Opinion
Case No. C17-1789RSL
08-06-2018
RYANAIR DAC, Plaintiff, v. EXPEDIA INC., Defendant.
ORDER DENYING MOTIONS TO DISMISS
This matter comes before the Court on defendant Expedia Inc.'s "Motion to Dismiss," Dkt. # 18, and "Motion to Dismiss for Forum Non Conveniens," Dkt. # 28. The Court has considered the motions, the parties' memoranda, the associated filings, and the remainder of the record. For the following reasons, defendant's motions are DENIED.
The Court can decide the motion on the papers submitted. For that reason, the requests for oral argument are DENIED.
I. BACKGROUND
Plaintiff Ryanair DAC is an airline headquartered and incorporated in Ireland that offers low-priced flights in Europe. Compl. (Dkt. # 1) ¶ 2. Expedia is headquartered in Bellevue, WA, and operates several websites where users can book flights, hotels, and other travel-related services. Painter Decl. (Dkt. # 29) ¶¶ 2-3. One of the websites' main features is a fare-comparison tool that aggregates flights from many airlines so users can compare routes and fares in one place. See id. Users can then book their preferred flight through Expedia. Compl. ¶ 43.
Ryanair's flights appear on Expedia's websites, even though Ryanair does not want them to. Id. ¶ 34. The basis for this suit is the way Expedia gets Ryanair's flight and price information. Ryanair alleges that Expedia employs a program—known, among other names, as a "screen scraper"—to automatically gather (or "scrape") data from the Ryanair website. Id. ¶¶ 39-40. The scraper mimics a customer to access the website, sifts through its code, and extracts relevant information about flights, seats, and prices. Id. ¶¶ 36, 38-41; see also EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 579 (1st Cir. 2001) (describing scraping).
Ryanair alleges the scraping is unauthorized based on the website's Terms of Use ("TOU"). Those Terms provide: "Use of any automated system or software, whether operated by a third party or otherwise, to extract any data from this website for commercial purposes ('screen scraping') is prohibited." Compl. ¶ 19. They also limit use of the website to private, non-commercial use. Id. In September 2017, counsel for Ryanair wrote Expedia clarifying that any scraping was not authorized and asking Expedia to stop. See Dkt. # 1-4.
Expedia did not stop, and Ryanair filed this suit under the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030 et seq. "The CFAA prohibits acts of computer trespass by those who are not authorized users or who exceed authorized use." Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1065 (9th Cir. 2016). It creates criminal and civil liability for whoever "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer." 18 U.S.C. § 1030(a)(2)(C). A "protected computer . . . includ[es] a computer located outside the United States that is used in a manner that affects interstate or foreign commerce." Id. § 1030(e)(2)(B). The CFAA also provides a civil remedy for "[a]ny person who suffers damage or loss by reason of a violation of this section." Id. § 1030(g).
Expedia moved to dismiss, arguing that the CFAA's civil provision does not apply extraterritorially. Dkt. # 18. Expedia followed up with a motion to dismiss on the bases of forum non conveniens and international comity. Dkt. # 28.
II. DISCUSSION
Extraterritoriality is analyzed under Federal Rule of Civil Procedure 12(b)(6). Morrison v. Nat'l Australia Bank Ltd., 561 U.S. 247, 254 (2010). To survive a Rule 12(b)(6) motion to dismiss, a plaintiff must plead facts that allow the Court to reasonably infer the plaintiff is entitled to relief. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
Whether to dismiss an action based on forum non conveniens or international comity is a matter of discretion and concerns convenience for the former, see Piper Aircraft Co. v. Reyno, 454 U.S. 235, 248-49 (1981), and foreign relations for the latter, see Mujica v. AirScan Inc., 771 F.3d 580, 597 (9th Cir. 2014).
A. Extraterritoriality
Expedia's first argument invokes the presumption against extraterritoriality, which rests on the principle that "[a]bsent clearly expressed congressional intent to the contrary, federal laws will be construed to have only domestic application." RJR Nabisco, Inc. v. European Cmty., 136 S. Ct. 2090, 2100 (2016). Courts apply "a two-step framework for deciding questions of extraterritoriality." WesternGeco LLC v. ION Geophysical Corp., 138 S. Ct. 2129, 2136 (2018). Courts first ask if a "clear, affirmative indication" rebuts the presumption against extraterritoriality, id., but the presumption is not a "'clear statement rule' . . . requir[ing] that a statute say 'this law applies abroad,'" Morrison, 561 U.S. at 265.
If nothing rebuts the presumption, courts "determine whether the case involves a domestic application of the statute." RJR Nabisco, 136 S. Ct. at 2101. "Courts make this determination by identifying 'the statute's focus' and asking whether the conduct relevant to that focus occurred in United States territory." WesternGeco, 138 S. Ct. at 2136. "If it did, then the case involves a permissible domestic application of the statute." Id. Where, as here, a claim invokes a criminal statute's civil right of action, courts apply the presumption to the statute's civil provision separately. RJR Nabisco, 136 S. Ct. at 2106.
Here, the CFAA's text "gives a clear, affirmative indication" that its civil provision applies extraterritorially. See WesternGeco, 138 S. Ct. at 2136. Other than prohibitions specific to government computers, nearly all the statute's protections guard against harm, damage, or unauthorized access to a "protected computer." See 18 U.S.C. § 1030(a). "Protected computer" includes "computer[s] located outside the United States." Id. § 1030(e)(2)(B). That definition is as clear an indication as possible short of saying "this law applies abroad." See Morrison, 561 U.S. at 265.
Expedia argues the civil provision contains insufficient indications of extraterritoriality. It relies on RJR Nabisco, Inc. v. European Community, which held that some criminal prohibitions in the Racketeer Influenced and Corrupt Organizations Act ("RICO"), 18 U.S.C. § 1961 et seq., apply extraterritorially but the statute's civil remedy does not. 136 S. Ct. at 2106.
The CFAA differs from RICO in several meaningful ways. RICO does not itself include language that indicates extraterritoriality as explicitly as the "protected computer" definition. RICO also differs from the CFAA in structure and breadth. RICO prohibits operating an enterprise through a pattern of racketeering acts, but it does not actually define or prohibit those acts. See 18 U.S.C. § 1962. Instead, it incorporates dozens of predicates hailing from a range of federal and state criminal statutes—predicates that all have varying degrees of extraterritorial application. See id. § 1961(a). In contrast, the CFAA defines a limited list of prohibitions and provides for their extraterritorial application alongside the civil right of action. There is no good reason that the civil provision does not incorporate the full definition of "protected computer." Unlike RICO, concluding that the CFAA's civil provision does not apply extraterritorially would require excising words from the actual statute.
To do so would make little sense given the conduct the CFAA regulates. That conduct (unauthorized computer access) basically happens simultaneously at the locations of the accessor and the accessed computer, with limitless possible locations that the transmitted data may pass through in between. See Jennifer Daskal, The Un-Territoriality of Data, 125 Yale L.J. 326, 365-77 (2015) (explaining how data, and the way it is accessed and controlled, undercuts core assumptions of territorial, location-based distinctions). Many data and cloud-computing servicers store customer data on servers around the globe. If a hacker in Seattle breaches his next-door neighbor's Gmail account, that information could be on a server in Oregon or one in Finland. It makes sense that the CFAA extends protection to computers outside the United States, and that logic applies just as forcefully to its civil provision. This reality belies Expedia's arguments that continually emphasize the location of Ryanair's servers in Ireland.
Google, for example, has servers in the Americas, Asia, and Europe—including some in Ireland. Data center locations, Google.com, https://www.google.com/about/datacenters/inside/locations (visited Jul. 20, 2018). Expedia's servers are in Arizona even though its headquarters is in Washington and relevant employees are in places from Florida to Singapore. Painter Decl. ¶¶ 6-7.
The CFAA's scope is limited elsewhere. Claims must stem from access to a computer that affects domestic commerce. See 18 U.S.C. § 1030(e)(2)(B). Any suit would also require personal jurisdiction over the defendant, which obviates the possibility of resolving claims between two foreign parties over a foreign computer that happens to affect American commerce.
Expedia also argues that limitations in the civil provision warrant reading out part of the "protected computer" definition. Expedia is correct that the CFAA's civil and criminal provisions are not coextensive, see Dkt. # 18 at 15, but that does not warrant cutting words from the definition of "protected computer." The CFAA "gives a clear, affirmative indication" that its civil provision applies extraterritorially, see WesternGeco, 138 S. Ct. at 2136, and the presumption against extraterritoriality has accordingly been rebutted.
The CFAA differentiates penalties based on enumerated harms. See 18 U.S.C. § 1030(c)(4)(A)(i). Invoking that list, the civil provision limits its scope to conduct causing: at least $5,000 of loss in one year; impairment to medical care; physical injury; threats to public safety; or harm to law-enforcement or national-security computers. See id. § 1030(g). It also limits the first group of claims to economic damages, imposes a limitations period, and excludes liability based on design. Id.
The Court does not reach step two, but there are persuasive indications this case involves a permissible domestic application. See WesternGeco, 138 S. Ct. at 2136. "[T]he statute's focus," id., is unauthorized access and the harm it causes. Ryanair alleges Expedia's unauthorized access originated in the United States, and that it harmed, among other things, Ryanair's reputation and goodwill with American customers, see Creative Computing v. Getloaded.com LLC, 386 F.3d 930, 935 (9th Cir. 2004) (explaining the CFAA's civil remedies allow "damages for loss of business and business goodwill").
B. Choice-of-Law Clause
Expedia also argues that a choice-of-law clause in the Ryanair website's TOU requires application of Irish law and precludes applying the CFAA. That clause provides:
It is a condition precedent to the use of the Ryanair website, including access to information relating to flight details, costs, etc., that any such party submits to the
sole and exclusive jurisdiction of the Courts of the Republic of Ireland and to the application of the law in that jurisdiction, including any party accessing such information or facilities on their own behalf or on behalf of others.Dkt. # 1-3 ¶ 7. The TOU simply define the limits of authorization to access the website. The choice-of-law clause would apply if Ryanair were suing for breach of the TOU. Even on the reasoning that the choice-of-law clause controls the CFAA claim because the TOU define the scope of access, Ryanair's September 2017 letter serves as an independent basis clarifying that the scraping was unauthorized. See Dkt. # 1-4. The choice-of-law clause does not bar Ryanair's CFAA claim. C. Forum Non Conveniens
Expedia also argues that the Court should dismiss Ryanair's complaint on grounds of forum non conveniens. That doctrine places within a district court's discretion the option of "resist[ing] imposition upon its jurisdiction," Gulf Oil Corp. v. Gilbert, 330 U.S. 501, 507 (1947), when trial would "establish . . . oppressiveness and vexation to a defendant . . . out of all proportion to plaintiff's convenience," Koster v. (Am.) Lumbermens Mut. Cas. Co., 330 U.S. 518, 524 (1947). "[T]he doctrine's purpose is to root out cases in which the open door of broad jurisdiction and venue laws may admit those who seek not simply justice but perhaps justice blended with some harassment, and particularly cases in which a plaintiff resorts to a strategy of forcing the trial at a most inconvenient place for an adversary." Carijano v. Occidental Petrol. Corp., 643 F.3d 1216, 1224 (9th Cir. 2011) (marks and citation omitted). A defendant seeking dismissal must show "(1) the existence of an adequate alternative forum, and (2) that the balance of private and public interest factors favors dismissal." Loya v. Starwood Hotels & Resorts Worldwide, Inc., 583 F.3d 656, 664 (9th Cir. 2009) (marks and citation omitted).
1. Adequate Alternative Forum
"Typically, a forum will be inadequate only where the remedy provided is so clearly inadequate or unsatisfactory, that it is no remedy at all." Ranza v. Nike, Inc., 793 F.3d 1059, 1077 (9th Cir. 2015). "[T]hat the law, or the remedy afforded, is less favorable in the foreign forum is not determinative." Loya, 583 F.3d at 666. "A foreign forum must merely provide 'some' remedy." Ranza, 793 F.3d at 1077.
Here, the Court notes that Expedia bears the burden of showing Ireland provides some remedy. See Tuazon v. R.J. Reynolds Tobacco Co., 433 F.3d 1163, 1178 (9th Cir. 2006). Expedia fails to discuss any actual remedies under Irish law, even though the forum non conveniens inquiry compares remedies—often based on expert testimony about the proposed forum's law and remedies. See Universe Sales Co. v. Silver Castle, Ltd., 182 F.3d 1036, 1038 (9th Cir. 1999) ("[E]xpert testimony accompanied by extracts from foreign legal materials has been and will likely continue to be the basic mode of proving foreign law."); see also Azima v. RAK Inv. Auth., 305 F. Supp. 3d 149, 173 (D.D.C. 2018) ("It is important to note that the onus is not on the district court to research the proposed alternative forum in order to make the necessary assessment of its adequacy.").
See, e.g., Gutierrez v. Advanced Med. Optics, Inc., 640 F.3d 1025, 1029 (9th Cir. 2011) (expert on Mexican law); Lockman Found. v. Evangelical All. Mission, 930 F.2d 764, 768 (9th Cir. 1991) (expert on Japanese law); Vivendi S.A. v. T-Mobile USA, Inc., No. C06-1524JLR, 2008 WL 2345283, at *10 (W.D. Wash. Jun. 5, 2008) (expert on Polish law); Peach v. Shopshire, No. CV05-369JCC, 2006 WL 456772, at *10 (W.D. Wash. Feb. 23, 2006) (expert on Canadian law). --------
Expedia cites two decisions finding Ireland to be an adequate forum, but those cases involved unrelated causes of action. See In re Banco Santander Sec.-Optimal Litig., 732 F. Supp. 2d 1305, 1332 (S.D. Fla. 2010) (negligence and fraud claims against investment managers); Flynn v. Nat'l Asset Mgmt. Agency, 42 F. Supp. 3d 527, 536 (S.D.N.Y. 2014) (financial crimes and wrongdoing). Whether a foreign forum is adequate depends on the nature of a particular cause of action, and neither cited case involved a dispute resembling this one.
Expedia also emphasizes that Ryanair has filed lawsuits related to unauthorized scraping in Ireland as proof it is an adequate forum. The Irish court opinions Expedia cites mostly concern jurisdictional issues and do not directly address whatever substantive causes of action Expedia might claim are adequate alternatives. The Irish suits do, however, suggest that there is some remedy in contract or trespass that Ryanair can invoke related to scraping. Ireland is probably an adequate forum even if the evidence of it is tenuous on this motion's briefing. The Court will assume without deciding that Ireland is an adequate alternative forum.
2. Private and Public Interests
The relevant private-interest factors are "(1) the residence of the parties and the witnesses; (2) the forum's convenience to the litigants; (3) access to physical evidence and other sources of proof; (4) whether unwilling witnesses can be compelled to testify; (5) the cost of bringing witnesses to trial; (6) the enforceability of the judgment; and (7) all other practical problems that make trial of a case easy, expeditious and inexpensive." Boston Telecomms. Grp., Inc. v. Wood, 588 F.3d 1201, 1206-07 (9th Cir. 2009) (citation omitted).
Expedia is headquartered in the Western District of Washington but wants to litigate in Ireland, while Ryanair is an Irish corporation that wants to litigate in the Western District of Washington. The potential witnesses are scattered globally in Washington, Florida, Dublin, London, and Singapore. Trial in either forum is likely to involve significant travel, which coincidentally happens to be the parties' field of expertise. Much of this case's evidence appears to be electronic data, which makes its "location" much less salient a factor. To the extent there is physical evidence, it is likely in Washington, Ireland, or Arizona. The factors relating to the location of evidence and witnesses are essentially neutral.
Whether to enforce a foreign judgment is a case-by-case determination based on principles of international comity. See Asvesta v. Petroutsas, 580 F.3d 1000, 1010-11 (9th Cir. 2009). Given the positions Expedia has taken here, an Irish judgment is likely enforceable.
Expedia raises concerns that it may not be able to compel testimony from witnesses with Ryanair and TravelFusion, a third-party contractor in London and Shanghai that Expedia claims is the actual party accessing Ryanair's servers. Ryanair brought this suit, and failure to comply with its discovery obligations would risk sanctions, including dismissal. See Fed. R. Civ. P. 37. As for TravelFusion, Expedia fails to point out what evidence it needs that is not in Expedia's possession or available through its contract with TravelFusion. "'Any court . . . will necessarily face some difficulty in securing evidence from abroad,' but these complications do not necessarily justify dismissal." Boston Telecomms. Grp., 588 F.3d at 1208 (quoting Tuazon, 433 F.3d at 1181). The private-interest factors do not meaningfully favor dismissal.
The relevant public-interest factors are "(1) the local interest in the lawsuit, (2) the court's familiarity with the governing law, (3) the burden on local courts and juries, (4) congestion in the court, and (5) the costs of resolving a dispute unrelated to a particular forum." Tuazon, 433 F.3d at 1181. Here, there is a local interest in adjudicating alleged violations of federal law committed by local companies. See Boston Telecomms. Grp., 588 F.3d at 1211 (explaining that the local-interest factor prompts courts to ask "only if there is an identifiable local interest in the controversy, not whether another forum also has an interest"). The case involves a federal court applying federal law. The case is not unrelated to the forum: Washington is home to Expedia's headquarters, several of its relevant employees, and locations alleged to have produced wrongful conduct. No court wants to unnecessarily add to its caseload, but concerns of congestion do not outweigh the public interests weighing against dismissal. The public-interest factors do not favor dismissal. Expedia has not met its burden of showing out-of-proportion inconvenience if the case remains in this Court. See id. at 1206.
D. International Comity
Finally, Expedia urges the Court to dismiss this case for reasons of international comity. "International comity is a doctrine of prudential abstention, one that 'counsels voluntary forbearance when a sovereign which has a legitimate claim to jurisdiction concludes that a second sovereign also has a legitimate claim to jurisdiction under principles of international law.'" Mujica, 771 F.3d at 598 (quoting United States v. Nippon Paper Indus. Co., 109 F.3d 1, 8 (1st Cir. 1997)). There is no well-defined test for when international comity obliges a court to dismiss an action in favor of another forum. See id. at 603. A "useful starting point" is to weigh the strength of the United States' interests, the strength of the foreign government's interests, and the adequacy of the alternative forum. Id. In considering the United States' interests, courts weigh "(1) the location of the conduct in question, (2) the nationality of the parties, (3) the character of the conduct in question, (4) the foreign policy interests of the United States, and (5) any public policy interests." Id. at 604.
Some conduct in question occurred in the United States considering that the alleged data-gathering originated with Expedia's web operators and that the data somehow made it back to Expedia. The character of the conduct—that is, the simultaneous interaction of computer networks—draws "closer the connection between the conduct and [Congress's] core prerogatives" to regulate unauthorized access of computers affecting interstate or foreign commerce. See id. There is no indication this case will adversely affect United States foreign policy interests, see id., nor is there a likely conflict of judgments, see Hartford Fire Ins. Co. v. California, 509 U.S. 764, 798-99 (1993) (describing situations when complying with two laws or judgments is impossible).
Exercising jurisdiction over this case has few implications for Ireland's interests. See Mujica, 771 F.3d at 607. Even if an Irish court determines Expedia has done nothing wrong under Irish law, Ireland has no interest in an American company avoiding (or not avoiding) liability under an American statute. Finally, the adequacy of Irish courts has little impact on this determination. See id. For these reasons and for the reasons in the Court's extraterritoriality and forum non conveniens analysis, the Court declines to dismiss this case based on international comity.
III. CONCLUSION
For the foregoing reasons, Expedia's motions, Dkt. ## 18, 28, are DENIED.
DATED this 6th day of August, 2018.
/s/_________
Robert S. Lasnik
United States District Judge