LUCY H. KOH, District Judge.
The Republic of Kazakhstan ("Kazakhstan") alleges that Defendants Muratbek Ketebaev ("Ketebaev") and Ilyas Khrapunov ("Khrapunov"), Kazakh citizens who reside in Poland and Switzerland, respectively, hacked Kazakh government email accounts and published the contents of those accounts. Kazakhstan filed this suit against Defendants for violations of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030, and the Stored Communications Act ("SCA"), 18 U.S.C. § 2701 et seq. Before the Court is Defendant Khrapunov's motion to dismiss the second amended complaint. ECF No. 40. Having considered the submissions of the parties, the relevant law, and the record in this case, the Court GRANTS Khrapunov's motion to dismiss for lack of personal jurisdiction with leave to amend.
Kazakhstan alleges that it directed various Kazakh government officials to conduct official business using Gmail and Hotmail email accounts. Second Amended Complaint ("SAC"), ECF No. 33 ¶ 17. In or around November 2013, Khrapunov, a Kazakh citizen who resides in Switzerland, allegedly retained an Israel-based hacking firm to target Kazakh government employee email accounts, among other targets. Id. ¶¶ 7, 18, 86-88. Kazakhstan alleges that during a meeting in Geneva, Switzerland in November 2013, Nicolas Bourg, a longtime business associate and confidant of Khrapunov's, heard Khrapunov admit to his alleged involvement in the hacking. Id. ¶¶ 85-88. Among the Kazakh government officials whose Gmail and Hotmail accounts were hacked are Executive Secretary of the Ministry of Justice Marat Beketayev and Deputy Prosecutor General Andrey Kravchenko. Id. ¶ 16.
"In early August 2014, someone (upon information and belief, Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators) created an account with Mega," id. ¶ 42, a cloud-based service provider in New Zealand, id. ¶ 39. Kazakhstan alleges upon information and belief that Ketebaev, Khrapunov, or one or more of their co-conspirators uploaded the hacked materials onto the Mega website (the "Mega Archive"). Id. ¶ 43. On or about August 8, 2014, "[u]pon information and belief," "Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators" allegedly created the "Kazaword Website" at https://kazaword.wordpress.com. Id. ¶ 45. The Kazaword Website linked to the Mega Archive. Id. Other websites that have posted or referenced the hacked materials are Ketebaev's personal Facebook page, the website of the Kazakh newspaper Respublika, and Respublika's Facebook page. Id. ¶¶ 49-50. Irina Petrushova, the founder and editor-in-chief of the Respublika website, is married to Ketebaev. Id. ¶ 52. Some of the hacked materials posted by Respublika contain information from attorney-client email communications between Kazakh government officials and their attorneys at the New York-based firm Curtis, Mallet-Prevost, Colt & Mosle LLP. Id. ¶ 63.
On March 12, 2015, Kazakhstan filed a lawsuit in the United States District Court for the Southern District of New York against fictitiously named Does 1-100.
On August 4, 2015, Respublika filed a motion seeking clarification of the preliminary injunction. See ECF No. 40-1 at 2. Specifically, Respublika argued that the preliminary injunction should not apply to it because there was no allegation or proof that Respublika was involved in the hacking and because enforcing the preliminary injunction against Respublika would be an unconstitutional prior restraint of speech. Id. at 3. The court in the S.D.N.Y. hacking case agreed with Respublika and clarified that the preliminary injunction did not apply to Respublika. Id. at 5. The court's order was without prejudice to Kazakhstan reapplying for the imposition of an injunction if it obtained sufficient evidence to support such an order. Id. at 5-6.
On October 28, 2015, the court in the S.D.N.Y. hacking case granted Kazakhstan's motion for the issuance of a Letter of Request to depose Ketebaev in Poland. SAC ¶¶ 76-77. Kazakhstan deposed Ketebaev on June 7, 2016. Id. ¶ 78. At the deposition, Ketebaev declined to testify based on his right to avoid self-incrimination. Id. ¶¶ 79-83.
On January 17, 2017, Kazakhstan voluntarily dismissed the S.D.N.Y. hacking case without prejudice. Id. ¶ 84.
In addition to the S.D.N.Y. case, there are at least two cases brought by the City of Almaty against Khrapunov, among other defendants. The first case, City of Almaty v. Khrapunov, No. 2:14-cv-3650-FMO-CW (C.D. Cal.), is a RICO action filed in the Central District of California that seeks to recover funds allegedly stolen by Khrapunov's stepfather when Khrapunov's stepfather was the mayor of Almaty. On October 25, 2017, Khrapunov moved to dismiss the RICO action for lack of personal jurisdiction. City of Almaty v. Khrapunov, No. CV-14-3650, Docket 164 (C.D. Cal. Oct. 25, 2017). The motion is still pending.
The second case, City of Almaty v. Ablyazov, No. 1:15-cv-5345-AJN-KHP (S.D.N.Y.), was filed by the City of Almaty and the leading bank in Kazakhstan to recover money allegedly stolen by Khrapunov's father-in-law. Khrapunov has appeared in this case and actively litigated it. See, e.g., Docket 503, The Khrapunovs' Proposed Finding of Facts in Support of Their Post-Hearing Brief (S.D.N.Y. Dec. 16, 2017). Evidence in this Ablyazov case shows that between 2012 and 2016, a company controlled by Khrapunov owned two homes in Beverly Hills. He has since sold both homes. See Semmelman Decl. ¶ 16. The evidence in the Ablyazov case also shows that Khrapunov, through companies that Kazakhstan alleges are sham entities, has invested tens of millions of dollars in real estate in Cinicinnati, Ohio, and Syracuse and New York City, New York. Id. ¶¶ 17-22.
On January 18, 2017—one day after dismissing the S.D.N.Y. hacking case—Kazakhstan filed a complaint in the Northern District of California against Ketebaev. ECF No. 1. On January 20, 2017, Kazakhstan filed a first amended complaint adding Khrapunov as a defendant. ECF No. 8. On June 9, 2017, Kazakhstan filed a certificate of service as to Khrapunov. ECF No. 24. On June 30, 2017, Khrapunov filed a motion to dismiss the first amended complaint. ECF No. 27. On August 15, 2017, Kazakhstan filed a certificate of service as to Ketebaev. ECF No. 29.
On August 21, 2017, Kazakhstan and Khrapunov filed a stipulation allowing Kazakhstan to file a second amended complaint. ECF No. 31. On August 22, 2017, the Court granted the stipulation allowing Kazakhstan to file a second amended complaint and denied the motion to dismiss the first amended complaint as moot. ECF No. 32. Also on August 22, 2017, Kazakhstan filed its second amended complaint. ECF No. 33.
On October 9, 2017, Khrapunov filed the instant motion to dismiss the second amended complaint. ECF No. 40 ("Mot."). On October 25, 2017, the Court held a case management conference and stayed all discovery pending resolution of the motion to dismiss. ECF No. 55. On November 9, 2017, Kazakhstan filed an opposition to the motion to dismiss. ECF No. 62 ("Opp."). On November 29, 2017, Khrapunov filed a reply. ECF No. 65 ("Reply"). Ketebaev has not yet appeared in the case.
Where a defendant moves to dismiss a suit for lack of personal jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(2), the plaintiff bears the burden of establishing that jurisdiction is proper. Boschetto v. Hansing, 539 F.3d 1011, 1015 (9th Cir.2008). Where, as here, the defendant's motion is based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts to withstand a motion to dismiss for lack of personal jurisdiction. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir.2011) (citing Brayton Purcell LLP v. Recordon & Recordon, 606 F.3d 1124, 1127 (9th Cir.2010)). At this stage of the proceeding, "uncontroverted allegations in plaintiff's complaint must be taken as true, and conflicts between the facts contained in the parties' affidavits must be resolved in plaintiff's favor." Brayton Purcell, 606 F.3d at 1127 (internal quotation marks, citations, and alterations omitted).
Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend "shall be freely granted when justice so requires," bearing in mind "the underlying purpose of Rule 15 to facilitate decision on the merits, rather than on the pleadings or technicalities." Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (ellipses omitted). However, a court "may exercise its discretion to deny leave to amend due to `undue delay, bad faith or dilatory motive on part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party . . ., [and] futility of amendment.'" Carvalho v. Equifax Info. Servs., LLC, 629 F.3d 876, 892-93 (9th Cir. 2010) (alterations in original) (quoting Foman v. Davis, 371 U.S. 178, 182 (1962)).
To determine the propriety of asserting personal jurisdiction over a nonresident defendant, the Court examines whether such jurisdiction is permitted by the applicable state's long-arm statute and comports with the demands of federal due process. Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements, Ltd., 328 F.3d 1122, 1128-29 (9th Cir. 2003). Because California's long-arm statute, Cal. Civ. Proc. Code § 410.10, is coextensive with federal due process requirements, the jurisdictional analyses under state law and federal due process are the same. See Cal. Civ. Proc. Code § 410.10 ("[A] court of this state may exercise jurisdiction on any basis not inconsistent with the Constitution of this state or of the United States."). For a court to exercise personal jurisdiction over a nonresident defendant consistent with due process, that defendant must have "certain minimum contacts" with the relevant forum "such that the maintenance of the suit does not offend `traditional notions of fair play and substantial justice.'" Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (quoting Milliken v. Meyer, 311 U.S. 457, 463 (1940)). In addition, "the defendant's `conduct and connection with the forum State' must be such that the defendant `should reasonably anticipate being haled into court there.'" Sher v. Johnson, 911 F.2d 1357, 1361 (9th Cir.1990) (quoting World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980)).
A federal court may exercise either general or specific jurisdiction over a nonresident defendant. Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 801-02 (9th Cir. 2004). In addition, a defendant can consent to a court's jurisdiction. Finally, Federal Rule of Civil Procedure 4(k)(2) "permits a federal court to exercise personal jurisdiction over a defendant if `the defendant is not subject to jurisdiction in any state's courts of general jurisdiction,' and `exercising jurisdiction is consistent with the United States Constitution and laws.'" Axiom Foods, Inc. v. Acerchem Int'l, Inc., 874 F.3d 1064, 1072 (9th Cir. 2017) (quoting Fed. R. Civ. P. 4(k)(2)). The Court addresses these possible bases for personal jurisdiction in turn.
The Court may exercise general jurisdiction over a defendant who is domiciled in the forum state. Panavision Int'l, L.P. v. Toeppen, 141 F.3d 1316, 1320 (9th Cir. 1998). Additionally, general jurisdiction over a nonresident exists where a defendant has "continuous and systematic" contacts with the forum state such that the defendant may be "haled into court in the forum state to answer for any of its activities anywhere in the world." Schwarzenegger, 374 F.3d at 801. The SAC does not allege that Khrapunov is or was domiciled in California. Specifically, the fact that Khrapunov or entities controlled by him once owned houses in California does not mean that Khrapunov was domiciled in California without a showing that Khrapunov lived in California and intended to stay there. See Mississippi Band of Choctaw Indians v. Holyfield, 490 U.S. 30, 48 (1989) ("For adults, domicile is established by physical presence in a place in connection with a certain state of mind concerning one's intent to remain there."). In fact, the SAC alleges that Khrapunov resides in Switzerland. SAC ¶ 7.
The SAC also does not allege that Khrapunov has the level of continuous and systematic contacts with California that would support a finding of general jurisdiction. Although Kazakhstan appears to advance a general jurisdiction argument in its opposition to the motion to dismiss, see Opp. at 15-21, the Court finds that this argument is more properly analyzed under Federal Rule of Civil Procedure 4(k)(2), which the Court discusses in more detail in Section III.A.4., below. Accordingly, Khrapunov is not subject to this Court's general jurisdiction.
Where general jurisdiction is inappropriate, a court may still exercise specific jurisdiction where the nonresident defendant's "contacts with the forum give rise to the cause of action before the court." Doe v. Unocal Corp., 248 F.3d 915, 923 (9th Cir. 2001). "The inquiry whether a forum State may assert specific jurisdiction over a nonresident defendant focuses on the relationship among the defendant, the forum, and the litigation." Axiom Foods, 874 F.3d at 1068 (quoting Walden v. Fiore, 134 S.Ct. 1115, 1121 (2014)). The Ninth Circuit recently explained that "[t]wo principles animate the defendant-focused inquiry." Id. at 1068 (internal quotation marks omitted). "First, the relationship between the nonresident defendant, the forum, and the litigation `must arise out of contacts that the defendant himself creates with the forum state." Id. (quoting Walden, 134 S. Ct. at 1122). "Second, the minimum contacts analysis examines `the defendant's contacts with the forum State itself, not the defendant's contacts with persons who reside there." Id. (quoting Walden, 134 S. Ct. at 1122). "It follows that `a defendant's relationship with a plaintiff or third party, standing alone, is an insufficient basis for jurisdiction.'" Id. (quoting Walden, 134 S. Ct. at 1123).
"While `a single act can support jurisdiction'" in a tort case, "the act must first `create[] a substantial connection with the forum.'" Id. (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 n.18 (1985) (alteration in original) (internal quotation marks omitted)). "Put differently, `some single or occasional acts related to the forum may not be sufficient to establish jurisdiction if their nature and quality and the circumstances of their commission create only an attenuated affiliation with the forum.'" Id. (quoting Burger King, 471 U.S. at 475 n.18 (internal quotation marks omitted)). "A defendant's `random, fortuitous, or attenuated contacts' will not suffice." Id. (quoting Walden, 134 S. Ct. at 1123) (internal quotation marks omitted).
To determine whether a defendant's contacts with the forum state are sufficient to establish specific jurisdiction, the Ninth Circuit employs a three-part test:
Morrill v. Scott Financial Corp., 873 F.3d 1136, 1142 (9th Cir. 2017) (quoting Schwarzenegger, 374 F.3d at 802). Kazakhstan bears the burden of satisfying the first two prongs. Id. If Kazakhstan does so, then the burden shifts to Khrapunov to "set forth a `compelling case' that the exercise of jurisdiction would not be reasonable." CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1076 (9th Cir.2011) (quoting Burger King, 471 U.S. at 477-78). The Court addresses the three prongs in turn.
For causes of action sounding in tort, like those in the instant case, the Court applies the purposeful direction test, rather than the purposeful availment test, which generally applies to claims arising from a contract. See Axiom Foods, 874 F.3d at 1069 ("Where, as here, a case sounds in tort, we employ the purposeful direction test."); Morrill, 873 F.3d at 1142 ("We generally apply the purposeful availment test when the underlying claims arise from a contract, and the purposeful direction test when they arise from alleged tortious conduct."). The purposeful direction test, "often referred to as the `effects' test, derives from Calder v. Jones, 465 U.S. 783 (1984)." Axiom Foods, 874 F.3d at 1069. To satisfy the Calder purposeful direction test, "[t]he defendant must have (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state." Id. (internal quotation marks omitted). Khrapunov concedes that Kazakhstan has alleged that he committed an intentional act, which satisfies the first prong of the Calder purposeful direction test. See Mot. at 18. However, Khrapunov contends that Kazakhstan has failed to satisfy the second or third prongs of the Calder test. Id.
The second prong of the purposeful direction inquiry is whether the defendant expressly aimed his act at the forum state. Dole Food Co. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002). The "express aiming" analysis "depends, to a significant degree, on the specific type of tort or other wrongful conduct at issue." Picot v. Weston, 780 F.3d 1206, 1214 (9th Cir. 2015) (quoting Schwarzenegger, 374 F.3d at 807). To be satisfied, the "express aiming" inquiry requires "something more" than "a foreign act with foreseeable effects in the forum state." A-Z Sporting, 704 F.3d at 675 (citing Bancroft & Masters, Inc. v. Augusta Nat'l Inc., 223 F.3d 1082, 1087 (9th Cir.2000)). For instance, the delivery or consumption of products in the forum state that are "random," "fortuitous," or "attenuated" does not satisfy the express aiming analysis. Mavrix Photo, 647 F.3d at 1230 (quoting Burger King, 471 U.S. at 486).
In Walden, which the United States Supreme Court decided in 2014, a police officer at the airport in Atlanta confiscated money from two Nevada-bound passengers. 134 S. Ct. at 1119. The United States Supreme Court held that the police officer's knowledge that his actions would cause harm to the plaintiffs in Nevada was not enough for a court in Nevada to exercise personal jurisdiction over the police officer. Id. The United States Supreme Court stressed that personal jurisdiction arises out of a defendant's own contacts with the forum state, not out of a plaintiff's or third party's contacts with the forum state. Id. at 1121-22. "To be sure, a defendant's contacts with the forum State may be intertwined with his transactions or interactions with the plaintiff or other parties. But a defendant's relationship with a plaintiff or third party, standing alone, is an insufficient basis for jurisdiction." Id. at 1123. Although the United States Supreme Court explicitly acknowledged that the facts of Walden "d[id] not present the very different questions whether and how a defendant's virtual `presence' and conduct translate into `contacts' with a particular State," 134 S. Ct. at 1125 n.9, the Ninth Circuit in Axiom Foods applied Walden to analyze whether emails sent to recipients in a forum state, without more, conferred personal jurisdiction.
Axiom Foods involved the distribution of an email newsletter that violated several trademarks to 343 email recipients, 55 of whom had companies in California and 10 of whom were physically located in California. The Ninth Circuit first rejected as too attenuated the fact that 55 recipients had companies in California, particularly where there was no information about the residence of those recipients or the legal or operational relationships between those recipients and their companies. 874 F.3d at 1070. Focusing on the 10 recipients who were physically located in California, the Ninth Circuit held that "[i]t can hardly be said that California was the focal point both of the newsletter and of the harm suffered." Id. at 1070-71 (internal quotation marks and alterations omitted). The Ninth Circuit stressed that sending one newsletter to a maximum of 10 recipients located in California, in a market where the defendant had no sales or clients, "barely connected [the defendant] to California residents, much less to California itself." Id. at 1071.
Thus, Axiom Foods did not explicitly answer how Walden applies to cases where all of the alleged activity occurs online—particularly in cases, like the instant case, where there are no specific allegations about the physical location of the affected computers or servers. However, the Axiom Foods decision does suggest that minimal online activity, when unaccompanied by any connections to the forum state in the physical world, are not enough to confer personal jurisdiction.
At least one court in this district has explicitly concluded the express aiming analysis is the same whether the intentional tort was committed via the internet or in "the non-virtual world." Erickson v. Nebraska Machinery Co., 2015 WL 4089849, at *4 (N.D. Cal. July 6, 2015). In Erickson, the district court concluded that a defendant who posted a California plaintiff's copyrighted images on its website did not expressly aim its conduct at California. Id. The district court reasoned that "[t]he mere act of copying Erickson's photographs and posting them on NMC's website did not involve entering California, contacting anyone in California, or otherwise reaching out to California." Id. Similarly, in Caracal Enterprises LLC v. Suranyi, 2017 WL 446313, at *2-3 (N.D. Cal. Feb. 2, 2017), another court in this district found that the Calder test was not satisfied where "the only claimed contact between [the defendant] and California is the fact that [the defendant] allegedly misappropriated" a software program licensed by a California company. Accord NexGen HBM, 2017 WL 4040808, at *1-5, 10-14 (finding that the express aiming component of the Calder test was not satisfied in case where defendants allegedly misappropriated trade secrets and committed other intentional torts by accessing a Minneosta-based company's website where there was no evidence that the defendants knew the company was based in Minnesota or intended the effects to be felt there).
In the instant case, Kazakhstan alleges that Khrapunov expressly aimed actions at California by hacking the Gmail accounts. See SAC ¶ 27; Opp. at 22. Specifically, Kazakhstan alleges that Google, which provides Gmail as a cloud-based email service, is headquartered in Mountain View, California. SAC ¶ 27. Kazakhstan does not allege that Khrapunov hacked any particular server in any particular location. Rather, Kazakhstan acknowledges that Google's servers that store its users' emails "can be located anywhere in the world." Id. ¶ 30. Kazakhstan also states that "the majority of [Google's] data centers (where its servers are located) are in the United States" without further specifying the location of any of the servers, let alone the location of the servers alleged to have been hacked by Khrapunov, who resides in Switzerland. Id. ¶ 29. Nevertheless, Kazakhstan contends that Khrapunov expressly aimed his actions at California because Google maintains control of Gmail data in California, even if the data are located throughout the world. See Opp. at 22 & n.13.
The Court finds that Kazakhstan has not sufficiently established that the hacking involved "entering California, contacting anyone in California, or otherwise reaching out to California." Erickson, 2015 WL 4089849, at *4. In fact, based on the allegations of the SAC, the servers containing the hacked information could "be located anywhere in the world." SAC ¶ 30. There is no allegation that Khrapunov believed the servers to be located in California, nor is there an allegation that the servers were actually located in California. The mere fact that Google—the company that owns the servers—is headquartered in California is not enough to establish that Khrapunov, a Kazakh citizen who resides in Switzerland, expressly aimed his alleged conduct at California. See NexGen HBM, 2017 WL 4040808, at *10-14; Caracal Enterprises, 2017 WL 446313, at *2-3. Indeed, in Walden, the United States Supreme Court reiterated that "[d]ue process requires that a defendant be haled into court in a forum State based on his own affiliation with the State, not based on the `random, fortuitous, or attenuated' contacts he makes by interacting with other persons affiliated with the State." 134 S. Ct. at 1123. Applied to the instant case, Walden makes clear that Google's relationship with California is not enough to confer personal jurisdiction over Khrapunov, who resides in Switzerland and whose personal actions, based on the allegations in the SAC, appear to have occurred entirely outside California.
Indeed, "[i]t can hardly be said that California was the focal point" of the hacking. Axiom Foods, 874 F.3d at 1070-71. If anything, the location of Google's corporate headquarters appears to be "random," "fortuitous," or "attenuated" to Khrapunov's alleged actions and intent: hiring an Israeli company to hack Kazakh government emails stored on a server in an unknown location and posting those hacked emails for consumption by people in Kazakhstan. See Mavrix Photo, 647 F.3d at 1230; see also Morrill, 873 F.3d at 1145 (stating that the foreseeability of some incidental harm in the forum state does not show express targeting and "obscures the reality that none of [the] challenged conduct has anything to do with [the forum state] itself" (alterations in original)); Doe v. Geller, 533 F.Supp.2d 996, 1007 (N.D. Cal. 2008) ("although the takedown notice was sent to [YouTube in] California, it was not aimed at any California resident").
Foreseeable harm is the third prong of the purposeful direction inquiry. "Harm suffered in the forum state is a necessary element in establishing purposeful direction." Morrill, 873 F.3d at 1144. There is foreseeable harm when a jurisdictionally sufficient amount of harm is suffered in the forum state. Yahoo! Inc. v. La Ligue Contre Le Racisme Et Antisemitisme, 433 F.3d 1199, 1207 (9th Cir. 2006). However, "[t]he foreseeability of injury in a forum" alone is not enough to confer personal jurisdiction in that forum. Axiom Foods, 874 F.3d at 1070.
In terms of the location of the harm, Kazakhstan contends in the SAC only that Kazakhstan and third parties, including Google, were harmed in the United States. SAC ¶ 36. In its opposition to the motion to dismiss, Kazakhstan clarifies that Kazakhstan "suffered harm in California" when Khrapunov allegedly accessed Google's servers. Opp. at 21. However, Kazakhstan does not explain how it suffered harm in California. See id. Relying on a single case from the District of Oregon, Kazakhstan argues that it can rely on harm to third parties to establish personal jurisdiction over Khrapunov. See id. at 23 (citing Capsugel Belgium NV v. Bright Parma Caps, Inc., 3:15-cv-321-PK, 2015 WL 7185463 (D. Or. Nov. 13, 2015)). Thus, Kazakhstan alleges that Khrapunov "had reason to foresee that the conduct would result in harm in California to Google." Id. Specifically, Kazakhstan argues that because Google has disclosed in SEC filings that phishing attacks cause Google "significant legal and financial exposure, damage to our reputation, and a loss of confidence in the security of our products and services," the hacking in this case harmed Google, upon which Kazakhstan can rely to satisfy the foreseeable harm prong of the Calder test.
In Doe v. Geller, another court in this district dealt with a similar argument. In Doe, a Pennsylvania-based plaintiff filed suit in the Northern District of California for claims arising out of a United Kingdom-based defendant's sending of a copyright takedown notice to YouTube, which is based in California. 533 F. Supp. 2d at 1005. The defendant in Doe had no other contacts with California besides sending the takedown notice to YouTube. The district court reasoned that "plaintiff's claimed injuries are more likely to be suffered in Pennsylvania," rather than California. Id. at 1006. However, the district court noted that purposeful direction caselaw did not easily apply to these facts: "Plaintiffs rarely claim an injury in a state other than their home state, and plaintiffs rarely allege the kind of . . . electron-based injuries that [plaintiff] alleges here." Id. If anything, the facts in Doe contained a stronger case for foreseeable harm in California than the facts of the instant case because the defendants' takedown notice in Doe was delivered to California-based YouTube and required California-based YouTube to take action, whereas the location of the servers in the alleged hacking in this case is unknown.
In a separate part of its analysis, the district court in Doe also noted the unreasonable practical implications of crediting the plaintiff's theory of personal jurisdiction:
Id. at 1009.
Indeed, other district courts have relied on similar reasoning—that "the `fortuitous' presence of a server" or contacts with California-based technology companies that are not parties to the litigation are not enough to confer personal jurisdiction. Rosen, 2015 WL 1272407, at *9 (availability of app in California-based Apple's App Store, use of California-based eBay servers, and license from eBay were insufficient to confer personal jurisdiction in California); Project DOD, Inc. v. Federici, 2009 WL 4910320, at *8 (D. Me. Dec. 13, 2009) (expressing uncertainty about the importance of the location of a web host in a copyright case where the plaintiff and defendants reside in different states); Browne v. McCain, 612 F.Supp.2d 1118, 1124 (C.D. Cal. 2009) (relationship with California-based YouTube and presence of YouTube servers in California insufficient to confer personal jurisdiction in California); Chang v. Virgin Mobile USA, LLC, No. CIV.A.3:07-CV-1767-D, 2009 WL 111570, at *3 (N.D. Tex. Jan. 16, 2009) (plaintiffs "cannot rely on the fortuitous location of Flickr's servers to establish personal jurisdiction over Virgin Australia").
These cases—where the technology company at issue is not a party to the litigation—are distinguishable from cases where the technology company itself brings suit based on its own alleged harms. See, e.g., Morill, 873 F.3d at 1148 ("Our analysis does not conflict with the well-established rule . . . that, when a defendant engages in tortious activity toward a plaintiff in the state where that plaintiff resides, the defendant is subject to personal jurisdiction there."); Automattic Inc. v. Steiner, 82 F.Supp.3d 1011, 1024 (N.D. Cal. Mar. 2, 2015) (finding sufficient foreseeable harm where technology company itself alleged reputational harm and wasted time and resources dealing with meritless takedown notices); NetApp, Inc. v. Nimble Storage, Inc., 41 F.Supp.3d 816, 826 (N.D. Cal. 2014) (finding sufficient foreseeable harm where technology company asserted that defendant knew its location and targeted it intentionally). Indeed, in Bristol-Myers Squibb Co. v. Superior Court of California, San Francisco County, 137 S.Ct. 1773 (2017), the United States Supreme Court recently explained that California courts could not exercise personal jurisdiction over nonresidents' claims over a nonresident defendant, even where resident defendants could bring similar claims. Id. at 1781.
Here, Kazakhstan has not carried its burden of showing that Khrapunov's alleged hiring of an Israeli firm to hack Kazakh officials' email accounts caused harm to Kazakhstan in California, let alone that Khrapunov knew that any such harm would occur in California. Moreover, the Court declines to allow Kazakhstan to rely on some alleged de minimis injury to Google—which is not a party to this suit—to establish personal jurisdiction over a Kazakh citizen defendant who resides in Switzerland and who has no other alleged contacts to California. If such a theory of injury were permitted, than this Court would have jurisdiction over any case arising from any wrongful conduct on Gmail, Google, Facebook, Twitter, or YouTube, to name just a few of the technology companies headquartered in this district, whether or not those companies are parties to the dispute and whether or not the defendants in such cases have any other contacts to California. As then-Chief Judge Walker reasoned in Doe, such a result cannot be squared with the traditional concept of specific personal jurisdiction.
Accordingly, the Court concludes that Kazakhstan has not shown that Khrapunov foresaw that the alleged hacking would cause harm in California. As such, Kazakhstan has not satisfied the second or third prongs of the Calder purposeful direction test, and thus Kazakhstan has failed to meet the first part of the Ninth Circuit's three-part test for specific jurisdiction.
Under the second prong of the Ninth Circuit's analysis for specific jurisdiction, the Court must determine whether Kazakhstan's claims arise from or are related to Khrapunov's forum-related activities. This inquiry turns on whether Kazakhstan "would not have been injured `but for'" Khrapunov's alleged misconduct. Panavision, 141 F.3d at 1322. To the extent that the hacking of the Kazakh officials' Gmail accounts is a forum-related activity—a point on which the Court has doubts, as explained above—Kazakhstan's claims arise from that forum-related activity. If the Gmail accounts had never been hacked, Kazakhstan would not have been injured. However, the Court need not resolve whether the hacking was a forum-related activity because the Court finds that the first and third prongs of the test for specific jurisdiction are not satisfied, as explained above and below.
Even if the first two prongs for specific jurisdiction are met, the third prong requires that "the exercise of personal jurisdiction must be reasonable." Panavision, 141 F.3d at 1322. In analyzing reasonableness, the Ninth Circuit considers seven factors: "(1) the extent of a defendant's purposeful interjection; (2) the burden on the defendant in defending in the forum; (3) the extent of conflict with the sovereignty of the defendant's state; (4) the forum state's interest in adjudicating the dispute; (5) the most efficient judicial resolution of the controversy; (6) the importance of the forum to the plaintiff's interest in convenient and effective relief; and (7) the existence of an alternative forum." Id. at 1323 (citing Burger King, 471 U.S. at 476-77).
With regard to the first factor, "[e]ven if there is sufficient `interjection' into the state to satisfy the [purposeful direction prong], the degree of interjection is a factor to be weighed in assessing the overall reasonableness of jurisdiction under the [reasonableness prong]." Ins. Co. of N. Am. v. Marina Salina Cruz, 649 F.2d 1266, 1271 (9th Cir. 1981). "The smaller the element of purposeful interjection, the less is jurisdiction to be anticipated and the less reasonable is its exercise." Id. In Doe, the district court found that sending a single takedown notice to YouTube was not a significant interjection into California. As a result, the court in Doe found that the first factor weighed against exercising jurisdiction. Here, the extent of Khrapunov's purposeful interjection into California was not substantial. It consisted only of the alleged hacking of several Gmail addresses belonging to Kazakh officials, and it is not even clear that the hacking actually had any connection to California, other than the fact that Google is headquartered in California. The first factor weighs against exercising jurisdiction.
The second factor, the burden on the defendant, addresses the logistical challenges for a defendant to litigate in the forum state. "The unique burdens placed upon one who must defend oneself in a foreign legal system should have significant weight in assessing the reasonableness of stretching the long arm of personal jurisdiction over national borders." Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 1132 (9th Cir. 2003) (quoting Asahi Metal Ind. v. Superior Court, 480 U.S. 102, 114 (1987)). However, "[m]odern means of communication and transportation have tended to diminish the burden of defense of a lawsuit in a distant forum." Ins. Co., 649 F.2d at 1271. In Insurance Co., the Ninth Circuit found that this factor weighed against exercising jurisdiction over a Mexican defendant in Alaska because the distance between the defendant and the forum was significant, transporting witnesses and evidence to the forum would be problematic, and testimony and documents would need to be translated. Id. at 1271-72. The Ninth Circuit acknowledged that the inconvenience burdens would be symmetrical if the case were instead litigated in defendant's home forum, but the Ninth Circuit observed that "[t]he law of personal jurisdiction . . . is asymmetrical. The primary concern is for the burden on a defendant. If the burdens of trial are too great for a plaintiff, the plaintiff can decide not to sue or, perhaps, to sue elsewhere. A defendant has no such luxury. The burdens on a defendant are of particular significance if, as here, the defendant has done little to reach out to the forum state." Id. at 1272. Similarly, in Doe, the court found that the burden on British defendants of litigating in California weighed slightly against exercising jurisdiction where the parties were also engaged in a separate suit in Pennsylvania. 533 F. Supp. 2d at 1008.
Here, Khrapunov resides in Switzerland. The burden on him to litigate this case in California would be significant in terms of travel, transportation of witnesses, and translation of evidence. Although Kazakhstan would suffer similar inconveniences, it is Kazakhstan that chose this forum, and so any inconvenience to Kazakhstan would not neutralize the burden on Khrapunov. In addition, Khrapunov would be burdened by adding another forum in addition to the cases he is already defending against Kazakhstan or its political subdivisions in New York and the Central District of California. See SAC ¶¶ 56, 59; Doe, 533 F. Supp. 2d at 1008 ("Litigation in California would force Explorologist to fight a two-front war in the United States . . . ."). Accordingly, the second factor weighs slightly against exercising jurisdiction in this case.
"This factor concerns the extent to which the district court's exercise of jurisdiction in California would conflict with the sovereignty of [Switzerland], [Khrapunov's] state of domicile." Panavision, 141 F.3d at 1323. "Litigation against an alien defendant creates a higher jurisdictional barrier than litigation against a citizen from a sister state because important sovereignty concerns exist." Harris Rutsky, 328 F.3d at 1133 (quoting Sinatra v. National Enquirer, 854 F.2d 1191, 1199 (9th Cir. 1988)). However, this factor is not controlling. Id. In Harris Rutsky, the Ninth Circuit presumed that the United Kingdom had a particular interest in adjudicating a suit with British defendants arising out of conduct that took place in London, even where defendants presented no evidence of the United Kingdom's interest. Id. Similarly, the court in Doe assumed that England had a sovereign interest in adjudicating a claim against a British resident. 533 F. Supp. 2d at 1008. Here, the Court assumes that Switzerland has a sovereign interest in adjudicating a dispute involving one of its residents. This factor weighs slightly against exercising jurisdiction.
Although "California maintains a strong interest in providing an effective means of redress for its residents tortiously injured," Panavision, 141 F.3d at 1323, here no California resident is a party to the instant suit. Thus, no California resident is seeking redress through this suit. Rather, this suit is between a sovereign nation in Central Asia and one of its citizens who resides in Switzerland. California has little interest in adjudicating this suit. Even New York, where the previous related case was litigated for two years, has more of an interest in adjudicating this case, because Kazakhstan's New York-based lawyers arguably suffered harm with the publication of the hacked attorney-client privileged communications. As a result, the fourth factor weighs against this Court exercising jurisdiction.
"This factor focuses on the location of the evidence and witnesses. It is no longer weighed heavily given the modern advances in communication and transportation." Panavision, 141 F.3d at 1324. Kazakhstan argues that Google's and Microsoft's witnesses reside in the United States, making California an appropriate forum. However, although the parties do not identify other potential witnesses, the Court assumes that some Kazakh government witnesses would also be called. In addition, to the extent that it is appropriate to consider other factors that contribute to efficiency, the Court notes that Kazakhstan previously litigated the same hacking for two years in the Southern District of New York before voluntarily dismissing that case and filing the instant case in California the very next day. If Kazakhstan were truly concerned with efficient resolution of this case, continuing to pursue the case in New York would have been more efficient than starting over in a new forum after two years of litigation that included discovery. See Doe, 533 F. Supp. 2d at 1009 (finding that the most efficient resolution would be in the Eastern District of Pennsylvania, where the court had already ruled on substantive motions and where discovery was already underway). The efficient resolution factor weighs strongly against this Court exercising jurisdiction.
"Consideration should also be given to the plaintiff's interest in obtaining convenient and effective relief." Ins. Co., 649 F.2d at 1273 (internal quotation marks omitted). However, the Ninth Circuit has cautioned that this factor should not weigh heavily in the analysis. See Harris Rutsky, 328 F.3d at 1133; Panavision, 141 F.3d at 1324. The only reason that Kazakhstan offers for preferring California is that a U.S. court is best positioned to enforce the CFAA and SCA. Opp. at 26. That may be so, and may weigh slightly against litigating this case in Switzerland. But the Southern District of New York, where Kazakhstan previously litigated a case related to the same hacking for two years before voluntarily dismissing that case and filing the instant case in the Northern District of California the very next day, is just as well positioned as this court is to enforce the CFAA and SCA. This factor is thus neutral.
Finally, the Court "must determine whether an adequate alternative forum exists. The plaintiff bears the burden of proving the unavailability of an alternative forum." Harris Rutsky, 328 F.3d at 1133-34. Khrapunov offers Switzerland as an adequate alternative forum because he resides there and agrees to submit to service of process there. Mot. at 21. Kazakhstan tries to shift the burden to Khrapunov by arguing that Khrapunov has not adequately identified an alternative forum that can provide relief. Opp. at 26. However, the parties do not address why the Southern District of New York would not be an adequate alternative forum. As discussed above, Kazakhstan originally brought suit related to the same hacking in the Southern District of New York and litigated the case there for two years, including by taking discovery. Also as discussed above, the Southern District of New York is just as well positioned as this Court is to adjudicate CFAA and SCA claims. Moreover, as Kazakhstan itself acknowledges, Khrapunov has been actively litigating cases in the Southern District of New York, which shows that he is subject to personal jurisdiction in New York. See id. at 18 (citing City of Almaty v. Ablyazov, No. 15-CV-5345 (AJN) (S.D.N.Y), in which Khrapunov has appeared and actively litigated). Thus, the Court concludes that at a minimum, the Southern District of New York offers an adequate alternative forum. Accordingly, this factor weighs strongly against exercising jurisdiction.
Kazakhstan argues for the first time in its opposition to the motion to dismiss that Khrapunov consented to jurisdiction in California by virtue of agreeing to the WordPress Terms of Service when he created the Kazaword Website, which contains a forum selection clause requiring disputes to be litigated in San Francisco County, California. Opp. at 24-25. However, the SAC does not clearly allege that Khrapunov himself consented to the WordPress Terms of Service. Rather, the SAC alleges upon information and belief that "the Kazaword Website was created by Defendants Ketebaev and Khrapunov and/or one or more of their co-conspirators." SAC ¶ 45. Because there is not even a clear allegation that Khrapunov was the person who consented to the WordPress Terms of Service, the WordPress Terms of Service is not sufficient to support the exercise of personal jurisdiction over Khrapunov. Moreover, the instant case was filed in Santa Clara County and not San Francisco County.
Finally, Kazakhstan argues that Khrapunov is subject to personal jurisdiction in California based on his Khrapunov's contacts with the United States as a whole. "This ability to look to the aggregate contacts of a defendant with the United States as a whole instead of a particular state forum is a product of Rule 4(k)(2)." Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1158 (9th Cir. 2006). Rule 4(k)(2) provides:
In other words, "Rule 4(k)(2) imposes three requirements: First, the claim against the defendant must arise under federal law. Second, the defendant must not be subject to the personal jurisdiction of any state court of general jurisdiction. Third, the federal court's exercise of personal jurisdiction must comport with due process." Axiom Foods, 874 F.3d at 1072 (citing Pebble Beach, 453 F.3d at 1159).
Kazakhstan's claims arise under the CFAA and SCA, satisfying the first requirement. Kazakhstan argues that Khrapunov bears the burden of naming a state in which he is subject to personal jurisdiction. Opp. at 14 (citing Holland Am. Line, Inc. v. Wartsila N. Am., Inc., 485 F.3d 450, 461-62 (9th Cir. 2007)). Because Khrapunov has not identified a state in which he is subject to personal jurisdiction, Kazakhstan argues that the second requirement is met. Id. However, this argument asks the Court to ignore the fact that Khrapunov is subject to personal jurisdiction in the Southern District of New York. Indeed, Kazakhstan's evidence of Khrapunov's contacts with the United States includes a Southern District of New York case in which Khrapunov has appeared and actively litigated. See id. at 17-18 (citing City of Almaty v. Ablyazov, No. 15-CV-5345). Because Khrapunov is subject to personal jurisdiction in New York, Kazakhstan cannot invoke Rule 4(k)(2) to support personal jurisdiction in California, because the second requirement of Rule 4(k)(2)—that the defendant must not be subject to personal jurisdiction in any other state—is not satisfied. See Teras Cargo Transport (Am.), LLC v. Cal Dive Int'l (Australia) Pty Ltd., No. 15-cv-03566-JSC, 2015 WL 6089276, at *5 (N.D. Cal. Oct. 16, 2015) (concession that defendant is subject to personal jurisdiction in Texas "is enough to preclude application of nationwide jurisdiction under Rule 4(k)(2)"). Because Kazakhstan cannot invoke Rule 4(k)(2), Khrapunov's alleged contacts with parts of the United States outside California, such as his alleged sham companies' real estate investments in New York and Ohio, are irrelevant to whether this Court can exercise personal jurisdiction over Khrapunov.
For the foregoing reasons, the Court concludes that it does not have personal jurisdiction over Khrapunov. Khrapunov's motion to dismiss is therefore GRANTED. However, because it is conceivable that Kazakhstan could allege additional facts to support this Court's exercise of personal jurisdiction over Khrapunov, the Court grants Kazakhstan leave to amend. If Kazakhstan fails to file an amended complaint within 30 days or fails to cure the jurisdictional deficiencies identified in this order, the case will be dismissed with prejudice as to Khrapunov. Kazakhstan may not add new causes of action or new parties without a stipulation or leave of the Court.
