The Email Hack, the "Stolen Domain Names" and Personal Jurisdiction

This post examines a relatively brief opinion ithat was recently ssued by a U.S. District Court Judge who sits in the U.S. District Court for the District of Arizona:  Wu v. BDK DSD, et al., 2016 WL 1059534. The first paragraph of the Complaint Yao Wu filed to initiate the lawsuit states that

Plaintiff brings this action pursuant to 18 U.S. Code § 2510 et seq., 18 U.S.C. § 2701 et seq., and state and federal common law for Defendant’s willful and unlawful access, interception, monitoring and viewing of Plaintiff’s electronic and stored electronic communications without his consent or authorization. Upon information and belief, Defendants illegally gained entry to Plaintiff’s email account and used or removed documents stored on his personal computer by using various methods, including, but not limited to, key loggers and other computer programs designed to enable remote access to, unmask passwords contained on someone else’s computer without leaving a trace. 

Armed with Plaintiff’s personal information, Defendants stole the domain names . . from his account (accessible via his email) with his domain name registrar, eNom, and transferred it to Defendants’ domain name registrar, GoDaddy, in Arizona.

Complaint, Wu v. BDK DSD, et al., supra.

The Complaint goes on to outline factual allegations that, if proven, would support the plaintiff’s (Wu’s) claims against the defendants.  Complaint, Wu v. BDK DSD, et al., supra.  Among other things, the Complaint seeks a judgment that would “[a]ward Plaintiff compensatory damages according to proof at trial but in an amount not less than $100,000.00”.  Prayer for Relief Complaint, Wu v. BDK DSD, et al., supra. 

It also asks that, as part of the judgment, the District Court Judge

[e]nter a temporary and permanent order, pursuant to 18 U.S. Code § 2515 and 18 U.S. Code § 2707(b), enjoining Defendants from directly or indirectly using or disclosing any information contained within any of Plaintiff’s electronic communications, documents attached to any such electronic communication that Defendants may have received, and documents stored on Plaintiff’s personal computers. . . .

Complaint - Prayer for Relief, Wu v. BDK DSD, et al., supra. 

The Complaint was filed with the District Court on September 22, 2015 and initiated Civil Case 2:15-cv-01898-DLR.  Wu v. BDK DSD, et al., supra.

According to the opinion, on February 26, 2016, the District Court Judge who has the case

ordered that Plaintiff show cause why the case should not be dismissed for lack of jurisdiction and venue. (Doc. 18.) In the Order, the Court doubted whether it has personal jurisdiction over Defendant, who has no connection with Arizona, based solely on Defendant's alleged agreement to non-party GoDaddy.com, LLC's terms and conditions of service. The terms and conditions contain an Arizona forum selection clause, which Plaintiff claims subjects Defendant to personal jurisdiction in this forum.

Wu v. BDK DSD, et al., supra. 

The opinion went on to note that

Plaintiff brought suit against Defendant BDK DSD for allegedly hacking into his email accounts and stealing numerous domain names. (Doc. 1, ¶ 1.) Because Defendant's name, address, and country of origin are unknown, the Court permitted service by email. (Doc. 11.)

Plaintiff served Defendant via email, and moved for default judgment after Defendant failed to respond. (Docs. 12, 17.) The Court denied the motion, citing concerns with exercising personal jurisdiction over an unknown Defendant with no connection to Arizona, and ordered Plaintiff to file a supplemental brief addressing the issue. (Doc. 18).

Wu v. BDK DSD, et al., supra.  In a footnote to the above paragraph, the opinion notes that “BDK DSD's listed country of residence appears to be China.” Wu v. BDK DSD, et al., supra. 

The reference to “service by email” in the above paragraph goes to the need, in U.S. civil litigation, for the party who brings the suit (plaintiff) to “serve” the party or parties that are being sued (defendant(s)) with notice that the suit has been filed and with documents that apprise the defendant(s) of what it involves.  

Wikipedia’s entry on “Service of Process” explains what is involved and lists the various options plaintiffs have in effecting service of process, e.g., personal service by an individual engaged to do this or service by mail.  Rule 5(b)(2)(E) of the Federal Rules of Civil Procedure, which you can find here, allows sending service “by electronic means” under certain circumstances.

And, as Wikipedia explains, in civil litigation a default judgment

is a binding judgment in favor of either party based on some failure to take action by the other party. Most often, it is a judgment in favor of a plaintiff when the defendant has not responded to a summons or has failed to appear before a court of law. The failure to take action is the default. The default judgment is the relief requested in the party's original petition.

Default can be compared to a forfeit victory in sports. In a civil trial involving damages, a default judgment will enter the amount of damages pleaded in the original complaint. If proof of damages is required, the court may schedule another hearing on that issue. A party can have a default judgment vacated, or set aside, by filing a motion, after the judgment is entered, by showing of a proper excuse.

Getting back to the opinion, the District Court Judge went on to explain that a court can

exercise personal jurisdiction only when the defendant has sufficient `minimum contacts’ with the forum state `such that jurisdiction does not offend traditional notions of fair play and substantial justice.’ International Shoe Co. v. Washington, 326 U.S. 310 (1945). . . . The minimum contacts requirement may be satisfied by establishing either general or specific jurisdiction. See Helicopteros Nacionales de Columbia, S.A. v. Hall, 466 U.S. 408, 414 (1984).

Here, Plaintiff only argues the Court may exercise specific personal jurisdiction over Defendant.

To establish specific personal jurisdiction, a plaintiff must show: (1) the nonresident defendant purposefully directed his activities at the forum, (2) the claim arises out of the defendant's forum-related activities, and (3) the exercise of jurisdiction is reasonable. See Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 (U.S. Court of Appeals for the 9th Circuit 2004). “The inquiry whether a forum State may assert specific jurisdiction over a nonresident defendant focuses on the relationship among the defendant, the forum, and the litigation.” Walden v. Fiore, 134 S. Ct. 1115, 1121 (2014) (internal quotation marks omitted). 

Furthermore, `[f]or a State to exercise jurisdiction consistent with due process, the defendant's suit-related conduct must create a substantial connection with the forum State.’ Walden v. Fiore, supra. (emphasis added).

Wu v. BDK DSD, et al., supra. 

The District Court Judge went on to point out that the

Plaintiff argues that Defendant `entered into contracts with Arizona-based GoDaddy concerning the stolen domain names at issue.’ (Doc. 19 at 1.) By stealing the domain names, Plaintiff asserts Defendant `agreed to be subject to personal jurisdiction for disputes concerning the registration and use of these stolen domain names’ in Arizona. (Id.at 2 (emphasis in original).) The Court disagrees.

Wu v. BDK DSD, et al., supra. 

The judge went on to explain that the

only connection Defendant is alleged to have with Arizona is based on GoDaddy's terms and conditions, which contain a forum selection clause. The clause provides:

`any action relating to or arising out of this Agreement shall be brought in the state or federal courts of Maricopa County, Arizona, and you hereby consent to (and waive all defenses of lack of personal jurisdiction and forum non conveniens with respect to) jurisdiction and venue in the state and federal courts of Maricopa County, Arizona.’

(Doc. 20-1 at 25.) Under general contract principles, a forum selection clause may give rise to waiver of objections to personal jurisdiction, provided that the defendant agrees to be so bound[.]” Holland Am. Line Inc. v. Wartsila N.A., Inc., 485 F.3d 450, 458 (U.S. Court of Appeals for the 9th Circuit 2007) (internal citations omitted).

Plaintiff relies on Productive People, LLC v. Ives Design, No. CV-09-1080-PHX-GMS, 2009 WL 1749751 (U.S. District Court for the District of Arizona June 18, 2009), to support his argument that the Court has personal jurisdiction over Defendant based solely on the forum selection clause. In that case, the plaintiff brought suit in Arizona against Ives Design, a Colorado company, for trademark infringement arising out of its use of the plaintiff's `NAMEDROP’ mark by operating `namedrop.com.’ Id. at *1.

The plaintiff also named GoDaddy.com as a defendant because it served as the host for the domain name. Id. Ives Design argued that the court lacked personal jurisdiction over it because it had no contacts with Arizona. Id. But the court did not decide whether Ives Design had sufficient contacts with the forum for purposes of specific personal jurisdiction. Id. 

Instead, the court resolved the jurisdictional question based on Ives Design's undisputed agreement to GoDaddy's terms of service agreement when it purchased the domain name from GoDaddy. Id. The terms of service agreement contained an Arizona forum selection clause, which the court found sufficient to create personal jurisdiction over Ives Design. Id. at *2.

Wu v. BDK DSD, et al., supra (emphasis in the original).

The judge then explained that the decision in

Productive People is distinguishable from this case. There, it was undisputed that Ives Design agreed to be bound by the forum selection clause, especially given that it directly contracted with GoDaddy to purchase the domain. In other words, Ives Design chose to contract away its right to raise certain defenses. 

Here, GoDaddy is not a party, and Defendant did not contract with GoDaddy to purchase the domain names. Defendant stole them. Though certainly illegal, such conduct hardly represents an agreement to be bound by the forum selection clause. Nor does it suggest Defendant contracted away the right to assert the defense. 

Much like contract formation, personal jurisdiction based on a forum selection clause is grounded on some form of consent, see S.E.C. v. Ross, 504 F.3d 1130, 1149 (U.S. Court of Appeals for the 9^th Circuit 2007) (`the parties may consent to jurisdiction through a forum selection clause in a contract’), but the Court finds no consent here. 

Thus, the Court cannot exercise personal jurisdiction over a nonresident Defendant based on a provision in a contract to which Defendant is not a party.

Wu v. BDK DSD, et al., supra. 

He also pointed out that,

[i]n addition, the Court finds that it lacks specific personal jurisdiction over Defendant. Defendant has no contact with Arizona and did not cause harm in Arizona. If anything, Defendant directed his illegal activities at California, the location of Plaintiff's residence, and presumably, his home computer containing the emails and information related to the domain names.

Certainly, Defendant's `suit-related conduct,’ i.e., hacking into Plaintiff's computer files and stealing several domain names, does not create a `substantial connection’ with Arizona sufficient to create specific jurisdiction. See den v. Fiore, supra. Plaintiff has failed to demonstrate that this Court's exercise of personal jurisdiction over Defendant would be consistent with due process, and has therefore failed to show cause to avoid dismissal.

Wu v. BDK DSD, et al., supra. 

The District Court Judge therefore held that

IT IS ORDERED that Plaintiff's motion for default judgment . . . is DENIED. Plaintiff has not shown cause in accordance with the Court's February 26, 2016 Order . . . and thus Plaintiff's complaint is dismissed. The Clerk is directed to terminate this action.

Wu v. BDK DSD, et al., supra (emphasis in the original). 
(I'm posting this today because I'm going to be tied up all day Monday and wouldn't  be able to post it then.)