EDD: Issues, Law, and Solutions: Does using the Internet in connection with a crime automatically create an interstate offense: PS3 Hack to decide

Thursday, February 10, 2011

Does using the Internet in connection with a crime automatically create an interstate offense: PS3 Hack to decide

The Internet and digital technologies broadly raise huge questions of federal law. Does using the Internet in connection with a crime automatically create an interstate offense, since information sent and received via it passes through many states? If illegal information is posted online, is it directed at the residents of other states, not just the user’s own? If someone utilizes an online business that is based in another state in commission of or connection to their violation, do they give more legitimacy to these claims?

For the past several weeks, Sony has been trying to stop the spread of a soft-ware based hack that opens the PlayStation 3 to installation of 3rd-party software and allows the use of pirated games. Hacker George Hotz, the man who released the hack’s code on his website and YouTube and a New Jersey resident, is being sued in California by Sony for breaching the Digital Millennium Copyright Act, commonly known as the DMCA, and the Computer Fraud and Abuse Act. The company has been granted an injunction by the Californian district court; Hotz was told to remove the code from his website immediately (which he did) and turn over all of his hard drives, computers and devices involved in the hack to Sony within 10 days.

Hotz’s lawyer, Stewart Kellar, is now battling Sony over jurisdiction – that is, which court should hear the case. The Ninth Circuit Court of Appeals, covering California, ruled in Schwarzenegger v. Fred Martin Motor Co. that a three-pronged test must be met to establish Californian specific personal jurisdiction. The test demands that a defendant “purposefully direct his activities or consummate some transaction with the forum [California] or resident thereof, or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws,” that Sony’s claim “arises out of or relates to the defendant's forum-related activities,” and that the “the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.”

This test requires that Sony show that Hotz’s activities were specifically directed at California residents – unlikely, considering that the information was posted online and not addressed specifically to Californians – or that Hotz had some sort of transaction with a resident of California. Sony argues that because Hotz used Twitter and YouTube to distribute his hack, and that since both companies are Californian, this requirement is fulfilled. Sony also points out that Hotz’s website had a PayPal donation button, that PayPal is a California-based company, and that Hotz received payment in relation to his hack. This connection is tenuous at best; according to Kellar, “Mr. Hotz expressly tells people on his website not to give him donations for his efforts,” and Sony’s only claimed transaction via PayPal was one the company initiated.

Sony also points out that its PlayStation Network user agreement includes a clause by which users submit to Californian jurisdiction, in cases Sony initiates against hackers. Kellar again argues that this connection is tenuous, pointing out that the PlayStation Network was not used to create or distribute the offending code.

The question of jurisdiction is hugely important; Sony is suing for costs and monetary damages. As a huge, multinational company with vast resources, the case is already balanced against Hotz. If he or his lawyer must also travel from his New Jersey home to San Francisco to argue the case, even more cost and difficulty would accrue against their already limited resources. Sony’s complaint asks attorney’s fees and court costs, for damages incurred against the company – lost profits from pirated games that might otherwise be sold – as well as statutory damages of $200-$25,000 per each violation of the DMCA, provided by USC § 1203(c)(3) and -(3)(B).

The case is hugely important. It may clarify precedent for questions of jurisdiction, and questions of the role of online activities in law more broadly; the Computer Fraud and Abuse Act was used, unsuccessfully, to prosecute Lori Drew, a mother accused of teasing a teenage girl to death over Myspace. It may create a chilling effect, warning users away from modifying their devices to install their own software on them – the Library of Congress recently protected users hacking their phones and bypassing copyright protection systems to install their own software, exactly the behavior engaged in by Hotz, albeit on a different device. It seems entirely possible that appeals to the Circuit Court, and perhaps even the Supreme Court, will be made to clarify these questions, and determine whether the California district court acted properly, however it rules.

No comments:

Post a Comment

Sedona Principles 2nd ed.

1. Electronically stored information is potentially discoverable under Fed. R. Civ. P. 34 or its state equivalents. Organizations must properly preserve electronically stored information that can reasonably be anticipated to be relevant to litigation.
2. When balancing the cost, burden, and need for electronically stored information, courts and parties should apply the proportionality standard embodied in Fed. R. Civ. P. 26(b)(2)(C) and its state equivalents, which require consideration of the technological feasibility and realistic costs of preserving, retrieving, reviewing, and producing electronically stored information, as well as the nature of the litigation and the amount in controversy.
3. Parties should confer early in discovery regarding the preservation and production of electronically stored information when these matters are at issue in the litigation and seek to agree on the scope of each party’s rights and responsibilities.
4. Discovery requests for electronically stored information should be as clear as possible, while responses and objections to discovery should disclose the scope and limits of the production.
5. The obligation to preserve electronically stored information requires reasonable and good faith efforts to retain information that may be relevant to pending or threatened litigation. However, it is unreasonable to expect parties to take every conceivable step to preserve all potentially relevant electronically stored information.
6. Responding parties are best situated to evaluate the procedures, methodologies, and technologies appropriate for preserving and producing their own electronically stored information.
7. The requesting party has the burden on a motion to compel to show that the responding party’s steps to preserve and produce relevant electronically stored information were inadequate.
8. The primary source of electronically stored information for production should be active data and information. Resort to disaster recovery backup tapes and other sources of electronically stored information that are not reasonably accessible requires the requesting party to demonstrate need and relevance that outweigh the costs and burdens of retrieving and processing the electronically stored information from such sources, including the disruption of business and information management activities.
9. Absent a showing of special need and relevance, a responding party should not be required to preserve, review, or produce deleted, shadowed, fragmented, or residual electronically stored information.
10. A responding party should follow reasonable procedures to protect privileges and objections in connection with the production of electronically stored information.
11. A responding party may satisfy its good faith obligation to preserve and produce relevant electronically stored information by using electronic tools and processes, such as data sampling, searching, or the use of selection criteria, to identify data reasonably likely to contain relevant information.
12. Absent party agreement or court order specifying the form or forms of production, production should be made in the form or forms in which the information is ordinarily maintained or in a reasonably usable form, taking into account the need to produce reasonably accessible metadata that will enable the receiving party to have the same ability to access, search, and display the information as the producing party where appropriate or necessary in light of the nature of the information and the needs of the case.
13. Absent a specific objection, party agreement or court order, the reasonable costs of retrieving and reviewing electronically stored information should be borne by the responding party, unless the information sought is not reasonably available to the responding party in the ordinary course of business. If the information sought is not reasonably available to the responding party in the ordinary course of business, then, absent special circumstances, the costs of retrieving and reviewing such electronic information may be shared by or shifted to the requesting party.
14. Sanctions, including spoliation ﬁndings, should be considered by the court only if it finds that there was a clear duty to preserve, a culpable failure to preserve and produce relevant electronically stored information, and a reasonable probability that the loss of the evidence has materially prejudiced the adverse party.
Copyright © 2007 The Sedona Conference®. All Rights Reserved.
Reprinted courtesy of The Sedona Conference®.
Go to http://www.thesedonaconference.org/ to download a free copy of the complete document for your personal use only.