Opinion
No. 2:17-cv-00105-SAB
08-28-2017
RIVER CITY MEDIA, LLC, a Wyoming limited liability company, MARK FERRIS, an individual, MATT FERRIS, an individual, and AMBER PAUL, an individual, Plaintiffs, v. KROMTECH ALLIANCE CORPORATION, a German corporation, CHRIS VICKERY, an individual, CXO MEDIA, INC., a Massachusetts corporation, INTERNATIONAL DATA GROUP, INC., a Massachusetts corporation, and STEVE RAGAN, an individual, and DOES 1-50, Defendants.
ORDER ADDRESSING DEFENDANTS' MOTIONS TO DISMISS
Before the Court are Defendant International Data Group's Motion to Dismiss for Lack of Personal Jurisdiction or Alternatively, Motion to Dismiss for Failure to State a Claim, ECF No. 12; Defendants CXO Media, Inc. and Steve Ragan's Motion to Dismiss for Lack of Personal Jurisdiction or Alternatively, Motion to Dismiss for Failure to State a Claim, ECF No. 14; and Defendant Kromtech Alliance Corporation's Motion to Dismiss Plaintiffs' Claims, ECF No. 41. A hearing on the motions was held on August 16, 2017, in Yakima, Washington. Plaintiffs were represented by Leeor Neta and Jason E. Bernstein. The IDG Defendants were represented by Charles L. Babcock, William J. Stowe, and Keven Curtis. Defendant Kromtech Alliance Corporation was represented by Matthew Brown, Amy Smith, and Christopher Durbin. Defendant Chris Vickery was represented by Aaron Rocke, who participated telephonically.
Plaintiffs River City Media, Mark Ferris, Matt Ferris and Amber Paul are suing Defendants under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq.; the Stored Communications Act, 18 U.S.C. § 2701 et seq.; the Electronic Communications Privacy Act, 18 U.S.C. § 2510, et seq.; and the Defend Trade Secrets Act, 18 U.S.C. § 1832 et seq.; and also are bringing state law claims for invasion of privacy; intentional interference with contractual relations/business expectancy; intentional infliction of emotional distress; conversion; and defamation. Plaintiff is seeking injunctive relief as well as general and special damages and attorneys' fees. All of the Defendants listed in the Complaint, with the exception of Defendant Chris Vickery, are moving to dismiss the action, asserting the Court does not have personal jurisdiction over them.
Defendants' Motions to Dismiss for Lack of Personal Jurisdiction
Defendants argue the Court does not have personal jurisdiction over them. They bring their motions under Fed. R. Civ. P. 12(b)(2).
1. Motion Standard - Fed. R. Civ. P. 12(b)(2)
Fed. R. Civ. P. 12(b)(2) governs the dismissal of an action based on lack of personal jurisdiction. When a defendant moves to dismiss a complaint for lack of personal jurisdiction, the plaintiff bears the burden of demonstrating that jurisdiction is appropriate. Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 799 (9th Cir. 2004). In ruling on a 12(b)(2) motion, the Court may, in its discretion, order discovery, hold an evidentiary hearing, or rely only on the written submissions. Data Disc, Inc. v. Sys. Tech. Assoc., Inc., 557 F.2d. 1280, 1285 (9th Cir. 1977). If the motion is based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts. Id. A prima facie showing means the plaintiff has produced admissible evidence which, if believed, is sufficient to establish the existence of personal jurisdiction. Ballard v. Savage, 65 F.3d 1495, 1498 (9th Cir. 1995). The plaintiff cannot "simply rest on the bare allegations of its complaint," but uncontroverted allegations in the complaint must be taken as true. Schwarzenegger, 374 F.3d at 800. While the court does not assume the truth of allegations in a pleading that are contradicted by affidavit, it resolves factual disputes in the plaintiff's favor. CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1073 (9th Cir. 2011) (citations omitted). This means that if both parties provide evidence supporting different versions of a fact, the court must resolve competing inferences in the plaintiff's favor. Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 1129 (9th Cir. 2003). 2. Personal Jurisdiction
Where there is no applicable federal statute governing personal jurisdiction, the law of the state in which the district court sits applies. Id. Washington's long-arm statute (RCW § 4.28.185) extends personal jurisdiction to the broadest reach that the Due Process Clause of the federal Constitution permits. Shute v. Carnival Cruise Lines, 113 Wash. 2d 763, 771 (1989). Because Washington's long-arm jurisdictional statute is coextensive with federal due process requirements, the jurisdictional analysis under state law and federal due process are the same. Mavrix Photo, Inc. v. Brand Techs. Inc., 647 F.3d 1218, 1223 (9th Cir. 2011).
The Due Process Clause protects a defendant's liberty interest in not being subject to the binding judgments of a forum with which it has established no meaningful contacts, ties, or relations. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 471-72 (1985). Thus, for a court to exercise personal jurisdiction over a nonresident defendant, that defendant must have at least "minimum contacts" with the relevant forum such that the exercise of jurisdiction "does not offend traditional notions of fair play and substantial justice." Id. (quoting Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). In conducting the minimum contacts inquiry, the court must focus on the relationship among the defendant, the forum, and the litigation. Walden v. Fiore, ___ U.S. ___, 134 S. Ct. 1115, 1122 (2014). For a court to exercise jurisdiction consistent with due process, the defendant's suit-related conduct must create a substantial connection with the forum State. Id. This means "the relationship must arise out of contacts that the defendant himself creates with the forum State." Id. (emphasis in original). Thus, the focus should be on the defendant's contacts with the forum State itself, not the defendant's contact with persons who reside there. Id.
Although personal jurisdiction can be established two ways—through general jurisdiction or specific jurisdiction—Plaintiffs are only relying on specific jurisdiction. Specific jurisdiction is based on the relationship between the defendant's forum contacts and the plaintiff's claim. It is established if the plaintiff can show that (1) the non-resident defendant purposefully directed his activities or consummated some transaction with the forum or resident thereof; or performed some act by which it purposefully availed itself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of the forum's laws; (2) the claim arises out of or relates to the defendant's forum-related activities; and (3) the exercise of jurisdiction comports with fair play and substantial justice, i.e., it must be reasonable. Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015). "If any of the three requirements is not satisfied, jurisdiction in the forum would deprive the defendant of due process of law." Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1155 (9th Cir. 2006) (quotation omitted).
A purposeful direction analysis is most often used in suits sounding in torts. Schwarzenegger, 374 F.3d at 902.
If Plaintiffs satisfy the first two prongs, Defendants must come forward with a "'a compelling case' that the exercise of jurisdiction would not be reasonable." CollegeSource, 653 F.3d at 1076.
In analyzing whether the non-resident defendant purposefully directed its activities with the forum (the first element), courts apply a three-part "effects" test. Id. at 1156. Under this test, a defendant purposefully directed its activities at the forum if it: "(1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that it knows is likely to be suffered in the forum state." Id. Under this analysis, there is no requirement that the defendant have any physical contacts with the forum. Schwarzenegger, 374 F.3d at 802.
This test is also referred to as the "Calder-effects" test. See Calder v. Jones, 465 U.S. 783 (1984).
"[M]ere injury to a forum resident is not a sufficient connection to the forum. Regardless of where a plaintiff lives or works, an injury is jurisdictionally relevant only insofar as it shows that the defendant has formed a contact with the forum State. The proper question is not where the plaintiff experienced a particular injury or effect but whether the defendant's conduct connects him to the forum in a meaningful way." Warden, 134 S. Ct. at 1125.
In evaluating whether the assertion of personal jurisdiction would comport with fair play and substantial justice, that is, would be reasonable (the third element), the following factors may be considered by the court: (1) the extent of the defendants' purposeful injection into the forum state's affairs; (2) the burden on the defendant of defending in the forum; (3) the extent of the conflict with the sovereignty of the defendant's state; (4) the forum state's interest in adjudicating the dispute; (5) the most efficient judicial resolution of the controversy; (6) the importance of the forum to the plaintiff's interest in convenient and effective relief; and (7) the existence of an alternative forum. CollegeSource, 653 F.3d at 1079.
"A State generally has a 'manifest interest' in providing its residents with a convenient forum for redressing injuries inflicted by out-of-state actors." Burger King Corp., 417 U.S. at 473. "[T]he likelihood that personal jurisdiction can be constitutionally exercised is directly proportionate to the nature and quality of commercial activity that an entity conducts over the Internet." Cybersell, Inc. v. Cybersell, Inc., 130 F.3d 414, 419 (9th Cir. 1997).
"When a plaintiff relies on specific jurisdiction, he must establish that jurisdiction is proper for "each claim asserted against a defendant." Picot, 780 F.3d at 1212. "If personal jurisdiction exists over one claim, but not others, the district court may exercise pendent personal jurisdiction over any remaining claims that arise out of the same "common nucleus of operative facts" as the claim for which jurisdiction exists." Id. 3. Background Facts
Plaintiff River City Media (RCM) is a Wyoming corporation that engages in internet-based marketing. Operated by Plaintiffs Mark Ferris, Matt Ferris, Amber Paul and others, its principal place of business is Liberty Lake, Washington. Plaintiffs maintain that Defendants systematically infiltrated their data network, illegally gained access to their databases without authorization, and then copied, modified, and damaged its confidential, sensitive, and propriety information.
Specifically, Plaintiffs allege that a suspicious IP address logged into their systems on January 27, 2017. On January 28, 2017, a then-unknown threat agent connected to one of River City's servers. This threat agent spent several days inside the server, learning as much as it could about RiverCity's network before ultimately using that information to compromise additional River City computer systems. This particular server was used to monitor River City's network for possible irregularities and intruders. By purposefully attacking and compromising this server, the threat agent effectively hamstrung River City's ability to detect and stop their cyberattack.
The threat agent accessed and destroyed data on River City's server that stored records of River City's network topology. Without this "map" of its network, River City lost the ability to manage its own systems, causing severe service disruptions and making recovery of River City's network much more difficult.
Also, the threat agent accessed the "rcm dev" system using cryptographically-secured credentials that could only have been obtained from the prior illegal access. Once the threat agent gained access to River City's systems, it located and used River City's credentials for its (1) company email accounts; (2) its Dropbox.com account; (3) its accounts for affiliate networks; (4) its PayPal accounts; (5) its Hipchap accounts; (6) its email service provider accounts; and (7) its Github accounts. While none of these accounts were exposed to the public, they all were accessed by the threat agent without authorization.
Defendants also used River City's PayPal account to make unauthorized purchases at http://www.alphames.com, a domain registrar. The unauthorized activity was traced to mailto:blueshield@protonmail.com. Defendant Vickery is known to use a "protonmail.com" email address. Defendants also used the data they obtained to log in to River City's email service provider accounts to draft and send illegal emails. Defendants sent offensive emails that appeared to come from one of River City's principals, Alvin Slocombe.
Ultimately, Defendants used the data they obtained to attack and damage River City's reputation via media and blog postings. For instance, on March 6, 2017, Defendants CXO and Steve Ragan posted on CXO's "Salted Hash" security blog and indicated that River City Media accidently exposed their entire operation to the public after failing to properly configure their RSYNC backups. In this article and others, Defendants claimed that Plaintiffs misconfigured a type of computer backup system and accidentally exposed its entire system to the public.
In March, 2017, Defendant Chris Vickery posted a story titled: "Spammergate: The Fall of an Empire." Also around this same time, Defendant Steve Ragan posted a story titled: "Spammers expose their entire operation through bad backups." These articles suggested that Plaintiffs operated an illegal/criminal spam operation that allegedly used "illegal hacking" techniques to send "up to a billion daily emails."
Plaintiffs sent Defendants cease and desist letters. Defendant Vickery responded by saying he did nothing wrong, and threatened to release more data in the future that would include private banking information.
Plaintiffs allege that Defendant Chris Vickey is a vigilante black-hat hacker who breaks into data systems without authorization or consent and intentionally and recklessly exposes confidential, sensitive, and propriety information. He spends his time scouring the web for private databases to which he can gain access. If he finds something interesting, he downloads it and publishes it. He has admitted to the BBC that he initiated an unlawful attack on uKnowKids in February 2016. Plaintiffs alleged that Vickery hacked into Defendant Kromtech's network and exposed it. It then hired him to write articles for its website and to promote its online products, MacKeeper.com, sometime of security software. They also believe he was the threat agent that cyberattacked their networks. He then convinced the other Defendants to assist him in publicizing and "exposing" Plaintiffs by publishing multiple false and defamatory articles on their blogs and news websites.
According to Plaintiffs, before Defendants' actions it was a multi-million dollar affiliate marketing enterprise bringing jobs and revenue to Spokane. After Defendants' actions, it went out of business.
4. Analysis
The Court begins its analysis by recognizing that Plaintiffs' allegations in its Complaint center around activities that took place less than six months ago. The alleged cyberattack took place in January and February of this year, and the alleged articles were published in early March. Plaintiffs filed their Complaint in late March. Most of Defendants' arguments challenge the sufficiency of the pleadings, alleging that Plaintiffs have not alleged sufficient facts to establish personal jurisdiction. Plaintiffs acknowledged at the hearing that their pleadings could have alleged more facts, and also indicated that additional evidence regarding personal jurisdiction has come to light as the proceedings have progressed. Plaintiffs requested opportunity to conduct discovery regarding the personal jurisdiction question.
The Court has broad discretion in deciding whether to grant jurisdictional discovery. Laub v. U.S. Dep't of Interior, 342 F.3d 1080, 1093 (9th Cir. 2003). Although the Court may refuse to grant discovery if it is clear that discovery will not demonstrate facts sufficient to establish jurisdiction, the Court should grant discovery when the jurisdictional facts are contested or more facts are needed. Id.
Here, although not necessarily alleged in the Complaint, there is evidence in the record to suggest that personal jurisdiction over the Defendants would be proper. For instance, with regard to Defendant Kromtech, in its response, Defendant provided the Agreement that defines the relationship between Kromtech and Chris Vickery. ECF No. 42, Ex. 1. The Agreement, along with the facts regarding the events preceding Kromtech entering into the Agreement with Chris Vickery, suggest that Defendant Kromtech required, directed, or strongly encouraged Defendant Vickery to engage in the conduct that he is alleged to have committed, i.e. the hacking of Plaintiff's networks. Under Williams v. Yama Motor Co., Ltd., 851 F.3d 1015, 1023 (9th Cir. 2017), this may be enough to establish personal jurisdiction over Kromtech. Plaintiff was not able to allege any facts surrounding the Agreement because it did not have possession of the Agreement at the time the Complaint was written and although Plaintiffs alleged facts regarding Vickery's illegal access of Kromtech's data systems, discovery regarding the relationship between Kromtech and Vickery will permit Plaintiffs and the Court to accurately assess whether it has personal jurisdiction over Kromtech.
While the Williams court did not identify the specific analysis courts should apply to determine whether a subsidiary's activities can provide sufficient contacts to maintain personal jurisdiction over the parent company, it did state that at the minimum, the parent company must have the right to substantially control its subsidiary's activities. Id. --------
Similarly, the record seems to suggest a more active role in the investigation on the part of Defendants CXO Media and Steve Ragan than alleged in the Complaint. For instance, in the second paragraph from the "Spammergate: The Fall of an Empire" article was posted by Chris Vickery, Mr. Vickery wrote the following:
A cooperative team of investigators from the MacKeeper Security Research Center, CSOOnline, and Spamhaus came together in January after I stumbled upon a suspicious, yet publicly exposed, collection of files. Someone had forgotten to put a password on this repository and, as a result, one of the biggest spam empires is now falling.ECF No. 25, Ex. 2
He also indicated that additional coverage would be available at CSOOnline. Id.
This seems to suggest that CSOOnline had a bigger role in the investigation than merely publishing an article as alleged in Plaintiff's Complaint. Discovery regarding the relationship between CXO Media, CSOOnline, Chris Vickery and Steve Ragan is necessary before the Court can adequately address whether personal jurisdiction exists over Defendant CXO Media.
Finally, Plaintiffs are entitled to obtain discovery regarding the relationship between IDG and CXO Media to determine whether Plaintiff can allege facts that pierce the corporate veil to establish personal jurisdiction over IDG.
On the other hand, Plaintiffs have adequately alleged facts to support personal jurisdiction over Steve Ragan and Chris Vickery. Although Defendants insist that Steve Ragan and Chris Vickery had no idea that River City Media was located in Washington, it is implausible that Mr. Ragan never looked into the physical location of River City Media. See CollegeSource, Inc., 653 F.3d at 1073 (noting it was implausible that the defendant was unaware of the plaintiff's place of business).
For instance, Mr. Ragan wrote:
Vickery had discovered everything. From Hipchat logs and domain registration records to accounting details, infrastructure planning and production notes, scripts and business affiliations. In addition, Vickery uncovered 1.34 billion email accounts. These are the accounts that will receive spam, or what RCM calls offers. Some of these records also contained personal information, such as full names, physical addresses, and IP addresses.ECF No. 25, Ex. 3.
He goes on:
For this story, we'll explore the finances and operations of RCM, but it is important to note the data is only a snapshot taken from backups.Id.
***
The problem is, organizations like River City Media use numerous aliases and affiliate programs, so while blocking their infrastructure will hurt, there is no assurance it will put them out of business for good.
Ragan wrote about Alvin Slocombe, the owner of Cyber World Internet Services Inc. and the fact that he is often associated with Matt Ferris, and his company River City Media. Id. He stated: "In all, documents exposed by RCM connect the organization to more than 20 business partners over the last two years, and more than 30 different aliases, including RCM Delivery, Pheasant Valley Marketing Group, ebox, and Wharton Dynamics, Inc. Id.
Ragan reported on a chat log between Slocombe and Ferris:
For example: In December of 2016, one of the exposed chat logs shows Slocombe explaining to Ferris that their buddy Mike Boehm is "very close friends with the owner of Alpnames, so if any issues come up let me know and I will see if he can hook us up / not let us get pulled down.Id.
***
Finally, there is TierPoint, a legitimate ISP with a relationship to Alvin Slocombe and Cyber World Internet Services. They are Cyber World's only link to the rest of the internet. IP records exposed by RCM show Slocombe tracking TierPoint IP addresses while working on various campaigns.
The scope and focus of the article was on River City Media's business model, business activities, and business relationships. The scope of the article makes it is implausible that Vickery and Ragan would not discover the physical location of the entity in which they were conducting extensive research and know that their article would impact Plaintiff's business activities occurring in Washington. Defendants Vickery and Ragan purposefully directed their activities in Washington, the claims arise and relates to their activities directed at Washington, and the exercise of personal jurisdiction over these two Defendants is reasonable.
The Court is cognizant that Washington has a 'manifest interest' in providing its residents with a convenient forum for redressing injuries inflicted by out-of-state actors. As it stands, although the Complaint does not allege facts that definitively support a finding of personal jurisdiction over Defendants Kromtech, CXO and IDG, the record does not foreclose the possibility that additional facts can be discovered and alleged that will establish personal jurisdiction over these Defendants. As such, it is appropriate to permit Plaintiffs to conduct discovery and to grant them leave to file an Amended Complaint. Because leave to amend is granted, it is not necessary to rule on Defendants' Motion to Dismiss based on Fed. R. Civ. P. 12(b)(6).
Accordingly, IT IS HEREBY ORDERED:
1. Defendant International Data Group, Inc's Motion to Dismiss, ECF No. 12, is DENIED, with leave to renew.
2. Defendant CXO Media's Motion to Dismiss, ECF No. 14, is DENIED, with leave to renew.
3. Defendant Steve Ragan's Motion to Dismiss, ECF No. 14, is DENIED.
4. Defendant Kromtech's Motion to Dismiss, ECF No. 41, is DENIED, with leave to renew.
5. The parties are directed to meet and confer and submit to the Court proposed deadlines for completing jurisdictional discovery and for Plaintiffs to file their Amended Complaint.
6. Plaintiffs' Motion to Strike, ECF No. 57, is DENIED, as moot.
7. Plaintiffs' Motion to Expedite, ECF No. 58, is GRANTED.
IT IS SO ORDERED. The Clerk of Court is directed to enter this Order and forward copies to counsel.
DATED this 28th day of August, 2017.
/s/_________
Stanley A. Bastian
United States District Judge