Pennsylvania LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Burdick v. Superior Court of Orange County (Cal. App., Feb. 14, 2015) Burdick, a resident of Illinois, made a defamatory comment about John Sanderson on Burdick’s Facebook page (The actual comment is not relevant to jurisdiction.) Sanderson brought suit for libel in California CALIFORNIA ILLINOIS

Burdick v. Superior Court of Orange County Burdick had no contacts with California No residence, no office, no property No bank account, no licenses, no employees Burdick asserted lack of personal jurisdiction He asked the Court to quash the subpoena commanding him to appear Sanderson argued that Burdick’s posting had an “effect” against him in California The Superior Court (the lowest level of court in California) refused to dismiss the case California Supreme Court granted review and transferred the review to the Court of Appeals LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Burdick v. Superior Court of Orange County Sanderson sought specific (not general) jurisdiction The case arose from Burdick’s actions in California Appeals Court held: A foreign act with foreseeable effects in the forum state does not always confer specific jurisdiction The forum must be the “focal point” of the conduct There must be “express aiming” or “purposeful targeting” Burdick did not aim his comments at or target California The Superior Court was ordered to dismiss the case LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Bases of International Jurisdiction Territoriality principle regulate conduct within its territory Nationality principle regulate conduct of nationals, wherever they are Effects principle regulate conduct having effect in the state Universality principle jurisdiction over crimes that are universally condemned Protective principle jurisdiction over defendants who threaten security of a state LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS The iCraveTV Case CANADA • US TV stations broadcast from Buffalo • iCraveTV is a Canadian company owned Pennsylvania residents iCraveTV • Received US TV signals, stored them on a streaming RealServer in Canada RealServer • iCraveTV wrapped its own advertising around the images and served them to anyone visiting its website • iCraveTV registered the iCraveTV.com domain name in Pittsburgh iCraveTV.com • iCraveTV set up receivers in Toronto, Canada NY • TORONTO BUFFALO • • No iCraveTV servers in the US PA • iCraveTV was sued in Federal Court in Pittsburgh by TV networks, movie studios and sports leagues for copyright infringement PITTSBURGH • UNITED STATES • Do US courts have jurisdiction? LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Yahoo! Nazi Memorabilia Case The Penal Code of France, Sec. R645-1, makes it an offense “other than for the needs of a film; a show or an exhibit enjoying historical context, to wear or exhibit in public a uniform, an insignia or an emblem which evokes the uniforms, insignia or the emblems which were worn or exhibited [by Nazis]” Penalty: fines; higher for subsequent offenses confiscation of the object used to commit the infraction perform public service; prohibition against carrying firearms for 3 years Yahoo! auctions routinely offered Nazi items Yahoo! Inc. is a California corporation Yahoo! France is a joint venture between Yahoo! Inc. and Softbank, a UK corporation LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Yahoo! Nazi Memorabilia Case Yahoo! Inc. and Yahoo France were sued in France by LICRA (League Against Racism and Antisemitism) and UEJF (Union of French Jewish Students) to enforce R6456 Yahoo argued: Court had no jurisdiction over it Yahoo’s content is directed to US “internauts” Yahoo servers are in the US Any order against Yahoo could not be enforced in the US because of freedom of speech HELD, France has jurisdiction over Yahoo because violation of the Code was disruptive to public order visualization of Nazi objects causes grief in France Yahoo (US) offers French content to users in France LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Yahoo! Nazi Memorabilia Case Yahoo! initially obeyed the French order Dec. 2000 Yahoo filed a declaratory judgment action in California against LICRA and UEJF asserts jurisdiction on grounds that: LICRA, UEJF sent cease-and-desist letters into California LICRA, UEJF agreed to Yahoo’s “terms of service” LICRA, UEJF used the U.S. Marshal to serve process alleges: Yahoo cannot comply on technological grounds French order chills freedom of expression in the U.S. Online service providers are immunized by DMCA Feb. 2001 Yahoo announced it would no longer comply THESE ARGUMENTS SUCCEEDED LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Yahoo! Nazi Memorabilia Case Nov. 2001 California court decided that “the First Amendment precludes enforcement within the United States of a French order intended to regulate the content of its speech over the Internet.” 169 F. Supp. 2d 1181 (N.D. Cal. 2001) “What is at issue here is whether it is consistent with the Constitution and laws of the United States for another nation to regulate speech by a United States resident within the United States on the basis that such speech can be accessed by Internet users in that nation.” Appeal to the Ninth Circuit, which held that California had no jurisdiction over LICRA (no purposeful availment) so it reversed the District Court. The French decision stands but is not enforceable in the United States. LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Significance of Yahoo! Goes way beyond Nazi memorabilia Basic question: When acts performed in country A are legal in A but violate the laws of country B because of transmission over the Internet: Whose laws apply? Does B have jurisdiction? Should A act in aid of any judgment against its own citizen? LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Major Ideas Jurisdiction is largely territorial Territories make little sense on the Internet The Zippo test is still used, but is on the way out International jurisdiction is complicated by the interaction of different legal systems An Internet treaty may be required LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Q A & LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Butler v. Beer Across America Beer Across America (BAA): Illinois company selling beer over the Internet; no offices, assets or personnel in Alabama; never visited Alabama Butler and her son, a minor, live in Alabama. Son bought 12 bottles of beer for $24.95 from BAA by ordering over the Internet The Alabama Civil Damages Act provides for a civil action by the parent or guardian of a minor against “any person who unlawfully sells or furnishes spiritous liquors to such minor and may recover such damages as the jury may assess.” Butler brought suit against BAA in Alabama. (Why?) LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Butler v. Beer Across America FACT: BAA had sold beer to other Alabama residents FACT: BAA had bought beer from Alabama brewers. FACT: BAA had advertised nationally, but not specifically in Alabama HELD: no personal jurisdiction over BAA in Alabama. The website was an “electronic version of a postal reply card” Butler is not without remedy. Case was transferred to court in Illinois. Butler v. Beer Across America, 83 F.Supp. 2d 1261 (N.D. Ala. 2000) LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Soma v. Standard Chartered Bank Soma Medical International v. Standard Chartered Bank, 196 F.3d 1292 (10th Cir. 1999). Full text. Soma is a Delaware corporation doing business in Utah Standard Chartered Bank (SCB) is a UK bank with an office in Hong Kong (no presence in Utah) Soma had an account with SCB’s Hong Kong office SCB maintained a website accessible from Utah Defendant Fong submitted a forged signature card to SCB; then withdrew $250,000 from Soma’s account Soma sued SCB in Utah HELD, no jurisdiction in Utah since SCB had a “passive Web site that does little more than make information available to those who are interested” LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS Recent Internet Cases Boschetto v. Hansing, 539 F.3d 1011 (9th Cir. 2008). Boschetto in California bought a car on eBay from Hansing in Wisconsin The car did not conform to Hansing’s description. Boschetto sued in California HELD, NO JURISDICTION in California One sale not a sufficient contact LAW OF COMPUTER TECHNOLOGY FALL 2018 © 2018 MICHAEL I. SHAMOS

Attaway v. Omega (Ind. App. 2009) Llexcyiss Omega in Indiana sold a car on eBay to Attaway in Idaho Attaway paid through MasterCard Attaway hired CarHop USA, based in Washington, to pick up the car in Indiana and deliver it to Idaho Attaway claimed the car was not as described and recovered $5900 in damages from MasterCard By submitting a bid, the Attaways agreed to appear, in person or by representative, in Indiana to pick up the vehicle By sending an agent into Indiana, the Attaways “purposely availed” themselves of the privilege of conducting activities within Indiana. Jurisdiction was PROPER