Thursday, February 10, 2011
Does using the Internet in connection with a crime automatically create an interstate offense: PS3 Hack to decide
The Internet and digital technologies broadly raise huge questions of federal law. Does using the Internet in connection with a crime automatically create an interstate offense, since information sent and received via it passes through many states? If illegal information is posted online, is it directed at the residents of other states, not just the user’s own? If someone utilizes an online business that is based in another state in commission of or connection to their violation, do they give more legitimacy to these claims?
For the past several weeks, Sony has been trying to stop the spread of a soft-ware based hack that opens the PlayStation 3 to installation of 3rd-party software and allows the use of pirated games. Hacker George Hotz, the man who released the hack’s code on his website and YouTube and a New Jersey resident, is being sued in California by Sony for breaching the Digital Millennium Copyright Act, commonly known as the DMCA, and the Computer Fraud and Abuse Act. The company has been granted an injunction by the Californian district court; Hotz was told to remove the code from his website immediately (which he did) and turn over all of his hard drives, computers and devices involved in the hack to Sony within 10 days.
Hotz’s lawyer, Stewart Kellar, is now battling Sony over jurisdiction – that is, which court should hear the case. The Ninth Circuit Court of Appeals, covering California, ruled in Schwarzenegger v. Fred Martin Motor Co. that a three-pronged test must be met to establish Californian specific personal jurisdiction. The test demands that a defendant “purposefully direct his activities or consummate some transaction with the forum [California] or resident thereof, or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws,” that Sony’s claim “arises out of or relates to the defendant's forum-related activities,” and that the “the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.”
This test requires that Sony show that Hotz’s activities were specifically directed at California residents – unlikely, considering that the information was posted online and not addressed specifically to Californians – or that Hotz had some sort of transaction with a resident of California. Sony argues that because Hotz used Twitter and YouTube to distribute his hack, and that since both companies are Californian, this requirement is fulfilled. Sony also points out that Hotz’s website had a PayPal donation button, that PayPal is a California-based company, and that Hotz received payment in relation to his hack. This connection is tenuous at best; according to Kellar, “Mr. Hotz expressly tells people on his website not to give him donations for his efforts,” and Sony’s only claimed transaction via PayPal was one the company initiated.
Sony also points out that its PlayStation Network user agreement includes a clause by which users submit to Californian jurisdiction, in cases Sony initiates against hackers. Kellar again argues that this connection is tenuous, pointing out that the PlayStation Network was not used to create or distribute the offending code.
The question of jurisdiction is hugely important; Sony is suing for costs and monetary damages. As a huge, multinational company with vast resources, the case is already balanced against Hotz. If he or his lawyer must also travel from his New Jersey home to San Francisco to argue the case, even more cost and difficulty would accrue against their already limited resources. Sony’s complaint asks attorney’s fees and court costs, for damages incurred against the company – lost profits from pirated games that might otherwise be sold – as well as statutory damages of $200-$25,000 per each violation of the DMCA, provided by USC § 1203(c)(3) and -(3)(B).
The case is hugely important. It may clarify precedent for questions of jurisdiction, and questions of the role of online activities in law more broadly; the Computer Fraud and Abuse Act was used, unsuccessfully, to prosecute Lori Drew, a mother accused of teasing a teenage girl to death over Myspace. It may create a chilling effect, warning users away from modifying their devices to install their own software on them – the Library of Congress recently protected users hacking their phones and bypassing copyright protection systems to install their own software, exactly the behavior engaged in by Hotz, albeit on a different device. It seems entirely possible that appeals to the Circuit Court, and perhaps even the Supreme Court, will be made to clarify these questions, and determine whether the California district court acted properly, however it rules.