Insights

09.24.2001

With the burgeoning growth of the Internet, courts across the nation have grappled with the issue of when they can properly exercise jurisdiction over out-of-state parties allegedly engaged in wrongful conduct in cyberspace. In the latest test of the Internet's lack of physical borders, a California Court of Appeal in Pavlovich v. Superior Court, held that an Indiana student, now living in Texas, can be sued in California for stealing trade secrets and copyright infringement because he posted them on the Internet. This decision, issued in August 2001, confirms that California companies may seek redress in California courts to protect their intellectual property rights if abused on the Internet by others, even when these wrongdoers never step foot in California.

At the same time, this decision highlights some of the risks inherent in conducting legitimate business over the Internet. Through traditional marketing channels (e.g., newspaper, mailing, radio, television), a company can easily tailor its advertising to offer its goods only in particular states. When offering a product or service over the Internet, however, a company's product is suddenly "for sale" in every corner of the world. The recent California decision, while simple in its analysis, nonetheless raises complex jurisdictional issues relating to doing business in cyberspace where one may not be able to control where and when its advertising may be viewed or its product may be offered.

Courts in different jurisdictions, and sometimes courts in the same jurisdiction, are applying different tests and reaching drastically different conclusions as to what circumstances support the exercise of jurisdiction over an out-of-state defendant. The recent California decision stresses the need for businesses operating on the Internet to seek counsel in designing their Web sites and evaluating their e-commerce activity to minimize the risk of having to defend a lawsuit in a distant or inconvenient location.

Jurisdiction Basics

Generally, the power of a court to exercise personal jurisdiction over a nonresident defendant turns on whether assertion of such jurisdiction comports with federal constitutional principles of due process. Under the United States Constitution, due process requires that before a court may exercise personal jurisdiction over a nonresident defendant, that defendant must have certain "minimum contacts" with the forum State such that the maintenance of the suit does not offend "traditional notions of fair play and substantial justice." The purpose of the minimum contacts doctrine is to protect nonresident defendants from the burden of litigating in a distant or inconvenient forum, and ensure that states do not reach out beyond the limits of their sovereignty imposed by their status in a federal system.

These minimum contacts may result in a court exercising general or specific jurisdiction, depending on the nature and extent of the contacts. "When a State exercises personal jurisdiction over a defendant in a suit not arising out of or related to the defendant's contacts with the forum, the State is exercising 'general jurisdiction' over the defendant." General jurisdiction results from a defendant's "substantial" or "continuous and systematic" activities in the forum state.

"When a State exercises personal jurisdiction over a defendant in a suit arising out of or related to the defendant's contacts with the forum, the State is exercising 'specific jurisdiction' over the defendant." Specific jurisdiction, the most common for Internet related cases, is determined under a three-part test: "(1) The nonresident defendant must do some act or consummate some transaction with the forum or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or results from the defendant's forum-related activities; and (3) exercise of jurisdiction must be reasonable."

In the end, the jurisdictional analysis is a case-by-case factual inquiry. As the United States Supreme Court has recognized, "the determination of whether minimum contacts exist is one in which few answers will be written in 'black and white.' The grays are dominant and even among them the shades are innumerable."

The Internet and Jurisdiction

Over the past five years, courts across the nation have varied substantially in deciding whether an out-of-state defendant's activity over the Internet was sufficient to warrant the exercise of personal jurisdiction. A standard that has been adopted by many courts is set forth in the 1997 decision Zippo Mfg. Co. v. Zippo Dot Com, Inc. There, the court articulated a "sliding scale" for the exercise of jurisdiction identifying three types of Web sites:

(1) Clearly Doing Business: If a company maintains a Web site on which it enters into contracts with residents of a foreign jurisdiction that involve the knowing and repeated transmission of computer files over the Internet, personal jurisdiction is proper.

(2) Interactive: The middle ground is occupied by interactive Web sites where a user can exchange information with the host computer.  In these cases, the exercise of jurisdiction is determined by examining the level of interactivity and commercial nature of the exchange of information that occurs on the Web site.

(3) Passive: These Web sites are where a company has simply posted information which is accessible to users in foreign jurisdictions. A passive Web site that does little more than make information available to those who are interested in it is not grounds for the exercise of personal jurisdiction.

The strict application of the Zippo "sliding scale test" has been subject to debate, particularly when applied to "passive" Web sites. In trademark infringement suits, several courts have dismissed cases for lack of personal jurisdiction where the alleged infringement was a passive Web site's domain name. Even where a defendant has published allegedly defamatory remarks on passive Web pages, in posted messages and in discussion groups, courts have found that the contacts were not sufficient to exercise jurisdiction over an out-of-state defendant. Other courts have concluded that a passive Web site alone can purposefully aim itself at a forum state thereby warranting the exercise of personal jurisdiction. For example, in a few cases, the court has concluded that the mere presence of a passive Web site on the Internet is sufficient to exercise jurisdiction over an out-of-state defendant because it has decided to direct its advertising activities toward the forum state on a continuing basis.

Separate and distinct from the Zippo "sliding scale test," California courts have long held that the "purposeful availment" requirement for specific jurisdiction is satisfied where a defendant's intentional conduct causes harmful effects within the state. Under this "effects test," personal jurisdiction can be based upon: (1) intentional actions (2) expressly aimed at the forum state (3) causing harm, the brunt of which is suffered -- and which the defendant knows is likely to be suffered -- in the forum state.

In Jewish Defense Organization, Inc. v. Superior Court, the plaintiff filed an action in California alleging that defendants (an organization based in New York and an individual who resided in New York) posted a Web site containing defamatory statements about the plaintiff. The Court of Appeal found that the effects test had not been met because the defendants' actions did not create a "foreseeable risk of injury" in California. There was insufficient evidence to conclude that plaintiff's residence or principal place of business was in California. Thus, the court could not find that the alleged defamation was targeted at California or would cause the brunt of the harm in California. The court separately held that the Web site was "passive" and did not support the exercise of jurisdiction under the Zippo test.

On different facts, the United States Court of Appeals for the Ninth Circuit reached the opposite conclusion under the effects test in Panavision Intern., L.P. v. Toeppen. In that case, a Delaware limited partnership with its principal place of business in California brought a lawsuit in California against a nonresident defendant who registered Panavision's trademarks as his domain names and posted a "passive" Web site on the Internet in the hope of selling the domain name to Panavision (or as the Ninth Circuit characterized it, with the intent to extort money from Panavision).

The court held that the defendant's conduct was sufficient to exercise jurisdiction over the defendant under the effects test. First, however, the court recognized that simply registering someone else's trademark as a domain name and posting a web site on the Internet is not sufficient to subject a party domiciled in one state to jurisdiction in another. But the defendant did considerably more than simply register Panavision's trademarks as his domain names on the Internet. The court found that he registered those names as part of a scheme to obtain money from Panavision. Pursuant to that scheme, he demanded $13,000 from Panavision to release the domain names to it. Thus, his acts were aimed at Panavision in California, and caused it to suffer injury there.

The Pavlovich Case

The "effects test," as opposed to the Zippo "sliding scale test" was recently applied by the California Court of Appeal in a recent case involving a "passive" Web site. In Pavlovich v. Superior Court, the DVD Copy Control Association (DVDCCA), which is associated with the Motion Picture Association of America (MPAA), brought suit against several individuals who posted certain software code on their websites, alleging that they misappropriated trade secrets when they reverse engineered DVD technology. The software, known as "DeCSS," is a computer program designed to defeat DVDCCA's encryption-based copy protection system, known as the Content Scramble System, or "CSS." The CSS is used to encrypt and protect the copyrighted motion pictures contained on digital versatile discs, or DVDs.

With the support of San Francisco-based Electronic Frontier Foundation, the defendants in Pavlovich are raising interesting and novel First Amendment defenses. Although beyond the scope of this article, in Pavlovich, as in a similar case pending in New York, defendants are hopeful that the court will embrace their conduct as protected under the First Amendment right to free speech. Specifically, the defendants have argued that written software code is protected speech, in part because DeCSS is already widely available in the public domain and they are merely republishing it.

After being served with the lawsuit, Pavlovich moved to have the case thrown out on the grounds that the California Court does not have personal jurisdiction over him. Pavlovich argued that he merely republished a piece of computer code identified as DeCSS at his Internet Web site while enrolled as a full-time student at the University of Indiana. Pavlovich submitted a declaration stating that he has never: (1) solicited business in California; (2) designated a registered agent for service of process in California; (3) maintained a place of business in California; (4) maintained a telephone listing in California; (5) maintained a bank account in California; or (6) even visited California for any business purpose. Pavlovich further argued that the Web site DVDCCA attributes to Pavlovich was a "passive" Web site that did not involve the interactive exchange of information with users, did not solicit or engage in business activities and did not solicit contact with California residents.

The trial court and the Court of Appeal rejected Pavlovich's "passive" Web site arguments by affirming that the California court had jurisdiction over Pavlovich. The Court of Appeal started by identifying the question as follows: Is jurisdiction proper over "owners, publishers, and operators of those Web sites when, in violation of California law, they make available for copying or distribution trade secrets or copyrighted material of California companies." Applying traditional rules to the facts presented, the Court answered the question in the affirmative and held that jurisdiction was proper.

The court found sufficient guidance in the United States Supreme Court's opinion in Calder v. Jones, a case arising not out of Internet activity but out of traditional marketing channels. In Calder, the plaintiff Jones brought suit in California against the defendants South and Calder. Jones claimed that she had been libeled in an article published in a national magazine (National Enquirer) that was written and edited by the defendants in Florida. The article was circulated in California. South, who wrote the first draft of the article, lived in Florida, and did most of his research in Florida, relying on phone calls to sources in California for the information contained in the article. Calder, the president and editor of the Enquirer, was also a resident of Florida. Calder reviewed South's draft and edited it in its final form. In finding that California had specific jurisdiction over South and Calder under these facts, the Calder Court stated that California was "the focal point both of the story and of the harm suffered," and that jurisdiction over  their persons was "proper in California based on the 'effects' of their Florida conduct in California." Calder concluded that California courts had personal jurisdiction over the defendants in Florida because defendants' "intentional conduct in Florida [was] calculated to cause injury to respondent in California."

Applying the Calder Court's analysis, the California Court of Appeal concluded that Pavlovich's lack of physical and personal presence in California did not prevent California courts from jurisdictionally reaching him. Specifically, the Court held that Pavlovich "knew, or should have known, that the DVD republishing and distribution activities he was illegally doing and allowing to be done through the use of his Web site, while benefitting him, were injuriously affecting the motion picture and computer industries in California." The Court concluded that the trial court's exercise of personal jurisdiction comports with notions of fair play and substantial justice under the due process clause of the United States Constitution.

Why Pavlovich Is Important to E-Commerce Activity

The Pavlovich decision provides California companies with some assurance that they may protect their intellectual property rights against piracy carried out over the borderless World Wide Web. Regardless of whether their Web site is passive or interactive, out-of-state defendants will be held accountable in California if they engage in wrongful conduct over the Internet and know or should know that the injury will be felt in California.

Some would argue that Pavlovich goes too far, while others would argue it does not go far enough in extending the jurisdictional reach for wrongdoers over the Internet. By focusing on Pavlovich's specific knowledge that California is the primary location for motion picture and computer industries, the decision suggests that an injured party must offer evidence that the defendant knows, or should know, that the injury will be felt in the specific state where the lawsuit is filed. Is such a requirement fair to the companies harmed by this activity? Would a small movie producer or computer company doing business in Virginia who, unbeknownst to Pavlovich, suffers harm in Virginia have to travel to Indiana or Texas to file suit? If the answer is yes, some would argue that this analysis rewards an "ignorant defendant" simply because the defendant does not know the location of the plaintiff or is not aware of the state in which the harm will be felt. When a defendant engages in intentional wrongful conduct over the Internet, he or she knows that the reach of its conduct is all over the world. Shouldn't he or she know that the brunt of the harm will be felt in any state in which the plaintiff happens to reside or does business even if the defendant does not know the specific state?

Others would counter that before a defendant can be forced to defend a lawsuit in a distant state, due process requires that the defendant have notice of the specific state in which the harm will be felt and that the defendant specifically intend for the harm to be suffered there. Perhaps Pavlovich goes too far. Consider a hypothetical. Suppose a small company, only intending to do business in San Diego, California, operates a passive Web site that offers local classes on health and safety. The local company posts an article on its Web site about serious health risks associated with a widely criticized diet. Although the article does not mention it, the diet is promoted by a business in Florida. Suppose further that the California company has no contacts or commercial activity in Florida, has no intention of ever doing business in Florida, and its Web site is never even accessed by anyone in Florida. Is it fair to require the California company to hire counsel and defend a lawsuit in Florida simply because the Florida company alleges that the California company knew or should have known that the publication of the article would cause harm to its business in Florida?

Surprisingly, there are a multitude of case law decisions that can be cited to support the many sides of these issues. As cited above, some courts have exercised jurisdiction over operators of a "passive" Web sites regardless of whether there was any evidence that the defendant knew or should have known about the location of the plaintiff or where the injury would be felt. Other courts have held that there is simply no jurisdiction on the basis of a passive Web site alone. While other courts have concluded that, there must be something more such that "the defendant is alleged to have engaged in wrongful conduct targeted at a plaintiff whom the defendant knows to be a resident of the forum state."

If anything, the Pavlovich decision should be a reminder to companies engaged in e-commerce that their conduct could expose them to lawsuits anywhere in the country. However, defensive measures can be taken (e.g., limiting the level of interactivity of the Web site, posting specific and clear notices on pages prior to allowing access to other pages, or having a forum selection clause in any contracts entered into over the Internet). Although defensive measures may not be effective in some circumstances, e-commerce may very well be one of those instances in which an ounce of prevention is worth a pound of cure.

Reprinted with permission from the San Diego Business Journal.