Judge gives Sony access to PS3 hacker's PayPal records
arstechnica.com
arstechnica.com
Frankly, this issue really shows how bizarre our adversarial system is. Sony must establish jurisdiction to the court, but they cannot. The court then orders unrelated service providers to disclose information about further unrelated persons to Sony. Sony then takes that information and uses it to try and prove what they are required to to the court (and also get the added value of learning the identities of a lot of consumers they presumably hate).
If Sony is allowed to make the court do its work for them, why do they even get to have the information disclosed to them? The court is the one that is going to decide on the evidence anyways, so why don't they (or a third-party appointed by the court) just look at it and decide?
I'm also reminded of cases where people have tried to request the source code of devices (voting machines and radar guns) to audit them. They could not even get it supplied to an independent third-party because of corporate privacy.
Eh, yes, that's how discovery works - in (hundreds of?) thousands of court cases every year. Otherwise how can one party prove its claim against someone else? Enforcing your rights would become a magnitude harder if one would have to rely on information from outside sources alone.
But... I am no lawyer, so there must be issues I don't understand here.
He also accepted funds from France (hello!), but somehow I doubt they'd try him here. Is Sony actually allowed to do this? (This is not -completely- a troll, I don't know US law and I'd be interested to know.)
If there's a loophole, someone's going to use it. (And being lawyers and all ...)
Under US law, if you want to sue someone, you must sue them in the state where they live. However, there are certain instances where the laws of another state might be more favorable to you. In order to sue in state other than the defendant's home state, you must prove that the matter you are suing about had relevance to that state. If Sony can prove that geohot's efforts were funded by someone in CA, they can sue him in CA.
I'm not sure WHY they want to sue him in CA, other than to make his life difficult. This sounds like a bit of a fishing expedition to me...
The constitutional analysis on this issue turns on whether a person has what are called "minimum contacts" with a given state such that the law deems it fair and reasonable to require that person to have to appear to defend an action there (there is an alternative specialty form of jurisdiction called "in rem" jurisdiction that deals with property but the foregoing pertains to the all-encompassing area of "jurisdiction over the person" or "personal jurisdiction"). To establish proper jurisdiction in a given state, the party suing must show that a person being sued is either generally "present" in that state (i.e., lives there or, if an entity, is domiciled there or conducts regular business there) or, alternatively, that such person had sufficient contacts with that state concerning the transaction over which he is being sued so as to make it fair to sue him there with respect to that transaction only. If either general jurisdiction (the first type) or limited jurisdiction (the second) is shown, then someone can be sued in a given state. Of course, as an individual, if you are sued under general jurisdiction, that means you are being sued where you live. However, if you are sued under a theory of limited jurisdiction, you can be sued in a place that is remote from where you live (a "remote forum," in legal parlance) provided only that the court deems it fair under a minimum-contacts analysis. Once jurisdiction is determined to be proper, a defendant sued in a distant forum can still attempt to get the case transferred to a place that is more convenient for him to defend in and that analysis then invokes a separate legal doctrine called "forum non conveniens" by which a court further assesses whether, among the range of forums over which a case might technically be brought, which is the most convenient and appropriate one given practical factors such as where most of the activity in dispute occurred, where people live, and the like.
So, from a fairness standpoint, anyone sued in a distant forum can fight on two fronts, jurisdiction and forum convenience. He makes what is called a "limited appearance" to challenge jurisdiction without agreeing to submit himself to the jurisdiction of the court for purposes of making that challenge. If he wins, the court dismisses the case while allowing the party to refile in a proper forum; if he loses, then the court has jurisdiction unless he can change the result through an emergency appeal. Once jurisdiction is so established, then any action of the court is binding on the defendant and any judgment entered can be enforced against him in that jurisdiction or in any other state in the U.S. (which will give "full faith and credit" to the judgment under prevailing U.S. law).
If you are sued in a remote forum, and you do not "specially appear" to challenge jurisdiction once you are served with the summons and complaint, then the party will take a default judgment against you. When the party comes to your state to ask a court to enforce the judgment against you, you can seek to set that judgment aside even at that stage on grounds that the original court lacked proper jurisdiction over your person and so was constitutionally incompetent to enter that judgment. If you win on such an argument, the judgment is unenforceable and void; if you lose, of course, then the judgment is enforced against you and, since you defaulted in the original action, you have no defense to it unless you can return to the originating jurisdiction and seek to set it aside on whatever grounds they permit for setting aside a default judgment. Since it is usually very difficult to set aside default judgments, it normally behooves a party who has been sued in a remote forum to hire counsel to challenge the jurisdiction right up front via a "special appearance" rather than letting a judgment go by default in hopes of challenging it later at the enforcement stage in your local jurisdiction.
All that said, what is happening in the Sony case is that the individual defendant appeared specially to say that the federal court in the Northern District of California (i.e., San Francisco) lacks jurisdiction over his person under minimum-contacts analysis and should therefore dismiss Sony's case without prejudice to its being refiled in the place in which he lives. Sony is arguing that sufficient minimum contacts do exist with the San Francisco forum such as to make it fair and reasonable to require the defendant to appear to defend the case there.
Once the issue is so joined, a federal court will normally allow a party such as Sony to conduct limited discovery tailored to determining facts relevant to the jurisdictional question only. Since the main issue concerning jurisdiction concerning what "contacts" the defendant had with the San Francisco forum relating to the underlying actions over which he is being sued, it becomes technically relevant for the suing party to attempt to find all such contacts. That would be the legal basis upon which the court is permitting this sort of subpoena to be enforced.
Why San Francisco? I assume this is less for the purpose of harassing the defendant as such than it is for that of having the case heard in a forum in which the judges are likely far more knowledgeable about Silicon Valley-style legal issues than they might be elsewhere.
This sort of high-profile fight, by the way, is wildly expensive to conduct and, I assume, the defendant is only able to do so because of donations from others or because of volunteer efforts by organizations who specialize in defending the rights here being attacked.
I hope this helps explain the relevant legal issues (sorry for the length but I clerked for a federal judge in the Northern District of California many years back and it fell to the sorry lot of the law clerks to research these exact issues many times over during one's stint with the court).
What's interesting about the original question, which pertains to standing in French courts, is that there's an on-point case involving the inverse of that. Yahoo! Inc. v. La Ligue Contre le Racisme et l'Antisemitisme (LICRA) establishes the competence of French courts to hear internet cases. Of particular interest is that Sony, which presumably has offices in France, could use the US Marshals to serve the defendant in the United States, pursuant to the Hague Service Convention. I imagine that any potential benefit Sony would get from doing this would be outweighed by the costs of litigation, and the risk of having the judgment unenforceable in the United States, though.
The key to this case was that Connectix had exhausted all other methods before resorting to reverse engineering; Connectix contended that direct disassembly was necessary, because they had no other way to learn the non-copyrightable facts and algorithms.
The holding in the case was that Sony's copyrighted material did not deserve as much protection, because it contained unprotected aspects that could not be examined without copying. This is why Sony's BIOS was accorded a lower degree of protection than more traditional literary/musical/creative works.
Keep in mind, Connectix was a 1999 case. DMCA implemented two 1996 WIPO treaties, and became effective in 1998. I've read through nearly all of the DMCA, and everything in the opinion comports with the sections of the US Code that the DMCA amended. This is probably the best case that illustrates reverse engineering.
I remember Rob Gonggrijp's comment when his Twitter logs were subpoena'd: "This is why people run their own mail servers".
I'm very surprised the Judge sided with Sony on this one.