I find it odd that Sony is allowed to infringe on the privacy rights of thousands of innocent people all to help them prove something that it is their duty to do in the first place. None of these individuals are even being notified that this is even happening, so even if they would spend the effort and money to fight it they have no chance to.
Frankly, this issue really shows how bizarre our adversarial system is. Sony must establish jurisdiction to the court, but they cannot. The court then orders unrelated service providers to disclose information about further unrelated persons to Sony. Sony then takes that information and uses it to try and prove what they are required to to the court (and also get the added value of learning the identities of a lot of consumers they presumably hate).
If Sony is allowed to make the court do its work for them, why do they even get to have the information disclosed to them? The court is the one that is going to decide on the evidence anyways, so why don't they (or a third-party appointed by the court) just look at it and decide?
I'm also reminded of cases where people have tried to request the source code of devices (voting machines and radar guns) to audit them. They could not even get it supplied to an independent third-party because of corporate privacy.
"I find it odd that Sony is allowed to infringe on the privacy rights of thousands of innocent people all to help them prove something that it is their duty to do in the first place."
Eh, yes, that's how discovery works - in (hundreds of?) thousands of court cases every year. Otherwise how can one party prove its claim against someone else? Enforcing your rights would become a magnitude harder if one would have to rely on information from outside sources alone.
I'm sure you're right.
Shouldn't Paypal just be able to give a yes or no answer to the question of if any donations came from California, without turning over all the records to Sony? If the jurisdiction is really what is at stake here.
But... I am no lawyer, so there must be issues I don't understand here.
> The information sought is part of a jurisdictional argument over whether Sony must sue Hotz in his home state of New Jersey rather than in San Francisco, where Sony would prefer.
He also accepted funds from France (hello!), but somehow I doubt they'd try him here. Is Sony actually allowed to do this?
(This is not -completely- a troll, I don't know US law and I'd be interested to know.)
The issue is a due process one under the U.S. Constitution. The law does not deem it fair to sue someone in a remote jurisdiction with which the defendant has no connection and, if a defendant is improperly sued in such a place, he can have the case dismissed on the technical ground that the court has no legitimate authority over him to be able to act on the case. If a court hears such a challenge, and grants it, it will dismiss the case "without prejudice" to its being refiled in a proper jurisdiction. In other words, such a dismissal does not determine the merits of the case but only whether it has been brought in a proper court.
The constitutional analysis on this issue turns on whether a person has what are called "minimum contacts" with a given state such that the law deems it fair and reasonable to require that person to have to appear to defend an action there (there is an alternative specialty form of jurisdiction called "in rem" jurisdiction that deals with property but the foregoing pertains to the all-encompassing area of "jurisdiction over the person" or "personal jurisdiction"). To establish proper jurisdiction in a given state, the party suing must show that a person being sued is either generally "present" in that state (i.e., lives there or, if an entity, is domiciled there or conducts regular business there) or, alternatively, that such person had sufficient contacts with that state concerning the transaction over which he is being sued so as to make it fair to sue him there with respect to that transaction only. If either general jurisdiction (the first type) or limited jurisdiction (the second) is shown, then someone can be sued in a given state. Of course, as an individual, if you are sued under general jurisdiction, that means you are being sued where you live. However, if you are sued under a theory of limited jurisdiction, you can be sued in a place that is remote from where you live (a "remote forum," in legal parlance) provided only that the court deems it fair under a minimum-contacts analysis. Once jurisdiction is determined to be proper, a defendant sued in a distant forum can still attempt to get the case transferred to a place that is more convenient for him to defend in and that analysis then invokes a separate legal doctrine called "forum non conveniens" by which a court further assesses whether, among the range of forums over which a case might technically be brought, which is the most convenient and appropriate one given practical factors such as where most of the activity in dispute occurred, where people live, and the like.
So, from a fairness standpoint, anyone sued in a distant forum can fight on two fronts, jurisdiction and forum convenience. He makes what is called a "limited appearance" to challenge jurisdiction without agreeing to submit himself to the jurisdiction of the court for purposes of making that challenge. If he wins, the court dismisses the case while allowing the party to refile in a proper forum; if he loses, then the court has jurisdiction unless he can change the result through an emergency appeal. Once jurisdiction is so established, then any action of the court is binding on the defendant and any judgment entered can be enforced against him in that jurisdiction or in any other state in the U.S. (which will give "full faith and credit" to the judgment under prevailing U.S. law).
If you are sued in a remote forum, and you do not "specially appear" to challenge jurisdiction once you are served with the summons and complaint, then the party will take a default judgment against you. When the party comes to your state to ask a court to enforce the judgment against you, you can seek to set that judgment aside even at that stage on grounds that the original court lacked proper jurisdiction over your person and so was constitutionally incompetent to enter that judgment. If you win on such an argument, the judgment is unenforceable and void; if you lose, of course, then the judgment is enforced against you and, since you defaulted in the original action, you have no defense to it unless you can return to the originating jurisdiction and seek to set it aside on whatever grounds they permit for setting aside a default judgment. Since it is usually very difficult to set aside default judgments, it normally behooves a party who has been sued in a remote forum to hire counsel to challenge the jurisdiction right up front via a "special appearance" rather than letting a judgment go by default in hopes of challenging it later at the enforcement stage in your local jurisdiction.
All that said, what is happening in the Sony case is that the individual defendant appeared specially to say that the federal court in the Northern District of California (i.e., San Francisco) lacks jurisdiction over his person under minimum-contacts analysis and should therefore dismiss Sony's case without prejudice to its being refiled in the place in which he lives. Sony is arguing that sufficient minimum contacts do exist with the San Francisco forum such as to make it fair and reasonable to require the defendant to appear to defend the case there.
Once the issue is so joined, a federal court will normally allow a party such as Sony to conduct limited discovery tailored to determining facts relevant to the jurisdictional question only. Since the main issue concerning jurisdiction concerning what "contacts" the defendant had with the San Francisco forum relating to the underlying actions over which he is being sued, it becomes technically relevant for the suing party to attempt to find all such contacts. That would be the legal basis upon which the court is permitting this sort of subpoena to be enforced.
Why San Francisco? I assume this is less for the purpose of harassing the defendant as such than it is for that of having the case heard in a forum in which the judges are likely far more knowledgeable about Silicon Valley-style legal issues than they might be elsewhere.
This sort of high-profile fight, by the way, is wildly expensive to conduct and, I assume, the defendant is only able to do so because of donations from others or because of volunteer efforts by organizations who specialize in defending the rights here being attacked.
I hope this helps explain the relevant legal issues (sorry for the length but I clerked for a federal judge in the Northern District of California many years back and it fell to the sorry lot of the law clerks to research these exact issues many times over during one's stint with the court).
This is an absolutely wonderful summary of jurisdictional issues facing courts in the United States. I really wish you had taught my civil procedure course!
What's interesting about the original question, which pertains to standing in French courts, is that there's an on-point case involving the inverse of that. Yahoo! Inc. v. La Ligue Contre le Racisme et l'Antisemitisme (LICRA) establishes the competence of French courts to hear internet cases. Of particular interest is that Sony, which presumably has offices in France, could use the US Marshals to serve the defendant in the United States, pursuant to the Hague Service Convention. I imagine that any potential benefit Sony would get from doing this would be outweighed by the costs of litigation, and the risk of having the judgment unenforceable in the United States, though.
(I'm not a lawyer, but I'm married to one, and I like law more than she does.)
Under US law, if you want to sue someone, you must sue them in the state where they live. However, there are certain instances where the laws of another state might be more favorable to you. In order to sue in state other than the defendant's home state, you must prove that the matter you are suing about had relevance to that state. If Sony can prove that geohot's efforts were funded by someone in CA, they can sue him in CA.
I'm not sure WHY they want to sue him in CA, other than to make his life difficult. This sounds like a bit of a fishing expedition to me...
I think that they want to sue him in CA so that they can group him together with the other people that they are trying to sue over this. He's just the only one that they can connect to an actual person thus far, IIRC.
That doesn't seem to be the case here; they're suing him in a federal district court in CA, and you can't sue people multiple times for the same thing in different federal district courts, since the federal court system is considered one unified system (just with administrative divisions). It's more with state law that you can try to pursue multiple suits in different states, since the state court systems are independent from each other. But most (all?) states don't have state-level law against circumvention; if the suit is relying on the DMCA, it has to be in federal court.
I don't think this case is getting enough attention outside of places like HN and Ars. The way this man's rights are being stripped bare is a very impressive display of fascism that needs to be seen in a public light.
Discovery is a phase that's always been there in the court system. What I don't get is that the judge is allowing them to go on a fishing expedition to prove that they can sue him in that jurisdiction. I mean right now, they haven't even proven that they can sue him in this court. If they can't prove that on their own, then why are they allowed to waste the court's time spending months (years?) searching for some proof that probably won't turn up?
I'd like to hear a lawyer's perspective on how the modern legal climate would have applied to historical events, especially Compaq's reverse engineering of the IBM PC BIOS which enabled them to create PC clones.
I'm not an attorney yet (another year), but I can give you a little more insight to that question, specifically. Absent a patent on the technology, reverse engineering is a completely acceptable way to learn the underlying facts and algorithms used in a technology. This was particularly evidenced in Sony Computer Entertainment Inc. v. Connectix (http://web.archive.org/web/20070228070634/http://www.ca9.usc...), where Connectix created an emulator and Sony sued, alleging that the BIOS had been transiently copied (thus violating copyright law) in order for Connectix to emulate Sony's systems.
The key to this case was that Connectix had exhausted all other methods before resorting to reverse engineering; Connectix contended that direct disassembly was necessary, because they had no other way to learn the non-copyrightable facts and algorithms.
The holding in the case was that Sony's copyrighted material did not deserve as much protection, because it contained unprotected aspects that could not be examined without copying. This is why Sony's BIOS was accorded a lower degree of protection than more traditional literary/musical/creative works.
Keep in mind, Connectix was a 1999 case. DMCA implemented two 1996 WIPO treaties, and became effective in 1998. I've read through nearly all of the DMCA, and everything in the opinion comports with the sections of the US Code that the DMCA amended. This is probably the best case that illustrates reverse engineering.
A more relevant question perhaps: is there a substantially different impact between careful clean room reverse engineering and simple hacking with public disclosure?
I feel more and more that Stallman has a point. Everything that's in the cloud is there for the taking. Not to sound like a luddite but if he'd have cashed checks instead of paypal or hosted his own website this wouldn't be possible, right?
I remember Rob Gonggrijp's comment when his Twitter logs were subpoena'd: "This is why people run their own mail servers".
Every monetary trading system creates an audit trail. If the ruling is given to give access to an email account, the place of hosting is irrelevant. Unless you were to delete your mail server, which would probably only incriminate you further.
if you're ordered to cough up the records of your donations, it doesn't matter if they're stored with paypal, or in your filing cabinet. you've got to produce them. the only way non-cloud storage is relevant to this is that you could choose to destroy your own records. (before being sued, since you'd get in trouble for trashing them after the fact.)
Does people only get the data who donated, or also how much?In the latter case, Sony now has a strategic asymmetric advantage: it can estimate how much money Geohot has for his defense, and then drag out the process so long until he has no money left.
I'm very surprised the Judge sided with Sony on this one.
Frankly, this issue really shows how bizarre our adversarial system is. Sony must establish jurisdiction to the court, but they cannot. The court then orders unrelated service providers to disclose information about further unrelated persons to Sony. Sony then takes that information and uses it to try and prove what they are required to to the court (and also get the added value of learning the identities of a lot of consumers they presumably hate).
If Sony is allowed to make the court do its work for them, why do they even get to have the information disclosed to them? The court is the one that is going to decide on the evidence anyways, so why don't they (or a third-party appointed by the court) just look at it and decide?
I'm also reminded of cases where people have tried to request the source code of devices (voting machines and radar guns) to audit them. They could not even get it supplied to an independent third-party because of corporate privacy.