Sony has now filed its opposition to George Hotz's Motion to Dismiss for Lack of Personal Jurisdiction and Improper Venue in SCEA v. Hotz. So we find out what Sony was able to find out from the discovery they fought so hard for. And the answer is: I see no clear smoking gun. Not that Sony doesn't yell bang, bang, bang throughout its response. But I'm not yet convinced that Sony has demonstrated jurisdiction in California. And that is the basis for Hotz's motion. Maybe they should consider the possibility Hotz was telling the truth.
A few exhibits are under seal, so we are limited in being able to determine whether there might be more, and I do see some things that are new that Hotz will have to respond to, and he will, and I haven't yet read everything with a fine tooth comb, but the overview feeling to me on first reading is that Sony did a lot of poking through people's things and came up with some hints and some assertions based on possibilities or even likelihoods but no solid proof. That doesn't mean they won't prevail. It's not hard to beat a motion to dismiss.
Personally, I think Sony should just sue the guy in New Jersey. They can afford to go anywhere, and he's just a solitary kid with no vast, equivalent resources to defend himself against this international corporation's mighty hand. It just feels unfair, even if everything Sony alleges were true. And I have my doubts it is. But I'll show you the main arguments, and with the documents themselves, you can draw your own conclusions.
Here are all the filings, some under seal so there's no PDF:
Note that I decided not to post the exhibit that shows a map of directions to Hotz's home.
03/18/2011 - 103 -
RESPONSE/OPPOSITION to (re 57 MOTION to Dismiss FOR LACK OF PERSONAL
JURISDICTION AND IMPROPER VENUE ) filed by Sony Computer Entertainment
America LLC. (Smith, Mehrnaz) (Filed on 3/18/2011) Modified on 3/21/2011
(ys, COURT STAFF). (Entered: 03/18/2011)
03/18/2011 - 104 -
DECLARATION of Ryan Bricker in Support of 103 Opposition/Response to
Motion filed by Sony Computer Entertainment America LLC. (Attachments: #
1 Exhibit A to
Bricker Decl., # 2 Exhibit B to
Bricker Decl, # 3 Exhibit C to
Bricker Decl, # 4 Exhibit D to
Bricker Decl, # 5 Exhibit E to
Bricker Decl, # 6 Exhibit F to
Bricker Decl, # 7 Exhibit G to
Bricker Decl, # 8 - Exhibit H to
Bricker Decl, # 9 Exhibit I to
Bricker Decl, # 10 Exhibit J to
Bricker Decl, # 11 Exhibit K to
Bricker Decl, # 12 Exhibit L to Bricker Decl, # 13 Exhibit M to
Bricker Decl, # 14 Exhibit N to Bricker Decl, # 15 Exhibit O to
Bricker Decl, # 16 Exhibit P to Bricker Decl, # 17 Exhibit Q to
Bricker Decl, # 18 Exhibit R to
Bricker Decl, # 19 Exhibit S to
Bricker Decl, # 20 Exhibit T to Bricker Decl, # 21 Exhibit U to
Bricker Decl)(Related document(s) 103 ) (Smith, Mehrnaz) (Filed on
3/18/2011) Modified on 3/21/2011 (ys, COURT STAFF). (Entered: 03/19/2011)
03/19/2011 - 105 -
DECLARATION in Support of 103 Opposition/Response to Motion filed by
Sony Computer Entertainment America LLC. (Attachments: # 1 Affidavit Liu
Declaration, # 2 Affidavit
Pierce, # 3 Proposed
Order)(Related document(s) 103 ) (Smith, Mehrnaz) (Filed on
3/19/2011) Modified on 3/21/2011 (ys, COURT STAFF). (Entered: 03/19/2011)
03/19/2011 - 106 -
Administrative Motion to File Under Seal filed by Sony Computer
Entertainment America LLC. (Attachments: # 1 Affidavit
Gaudreau Declaration ISO Admin Motion, # 2 Proposed
Order, # 3 Certificate of
Service)(Smith, Mehrnaz) (Filed on 3/19/2011) (Entered: 03/19/2011)
03/19/2011 - 107 -
DECLARATION of Marvin Miller in Support of 103 Opposition/Response to
Motion filed by Sony Computer Entertainment America LLC. (Attachments: #
1 Exhibit B to
Miller Declaration, # 2 Exhibit C to
Miller Declaration)(Related document(s) 103 ) (Smith, Mehrnaz)
(Filed on 3/19/2011) Modified on 3/21/2011 (ys, COURT STAFF). (Entered:
03/19/2011 - 108 - Exhibit A
to 107 Miller Declaration filed by Sony Computer Entertainment America
LLC. (Attachments: # 1 Exhibit A pt.
2, # 2 Exhibit A pt.
3, # 3 Exhibit A pt.
4)(Related document(s) 107 ) (Smith, Mehrnaz) (Filed on 3/19/2011)
Modified on 3/21/2011 (ys, COURT STAFF). (Entered: 03/19/2011)
And Sony found thousands of California people downloaded his "circumvention device", as Sony insists on calling his work, but is that enough to get you sued there, in that Hotz didn't know they were in California or solicit California in particular? It's not like he personally emailed them, after all. Sony thinks so:
In March, 2010, Hotz signed up for a PlayStation® Network (“PSN”) Account using a new PlayStation® 3 computer entertainment system (“PS3 System”) that he purchased. Moreover, Hotz has plainly directed his unlawful conduct at Plaintiff Sony Computer Entertainment America LLC (“SCEA”) here in the Northern District of California and has caused harm to SCEA, a resident of this district. Hotz circumvented the technological protection measures (“TPMs”) in the PS3 System and through his website, Hotz distributed circumvention devices to thousands of California residents. Discovery from the third party webhost for Hotz’s website shows that approximately 5,700 unique IP addresses in California downloaded the circumvention devices from Hotz’s website before the commencement of this lawsuit.
What Sony does not address is that there was apparently no money involved. I mean, Sony got the right to poke through his Paypal account. Where's the proof anyone paid him a dime? He wasn't selling anything, I gather, or even accepting donations, which is what Sony started out alleging, and so there was no way Hotz would know if people in California or New Jersey or Belarus downloaded. So I am not yet convinced that this proves intent to accept California as the right forum for litigation, but the judge may. Here's Sony's argument, so you can form your own impression:
In his latest exploit, Hotz, a well-known hacker who has gained notoriety for circumventing the technological protection measures in a number of sophisticated software and hardware systems, purposefully directed his activities at SCEA in California. He committed an intentional act expressly aimed at California, causing harm in California that Hotz knew was likely to be suffered in California.
Doesn't that feel a little thin? It does to me. It was just as likely in New Jersey or Belarus or anywhere. Can he be sued literally *everywhere*? Did he intend to have people download from everywhere, making any jurisdiction on planet Earth appropriate? Nice way to kill off the Internet, if so. Who'd want to have a website if the law worked like that? Dear Sony, please think about this. You are a huge corporation. The Internet has value beyond just you. Consider your steps carefully, please. And think beyond just this one case.
The thing is, it's not like Hotz was selling products, where you know where you are sending products or are accepting credit cards with home addresses. If he had, I'd find Sony's argument much more persuasive. Then you'd definitely see targeting the state and intending to. But a passive website, where you put up something and who knows what happens next -- that isn't the same kind of targeting. It's a little scary to think that you can be sued in any of the 50 states, and for that matter the entire world, just because you have something on your website. Would even Sony want it to work like that?
Here is their evidence that he has a PlayStation Network account:
Hotz identified four PS3 Systems in his possession. Bricker Decl., ¶4, Exh. C. He explained that he had purchased one of these consoles new in February 2010 and provided the serial number for that console. Id. SCEA used that serial number to determine that on February 25, 2010, Hotz purchased the PS3 System at a Gamestop store just miles from his home. Law Decl., ¶6; Bricker Decl., ¶6, Exh. E. SCEA’s records show that the same PS3 System was used on March 10, 2010 to create a PSN account under the user name “blickmanic.” Law Decl., ¶6, Exh. A. The IP address associated
with the registration is located in Glen Rock, New Jersey, where Hotz lives. Law Decl.
¶6. Hotz’s ownership of the “blickmanic” account is further supported by the fact that an Internet search of the user name “blickmanic” reveals a posting discussing the jailbreaking of cellular phones – Hotz’s original “claim to fame.” Bricker Decl., ¶7, Exh. F (“Just curious what people would pay for exclusive rights to this solution. [Motorola]
Tracfone W175g unlocked and debranded. PM me.”) As discussed above, to create his PSN account, Hotz was required to first agree to the terms of the PSN User Agreement and thus he is clearly subject to personal jurisdiction in California.
Except none of this establishes, to me, anyway, that any of this was done by Hotz, except presumably for the purchase, and even that was apparently in cash. Hotz acknowledges owning this one. But I see no proof that he is blickmanic (or blickmaniac). The man has friends, presumably, and surely relatives. Who knows who signed up for sure? It could be it was Hotz, but if so, he's a mighty big fibber, in that he said that to the best of his knowledge, he never had such an account, and it'd be hard to forget something this recent and this important.
But what if he bought it and someone else signed up as blickmanic, or blickmaniac, without his awareness, and Sony just imagines that it's Hotz, because they need it to be him to stay in California? If you are out there, blickmanic (or blickmaniac), do step forward, by all means. No doubt Hotz will have to respond to this assertion.
Sony takes another rather large leap in trying to establish jurisdiction:
The “purposeful availment” requirement is satisfied when an intentional act is both aimed at and has an effect in the forum state and causes harm, “the brunt of which is suffered – and which the defendant knows is likely to be suffered – in the forum state.” Core-Vent Corp. v. Nobel Industries AB, 11 F.3d 1482, 1486 (9th Cir. 1993) (citing Calder v. Jones, 465 U.S. 783, 783-784 (1984)). Under this well-established “effects test,” personal jurisdiction over Hotz is proper.
Except the brunt of the harm, if Hotz is correct that it's Sony Japan who should be suing him and not SCEA, wouldn't be in California or even in the US. If Hotz ever thought about what he was doing as causing harm, he'd likely have thought of Sony Japan. I know I would.
Here's how Sony tries to deal with that claim, strengthening the evidence of Hotz's knowledge that SCEA was in California with warranty language:
Likewise, here, the specific model of PS3 System that Hotz purchased came packaged together with various PS3 System materials including an Instruction Manual replete with references to SCEA in California. Miller Decl., ¶3, Exh. A. For example, the Instruction Manual directs users to contact SCEA for their support needs and contains a warranty agreement between SCEA and its customers. Id., Exh. A at pp. 3, 4, 7-8, 10, 24 33, 40, 53-54. The warranty agreement continually refers to SCEA. For example:
Except, of course, that it does matter what Hotz meant by what he wrote. And I still have questions about whether he was aiming at California, if he was aiming at all. None of the above proves to me that he knew he could be sued in California. SCEA may have been the contact for support, but that doesn't mean he thought that SCEA was the owner or supplier of the PS3. This is a world of outsourcing. I mean, Dell used to use folks in India for support. I know because I used to chat with them for hours when office equipment broke down years ago. But I never thought that any litigation between me and Dell might be proper in India. Ditto here. Support isn't the same as ownership. It just isn't. And while the warranty is a better argument, given the support being SCEA's, Hotz might have assumed it was tied to the warranty, because they did the support, while the owner was still Sony Japan.
Sony Computer Entertainment America (“SCEA”) warrants to the original purchaser that the PS3TM hardware shall be free from material defects in material and workmanship for a period of one (1) year from the original date of purchase (the “Warranty Period”)Miller Decl., Ex. A, p. 53. Additionally, the Instruction Manual repeatedly directs customers to SCEA’s website, which itself prominently describes SCEA’s headquarters in Foster City, California. Bricker Decl., ¶20, Exh. R. Also included in the PS3 System packaging that Hotz received was a standalone Notice of SCEA’s Return Policy. Id. at ¶2, Exh. C. And the packaging itself provided Hotz with additional notice that his circumvention would harm SCEA in California. Id. at ¶4.
The warranty offered by Sony Computer Entertainment America on your PS3TM hardware is the same whether or not you registered your product.
Hotz’s knowledge of SCEA was not limited to his purchase of PS3 Systems. Hotz had notice of both SCEA and the PSN User Agreement through his own blog in April 2010. Bricker Decl., ¶18, Exh. P. In response to Hotz’s blog post regarding his earlier attempts to hack the PS3 System, commenters posted the PSN User Agreements on at least five occasions. Id.
Indeed, Hotz was well aware of the harmful impact of his unlawful conduct on SCEA. Bricker Decl., ¶9, Exh. H; ¶17, Exh. O. Contrary to his after-the fact denials, Hotz deliberately aimed his conduct at SCEA in this District when he published the “Metldr Keys” on his website and – on the same day – wrote to SCEA: “if you want your next console to be secure, get in touch with me. Any of you.” Bricker Decl., ¶9, Exh. H.
Hotz now summarily denies that he sought employment from SCEA and his counsel argues that his conduct was targeted to SCEI in Japan. (Docket No. 44, ¶15.) How Hotz retroactively characterizes his conduct does not matter. Hotz had ample notice that his actions were targeted at SCEA, not just SCEI. Further, Hotz had actual knowledge that his actions were targeting SCEA in California. Hotz – who is
unquestionably familiar with the video game and computing industries in California from his prior hacking activities, his prior employment at Google in California, and his prior residence in California – deliberately induced thousands of individuals in California to download his circumvention devices.
On this factual record, there can be no question that Hotz’s actions were “expressly aimed” at SCEA in California.
[ Update 2: Groklaw's celtic hacker noted something else about the warranty language, namely that it says it doesn't cover the software, only the hardware:
This warranty does not apply to any system software that is pre-installed in the PS3™ hardware, or Is subsequently provided via update or upgrade releases. Such system software is licensed to you under the terms and conditions of a separate end user license agreement at http://www.scei.co.jp//ps3-eula and such software is provided pursuant to its own warranty. As you can see, Hotz would clearly realize, if he had read the warranty, that the software, including the firmware, which is what he was studying, came from Sony Japan, not from SCEA. That would strengthen Hotz's argument that SCEA is not the right party to sue him. Firmware is software, not hardware. Note in Exhibit A attached to the Bricker Declaration that the parties agreed to revise the language defining circumvention device, and I'll highlight in red the relevant pieces:
The parties agreed to the following modified definition of "Circumvention Devices" to be included in the Preliminary Injunction and the discovery requests propounded by SCEA: What Hotz was mainly doing was working with firmware, as in "3.55 Firmware Jailbreak", I gather, and so this would bring Sony Japan into the warranty picture, not SCEA. Firmware is software code permanently in read-only memory, not hardware. However, Exhibit I, an article in The Register, quotes Hotz as saying, "Basically, I used hardware to open a small hole and then used software to make the hole the size of the system to get full read/write access." So, if he was quoted correctly, that would include hardware to that degree. Note the BBC article attached as Exhibit O quotes Hotz as saying he is opposed to piracy, as well as others:
Offering to the public, posting online, marketing, advertising, promoting, installing, distributing, providing, or otherwise trafficking in any circumvention technology, products, services, methods, codes, software tools, devices, components or part thereof, including but not limited to the Elliptic Cure Digital Signature Algorithm ("ECDSA") Keys, encryption and/or decryption keys, dePKG firmware decrypter program, Signing Tools, 3.55 Firmware Jailbreak, root keys, and/or any other technologies that enable unauthorized access to and/or copying of the PS3 System and/or enable compatibility of unauthorized copies of other copyrghted works with the PS3 System.
The group, which has previously hacked Nintendo's Wii and says it is vehemently against
games piracy, said that it had developed the hack so that it could install other operating systems and community-written software - known as homebrew - on the powerful machine.
"The details we provided and information and techniques we disclosed would have been enough to install Linux," he said. "We have no interest in piracy."... That is consistent with what Hotz has told the court, that he's opposed to piracy. And that gives context to his offer to help Sony improve their security. One complication for Hotz, though, is that while one can argue that the hardware belongs to the buyer, there is no such argument with software, which is licensed, not sold. End update.]
"I hate that it enables piracy," said Mr Hotz. "The publication of the key is more academic than anything else."...
Following his initial announcement, Sony released an update disabling a function, called OtherOS, that allowed gamers to install a version of Linux on their machines, thought to have been exploited by Mr Hotz.
Many saw it as a pre-emptive strike to guard against games piracy. Mr Hotz never released the exploit and publicly said that he had stopped work on the console.
But Sony's removal of OtherOS prompted other hackers to begin to look at the system more closely.
And since Hotz would never be using support, why would he even read any of that stuff? Even if he did, none of it says to me that SCEA was the owner or distributor, just the support entity.
As for comments on his website, I can assure you, as editor of this website, I don't have time to read all the comments. If I tried, I'd have to stop writing Groklaw articles. You can't assume people have read something just because it exists somewhere on the Internet or even on one's own website. The issue is what Hotz knew and what he intended. The argument that the gaming industry is in California so he must have known he'd be affecting California is very odd indeed, coming from a company headquartered in Japan.
And as for SCEA twisting Hotz's offer to help Sony fix its security to make it sound like a job request, the whole gaming world knows for sure that no programmer on Hotz's level wants to work for Sony. Take that to the bank. Hotz was just being nice. That's how I read it even before he explained it. Sony looks at Hotz with mean eyes, I suspect. Or they'd like the judge to do so.
Keep in mind that Hotz gets to respond, so my advice is wait and get the whole picture before you decide who is telling the truth. In my experience, in most litigation, it's a little bit on both sides. And a little bit not. But this doesn't convince me at all yet. I am left wondering, is this all they've got? After all that frantic discovery, pawing through everybody's stuff? An account in a nym not known to be Hotz? It's so ephemeral.
But the law tilts all Sony's way, other than the US Constitution, so what would convince a judge to let this go forward in California and what it would take to convince me that Sony isn't taking advantage of the law in a way one may not much admire -- well, it's two different things. Watching this huge and wealthy corporation trying to force this kid to suffer their full weight and power in litigation in California, when he lives across the country and has no equivalent money to absorb such a blow is disturbing. Like I said, no one admires a bully.
Update 4: In the Kenneth Law Declaration [PDF], he provides this answer:
3. A PSN account can be created by using the PS3 System or a personal computer. ln either case, a user creating a PSN account must provide the following information: a valid email address, date of birth, a unique username and password, the user's first and last name, a physical address, and the country in which the user lives. During the account creation process, whether the account is created using a personal computer or a PS3 console, the user is presented with the PlayStation Network Terms of Service and User Agreement ('PSN User Agreement") and required to either "accept" or udeny" the PSN User Agreement by clicking a corresponding button. The PSN User Agreement specifies that the
user has entered a binding agreement with SCEA if he or she chooses to accept it. The PSN User Agreement requires that users "submit to personal jurisdiction in California and further agree that any dispute arising from or relating to this Agreement shall be brought in a court within San Mateo County, California." During the PSN account registration process using a personal computer, there is an email address authentication step in which the user must open an email sent from the PSN to the email address given by the user and then click on a link in order to complete the process. Did blickmaniac provide all the above? If so, it would seem we would not have to guess whether he is really George Hotz or not. Unfortunately, those details are in a sealed exhibit.