ORDER ON MOTIONS TO DISMISS AND MOTION FOR PRELIMINARY INJUNCTION

Re: Dkt. Nos. 12, 23, 35, 45

HAYWOOD S. GILLIAM, JR., District Judge.

Before the Court are three motions: (1) Defendant Fast Choice LLC's motion to dismiss for lack of personal jurisdiction and based on forum non conveniens, Dkt. No. 12; (2) Defendant Inspiring Trading Apps LLC's motion to dismiss for lack of personal jurisdiction, improper service, and failure to state a claim, Dkt. No. 35; and (3) Plaintiff's motion for preliminary injunction, Dkt. No. 23. Because the Court finds that it does not have personal jurisdiction over Defendants, the Court GRANTS Defendants' motions to dismiss and DENIES Plaintiff's motion for preliminary injunction.

I. BACKGROUND

Plaintiff Hungerstation LLC, Defendant Fast Choice LLC d/b/a Pace, and Defendant Inspiring Trading Apps LLC d/b/a Swyft are all limited liability companies formed under the laws of the Kingdom of Saudi Arabia. Dkt. No. 1 ("Compl.") ¶¶ 4-6. All parties have their principal place of business in Saudi Arabia. Id.

Plaintiff is one of the leading online food delivery services in Saudi Arabia. Id. ¶ 11. It developed three software apps in connection with its food delivery service: (1) a customer-facing app, on which customers can order food from local restaurants; (2) a restaurant-facing app, which restaurants use to accept customer orders; and (3) a rider-facing app, which couriers use to pick up and deliver the food. Id. ¶ 13. Plaintiff owns the source code for all three apps and has registered the copyrighted materials with the U.S. Copyright Office. Id. ¶ 31. It "creates, stores, and updates its copyrighted source code" on GitHub servers. Id. ¶ 32. GitHub is a third party based in the United States with servers in California, Washington, and Virginia. Id.

As a result of operating these apps and accumulating data over time, Plaintiff has developed "valuable confidential information," which includes customer databases, restaurant databases, key contacts, and marketing strategies. Id. ¶ 14. Its confidential data is stored on Amazon Web Services, Inc. servers, which are in the United States and controlled through Cloudflare, Inc. Id. ¶ 51. Cloudflare is also a U.S.-based company. Id.

Pace owns and operates a rider-facing food delivery mobile app, and Swyft owns and operates a customer-facing food delivery mobile app. Id. ¶¶ 16, 18. Swyft is a direct competitor of Plaintiff. Id. ¶ 18. According to the complaint, Pace and Swyft operate financially as one entity and "should be treated as alter egos of each other." Id. ¶¶ 19-29.

At issue here is the alleged unlawful theft of Plaintiff's source code and confidential data. Plaintiff alleges that Defendants "launched a plan to raid Hungerstation's intellectual property for the benefit of Defendants, who were direct competitors of Hungerstation." Id. ¶ 43. Specifically, Defendants allegedly "attempted to recruit or exploit key members of Hungerstation's senior management team and software development team to either join Defendants ... or to transfer confidential information to Defendants." Id. This purported scheme involved "penetrating Hungerstation's computer servers in the United States in order to steal Hungerstation's trade secrets." Id. ¶ 44. According to Plaintiff, Defendants' employees used "their then-valid Hungerstation credentials to wrongfully access, copy, and steal Hungerstation's GitHub repositories of copyrighted and proprietary source code," and "accessed Hungerstation's confidential data" stored on Amazon Web Services. Id. ¶¶ 46, 51. Defendants allegedly stored the "copycat source code on GitHub's U.S. servers." Id. ¶ 48

Defendants then purportedly "contracted with California-based Apple, Inc. and Google LLC, and transmitted executable files created using the infringing source code to those companies to be stored on their California-based servers, to distribute Defendant's infringing apps to smart phone users across the world." Id. ¶ 50. According to Plaintiff, Defendants "signed terms of services and/or other contracts with Apple and Google ... that explicitly contained choice of law provisions stating that California laws would govern the agreements." Id. At the time Plaintiff filed the complaint, the apps were allegedly available for download in the United States on Apple's AppStore and GooglePlay. Id.

Based on the allegations, Plaintiff brings six causes of action against Defendants: (1) misappropriation of trade secrets under the Defend Trade Secrets Act, 18 U.S.C. § 1836 et seq.; (2) misappropriation of trade secrets under California Uniform Trade Secrets Act, Cal. Civ. Code § 3426 et seq.; (3) copyright infringement, 17 U.S.C. § 101 et seq.; (4) violation of Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq.; (5) violation of California's Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502(c); and (6) unfair competition under Cal. Bus. and Prof. Code § 17200 et seq. Id. ¶¶ 67-117

II. MOTIONS TO DISMISS: PERSONAL JURISDICTION

Because personal jurisdiction is a threshold issue and relevant to the likelihood of success factor of a preliminary injunction analysis, the Court first considers whether it has jurisdiction over the parties.1

A. Legal Standard

"When a defendant moves to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of demonstrating that the court has jurisdiction over the defendant." Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1154 (9th Cir. 2006). When personal jurisdiction is challenged, "the district judge has considerable procedural leeway in choosing a methodology for deciding the motion." 5B Charles A. Wright & Arthur R. Miller, Federal Practice and Procedure § 1351 (3d ed. 2018). The court may rest on the allegations in the pleadings, weigh the contents of affidavits and other evidence, or even hold a hearing and resort to oral testimony. Id. Where, as here, the motion is based on written materials rather than an evidentiary hearing, Plaintiff need only make a prima facie showing of jurisdictional facts. Bauman v. DaimlerChrysler, 579 F.3d 1088, 1094 (9th Cir. 2009), vacated on other grounds, 603 F.3d 1141 (9th Cir. 2010) (citations omitted).

The court "may not assume the truth of allegations in a pleading which are contradicted by affidavit." CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1073 (9th Cir. 2011) (quotations omitted); see also Amba Mktg. Sys., Inc. v. Jobar Int'l, Inc., 551 F.2d 784, 787 (9th Cir. 1977) (plaintiff "could not simply rest on the bare allegations of its complaint, but rather was obligated to come forward with facts, by affidavit or otherwise, supporting personal jurisdiction"). But, the court must resolve conflicts between the facts contained in the parties' affidavits in plaintiff's favor. Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004).

B. Discussion

Due process limits a court's power to "render a valid personal judgment against a nonresident defendant." See World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 291 (1980). Where a state authorizes "jurisdiction on any basis not inconsistent with the Constitution of this state or of the United States," as does California, see Cal. Civ. Proc. Code § 410.10, federal courts must determine whether the exercise of jurisdiction over a defendant "comports with the limits imposed by federal due process." Daimler AG v. Bauman, 571 U.S. 117, 126 (2014); see also Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011) ("California's long-arm statute . . . is coextensive with federal due process requirements, so the jurisdictional analyses under state law and federal due process are the same."). Due process requires that a nonresident defendant have sufficient "`minimum contacts' with the forum such that the assertion of jurisdiction `does not offend traditional notions of fair play and substantial justice.'" Pebble Beach, 453 F.3d at 1155 (quoting Int'l Shoe Co. v. Washington, 326 U.S. 310, 315 (1945)).

There are two categories of traditional personal jurisdiction a plaintiff can invoke: general and specific. Ranza v. Nike, Inc., 793 F.3d 1059, 1068 (9th Cir. 2015). "If the defendant's activities in the forum are substantial, continuous and systematic, general jurisdiction is available; in other words, the foreign defendant is subject to suit even on matters unrelated to his or her contacts to the forum." Doe v. Unocal Corp., 248 F.3d 915, 923 (9th Cir. 2001). The Supreme Court has held that the "paradigm forums" for the exercise of general jurisdiction are an individual's domicile and a corporation's place of incorporation and principal place of business. Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 924 (2011); see Daimler, 571 U.S. at 134. This is in contrast to specific jurisdiction, which "exists when a case arises out of or relates to the defendant's contacts with the forum." Ranza, 793 F.3d at 1068 (quotations and citations omitted). It "depends on an affiliation between the forum and the underlying controversy, principally, activity or an occurrence that takes place in the forum State and is therefore subject to the State's regulation." Id.

Federal Rule of Civil Procedure 4(k)(2), the nationwide jurisdiction provision, provides another avenue for a federal court to exercise personal jurisdiction if "the defendant is not subject to jurisdiction in any state's courts of general jurisdiction." Fed. R. Civ. P. 4(k)(2). Under Rule 4(k)(2), the focus is on the defendant's aggregate contacts with the United States as a whole, rather than the specific forum. Axiom Foods, Inc. v. Acerchem Int'l, Inc., 874 F.3d 1064, 1072 (9th Cir. 2017) (citation omitted).

Plaintiff asserts that this Court has specific jurisdiction over Defendants under both traditional principles of specific jurisdiction and Rule 4(k)(2). Dkt. No. 22 at 5; Dkt. No. 42 at 7. There is no dispute that the Court does not have general jurisdiction over Defendants. The Court addresses each argument in turn.

i. Evidence Regarding Personal Jurisdiction

In support of its motion to dismiss, Defendant Swyft submitted a declaration from Abdulaziz Al Omran, the Managing Director of Swyft. Dkt. No. 35-1 ("Al Omran Decl."). In his declaration, Mr. Al Omran explains that the Swyft app is an on-demand delivery service that allows users in Saudi Arabia and Bahrain to place delivery orders for goods, which include cosmetics, bicycle repair kits, and food. Id. ¶ 4. According to Mr. Al Omran, Swyft "does not provide services to anyone in the United States, nor has it attempted to do so." Id. ¶ 5. He further elaborates that Swyft does not have property, offices, bank accounts, or employees in the United States. Id. Mr. Al Omran also states that Swyft "is unaware of any of its data being stored on servers located in the United States." Id.

Defendant Pace did not submit any evidence to support the jurisdictional assertions in its motion to dismiss, and therefore the Court will not consider the uncorroborated factual allegations in Defendant Pace's motion.2

Plaintiff submitted a declaration from Rakan Dmairi, the Chief Sales Officer of Hungerstation. Dkt. No. 23-2 ("Dmairi Decl."). According to Mr. Dmairi's sworn declaration, Defendant Pace was aware that GitHub is a U.S.-based company with servers located in California, and Pace "independently partnered with GitHub to store Pace's copycat source code on GitHub's U.S. servers and signed contracts with GitHub that were governed by California law." Id. ¶ 25. Mr. Dmairi also states that Defendants knew Plaintiff's confidential data was stored on "U.S.-based servers," and Defendants accessed the confidential data stored on the Amazon Web Services' servers. Id. ¶¶ 31-32. Further, Mr. Dmairi asserts that Defendants contracted with Apple and Google to store their executable files on Apple and Google's California-based servers. Id. ¶¶ 29, 41. In doing so, Defendants entered into agreements with Apple and Google which, "upon information and belief, explicitly contained choice of law provisions stating that California laws would govern the agreements." Id. Defendants' apps were available for download on Apple's AppStore and Google Play. Id. ¶¶ 30, 41. Google Play removed the applications on October 7, 2019.3 Id. Plaintiff did not submit any evidence controverting Defendant Swyft's statement that Swyft does not provide services to anyone in the United States, or that Swyft does not have any property, bank accounts, or employees in the United States.

With these facts in mind, the Court turns to the jurisdictional analysis.

ii. Specific Personal Jurisdiction

Under Ninth Circuit caselaw, there are three requirements for a court to exercise specific jurisdiction over a nonresident defendant: "(1) the defendant must either `purposefully direct his activities' toward the forum or `purposefully avail[ ] himself of the privileges of conducting activities in the forum'; (2) `the claim must be one which arises out of or relates to the defendant's forum-related activities'; and (3) `the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.'" Axiom Foods, 874 F.3d at 1068-69 (quoting Dole Food Co., Inc. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002)). "The plaintiff bears the burden of satisfying the first two prongs of the test." Schwarzenegger, 374 F.3d at 802. If the plaintiff meets that burden, "the burden then shifts to the defendant to `present a compelling case' that the exercise of jurisdiction would not be reasonable." Id. (citation omitted).

For the first requirement, when a case sounds in tort, courts employ the "purposeful direction test," which is also referred to as the "effects" test from Calder v. Jones, 465 U.S. 783 (1984). Axiom, 874 F.3d at 1069. "[T]he `effects' test requires that the defendant allegedly have (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state." Dole Food, 303 F.3d at 1111.

1. Purposeful Direction

Plaintiff argues that Defendants purposefully directed their wrongful acts at California by (1) stealing Plaintiff's copyrighted source code and confidential data from servers they knew were located in the United States (owned by GitHub and Amazon Web Services); (2) copying the source code onto GitHub servers in the United States; (3) engaging with California-based companies (Apple and Google) to "store and distribute the stolen code" on California servers; and (4) using "California servers and companies to make its apps available in California and in various other countries around the world." Dkt. No. 22 at 5; Dkt. No. 42 at 7.

a. Expressly Aimed at Forum State4

To be satisfied, the express aiming inquiry requires "something more" than a foreign act with foreseeable effects in the forum state. Washington Shoe Co. v. A-Z Sporting Goods Inc., 704 F.3d 668, 675 (9th Cir. 2012) ("We have held that Calder `cannot stand for the broad proposition that a foreign act with foreseeable effects in the forum state always gives rise to specific jurisdiction.'" (citation omitted)). "Due process requires that a defendant be haled into court in a forum State based on his own affiliation with the State, not based on the `random, fortuitous, or attenuated' contacts he makes by interacting with other persons affiliated with the State." Walden v. Fiore, 571 U.S. 277, 286 (2014) (citations omitted). Here, the main question is whether Defendants' interactions with third parties (GitHub, Amazon, Google, and Apple) are sufficient to establish that they expressly aimed their conduct at California, or if instead these contacts are too random, fortuitous, or attenuated.

The Court finds that these connections are too fortuitous to establish that Defendants have purposefully directed their activities at California such that it would be reasonable to hale Defendants into court in this forum. Plaintiff's central argument for jurisdiction is that Defendants accessed servers owned by third parties that happen to be based in or have servers in California. But district courts in this circuit have held that the mere location of a third party or its servers is insufficient to give rise to personal jurisdiction. See, e.g., Republic of Kazakhstan v. Ketebaev, No. 17-CV-00246-LHK, 2017 WL 6539897, at *7 (N.D. Cal. Dec. 21, 2017) ("The mere fact that Google—the company that owns the servers—is headquartered in California is not enough to establish that Khrapunov, a Kazakh citizen who resides in Switzerland, expressly aimed his alleged conduct at California."); Rosen v. Terapeak, Inc., No. CV-15-00112-MWF (EX), 2015 WL 12724071, at *9 (C.D. Cal. Apr. 28, 2015) (fact that images at issue came from eBay and were taken off eBay's servers located in California was not sufficient to give rise to personal jurisdiction); Man-D-Tec, Inc. v. Nylube Products Co., LLC, No. CV-11-1573-PHX-GMS, 2012 WL 1831521, at *2 (D. Ariz. May 18, 2012) ("If the mere location of a server could create personal jurisdiction, any state where a server is located would have personal jurisdiction over any user of that server"); Browne v. McCain, 612 F.Supp.2d 1118, 1124 (C.D. Cal. 2009) (no jurisdiction over a defendant merely because of relationship with California-based YouTube, as presence of YouTube's servers in California was insufficient to establish personal jurisdiction); Doe v. Geller, 533 F.Supp.2d 996, 1009 (N.D. Cal. 2008) ("Such broad jurisdiction, premised solely on the happenstance that many internet companies that are not even parties to [the] litigation have offices in Silicon Valley, is unreasonable.").5

Plaintiff argues that "this case has more compelling facts" than the Ninth Circuit's unpublished opinion in DEX Sys., Inc. v. Deutsche Post AG, 727 F. App'x 276, 278 (9th Cir. Mar. 13 2018). Dkt. No. 22 at 5; Dkt. No. 42 at 8. The Court disagrees. In DEX, the Ninth Circuit found that the district court had specific jurisdiction. DEX, 727 F. App'x at 278. But the key factor distinguishing this case is that in DEX, the plaintiff itself had a server in California. Id. at 278. The fact that the software at issue "was located on DEX's California server was not merely a fortuitous occurrence," because the "software was located on California servers pursuant to an agreement reached by the parties." Id.; see also id. ("As agreed by the parties, DEX's server ... was located in California"). Here, in contrast, Plaintiff does not have a server in California, nor did any of the parties have control over where the identified third parties located their servers. As other courts in this circuit have held, the presence of servers in California (which may or may not host Plaintiff's source code or confidential data) is insufficient to find that Defendants expressly aimed their conduct at California. That these well-known Silicon Valley technology companies host client data from all over the world on servers located in California (and elsewhere in the United States) is pure happenstance. See Future World Elecs., LLC v. Results HQ, LLC, No. CV 17-17982, 2018 WL 2416682, at *3 (E.D. La. May 29, 2018) (distinguishing DEX and finding that "[h]ere, the location of the server" was "fortuitous," as there "is no indication that either plaintiff or defendants had any control over the server's location, or that the location had any bearing on defendants' conduct."). Plaintiff fails to provide, and the Court has not located, any case where the location of third-party servers, as opposed to servers affiliated with one of the parties, was sufficient to satisfy purposeful direction.6

In addition, that Defendants stored their own apps and source code on GitHub, Google, and Apple servers does not establish that Defendants expressly aimed their conduct at California such that California was the "focal point" of Defendants' actions and the harm suffered. See Axiom Foods, 874 F.3d at 1070-71. This is even more highlighted by the fact that Defendant Swyft's target market is in Saudi Arabia and Bahrain. See Al Omran Decl. ¶¶ 4-5; see also Bibiyan v. Marjan Television Network, Ltd., No. CV181866DMGMRWX, 2019 WL 422664, at *4 (C.D. Cal. Feb. 4, 2019) (that defendant's app is available on Google and Apple's store has "no bearing on whether Defendant intended to exploit the Persian music video viewership market in California"). Nor is it relevant that Defendants entered into agreements governed by California law with these third parties. See Rosen, 2015 WL 12724071, at *10 ("The Court is unpersuaded that [defendant's license agreement with eBay, by which it subjected itself to California law,] is a jurisdictionally relevant contact that is sufficiently related to either the forum or the claims to justify exercising personal jurisdiction."). Defendants' agreements are not relevant to the claims asserted by Plaintiff here, as Plaintiff is not even a party to the agreements.

Under Plaintiff's theory, the Northern District of California always would have jurisdiction in any case where a party hosts its data with a Silicon Valley company, even when that company is not a party to the litigation. "Federal courts sitting in California could assert personal jurisdiction over foreign defendants in wholly foreign disputes." Doe, 533 F. Supp. 2d at 1009. Here, all parties were formed under the laws of Saudi Arabia; all parties have their headquarters in Saudi Arabia; the apps at issue are for delivery services in Saudi Arabia and Bahrain; and Defendants do not have any property or employees in the United States. It would be unreasonable to hale Defendants into this forum merely because the parties contract with Bay Area technology companies to host their data, considering the lack of any other connection to this forum and to the United States in general. "The Northern District of California is not an international court of internet law." Id.7

The Court concludes that Plaintiff fails to allege facts showing that Defendants purposefully directed their activities at California.8 Because this ground is sufficient to conclude that Plaintiff has not established specific personal jurisdiction, the Court need not address the remaining factors.

iii. Nationwide Jurisdiction

The Court next turns to Plaintiff's argument that jurisdiction is appropriate under Rule 4(k)(2). During oral argument, Plaintiff argued that Rule 4(k)(2) was the easiest pathway to find jurisdiction here, given its concession as to the uncertainty of whether its source code was hosted on a GitHub server in California as opposed to in Washington or Virginia. Regardless, Plaintiff's invocation of Rule 4(k)(2) does not change the Court's prior analysis finding that exercise of jurisdiction in this case would be unreasonable.

To establish jurisdiction under Rule 4(k)(2), three requirements must be met:

Pebble Beach, 453 F.3d at 1159. "`The due process analysis under Rule 4(k)(2) is nearly identical to traditional personal jurisdiction analysis with one significant difference: rather than considering contacts between [the defendant] and the forum state, [the Court] consider[s] contacts with the nation as a whole.'" Axiom Foods, 874 F.3d at 1072 (quoting Holland Am. Line Inc. v. Wartsila N. Am., Inc., 485 F.3d 450, 462 (9th Cir. 2007)).

The Ninth Circuit has urged cautious application of Rule 4(k)(2). See Holland Am. Line, 485 F.3d at 462 ("Indeed, in the fourteen years since Rule 4(k)(2) was enacted, none of our cases has countenanced jurisdiction under the rule."). The Holland court noted that the "few cases in which our sister circuits have concluded that Rule 4(k)(2) conferred jurisdiction" involved much more extensive contacts with the United States. Id. As examples, the Ninth Circuit cited Mwani v. bin Laden, 417 F.3d 1, 13 (D.C. Cir. 2005) (upholding jurisdiction where defendants had engaged in numerous conspiracies to bomb the World Trade Center, the United Nations, and the Lincoln and Holland Tunnels), and Adams v. Unione Mediterranea Di Sicurta, 364 F.3d 646, 651 (5th Cir. 2004) (upholding personal jurisdiction where the defendant had directly insured hundreds of claims in the United States), as the rare cases finding jurisdiction under Rule 4(k)(2). Id.

Plaintiff incorporates its prior reasoning under the traditional personal jurisdiction analysis to support its position that Defendants have purposefully availed themselves of jurisdiction in the United States. Although the first two factors are satisfied, the third factor fails for the same reason as discussed in the Court's traditional jurisdiction analysis. The fact that a third party hosts data on its server somewhere in the United States does not amount to a meaningful contact sufficient to find that Defendants have purposefully availed themselves of the jurisdiction of the United States.

* * *

The Court finds that Plaintiff has not carried its burden of demonstrating that Defendants purposefully directed their activities towards California or the United States, and the Court thus does not have personal jurisdiction over Defendants. Since the determination that it lacks jurisdiction over Defendants is dispositive, the Court need not address the alternative arguments presented in Defendants' motions. The Court GRANTS Defendants' motions to dismiss for lack of personal jurisdiction.

III. MOTION FOR PRELIMINARY INJUNCTION

Because a district court does not have authority to grant a preliminary injunction when it lacks personal jurisdiction over defendants, the Court DENIES Plaintiff's motion for preliminary injunction on that basis alone. See Paccar Int'l, Inc. v. Commercial Bank of Kuwait, S.A.K., 757 F.2d 1058, 1066 (9th Cir. 1985) (vacating order granting preliminary injunction because the district court did not have personal jurisdiction); see also Carter v. Reese, No. C 12-5537 MMC, 2012 WL 5471886, at *1 (N.D. Cal. Nov. 9, 2012) ("A district court has no authority to grant relief in the form of temporary restraining order and permanent injunction where it has no jurisdiction over the parties.").

IV. CONCLUSION

For the reasons stated above, the Court GRANTS Defendants' motions to dismiss, Dkt. Nos. 12, 35; DENIES Plaintiff's motion for preliminary injunction, Dkt. No. 23; and GRANTS Plaintiff's administrative motion, Dkt. No. 45.

The Court DIRECTS the Clerk to terminate the case.

IT IS SO ORDERED.