Oral argument — Safe 'N' Sec Corporation v. SNS Holding LLC

Councilor White, you are arguing for 5 minutes and your colleague, Councilor Rhoad, is arguing for 10. Is that correct? That's correct, Your Honor. Alright, you may proceed. May I inquire what you're handing? Yes, Your Honor. There is a recent case I would like to address in my oral argument that was not published at the time we filed our claim of appeal. I've provided it to Council. Did you file a supplementary? I have not, Your Honor. I just discovered it recently and it bears on some of the issues present here today. So with the court's permission, I'd like to briefly address it and the court can do with it what it would like if that is acceptable. Well, I find it could lead to some unfairness in bringing this to Council's attention at the moment of argument. I mean, you could have at least handed that to them two hours ago and said we're going to be addressing this and giving them a little bit of time. That said, I'm going to reserve whether to let that have weight in today's argument and we can decide that at a later time. I understand. But I do encourage you to file your motion for supplemental information as quickly as possible or you're going to find yourself one of these days where in trouble over that. I apologize, Your Honor. Okay. Thank you. You may proceed. Thank you, Your Honor. May it please the court, my name is Christine Essek. I represent the Plaintiff Appellate Safe and Sec Corporation. This case presents the very interesting question of personal jurisdiction in the age of e-commerce. Specifically, we're dealing with software of the plaintiff and that software is called SysWatch TP Secure as well as the Safe and Soft product lines. These are, I'll collectively refer to that software as the software. This is anti-malware software and it is used in the context of global banking transactions. Specifically, automated teller machines, other unattended financial devices, online banking, mobile banking applications. Did you submit any evidence that at least one person practiced or used that software in the state of California? Yes, Your Honor. We did provide some banking statements, showing Sperbank banking statements, indicating that there were credit card transactions, debit transactions, also unattended financial transactions such as using it for Uber, parking in California. Was lunch in Marina Del Rey? I'm sorry? Was lunch in Marina Del Rey? That was one of the items, yes, Your Honor. In Santa Monica? Yes, Your Honor. In this case, we did not have an evidentiary hearing. We did not have discovery. What we're looking at today is prima facie allegations contained in the second amended complaint. Do I understand correctly that those were for people who were visiting California, not necessarily California residents? At this point, we are unaware of whether Sperbank's customers are U.S. residents. We believe them to either be traveling to the United States, specifically California, working in California, or visiting California. And we don't have the discovery to be more specific as to that, Your Honor. So the concept of internet-based personal jurisdiction is a developing area of law. The United States Supreme Court has not addressed it, The First Circuit did recently address contacts, virtual contacts, and how that translates into contacts for purposes of the minimum contacts analysis in the context of personal jurisdiction. I do apologize. At the time plaintiff filed its claim of appeal in this matter, it had not been published. During the parties' briefings, it had been published. None of the parties did address it, and I recently discovered this in looking at the relevant case on updating it for purposes of this hearing. The case is Plexner International v. Scrutinizer. The site is 905 F. 3rd. 1. In Plexner, the First Circuit addressed... What's the site again? I'm sorry? The citation? 905, I should say 905 F. 3rd, page 1. Plexner? I'm sorry? Plexner? Plexner. It's spelled P-L-I-X-N-E-R, International v. Scrutinizer. In this case, the defendant was a German company, and it ran a virtual platform. Essentially, that virtual platform was cloud-based, and customers all over the world, and specifically the United States, would upload their source code to the cloud-based system for purposes of analyzing whether it had any security vulnerabilities. The customer would simply upload the source code, and the platform would scrutinize it for bugs and improve the software. So we're talking like a banking application, right? I wouldn't say it's exactly a banking application. It was software that could be used in any medium, not just banking, in the Plexner case. In our case, we are talking about global banking transactions, which would be ATMs, doing online banking when you're traveling, doing mobile-based applications, transferring funds. So as in the present case, the defendant conducted global web activity, but it had no servers in the United States, had no equipment in the United States, had no offices in the United States, no employees. Let me ask you, so if a California resident goes to withdraw, let's say they're from Russia, and they're in California on vacation, and they go to withdraw money from the local ATM, and that ATM is a Wells Fargo ATM, are you saying that by virtue of the person being Russian or holding a Russian bank account, that the software will be activated and run during this transaction? According to the inventor, Mikhail Kalinchenko, and his declaration was a part of the appendix, he indicates that any time you use an ATM anywhere in the world, that the defense agents of that malware are executed and triggered wherever that ATM is located. And who's protected there, Wells Fargo or just the Russian bank? I'm sorry, your Honor? Who's protected? It is the customer of Sberbank that is protected by using its Sberbank card anywhere in the world. So the Plixner case is significant because the First Circuit rejected the same argument the defendant Sberbank is making in this case, which is our contacts with the United States and California aren't ours, it's our customers. And the First Circuit rejected that argument because, like Sberbank, the defendant in Plixner had a website that was globally accessible. They had it in the English language, among other languages. And we've attached that website and those pages in our appendix. And the defendant could have but did not restrict activity to its customers on U.S. soil. Obviously, this is a global company. They targeted the world. Just like the defendants in this case, they advertise on their website, banking wherever you are. So the exercise of jurisdiction was found to be voluntary and foreseeable, premised upon the failure to implement any restrictions which would limit the U.S., its customers in the United States' ability to access the website. So the First Circuit, that's indicated that regardless of a physical presence in the United States, that intent to direct activity towards the United States and the customers in the United States was sufficient to exercise jurisdiction over the German defendant. What's the sum total of facts, since we obviously haven't had a chance to read the case yet, but the sum total of facts that the First Circuit recited about Scrutinizer, is that the name of the German company? That is correct, Your Honor. That supported the idea that it was directing its openness to business to the United States. Yes, Your Honor. It was a trademark infringement action, and the First Circuit, the relevant facts were that the German company operated and really targeted the world, including the United States. Do you remember by what specific activities? Yes. That's more of a conclusion than a... I'm sorry, Your Honor. So they used the global platform, the iCloud-based services, and had a website, a globally accessible website. Was it a de.com, or did they have an actual .com? It was cloud-based, Your Honor. I'm sorry if I don't understand the question. What was the URL? Was it scrutinizer.com or scrutinizer.de.com, or what? It was scrutinizer-ci.com. Okay. The facts in that case is that they intentionally made their website available in English, and they did not restrict access by the United States, by customers in the United States. So the prima facie allegations, which I believe the lower court disregarded, which showed that Sberbank purposely directed its activities at California, is that it provides remote service channels. And in order to promote its remote service channels, including online banking, they maintain a website in English. It's not restricted to customers traveling to the United States or living in the United States or working in the United States. And it advertises banking wherever you are, always by your size. The purpose of Sberbank in making these representations, and this is part of the second amended complaint, its allegations, is to increase its customer base and increase its profits and business. Sberbank unilaterally, voluntarily contacted the plaintiff during the time period that it had a legal sublicense to use and copy the software in order to develop another module relating to that globally accessible software to secure online payments made by its customers worldwide. So each time that Sberbank's customers would access or use these remote service channels, the defense agents of the plaintiff's software would be triggered and executed in the United States and specifically California, which constitutes infringement in California. These are voluntary actions by Sberbank which demonstrate that it purposefully directed its activities in California. The lower court's first error is that in the absence of an evidentiary hearing and without jurisdictional discovery. You're getting into your rebuttal time. I just wanted to warn you. Thank you, Your Honor. I'll just briefly address S&S Holding. In some respects, S&S Holding has a stronger case in that they voluntarily contracted with the plaintiff. They were aware and acknowledged that the plaintiff was the exclusive rights holder to the software, and they were aware that Sberbank's license expired, sublicense expired as of 2016. But pursuant to the software support and maintenance agreement, they're continuing to provide service to that software, which enables Sberbank to cap and use the software and users to use it in the foreign state. So the plaintiff's prima facie allegations are that but for S&S Holding's actions in supporting the software, Sberbank's customers could not use that software, and it would not be triggered in California. We believe this constitutes purposeful direction, and like the court in Klixner, we request that the court reject the notion that physical presence as of servers is necessary for the purpose of exercising personal jurisdiction over these defendants. Thank you. Good morning, Your Honors, and may it please the court. So on behalf of Sberbank, we believe that the district court correctly held that there are not the sufficient minimum context to sustain personal jurisdiction over Sberbank in California, and I think Your Honor's questions have hit the critical issues, which are what's in the record about the extent of any contact. What's in the record is that it's undisputed that all of Sberbank's operations are entirely located within Russia. It's undisputed that Sberbank has no physical presence, no employees, no equipment, anything like that in California. There's no evidence that Sberbank conducted any acts in California or directed any... Does the software protect the customer or the banks? The software protects the device. So it's installed, for example, on ATMs and it's designed to prevent somebody from trying to introduce some software into the ATM that could then be... Are those devices installed in California? What's that? Are the devices installed in California? Yes, if you look at the ATMs, Sberbank has no ATMs in California. They're all in Russia. So we have no idea how they're alleging that the software supposedly gets onto an ATM in Russia or when somebody uses a credit card somehow. We have no idea of the basis for the allegation, but I think... So when a Russian citizen buys lunch at Marina Del Mar or someplace in California, they use their ATM, I mean they use their credit card, and that credit card is processed. Who's being protected? The ATM. In your example, the Wells Fargo ATM. And you're saying that there has to be a device on the Wells Fargo ATM machine in order for that to happen? I'm just saying they make the allegation that when somebody uses an ATM, that somehow software from Sberbank somehow gets executed on that ATM. We have no idea of the basis for that. What we're saying is that's not Sberbank's ATM. That is somebody taking... Are you able to walk us through the process? Give us an example of what's happening. Someone comes in, they put in their ATM card, and then what? I mean, can you talk about it? What does the ATM do? Does it talk to a back end somewhere that leads to the cloud where your client's software might be? Or do you not even have that information? All I can tell you is Sberbank's position is they've only installed the software on ATMs in Russia that never leaves Russia. We have no idea of the basis for their allegation that somehow when somebody goes to a Wells Fargo ATM... So Sberbank's, the only software Sberbank has, the only system that's being discussed here, is actually only located on ATMs in Russia? That's Sberbank's position, yes. That's everything I understand. And I think importantly, though, if you look at what they're alleging happens, and this is found, for example, on page 8 to 9 of their blue brief, and it's in a declaration of appendix 973, they list eight steps that are supposedly performed that constitutes the infringement. There's actually nine. The ninth step is repeating steps 1 through 8. And what they say is that's occurring... It's all internal to a device in California. So apparently they're saying if you use your ATM card, that's all happening within the ATM that's in California. That would be a Wells Fargo or some other non-Sberbank ATM. Or if it's a mobile device, they're saying, well, I might have a mobile app on my phone, and I bring it to California. And then when I do that on California, all this is happening on my phone in California. And, again, that's a device that's somebody else's smartphone. That's not a Sberbank smartphone. That's somebody else's smartphone that happens to be in California. It protects the Russian bank from picking up malware in the United States. They do not allege that there's any communication back to... that part of the infringement is not... Well, we're looking at invoices here, lunch in a restaurant in California, and it's got the bank's name. So there's been a financial transaction that occurred in California. There's a visa. First of all, that is completely unverified. We don't know what it is. On its face, it appears to be a visa statement. So Sberbank issues visa cards on Sberbank. We all have our... So whenever the customer uses that credit card, then the software is activated to protect against malware. So what that credit card is somebody who... What that appears to be is a transaction in which somebody had a Sberbank credit card, and they went and they used it in a restaurant, say, and that transaction then gets processed by the visa or whoever the credit card processor is, which is not Sberbank. So that transaction is protected against malware at that point. They say it causes the... There's no software installed on the credit card. I get that. But to activate the software in order to use it... I mean, you have a user here that's using what's been alleged to be an infringed patent. But the point, Your Honor... So they're saying that when they take a credit card and the company scans the credit card and it goes back to Visa Processing Center, where we don't know where that is, but that Visa software somehow runs this program. We don't... That's not Sberbank's equipment. It's not software from Sberbank. Can I just... I'm trying to understand kind of procedurally what we're entitled to look at and also what the district court found. So paragraph 9 on 973, which is your... That's the paragraph before the nine-part paragraph, says that Sberbank's... It seems to say that Sberbank's software or the defense agents of... Oh, of plaintiff's software products. This doesn't even say that it's Sberbank's. Correct. It's a device... I'm sorry. Do they have an allegation and or evidence that says Sberbank puts its product onto California devices? There is no such allegation. No such allegation. And is there a... Okay. As I understand their allegation is that if I have a mobile app on my smartphone and I go to California and I use it internal to the smartphone, steps happen that constitute infringement of the patent. And in my mind, as I thought about this more, this case is more and more akin to worldwide Volkswagen, right? Where the allegation was somebody sold a Volkswagen in New York that is obviously... Cars are obviously mobile. They can go wherever. And that it was a defective product. And somebody drove it to Oklahoma and got injured there and therefore there should be jurisdiction in Oklahoma. And they said no. Here, the allegation is, you know, there are mobile apps. You can put a mobile app on your smartphone. And then when you take your smartphone to California, there's infringement occurring on that smartphone. And therefore Sberbank is liable to be sued in California. But the situation might well be different if Sberbank puts its software not on the phone that ends up in California but on ATMs in California. There is no allegation and that is flatly denied. Why would Wells Fargo allow Sberbank to put software... No, no, no. Here's what I'm trying to get straight. If they alleged it and you denied it, I'm not sure we could decide it without a factual finding after a proper factual process, which I don't gather we have had here. So it makes a difference, I think, whether they even allege it. Or, more importantly, even if they alleged it, whether in whatever the proceeding was here they had a declaration that says it. There is no allegation or declaration that says Sberbank software gets loaded somehow onto a Wells Fargo ATM when somebody uses their ATM card at Wells Fargo in California. What is the app that they have to download? Is there an app, an application? The only evidence in the record is that we advertise that there's mobile banking and that you can have it in mobile apps. There's no allegations about what it is, how it works. So here in California you can transfer money from one account to another or... There's no evidence... You can pay your bills? There's no evidence at all in the record and I haven't investigated that personally. There's allegations about being able to do online banking. I think for purposes of... There may not be evidence, but I think that's the problem here. We're looking at whether there's jurisdiction. And I think the important thing, though, is that Sberbank has to purposefully, for personal jurisdiction, has to purposefully direct activities towards California and Sberbank's actions towards California, the claim has to arise from that. Here what we have is a situation where all of the... They're not alleging that communications going back and forth to Russia as part of this are what constitutes infringement. The infringement is entirely, as described in page 8 and 9 of their brief and in the declaration, is entirely happening on software within the device that is located in California. So it's this device that is located in California that is doing everything that they're alleging the claim arises out of. That's not Sberbank directing anything at California. It's not arising out of conduct by Sberbank towards California. Okay. You run out of time. Thank you, Your Honor. Can I make just 30 seconds about this case? Yes, please. Just what I noted very, very quickly in trying to review it. A, it's a trademark case. And to me that's significant because whether there's confusion about using a trademark to me is different than patent. But there's also allegations about... that it accepted recurrent business from the United States in a substantial amount and that it did so knowingly. And there's evidence that it engaged in sizable and continuing commerce with United States customers. And there's no evidence of anything remotely like that in the record here. In fact, if you look at the NextLearn case, that's an interactive website case and there was an allegation that they gave a free trial to a customer, I think it was in Kansas, and they said that one instance is too insubstantial and attenuated to support jurisdiction. And here we have evidence of one credit card statement about somebody taking a credit card to California. Thank you. Counselor, you have five minutes. Thank you, Your Honor. May it please the court? I don't intend to repeat my colleague's arguments, which I agree with. Suffice it to say that if the court finds that jurisdiction exists as to spur bank... does not exist as to spur bank, it also does not exist as to S&S holding. But I'd like to explain why even if the court finds that there were personal jurisdiction against spur bank, it still would not exist against S&S holding. So according to Appellant, the only intentional conduct engaged in by S&S holding was its provision of software support to spur bank. In other words, providing software support in Russia to a Russian bank, Appellant alleges, gives rise to purposeful express aiming at the Forum California. That argument is absurd on its face and incompatible with the Supreme Court's decision in Walden, which clearly stated that a defendant's relationship with a third party is insufficient to find personal jurisdiction. And there, the defendant was aware of the plaintiff's substantial connections to the Forum. Here, Appellant has not even alleged that spur bank was aware of its customers' connections to California, much less that those connections were substantial. And there certainly is no allegation that S&S holding had any awareness of spur bank's customers' connections to California. Unless the court has any questions, I will yield the rest of my time and respectfully urge the court to affirm dismissal. Thank you. Two minutes. Thank you, Your Honors. I'd just like to briefly address some of the questions that the court had to Defendant's Counsel. Judge Stoll, you asked what are specifically the steps. The inventor detailed those steps in his declaration, and that's at appendix page 969 to 975. With respect to spur bank counsel's argument that this is like the Volkswagen case, the stream of commerce analysis, it's completely different because when Volkswagen manufactures a car, it has no control over where its customer drives that car. In this case, the defendant had control over which members of the world could access its website. It specifically chose to provide that website in English, and it specifically offered those services to its customers to increase its customers' base and its profit. You are correct, Judge Toronto, that there is no allegation that we installed any of the software on equipment in the United States or that the defendants did. What we are alleging is that when the customers of defendant travel to California, that the defense components, the anti-malware components of the software, get triggered on U.S. soil. And finally... Those components get... What do you mean they get triggered? Where are those components? They're on the ATM in... They're associated with the service online banking with spur bank, the mobile applications. And when that card gets swiped at an ATM on U.S. soil, those components are triggered and protect... Where are those components? When you say those components are triggered? In the virtual world, where are those components? It's a difficult concept, but I believe they are triggered and protect that transaction on U.S. soil. But there's no servers on U.S. soil, correct? That is correct, Your Honor. So the servers are in Russia? That is what we believe to be the case, yes. Okay. In the Plixner case... If you want to conclude, you're out of time. Yes, I see 27 seconds, Your Honor. I'm wrapping up. The sizable commerce comment made that counsel made with respect to the Plixner case, in fact, there were only two transactions in Maine that allowed the district court in Maine to exercise personal jurisdiction over the defendant in that case. But it was a globally accessible website that targeted the world, and specifically the United States, including Maine. Thank you, Your Honor. Thank you. We thank all the parties for their participation.