Blog

Where Can I Sue An App?

Written by Michael S. Dorsi

Smartphone applications, or apps, control an increasing share of internet traffic, and also an increasing share of litigation. Disputes about apps range from copyright infringement to contract disputes. But unlike car accidents or real estate disputes, there is no physical place where the wrongdoing happened. So where to sue? Where is the App Store? California?

The Rules of Jurisdiction

A person may only be sued either where the person is, or where the person may reasonably be called into court.[1] In the case of disputes concerning a specific product or service, the court will need to be satisfied that:

  1. The defendant has purposefully directed activities at the forum state,
  2. The plaintiff’s claim arises out of or relates to those activities, and
  3. The assertion of personal jurisdiction is reasonable and fair.[2]

What About The Internet?

The expanded use of the internet in the mid-1990s forced courts to examine this test in a new light. Concerning the first part of the test — purposeful direction — a federal court in Pennsylvania set out the rule, known as the Zippo test, that has been adopted in most of the country: websites fall along a sliding scale, with websites that engaged in commercial interactions at end of the scale toward finding jurisdiction, and websites that did not interact with their users at all, just showing a page, at the other.[3] Many other courts adopted the sliding scale from Zippo.[4]

Are Apps Like Websites?

Courts have not yet clearly stated whether Apps will be treated like websites. Two cases show potentially different outcomes with Apps based on being filed in different districts. In Intercarrier Communs. LLC v. WhatsApp Inc.,[5] a federal court in Virginia found that customers using WhatsApp — an instant messenger application — was insufficient to find jurisdiction. Of note, WhatsApp users did not make purchases through WhatsApp, but paid third parties such as Apple and those third parties delivered the app to the user’s phone.

But in Zherebko v. Reutskyy,[6] a federal court in California concluded that an interactive app — in that case a game that sold hints to players — satisfied the first part of the personal jurisdiction test because, under the sliding scale from Zippo, the app was commercially interactive.

The court also found that the second part — the relation to activities in the forum state — was satisfied because according to Apple’s terms and conditions, title to the app transfers electronically through Apple in California.

Although the court concluded that the case did not satisfy the third part of the test — jurisdiction was not reasonable because none of the parties were from California — the court’s analysis indicated that California will be an one of the best places bring cases about iPhone apps, and future courts may reach a similar conclusion about Android apps. In effect, a plaintiff suing about a smartphone app may only need to prove the third part of the test in order to establish jurisdiction in California.

[1] See International Shoe Co. v. Washington, 326 U.S. 310, 320 (1945).

[2] See Burger King Corp. v. Rudzewicz, 471 U.S. 462, 472-77 (1985).

[3] See Zippo Mfg. Co. v. Zippo Dot Com, Inc., 952 F. Supp. 1119 (W.D. Pa. 1997).

[4] See Cybersell, Inc. v. Cybersell, Inc., 130 F.3d 414, 419 (9th Cir. 1997).

[5] Intercarrier Communs. LLC v. WhatsApp Inc., 2013 U.S. Dist. LEXIS 131318 (E.D. Va. Sept. 12, 2013), available at https://casetext.com/case/intercarrier-commcns-llc-v-whatsapp-inc.

[6] Zherebko v. Reutskyy, 2013 U.S. Dist. LEXIS 113493 (N.D. Cal. Aug. 12, 2013), available at https://cases.justia.com/federal/district-courts/california/candce/3:2013cv00843/263828/31/0.pdf?ts=1377209210.

I’ve Been Hacked. Have I Been Damaged?

Pleading computer fraud damages

Written by Keenan W. Ng

Plaintiffs seem to have difficulty pleading damages related to computer fraud violations, including the Computer Fraud and Abuse Act (18 U.S.C. §1030), the Stored Communications Act (18 U.S.C. § 2701), the Electronic Communications Privacy Act (18 U.S.C. § 2501), and the California Computer Data Access and Fraud Act (Cal. Penal Code § 502). While litigants simply seem confused as to what they are allowed to ask for, pleading damages is a fairly straightforward process as most courts interpret the requisite sections by their plain meaning.

Computer Fraud and Abuse Act

The CFAA does not allow for traditional compensatory damages. Rather, the statute allows for the recovery of loss and damage as defined by the statute.

Read More >

Ellen Pao v. Kleiner Perkins: The Defense Risked a Split Verdict

Written by Michael Dorsi

As this post goes up, the jury in Ellen Pao v. Kleiner, Perkins, Caufield & Byers has been sent back to deliberate on the fourth claim — that Ellen Pao was fired in retaliation for her bringing this lawsuit.

The case has been closely watched for the scrutiny of the culture of Kleiner Perkins, venture capital, and Silicon Valley, which Ms. Pao’s attorneys characterized as a boy’s club. In the end, only two of the twelve jurors agreed with Ms. Pao’s case concerning gender discrimination, but two more found that Ms. Pao was the victim of retaliation.

While watching Kleiner Perkins’ attorney Lynne Hermle give her closing argument, I suspected that there could be a split verdict, finding Kleiner Perkins liable only for retaliation, not for gender discrimination.

What did not cross my mind in the audience was that the jury might end up without a sufficient majority on the fourth claim, or more bizarre result today: that the jury thought they had enough votes, but counted wrong.

Kleiner Perkins Story of Ellen Pao in Performance Reviews

Read More >

Opinion Roundup: California District Courts and the Computer Fraud and Abuse Act, July 2014 through February 2015 – Part Two

Author: Scripta Ad Astra Staff

This is the second part of a two part-series on federal district court opinions in California regarding the CFAA. The first part of this series can be found here.

NetApp, Inc. v. Nimble Storage, Inc., 2015 U.S. Dist. LEXIS 11406 (N.D. Cal. January 29, 2015)(“NetApp II”)

Judge: Lucy H. Koh, United States District Judge

Read More >

Opinion Roundup: California District Courts and the Computer Fraud and Abuse Act, July 2014 through February 2015 – Part One

Author: Scripta Ad Astra Staff

This week, we will have a two-part series on all of the substantive California district court Computer Fraud and Abuse Act opinions from July 2014 through February 2015. These posts are a follow up to a three – part series I wrote last summer discussing CFAA opinions from January 2014 through June 2014.

I decided to include some 2015 opinions in this Round Up because (1) there were not that many substantive opinions in the latter half of 2014 and (2) because I was a bit tardy on getting this post up – I figured I would bring you up to speed.

The next post will be on Friday, March 20. I hope you check it out!

Sprint Solutions, Inc. v. Pacific Cellupage Inc., 2014 U.S. Dist. LEXIS 101397 (C.D. Cal. July 21, 2014)

Judge: Christina A. Snyder, United States District Judge.

Read More >

NovelPoster Files Amicus Brief in United States v. Nosal

Written by Michael S. Dorsi

San Francisco-based NovelPoster, having settled its Computer Fraud and Abuse Act (“CFAA”) claim against Javitch Canfield Group, filed a brief as amicus curiae in the Ninth Circuit Court of Appeals case of United States v. Nosal (9th Cir. Case Nos. 14-10037 and 14-10275).

While the NovelPoster and Nosal cases originated differently — NovelPoster was a civil action and Nosal is a criminal prosecution — both cases touched on an important question: is a person liable under the Computer Fraud and Abuse Act for acting without authorization — a term that applies equally in civil lawsuits and criminal prosecutions — if the actions in question did not involve circumventing a technical or code-based access barrier.

Read More >

Lenovo and Superfish Sued Under The Computer Fraud and Abuse Act.

Written by Keenan W. Ng

It was recently discovered that Lenovo has been selling laptops with preinstalled adware that creates a catastrophic security hole in the web browser leaving users vulnerable to hacks. Superfish, a small company in Palo Alto, develops the adware. Plenty has been written about the technical aspects of the security flaw and more will be written going forward.  As the ramifications of the Superfish vulnerability play out in the community, at least two lawsuits* have been filed. More lawsuits certainly will come. One of these cases, Sterling International Consulting Group (“SICG”) v. Lenovo, Inc. and Superfish, Inc.(collectively, “Lenovo”), alleges violations of the Computer Fraud and Abuse Act. SICG seeks class action certification and was filed in the Northern District of California. The problem with Sterling is that the plaintiffs may have a hard time establishing the authorization element of the CFAA.

Allegations

Read More >

Company Seeks To Regain Stolen Domain Names Using CFAA

Written by Keenan W. Ng

An interesting Computer Fraud and Abuse Act case was recently filed in Virginia. In AcmeBilling Company v. John Doe, Plaintiff, Acme, who maintains numerous websites hosted by GoDaddy, alleges cyber criminals in China stole its domain names. These cyber criminals stole the domain names by gaining unauthorized access to Acme’s domain management account and altering the domain registration records for accounts owned and used by Acme. While Acme was able to recover some of its domain names by working with GoDaddy, GoDaddy unfortunately informed Acme the Chinese domain name registrar who had 14 of their domain names refused to return the websites.

Read More >

Ninth Circuit Opinion Confirms That Websites Should Probably Have Clickwrap Agreements To Bind Their Customers

Written by Keenan W. Ng

Recently, the Ninth Circuit in Nguyen v. Barnes &Noble, Inc. held that “where a website makes its terms of use available via a conspicuous hyperlink on every page of the website but otherwise provides no notice to users nor prompts them to take any affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant buttons users must click on—without more—is insufficient to give rise to constructive notice.”

In 2011, plaintiff purchased two Hewlett-Packard Touchpads from the Barnes & Noble website during a fire sale. Unfortunately, despite receiving a confirming email of his purchase, plaintiff’s order was cancelled due to high demand. Plaintiff filed suit alleging he had to purchase another tablet at a higher price. Defendant argued that plaintiff must arbitrate the matter per the browsewrap terms of use agreement.

Read More >

Congress Readies Itself to Tackle Cybersecurity Legislation

Written by Keenan W. Ng

With Congress coming back from its summer recess, it will be focusing on a few cybersecurity related bills. One of the most controversial of these bills is the Cybersecurity Information Sharing Act of 2014 (“the Act”), introduced by Senator Dianne Feinstein (D-CA) and Senator Saxby Chambliss (R-GA) for the fourth consecutive year. The Act is supposed to “improve cybersecurity in the United Sates through enhanced sharing of information about cybersecurity threats, and for other purposes.” While some of the ideas and the language behind the Act seem reasonable and commonsense, the devil is in the details- or rather, the definitions in the Act- and could have some very interesting implications for individuals and businesses.

Read More >