

Judge gives Sony access to PS3 hacker's PayPal records - liquid_x
http://arstechnica.com/gaming/news/2011/03/judge-gives-sony-access-to-ps3-hackers-paypal-records.ars

======
mukyu
I find it odd that Sony is allowed to infringe on the privacy rights of
thousands of innocent people all to help them prove something that it is their
duty to do in the first place. None of these individuals are even being
notified that this is even happening, so even if they would spend the effort
and money to fight it they have no chance to.

Frankly, this issue really shows how bizarre our adversarial system is. Sony
must establish jurisdiction to the court, but they cannot. The court then
orders unrelated service providers to disclose information about further
unrelated persons to Sony. Sony then takes that information and uses it to try
and prove what they are required to to the court (and also get the added value
of learning the identities of a lot of consumers they presumably hate).

If Sony is allowed to make the court do its work for them, why do they even
get to have the information disclosed to them? The court is the one that is
going to decide on the evidence anyways, so why don't they (or a third-party
appointed by the court) just look at it and decide?

I'm also reminded of cases where people have tried to request the source code
of devices (voting machines and radar guns) to audit them. They could not even
get it supplied to an independent third-party because of corporate privacy.

~~~
roel_v
"I find it odd that Sony is allowed to infringe on the privacy rights of
thousands of innocent people all to help them prove something that it is their
duty to do in the first place."

Eh, yes, that's how discovery works - in (hundreds of?) thousands of court
cases every year. Otherwise how can one party prove its claim against someone
else? Enforcing your rights would become a magnitude harder if one would have
to rely on information from outside sources alone.

~~~
triffidhunter
I'm sure you're right. Shouldn't Paypal just be able to give a yes or no
answer to the question of if any donations came from California, without
turning over all the records to Sony? If the jurisdiction is really what is at
stake here.

But... I am no lawyer, so there must be issues I don't understand here.

------
pluies_public
> The information sought is part of a jurisdictional argument over whether
> Sony must sue Hotz in his home state of New Jersey rather than in San
> Francisco, where Sony would prefer.

He also accepted funds from France (hello!), but somehow I doubt they'd try
him here. Is Sony actually allowed to do this? (This is not -completely- a
troll, I don't know US law and I'd be interested to know.)

~~~
grellas
The issue is a due process one under the U.S. Constitution. The law does not
deem it fair to sue someone in a remote jurisdiction with which the defendant
has no connection and, if a defendant is improperly sued in such a place, he
can have the case dismissed on the technical ground that the court has no
legitimate authority over him to be able to act on the case. If a court hears
such a challenge, and grants it, it will dismiss the case "without prejudice"
to its being refiled in a proper jurisdiction. In other words, such a
dismissal does not determine the merits of the case but only whether it has
been brought in a proper court.

The constitutional analysis on this issue turns on whether a person has what
are called "minimum contacts" with a given state such that the law deems it
fair and reasonable to require that person to have to appear to defend an
action there (there is an alternative specialty form of jurisdiction called
"in rem" jurisdiction that deals with property but the foregoing pertains to
the all-encompassing area of "jurisdiction over the person" or "personal
jurisdiction"). To establish proper jurisdiction in a given state, the party
suing must show that a person being sued is either _generally_ "present" in
that state (i.e., lives there or, if an entity, is domiciled there or conducts
regular business there) or, alternatively, that such person had sufficient
contacts with that state concerning the transaction over which he is being
sued so as to make it fair to sue him there with respect to that transaction
only. If either general jurisdiction (the first type) or limited jurisdiction
(the second) is shown, then someone can be sued in a given state. Of course,
as an individual, if you are sued under general jurisdiction, that means you
are being sued where you live. However, if you are sued under a theory of
limited jurisdiction, you can be sued in a place that is remote from where you
live (a "remote forum," in legal parlance) provided only that the court deems
it fair under a minimum-contacts analysis. Once jurisdiction is determined to
be proper, a defendant sued in a distant forum can still attempt to get the
case transferred to a place that is more convenient for him to defend in and
that analysis then invokes a separate legal doctrine called "forum non
conveniens" by which a court further assesses whether, among the range of
forums over which a case might technically be brought, which is the most
convenient and appropriate one given practical factors such as where most of
the activity in dispute occurred, where people live, and the like.

So, from a fairness standpoint, anyone sued in a distant forum can fight on
two fronts, jurisdiction and forum convenience. He makes what is called a
"limited appearance" to challenge jurisdiction without agreeing to submit
himself to the jurisdiction of the court for purposes of making that
challenge. If he wins, the court dismisses the case while allowing the party
to refile in a proper forum; if he loses, then the court has jurisdiction
unless he can change the result through an emergency appeal. Once jurisdiction
is so established, then any action of the court is binding on the defendant
and any judgment entered can be enforced against him in that jurisdiction or
in any other state in the U.S. (which will give "full faith and credit" to the
judgment under prevailing U.S. law).

If you are sued in a remote forum, and you do not "specially appear" to
challenge jurisdiction once you are served with the summons and complaint,
then the party will take a default judgment against you. When the party comes
to your state to ask a court to enforce the judgment against you, you can seek
to set that judgment aside even at that stage on grounds that the original
court lacked proper jurisdiction over your person and so was constitutionally
incompetent to enter that judgment. If you win on such an argument, the
judgment is unenforceable and void; if you lose, of course, then the judgment
is enforced against you and, since you defaulted in the original action, you
have no defense to it unless you can return to the originating jurisdiction
and seek to set it aside on whatever grounds they permit for setting aside a
default judgment. Since it is usually very difficult to set aside default
judgments, it normally behooves a party who has been sued in a remote forum to
hire counsel to challenge the jurisdiction right up front via a "special
appearance" rather than letting a judgment go by default in hopes of
challenging it later at the enforcement stage in your local jurisdiction.

All that said, what is happening in the _Sony_ case is that the individual
defendant appeared specially to say that the federal court in the Northern
District of California (i.e., San Francisco) lacks jurisdiction over his
person under minimum-contacts analysis and should therefore dismiss Sony's
case without prejudice to its being refiled in the place in which he lives.
Sony is arguing that sufficient minimum contacts do exist with the San
Francisco forum such as to make it fair and reasonable to require the
defendant to appear to defend the case there.

Once the issue is so joined, a federal court will normally allow a party such
as Sony to conduct limited discovery tailored to determining facts relevant to
the jurisdictional question only. Since the main issue concerning jurisdiction
concerning what "contacts" the defendant had with the San Francisco forum
relating to the underlying actions over which he is being sued, it becomes
technically relevant for the suing party to attempt to find all such contacts.
That would be the legal basis upon which the court is permitting this sort of
subpoena to be enforced.

Why San Francisco? I assume this is less for the purpose of harassing the
defendant as such than it is for that of having the case heard in a forum in
which the judges are likely far more knowledgeable about Silicon Valley-style
legal issues than they might be elsewhere.

This sort of high-profile fight, by the way, is wildly expensive to conduct
and, I assume, the defendant is only able to do so because of donations from
others or because of volunteer efforts by organizations who specialize in
defending the rights here being attacked.

I hope this helps explain the relevant legal issues (sorry for the length but
I clerked for a federal judge in the Northern District of California many
years back and it fell to the sorry lot of the law clerks to research these
exact issues many times over during one's stint with the court).

~~~
law
This is an absolutely wonderful summary of jurisdictional issues facing courts
in the United States. I really wish you had taught my civil procedure course!

What's interesting about the original question, which pertains to standing in
French courts, is that there's an on-point case involving the inverse of that.
Yahoo! Inc. v. La Ligue Contre le Racisme et l'Antisemitisme (LICRA)
establishes the competence of French courts to hear internet cases. Of
particular interest is that Sony, which presumably has offices in France,
could use the US Marshals to serve the defendant in the United States,
pursuant to the Hague Service Convention. I imagine that any potential benefit
Sony would get from doing this would be outweighed by the costs of litigation,
and the risk of having the judgment unenforceable in the United States,
though.

------
nhangen
I don't think this case is getting enough attention outside of places like HN
and Ars. The way this man's rights are being stripped bare is a very
impressive display of fascism that needs to be seen in a public light.

~~~
pyre
Discovery is a phase that's always been there in the court system. What I
don't get is that the judge is allowing them to go on a fishing expedition to
prove that they can sue him in that jurisdiction. I mean right now, they
haven't even proven that they can sue him in this court. If they can't prove
that on their own, then why are they allowed to waste the court's time
spending months (years?) searching for some proof that probably won't turn up?

------
InclinedPlane
I'd like to hear a lawyer's perspective on how the modern legal climate would
have applied to historical events, especially Compaq's reverse engineering of
the IBM PC BIOS which enabled them to create PC clones.

~~~
law
I'm not an attorney yet (another year), but I can give you a little more
insight to that question, specifically. Absent a patent on the technology,
reverse engineering is a completely acceptable way to learn the underlying
facts and algorithms used in a technology. This was particularly evidenced in
Sony Computer Entertainment Inc. v. Connectix
([http://web.archive.org/web/20070228070634/http://www.ca9.usc...](http://web.archive.org/web/20070228070634/http://www.ca9.uscourts.gov/ca9/newopinions.nsf/0/66b3a352ea33712988256952007578c2?OpenDocument)),
where Connectix created an emulator and Sony sued, alleging that the BIOS had
been transiently copied (thus violating copyright law) in order for Connectix
to emulate Sony's systems.

The key to this case was that Connectix had exhausted all other methods before
resorting to reverse engineering; Connectix contended that direct disassembly
was necessary, because they had no other way to learn the non-copyrightable
facts and algorithms.

The holding in the case was that Sony's copyrighted material did not deserve
as much protection, because it contained unprotected aspects that could not be
examined without copying. This is why Sony's BIOS was accorded a lower degree
of protection than more traditional literary/musical/creative works.

Keep in mind, Connectix was a 1999 case. DMCA implemented two 1996 WIPO
treaties, and became effective in 1998. I've read through nearly all of the
DMCA, and everything in the opinion comports with the sections of the US Code
that the DMCA amended. This is probably the best case that illustrates reverse
engineering.

~~~
daeken
Another critical reverse-engineering case was Sega v. Accolade, 1992:
<http://en.wikipedia.org/wiki/Sega_v._Accolade>

------
mahrain
I feel more and more that Stallman has a point. Everything that's in the cloud
is there for the taking. Not to sound like a luddite but if he'd have cashed
checks instead of paypal or hosted his own website this wouldn't be possible,
right?

I remember Rob Gonggrijp's comment when his Twitter logs were subpoena'd:
"This is why people run their own mail servers".

~~~
mathnode
Every monetary trading system creates an audit trail. If the ruling is given
to give access to an email account, the place of hosting is irrelevant. Unless
you were to delete your mail server, which would probably only incriminate you
further.

~~~
rmc
The place of hosting is very important if its not in the same jurisdiction as
the court

------
Entlin
Does people only get the data who donated, or also how much?In the latter
case, Sony now has a strategic asymmetric advantage: it can estimate how much
money Geohot has for his defense, and then drag out the process so long until
he has no money left.

I'm very surprised the Judge sided with Sony on this one.

------
callumjones
I wish Sony would use these legal costs to hire some decent designers.

