der.hans--anonymous services--

[der.hans]

Am 15. Sep, 2001 schwätzte Eric so:

> Well der.hans I will tell you that I am not an expert on this.  Not many
> people are.  This is new territory in the legal field.  And most of what I
> know about jurisdiction relates to *civil* jurisdiction.  However, I have
> spent quite a few hours now on the specific facts of Sklyarov and this is
> what I have so far.  Traditional personal jurisdiction does focus on where
> you "go" as you stated above.  No doubt Arizona has jurisdiction over me
> because I live here.  And if I am a business and I direct market to
> California and commit a civil wrong against customer X, then that state has
> personal jurisdiction over me even if I don't go there because I have
> directed my activities there by soliciting customers.  In legalese this is
> called having "minimum contacts" with a state.  In any given civil case, the
> court will go through and do a "totality of the circumstances" analysis of
> the facts: for instance, in my hypo above, they would say "Did Eric ever
> send mail to customer X?" and "Did Eric send ever make telephone calls to X
> in Calif.?" and they might say something like "Eric benefited from the laws
> of California because those laws protected the mail he sent while it was in
> transit within the borders of Calif" and "Eric benefited from the California
> infrastructure when he made a telephone call to X and it is the taxpayers of
> Calif. that support some of that telephone infrastructure."  Importantly a
> court would also state something like "It is not unfair to subject Eric to
> personal jurisdiction in this case because he was on *notice* that he was
> dealing with the state of California: after all, he did purposefully direct
> his activity to our state....Therefore this court does have personal
> jurisdiction."  The important thing here is that in this silly example I
> have given is this: I purposefully directed my activity to Calif. such that
> I had notice that I might be subjected to the laws of Calif, and such that I
> did have "minimum contacts."  Therefore, it is not unfair to find there is
> personal jurisdiction because I was basically on notice that this could
> happen.  If I did not want to be sued there, I should not have directed my
> activities there and made minimum contact with Calif.
> 
> Think about how the Internet changes this.  If X runs a Web server at his
> house in .de and makes the page free for all to see, then in a way X directs
> "activities" to anywhere in the world.  Let's say that X writes a message on
> his Web page, but X only intends for people in his neighborhood to see it.
> Let's say X writes posts the code for DeCSS on his page.  Let's also say
> that Y works for the RIAA and is browsing the Net one day from the .us and
> comes across this page and reads it.  Let's further say that its clearly
> illegal under .us law to post this code.  Lastly, let's assume this is a
> civil case.

To me this is the same a having mail order, phone order or BBS. Pull content
vs. push content. In other words he makes it available and people pull it
in. He does not push it into those markets. In the Elcomsoft case they
pushed it into .us markets by establishing web servers here for the sale of
"illegal" software.

> Can Y/RIAA sue X in US Federal court?  The answer in part depends on whether
> X has minimum contacts such that personal jurisdiction is proper.  But why
> should jurisdiction be proper under the analysis in the first paragraph?  X
> did not purposefully direct his activity to the .us.  He only wanted his

Exactly.

> neighbors to see it.  Certainly he must have been aware someone in the .us
> would/could see the page.  But is this enough to put someone on notice that
> they would be subject to civil suit in the .us?  If you say yes, then you
> are also subjecting X to civil suit anywhere in the world where that page is
> accessible inasmuch as other countries use the same jurisdictional
> analysis..  Is this the kind of justice system we want?  Is it "fair," as I
> have described in the first paragraph, to subject me to civil suit worldwide
>  simply because my Web page was accessible worldwide?  This is where the

I say no. Someone in nocal was charged with porn stuff from a town in
another state ( I think it was .tn ) for someone dialing his BBS long
distance to get porn that went against local statutes. This was well after
the Internet was well-known. How was he responsible for someone in another
state breaking the law? Again, push vs. pull.

> debate is.  Jurisdiction is based on notions of fairness because the Due
> Process clause of the 5th Amendment of the US constitution.  And due process
> is roughly/basically about fairness.  It doesn't seem as though the Internet
> should change the basics of personal jurisdiction, and that is where courts
> are struggling.
> 
> The whole analysis changes a bit when you talk about criminal cases.  Since
> a criminal case involves the possibility of jail time, retribution, a
> criminal record which makes it hard to get a job, etc.--in other words,
> since the stakes are so much higher in a criminal case, it is thought that
> the notion of fairness and the possibility of being subjected to suit are
> that much more important.  This applies to Elcomsoft.  Since they were
> selling products through the Internet, jurisdiction with them is tricky

As far as I understand it Skylarov was not actually charged for his coding,
e.g. .ru-based activities.

> because it will depend on the actual mechanics of the transaction--e.g.,
> where was the Web server? Were they intending to sell to US customers? In

That's why Skylarov was charged. Elcomsoft setup co-lo or something within
the continental .us for sales within the .us. Skylarov was listed on the
paperwork as the person in charge of that operation.

Was he also charged for the content of his talk in Vegas?

> what sense did they "go" to the .us with the Internet.?  Etc.  But since
> this is the first case where the criminal portions of the DMCA have been
> used, no one can say how the jurisdiction part will play out.  In the end,
> you may be right that Elcomsoft had a presence, meaning personal and subject
> matter jurisdiction.  But I don't think we can say that for sure, just yet.
> And the case is even more difficult because *Sklyarov* was not selling

Ah, but he was :).

> anything.  He was just an employee! Corporations are legally separate from
> the employees who work for them.  In what sense did he "go" to the .us with

That is a question. Let's say someone sets up a legal corp in .co to sell
narcotics and they have employees in the .us to sell the drugs. Are the
salespeople liable for selling illegal drugs? What about those running the
corp in .co? What if the janitor for the .co corp is the one listed as
running the field offices in the .us? What if the drugs were sold in the .us
via mail order with no one from the organization in the .us?

The above seems pretty obvious to me because to ship into the .us, the
"products" have to have gone through customs. Also, to sell in the .us, they
have to have gotten permission to import their "products".

With software downloaded over the 'Net, that becomes somewhat obscure to
determine. I can be sitting "here", wherever "here" might be, but claim to
be "there", whereever "there" might be. Easy enough to actually be
contacting you directly from "there" as well. No physical delivery, so no
way to verify geographical delivery of the product.

> this Web transaction?  Are we going to subject the janitor at Elcomsoft and
> his family to jurisdiction?  No, why not?  Because he just an f'ing
> employee.  So what if Sklyarov wrote the code?  Maybe someone else debugged

I don't think he was actually charged for writing the code, rather for his
role in selling the product in the .us.

> it?  Are we going to prosecute them too?  True, Skl. did come to the .us for
> Defcon, so he was on notice he was subject to suit.  But has there even been
> a crime? That is, does the .us have jurisdiction over the subject matter
> that occurs in Russia?  Does the DMCA apply worldwide?

I don't think so. If the .us thinks so, then other countries need to step
forward and say no.

Can they get him for his talk here, though?

Again, I completely agree that the DMCA needs to be repealed. If crypto laws
go up are they going to affect non-US hosted in the .nl?

ciao,

der.hans
-- 
# der.hans@LuftHans.com home.pages.de/~lufthans/ www.DevelopOnline.com
#  If you're not learning, you're not living. - der.hans