Summary
In SkyHop Techs., Inc. v. Narra 58 F.4th 1211, 1230-31 (11th Cir. 2023)-a case Micro calls "directly on point"-we held that California residents satisfied the effects test when they extorted a Florida company they were in business with via emails sent into Florida.
Summary of this case from Micro Fin. Advisors v. ColoumbOpinion
No. 21-14051
01-26-2023
SKYHOP TECHNOLOGIES, INC., a Delaware corporation, SkyHop Global, LLC, a Florida limited liability company, Kristine Scotto, an Individual, Plaintiffs-Appellants, v. Praveen NARRA, an Individual, Indyzen, Inc., a California corporation d.b.a. AppDevelopment.com, Inc. d.b.a. Tech.US, Inc., Defendants-Appellees.
Alexander Esteban, Armando Rosquete, Bell Rosquete Reyes Esteban, PLLC, Coral Gables, FL, Omar Ortega, Reinaldo J. Dorta, Jr., Rosdaisy Rodriguez, Dorta & Ortega, PA, Coral Gables, FL, Javier Angel Reyes, Murai Wald Biondo & Moreno, PA, Coral Gables, FL, for Plaintiffs-Appellants. Robert L. Parks, Gabriel A. Garay, Garay Law, Coral Gables, FL, for Defendants-Appellees.
Alexander Esteban, Armando Rosquete, Bell Rosquete Reyes Esteban, PLLC, Coral Gables, FL, Omar Ortega, Reinaldo J. Dorta, Jr., Rosdaisy Rodriguez, Dorta & Ortega, PA, Coral Gables, FL, Javier Angel Reyes, Murai Wald Biondo & Moreno, PA, Coral Gables, FL, for Plaintiffs-Appellants.
Robert L. Parks, Gabriel A. Garay, Garay Law, Coral Gables, FL, for Defendants-Appellees.
Before William Pryor, Chief Judge, Rosenbaum, and Marcus, Circuit Judges.
Rosenbaum, Circuit Judge:
Nobody enjoys flight delays. They are disruptive for airlines, passengers, and crew members alike. And any number of things can cause them: to name just a few, severe weather, faulty equipment, or the unavailability of pilots and crew members.
Plaintiffs-Appellants SkyHop Global, LLC, SkyHop Technologies, Inc., and Kristine Scotto (collectively, "SkyHop") and Defendants-Appellees Praveen Narra and his company Indyzen, Inc. (collectively, "Indyzen" (unless otherwise indicated)) have taken aim at that last problem source: the unavailability of pilots and crew members. Together, they have developed and deployed digital software aimed at transporting crew members to and from airports across the country. And business has taken off. SkyHop has about eighty contracts with fifteen airlines, including major carriers like Delta, American, and United.
But now SkyHop and Indyzen dispute who owns the digital software. And beyond that, they disagree on where their dispute should be decided. Indyzen has filed an arbitration action in California (where it is based), alleging various forms of breach of contract and other promises. Meanwhile, SkyHop has filed this federal lawsuit in Florida (where it is based), alleging that Indyzen violated the federal Computer Fraud and Abuse Act ("CFAA") and the Florida Computer Abuse and Data Recovery Act ("CADRA").
In response, Indyzen sought to dismiss this action for lack of personal jurisdiction. It argued that the exercise of personal jurisdiction over it in Florida satisfied neither the Florida long-arm statute nor the Due Process Clause of the Fourteenth Amendment. The district court agreed and entered an order dismissing SkyHop's complaint.
We see things differently. The allegations in SkyHop's complaint, which we must accept as true on a motion to dismiss, suggest that SkyHop is the rightful owner of the digital software. And because Indyzen has refused to relinquish possession of the digital software without additional payment, SkyHop's complaint states a cause of action under the CFAA. The complaint therefore satisfies the Florida long-arm statute. And it also meets the requirements of the Due Process Clause because the emails that Indyzen sent into Florida triggered SkyHop's claims. So after careful review, and with the benefit of oral argument, we reverse the district court's order and remand for further proceedings.
I. Background
Because this case arrives here after the district court granted a motion to dismiss, for purposes of our analysis, we accept as true the factual allegations in the complaint. Silberman v. Miami Dade Transit , 927 F.3d 1123, 1128 (11th Cir. 2019). The actual facts may or may not be as alleged.
SkyHop Global, LLC, primarily offers a service to airlines: it provides ground transportation for flight crews to and from airports across the nation. To do this, SkyHop uses proprietary digital software, including a web-based program called SkyPlan and two mobile applications, SkyHop Crew and SkyHop Driver (collectively, the "Software").
SkyPlan uses flight manifests and real-time data to create schedules to pick up and drop off flight-crew members. Meanwhile, the mobile apps communicate and coordinate between flight crews and drivers on the ground. According to the First Amended Complaint, the operative complaint here, SkyHop Technologies, Inc. ("SkyHop Tech"), owns all this technology, and it licenses it to SkyHop Global. In turn, SkyHop Global has contracts with fifteen airlines and operates in twenty-one cities in eleven states. Both SkyHop Tech and SkyHop Global operate from their headquarters in Broward County, Florida.
Two password-protected cloud servers that are hosted by Amazon Web Services ("AWS") and physically located in Virginia house the SkyPlan program. One AWS account has the production server and SkyPlan's operational version, while the other account contains the staging server and its testing version. SkyHop Tech pays for both accounts.
Of course, the Software did not always exist. Rather, the process to develop it began in June 2014. Plaintiff Kristine Scotto—a Florida resident and one of SkyHop's founders—met with developers to discuss the development of what would become the Software. One of these developers was Defendant Praveen Narra. Narra resides in California and traveled to Fort Lauderdale, Florida, in 2014 to meet with Scotto. Scotto and her then-business partner reached an understanding with Narra that each of the three would own 32% of a newly formed entity that would become SkyHop Tech, with a fourth partner owning the remaining 4%.
After bringing Narra on board, SkyHop Tech contracted with Narra's California-based development company, Indyzen, Inc.—which does business under the name Tech.US—to develop and maintain the Software. That partnership has lasted for a few years. Since 2014, SkyHop Tech and Indyzen have signed several software-development and maintenance contracts for the ongoing services that Indyzen has provided. And in total, Narra has made three separate trips to Florida (in 2014, 2016, and 2018) to meet with Scotto about the relationship between the companies. All told, SkyHop Tech has paid Indyzen roughly $2.6 million—the full amount it owes under the agreements between the companies—for the development and maintenance of the Software.
As the party who developed and maintains the Software, Indyzen possesses what SkyHop Tech calls SkyHop's Digital Property: the source code for SkyHop's mobile apps, the outside vendor accounts those apps use to function (including the AWS accounts), the application programming interfaces for the apps, the relevant domain names, DNS service, signing keys, and all corresponding passwords required to operate, develop, and maintain the Software. One of the relevant AWS accounts is in Narra's name while the other is in Indyzen's name (in its own right), and both accounts use Narra's personal residence as the account address.
"DNS" means the "Domain Name System." Register.com, Inc. v. Verio, Inc. , 356 F.3d 393, 409–18 (2d Cir. 2004) (providing background on how the DNS works). "A DNS service ... is a globally distributed service that translates human readable names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect to each other." Amazon Web Services, What is DNS? , https://aws.amazon.com/route53/what-is-dns (last accessed Jan. 24, 2023).
Because the parties have incorporated the meaning of the term Digital Property into the meaning of the term Software, we will too.
Around the time Narra joined the venture and the parties sought to incorporate SkyHop Tech, the relationship between Scotto and her then-business partner began to break down, resulting in a lawsuit filed in January 2015. While Narra was never a party to that lawsuit, he twice represented during the course of those proceedings that he relinquished any ownership interest he had in SkyHop Tech. The parties based their settlement agreement resolving that dispute—five years later, in March 2020—on Narra's relinquishment of the ownership interest.
A few months later, on January 9, 2021, Scotto, in her role as the chief executive officer of SkyHop Global and President of SkyHop Tech, informed Narra that SkyHop Tech planned to hire in-house developers to take over development and maintenance of the Software. As a result, Scotto explained, SkyHop Tech planned to terminate its relationship with Indyzen.
Two days later, Narra responded by email that he would "turn over all the source code and intellectual property developed for SkyHop Tech[ ]" in exchange for slightly over $1.1 million. In reply, SkyHop Tech counteroffered $75,000 for three months of support and consulting. Indyzen did not accept. Instead, Tech.US's chief revenue officer, Rob Milks, emailed Scotto and reiterated Narra's offer to turn over the Software for roughly $1.1 million. A few days later, Narra sent another email to say that, if the parties could not reach a financial agreement, Scotto should transfer a 32% stake in SkyHop Tech to Narra individually.
On February 9, SkyHop Tech, through its counsel, sent a demand letter to Narra. In that letter, SkyHop Tech asserted that Indyzen lacked any property right in the Software and that Indyzen's refusal to transfer was "inconsistent with SkyHop Tech's ownership rights in its Property." The letter "demand[ed] that by March 1, 2021, Indyzen transfer possession of SkyHop's Property to SkyHop Tech." That did not occur.
Rather, on March 12, in San Jose, California, Indyzen (in its own right) filed a Demand for Arbitration against SkyHop Global, SkyHop Tech, and Scotto with the American Arbitration Association. A few months later, Indyzen filed an Amended Demand listing Narra as an additional claimant.
SkyHop responded by suing Indyzen in the Southern District of Florida. SkyHop raised six causes of action, including three claims under the CFAA, 18 U.S.C. § 1030 ; one claim under the Florida CADRA, Fla. Stat. § 668.803 ; and two claims seeking a declaratory judgment concerning the arbitrability of the dispute.
Indyzen moved to dismiss for lack of personal jurisdiction and, in the alternative, for improper venue. In support of the motion, Indyzen included Narra's affidavit, which asserted additional facts relevant to the jurisdiction inquiry. In the motion, Indyzen argued that personal jurisdiction was improper in Florida because the Florida long-arm statute was not satisfied and the exercise of jurisdiction did not comport with the Due Process Clause. Indyzen also contended that a valid and applicable forum-selection clause in the contracts required any litigation between the parties to be brought in Santa Clara County, California.
Indyzen moved once before to dismiss for lack of personal jurisdiction or improper venue, but SkyHop filed an amended complaint in response.
SkyHop opposed Indyzen's motion seeking dismissal. In support of its position, SkyHop argued Florida's long-arm statute supported jurisdiction because, in relevant part, Narra claimed an ownership interest in a Florida-based company and Indyzen committed a tortious act in Florida. SkyHop also asserted that Indyzen had sufficient contacts with Florida to justify the exercise of jurisdiction under the Due Process Clause. As to the forum-selection clauses, SkyHop rejected their applicability because, SkyHop asserted, its claims did not arise from or relate to the contracts that contain the forum-selection clauses.
The district court granted Indyzen's motion to dismiss for lack of personal jurisdiction. The district court concluded that the Florida long-arm statute was not satisfied because Indyzen is not conducting a business in Florida, and Narra's purported ownership interest in SkyHop Tech is insufficient for jurisdiction. Nor did Indyzen commit a tortious act in Florida, the district court found, because, in its view, the allegations in the complaint failed to state a claim for relief under the CFAA or CADRA. Finally, the district court held that due process is not satisfied because SkyHop didn't establish that its claims " ‘arise out of or relate to’ at least one of [Indyzen's] contacts in Florida." (Citation omitted.) Because the district court granted the motion to dismiss for lack of personal jurisdiction, it did not reach Indyzen's alternative argument that the forum-selection clauses rendered venue improper. SkyHop timely appealed the district court's order dismissing the case for lack of personal jurisdiction.
Before wheels up on our legal flight, we must make one last announcement important to understanding the issues here: as this litigation has progressed, Indyzen has retained possession and control of the relevant passwords and digital property. While SkyHop Tech can operate the Software, it cannot develop or maintain the Software itself. Nor can it reproduce the Software or prepare derivatives of it. SkyHop Tech has also continued to pay Indyzen monthly to ensure against outage or interruption in the availability of the Software.
II. Standard of Review
We review de novo the dismissal for lack of personal jurisdiction, accepting the allegations in the complaint as true. Don't Look Media LLC v. Fly Victor Ltd. , 999 F.3d 1284, 1292 (11th Cir. 2021). When a defendant submits an affidavit contesting the basis for personal jurisdiction, "the burden shifts back to the plaintiff to produce evidence to support personal jurisdiction." Id. "[W]here the plaintiff's complaint and the defendant's affidavits conflict, the district court must construe all reasonable inferences in favor of the plaintiff." Madara v. Hall , 916 F.2d 1510, 1514 (11th Cir. 1990).
Because part of the analysis Florida's long-arm statute requires us to consider includes whether SkyHop's complaint states a cause of action, we also review de novo the district court's conclusions on that score. See United Techs. Corp. v. Mazer , 556 F.3d 1260, 1274–75 (11th Cir. 2009). In so doing, we treat exhibits attached to a complaint as part of the complaint. Crowder v. Delta Air Lines, Inc. , 963 F.3d 1197, 1202 (11th Cir. 2020).
III. Discussion
This appeal presents a dispute about personal jurisdiction. "Federal courts ordinarily follow state law in determining the bounds of their jurisdiction over persons." Daimler AG v. Bauman , 571 U.S. 117, 125, 134 S.Ct. 746, 187 L.Ed.2d 624 (2014). We do so "because a federal district court's authority to assert personal jurisdiction in most cases is linked to service of process on a defendant ‘who is subject to the jurisdiction of a court of general jurisdiction in the state where the district court is located.’ " Walden v. Fiore , 571 U.S. 277, 283, 134 S.Ct. 1115, 188 L.Ed.2d 12 (2014) (quoting Fed. R. Civ. P. 4(k)(1)(A) ).
So we have two stops on our personal-jurisdiction itinerary. First, we must "determine whether the Florida long-arm statute provides a basis for personal jurisdiction." Sculptchair, Inc. v. Century Arts, Ltd. , 94 F.3d 623, 626 (11th Cir. 1996). If it does, we then examine "whether the exercise of personal jurisdiction over the defendant would violate the Due Process Clause of the Fourteenth Amendment to the United States Constitution, which requires that the defendant have minimum contacts with the forum state and that the exercise of jurisdiction over the defendant does not offend ‘traditional notions of fair play and substantial justice.’ " Mut. Serv. Ins. Co. v. Frit Indus., Inc. , 358 F.3d 1312, 1319 (11th Cir. 2004) (quoting Int'l Shoe Co. v. Washington , 326 U.S. 310, 316, 66 S.Ct. 154, 90 L.Ed. 95 (1945) ).
Our opinion follows that structure. In Part A, we consider whether the Florida long-arm statute provides a basis for personal jurisdiction. Part A has two subparts—whether SkyHop alleged a tortious act in Florida and whether the cause of action has "connexity" with the alleged tort that occurred in Florida. And in Part B, we evaluate whether exercising jurisdiction in this case satisfies the Due Process Clause's minimum-contacts and fair-play requirements.
A. The Florida long-arm statute supports the exercise of personal jurisdiction over Indyzen.
Florida's long-arm statute subjects to the jurisdiction of Florida state courts anyone "who personally or through an agent" engages in any of nine enumerated acts, as long as the cause of action arises from that act. Fla. Stat. § 48.193(1)(a). Because the construction and interpretation of the Florida long-arm statute raises questions of Florida law, we must construe the long-arm statute as would the Florida Supreme Court. United Techs. , 556 F.3d at 1274.
On appeal, SkyHop argues that its allegations satisfy Florida's long-arm statute for two independent reasons. More specifically, in SkyHop's view, Indyzen has engaged in two of the nine acts Florida's statute identifies as submitting to personal jurisdiction in Florida. First, SkyHop contends that Indyzen has "[o]perat[ed], conduct[ed], engag[ed] in, or carr[ied] on a business or business venture" in Florida. See Brief for Appellant at 19 (quoting Fla. Stat. § 48.193(1)(a)(1) ). Second, it asserts that Indyzen has "[c]ommitt[ed] a tortious act" in Florida. Id. (quoting Fla. Stat. § 48.193(1)(a)(2) ). SkyHop need establish only one of these acts to satisfy the long-arm statute. Because we conclude that SkyHop sufficiently alleged that Indyzen committed a tortious act in Florida, we need not (and therefore do not) consider whether it also engaged in a business or business venture in Florida.
We analyze whether SkyHop alleged a tortious act sufficient to bring its complaint within Florida's long-arm statute in two subparts. First, we explain why SkyHop's complaint sufficiently alleges that Indyzen committed a tortious act in Florida. See Fla. Stat. § 48.193(1)(a)(2). Second, we show why the tortious acts SkyHop alleged satisfy the Florida statute's "connexity" requirement—that is, its requirement that at least one of SkyHop's claims arises out of the act or acts that qualify for personal jurisdiction under the long-arm statute. Wendt v. Horowitz , 822 So. 2d 1252, 1260 (Fla. 2002) (citing Fla. Stat. § 48.193(1) ).
1. Because the complaint states a cause of action under 18 U.S.C. § 1030(a)(7)(A), SkyHop has alleged that Indyzen committed a tortious act within Florida.
We start by considering whether Indyzen "[c]ommitt[ed] a tortious act within" Florida. Fla. Stat. § 48.193(1)(a)(2). SkyHop argues that Indyzen's emails refusing to transmit the Software unless SkyHop paid $1.1 million amounted to a tortious act in Florida. We agree.
To determine whether SkyHop alleged a tortious act, we must determine whether it stated a claim for its tortious act. Wendt , 822 So. 2d at 1260. The Florida Supreme Court has held that "a defendant's physical presence is not required" to "commit a tortious act in Florida." Id . (citation and internal quotation marks omitted). Indeed, a tortious act "can occur through the nonresident defendant's telephonic, electronic, or written communications into Florida." Id. But as the Florida Supreme Court has explained, when a plaintiff attempts to use communications as the basis of a tortious act, "[t]he threshold question that must be determined is whether the allegations of the complaint state a cause of action." Id. So we must consider whether the complaint states a claim under the CFAA or Florida's CADRA.
When interpreting this provision, the Florida Supreme Court has recognized, "Broadly speaking, a tort is a civil wrong, other than a breach of contract, for which the court will provide a remedy in the form of an action for damages." Execu-Tech Bus. Sys., Inc. v. New Oji Paper Co. , 752 So. 2d 582, 585 n.8 (Fla. 2000) (quoting Prosser and Keeton on the Law of Torts 2 (W. Page Keeton ed., 5th ed. 1984)). Because a CFAA violation entitles victims to compensation based on principles similar to those of tort law, a CFAA violation is analogous to the commission of a tort. See Van Buren v. United States , ––– U.S. ––––, 141 S. Ct. 1648, 1652, 210 L.Ed.2d 26 (2021) (explaining CFAA was enacted, in part, because "traditional theft and trespass statutes were ill suited to address cybercrimes that did not deprive computer owners of property in the traditional sense"); 18 U.S.C. § 1030(g) (creating a private cause of action for victims of CFAA violations).
We begin (and as it turns out, end) with SkyHop's first CFAA claim. SkyHop contends that Indyzen's emails amount to extortion and impede SkyHop's access to its digital property in violation of 18 U.S.C. § 1030(a)(7)(A). That section imposes liability on anyone who "with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any— (A) threat to cause damage to a protected computer." 18 U.S.C. § 1030(a)(7)(A). The elements of a CFAA claim under § 1030(a)(7)(A) are therefore the following: (1) with the intent to extort from any person any money (or thing of value), (2) transmitting in interstate or foreign commerce any communication containing (3) a threat to cause damage to a protected computer.
Our Circuit has not yet had an opportunity to discuss the scope of § 1030(a)(7)(A). Here, the dispute under it centers on element (3)—in particular, whether SkyHop has sufficiently alleged that Indyzen's emails constitute "threat[s]" and, if so, whether those threats were threats to cause "damage." We'll address those terms in turn.
a. SkyHop sufficiently alleges that Indyzen made threats.
To determine whether the emails could rise to the level of being a "threat," we begin, as we always do, with the statutory text. See United States v. Henco Holding Corp. , 985 F.3d 1290, 1297 (11th Cir. 2021). The CFAA does not define "threat." So we interpret that term using its "ordinary meaning at the time Congress enacted the statute." New Prime, Inc. v. Oliveira , ––– U.S. ––––, 139 S. Ct. 532, 539, 202 L.Ed.2d 536 (2019) (alterations adopted) (citation omitted).
The CFAA was initially enacted in 1986. See Pub. L. No. 99-474, 100 Stat. 1213 (1986). Ten years later, Congress amended the CFAA to add the term "threat" as part of the Economic Espionage Act of 1996. See Pub. L. No. 104-294, § 201, 110 Stat. 3488, 3492 (1996). Contemporary dictionaries defined a "threat" as "[a] communicated intent to inflict physical or other harm on any person or on property." Black's Law Dictionary (6th ed. 1990); see also Webster's Collegiate Dictionary (10th ed. 1993) (defining "threat" as "an expression of intention to inflict evil, injury, or damage"); Oxford English Dictionary (2d ed. 1989) (defining "threat" as "a declaration of hostile determination or of loss, pain, punishment, or damage to be inflicted in retribution for or conditionally upon some course; a menace").
The Supreme Court's discussion of the meaning of "threat" in United States v. Taylor , a case about a different criminal statute (the Armed Career Criminal Act), supports this definition. ––– U.S. ––––, 142 S. Ct. 2015, 2020, 213 L.Ed.2d 349 (2022) (discussing 18 U.S.C. § 924(c)(3)(A) ). In Taylor , the Court surveyed definitions of the term "threat" and concluded the term had the same meaning we use today. As the Court explained, "in the criminal law the word ‘threat’ and its cognates usually denote ‘a communicated intent to inflict physical or other harm on any person or on property.’ " Id. at 2022 & n.2 (citation omitted). And the CFAA is in part a criminal statute and is codified in the criminal-law title, Title 18. See 18 U.S.C. § 1030(a)(7)(A).
When we apply this definition, we think that, viewed in the light most favorable to SkyHop, Indyzen's emails could constitute threats under the CFAA. The emails stated that Indyzen would "turn over all the source code and intellectual property developed for [SkyHop Tech]" only if SkyHop Tech tendered payment of $1.1 million. Without that payment, Indyzen would not provide the passwords or other electronic property. And based on the allegations in the complaint, SkyHop owned these digital materials that Indyzen asserted it would withhold unless and until it received additional payment.
Put another way, SkyHop has alleged that (1) Indyzen possesses SkyHop's intellectual property, (2) SkyHop asked Indyzen to return its property, and (3) Indyzen said it would not do so unless SkyHop paid $1.1 million. We think SkyHop has plausibly alleged that these emails communicate an intent to inflict harm on SkyHop's property and therefore can be considered "threats" under the CFAA.
To be sure, a fact-finder may ultimately determine that Indyzen did not intend to cause harm or that Indyzen was, in fact, entitled to the $1.1 million or the 32% stake in SkyHop Tech that Narra sought. Or the fact-finder may conclude that Indyzen intended its emails as negotiations rather than threats. That determination may turn on whether Indyzen has a legitimate claim to the property. Cf. Crawford's Auto Ctr., Inc. v. State Farm Mut. Auto. Ins. Co. , 945 F.3d 1150, 1160 (11th Cir. 2019) (citing Levitt v. Yelp! Inc. , 765 F.3d 1123, 1130 (9th Cir. 2014) ) (explaining the "well-established principle" that "[t]hreats of economic harm made to obtain property from another are not generally considered wrongful where the alleged extortioner has a legitimate claim to the property obtained through such threats"). But at this early stage, we assess only whether SkyHop has sufficiently alleged that Indyzen's emails were "threats" within the meaning of the CFAA. SkyHop has cleared that bar.
b. SkyHop sufficiently alleges that Indyzen caused damage.
Next, we turn to the term "damage." But this time, Congress has expressly defined the term: "damage" means "any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). That definition doesn't tell the full story, though, because the statute does not define three key terms—"impairment," "integrity," or "availability." So we once again consult the ordinary meaning of those words to determine what Congress meant.
An "impairment" is a "deterioration" or an "injurious lessening or weakening." Oxford English Dictionary (2d ed. 1989). "Integrity" means an "unimpaired or uncorrupted condition," an "original perfect state," or "soundness." Id. And "availability" means the "capability of being employed or made use of." Id. Putting it all together, we conclude that a transmission that does "damage" is one that weakens the condition of a computer system or program, or one that diminishes a plaintiff's ability to use that system or any associated data. See Pulte Homes, Inc. v. Laborers’ Int'l Union of N. Am. , 648 F.3d 295, 301 (6th Cir. 2011).
Here, the relevant question is whether Indyzen's withholding of the passwords and SkyHop's other digital property diminished SkyHop's ability to use its computer system or the associated data. We conclude it did. SkyHop alleged that it owns the Software, including the relevant passwords, and that it pays for the AWS accounts that house the SkyPlan. SkyHop further averred that it seeks to access its Software so it can make desired changes and updates to the programs with its in-house team rather than funnel all its requests through Indyzen (in its own right). SkyHop cannot assume control of the Software only because of Indyzen's decision to withhold the passwords and account information until SkyHop pays another $1.1 million or transfers a 32% equity stake to Narra. Since SkyHop cannot access and independently modify its Software without the passwords, Indyzen's refusal to provide those passwords "impair[s]" the "availability" of the Software and therefore causes "damage."
Our holding aligns with those of other circuits in cases raising similar issues. For instance, the Seventh Circuit, after a defendant reset the victim's password and prevented the victim from accessing his computer system, affirmed the conviction because "a reasonable jury could find that [the defendant's] actions ‘impaired the availability of the system’ by temporarily diminishing its readiness for [the victim's] immediate use." United States v. Soybel , 13 F.4th 584, 595 (7th Cir. 2021) (quoting 18 U.S.C. § 1030(e)(8) ) (alterations adopted). And after a defendant changed a plaintiff's social-media passwords and locked her out of her accounts, the Second Circuit suggested that the plaintiff had a CFAA claim at the time she "discovered that someone had impaired the integrity of each of her relevant Internet accounts." Sewell v. Bernardin , 795 F.3d 337, 340 (2d Cir. 2015).
Indyzen argues, without any authority, that no "damage" occurred here because the Software has continued to function in an uninterrupted manner. But SkyHop alleged (and Indyzen acknowledged at oral argument, Oral Arg. 22:50-24:26) that SkyHop cannot access the Software itself. Rather, it must continue to pay Indyzen and rely on its benevolence to keep the Software operational, even though SkyHop desires to move its Software development and maintenance in-house. SkyHop's inability to access its own Software renders its Software unavailable to it—even if the technology continues to function, and SkyHop's customers continue to receive SkyHop's services.
c. SkyHop sufficiently alleges the remaining statutory terms.
The parties squarely dispute only the meanings of "threat[s]" and "damage" under § 1030(a)(7)(A). But because SkyHop must sufficiently allege a cause of action to satisfy personal jurisdiction here, we must still verify that SkyHop's allegations satisfy the remaining statutory terms and elements. Namely, SkyHop must have sufficiently alleged that Indyzen (1) acted "with intent to extort" money or another thing of value; (2) transmitted a communication in interstate or foreign commerce; and (3) made alleged threats that would have damaged "a protected computer."
First, SkyHop has sufficiently alleged that Indyzen acted "with intent to extort from any person any money or other thing of value." 18 U.S.C. § 1030(a)(7). While the CFAA does not define "extort," the plain meaning of the term is "[t]o gain by wrongful methods" or "to obtain in an unlawful manner, as to compel payments by means of threats of injury to person, property, or reputation." Black's Law Dictionary (6th ed. 1990). Here, the complaint alleges that Indyzen seeks to obtain $1.1 million or 32% of SkyHop Tech through wrongful methods—withholding SkyHop's digital property until it meets their demands.
While Indyzen does not dispute the meaning of "extort," it suggests that we should infer the "obvious alternative explanation[ ]" for its emails: that this is simply an ownership dispute rather than an extortion attempt. And that may turn out to be true. But at this stage, we must make all factual inferences in SkyHop's favor, and given the allegations, this inference does not strike us as so obvious that we should adopt it here. SkyHop has alleged that it owns the Software, and we must accept that allegation as true.
Second, Indyzen's emails clearly constitute communications. See Missouri v. McNeely , 569 U.S. 141, 154, 133 S.Ct. 1552, 185 L.Ed.2d 696 (2013) (describing emails as a type of "electronic communication"). And the complaint easily satisfies the interstate-commerce requirement here: Indyzen transmitted the emails from California to Florida over the internet. See United States v. Hornaday , 392 F.3d 1306, 1311 (11th Cir. 2004) ("The internet is an instrumentality of interstate commerce.").
Third, the "threat to cause damage" must be to a "protected computer." As relevant here, the CFAA defines "computer" as "an electronic ... or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device." 18 U.S.C. § 1030(e)(1). And a "protected computer" includes one that is "used in or affecting interstate or foreign commerce." Id. § 1030(e)(2)(B).
Here, the complaint's allegations satisfy the "protected computer" term. Indyzen has withheld the passwords to SkyHop's AWS accounts and the associated servers, which clearly qualify as "computer[s]." See hiQ Labs, Inc. v. LinkedIn Corp. , 31 F.4th 1180, 1195 (9th Cir. 2022) (explaining that servers are "computers that manage network resources and provide data to other computers"). It makes no difference that SkyHop does not own the servers (Amazon does). Those servers are cloud-based and permit users to access their data and information from anywhere via the internet. Cf. Riley v. California , 573 U.S. 373, 397, 134 S.Ct. 2473, 189 L.Ed.2d 430 (2014) ("Cloud computing is the capacity of Internet-connected devices to display data stored on remote servers rather than on the device itself."). In other words, they are "used in or affecting interstate or foreign commerce," 18 U.S.C. § 1030(e)(2)(B), so they meet the CFAA's definition of "protected computer." And by retaining the passwords, Indyzen has diminished SkyHop's ability to access the programs and data that are housed on the servers and has therefore caused "damage."
In sum, we conclude that SkyHop has stated a cause of action under § 1030(a)(7)(A) because it has plausibly alleged that Indyzen sent its emails to SkyHop with an "intent to extort." Viewing the allegations in the light most favorable to SkyHop, it has also plausibly alleged that the emails amounted to a "threat to cause damage to a protected computer." We therefore conclude that SkyHop has sufficiently alleged a cause of action under Count I.
2. Florida's connexity requirement is satisfied.
Establishing one of the Florida long-arm statute's enumerated acts alone is not enough to satisfy the Florida statute. The long-arm statute also imposes a connexity requirement between the enumerated activity in Florida and the plaintiff's cause of action. Knepfle v. J-Tech Corp. , 48 F.4th 1282, 1292 (11th Cir. 2022). That is, the statute "requires a connection ... between the enumerated activity in Florida and the cause of action." Id. (citation omitted). The connexity requirement stems from the long-arm statute's mandate that, to support jurisdiction, the cause of action must "aris[e] from" the enumerated activity. Fla. Stat. § 48.193(1)(a) ; see Wendt , 822 So. 2d at 1260.
Under Florida Supreme Court precedent, a tortious act "can occur through the nonresident defendant's telephonic, electronic, or written communications into Florida" so long as "the cause of action ... arise[s] from the communications." Wendt , 822 So. 2d at 1260. Indeed, that court characterized as "straightforward" and "clear [the conclusion] that the nonresident defendant's communications were made into Florida" when the defendant sent emails into Florida. Internet Solutions Corp. v. Marshall , 39 So. 3d 1201, 1208 (Fla. 2010). That is so, the court explained, because those emails "[we]re directed to reach a specific recipient in a specific forum." Id. ; see also Del Valle v. Trivago GMBH , 56 F.4th 1265, 1273–74 (11th Cir. 2022).
Based on this Florida Supreme Court precedent, we conclude that SkyHop's CFAA claim arises from Indyzen's communications into Florida. The emails informed SkyHop that Indyzen did not intend to return the passwords and other digital property unless SkyHop paid the additional $1.1 million or transferred an equity stake to Narra. Those communications constitute the alleged "threat[s]" to cause "damage" to SkyHop's Software, and they serve as the basis for the inference that Indyzen had the requisite extortive intent to satisfy 18 U.S.C. § 1030(a)(7)(A). In other words, given that SkyHop alleged that Indyzen committed a tort in Florida, and SkyHop is suing Indyzen for that tort , it is easy to conclude that the cause of action arises from the Florida tort.
B. The Due Process Clause does not prohibit personal jurisdiction over Indyzen in Florida.
The second (and final) stop on our personal-jurisdiction journey requires us to assess whether the Due Process Clause supports the exercise of personal jurisdiction in Florida.
The Due Process Clause limits "a [s]tate's authority to bind a nonresident defendant to a judgment of its courts." Walden , 571 U.S. at 283, 134 S.Ct. 1115. Jurisdiction is proper only when the nonresident defendant has "certain minimum contacts with [the forum] such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’ " Int'l Shoe , 326 U.S. at 316, 66 S.Ct. 154 (quoting Milliken v. Meyer , 311 U.S. 457, 463, 61 S.Ct. 339, 85 L.Ed. 278 (1940) ).
The Supreme Court has recognized two types of personal jurisdiction: general jurisdiction, which attaches when a defendant is "essentially at home in the forum State," and specific jurisdiction, which "depends on an affiliation between the forum and the underlying controversy." Goodyear Dunlop Tires Operations, S.A. v. Brown , 564 U.S. 915, 919, 131 S.Ct. 2846, 180 L.Ed.2d 796 (2011) (alteration adopted) (internal quotation marks omitted). Specific jurisdiction is the only type at issue here, and it "derive[s] from and reflect[s] two sets of values—treating defendants fairly and protecting ‘interstate federalism.’ " Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct. , ––– U.S. ––––, 141 S. Ct. 1017, 1025, 209 L.Ed.2d 225 (2021) (quoting World-Wide Volkswagen Corp. v. Woodson , 444 U.S. 286, 293, 100 S.Ct. 559, 62 L.Ed.2d 490 (1980) ).
To adhere to these values, our constitutional analysis proceeds in three steps: (1) we first consider "whether [a] plaintiff's claims ‘arise out of or relate to’ at least one of the defendant's contacts with the forum" state; (2) then we evaluate "whether the ... defendant ‘purposefully availed’ himself of the privilege of conducting activities within the forum state"; and (3) finally, we assess "whether the exercise of personal jurisdiction comports with ‘traditional notions of fair play and substantial justice.’ " Louis Vuitton Malletier, S.A. v. Mosseri , 736 F.3d 1339, 1355 (11th Cir. 2013) (citations omitted). SkyHop bears the burden of establishing the first two requirements. Id. If it does, Indyzen must then "make a ‘compelling case’ that the exercise of jurisdiction would violate traditional notions of fair play and substantial justice." Id. (quoting Diamond Crystal Brands, Inc. v. Food Movers Int'l, Inc. , 593 F.3d 1249, 1267 (11th Cir. 2010) ).
The first inquiry—whether the claims "arise out of or relate to" one of the defendant's contacts—does not require direct causation. Ford Motor , 141 S. Ct. at 1026 (emphasis omitted) (citation omitted). Rather, it "contemplates that some relationships will support jurisdiction without a causal showing." Id. So we focus on the " ‘essential foundation’ of specific jurisdiction"—whether there is "a strong ‘relationship among the defendant, the forum, and the litigation.’ " Id. at 1028 (quoting Helicopteros Nacionales de Colombia, S.A. v. Hall , 466 U.S. 408, 414, 104 S.Ct. 1868, 80 L.Ed.2d 404 (1984) ); Del Valle , 56 F.4th at 1275–76. The principal way to establish this relationship is through an "activity or an occurrence that takes place in the forum State and is therefore subject to the State's regulation." Ford Motor , 141 S. Ct. at 1025 (quoting Bristol-Myers Squibb Co. v. Superior Ct. of Cal. , ––– U.S. ––––, 137 S. Ct. 1773, 1780, 198 L.Ed.2d 395 (2017) ).
That essential foundation is present here. Indyzen knowingly and intentionally directed its emails demanding compensation and withholding SkyHop's passwords into Florida, and a Florida resident received them. Because those emails contained the alleged "threat[s]" to do "damage" to SkyHop's Software and therefore triggered SkyHop's CFAA claim, this litigation has the required connection to Indyzen's Florida-based contacts.
Indyzen responds by citing Walden for the proposition that "the plaintiff cannot be the only link between the defendant and the forum." We agree that that is an accurate statement of the law. But it doesn't help Indyzen here. In Walden , Nevada-resident plaintiffs sued a Georgia-based Drug Enforcement Administration agent in Nevada after an incident that occurred wholly at the Atlanta Hartsfield-Jackson Airport. 571 U.S. at 279–80, 134 S.Ct. 1115. So there, the defendant's conduct provided no connection to the forum state. Id. at 288–89, 134 S.Ct. 1115. By contrast, here, through its emails sent to SkyHop in Florida, Indyzen directed its conduct into Florida. And that very same conduct serves as the basis for the claims SkyHop brings against it. So Walden does not apply here.
Indyzen's reliance on Helicopteros and Hanson v. Denckla , 357 U.S. 235, 78 S.Ct. 1228, 2 L.Ed.2d 1283 (1958), fares no better. Helicopteros is inapposite. There, the Court limited its analysis to whether the defendant was subject to general jurisdiction in Texas because the plaintiff conceded that its claims "did not arise out of, and [were] not related to" the defendant's activities within Texas. 466 U.S. at 415–16, 104 S.Ct. 1868 (internal quotation marks omitted). But the general-jurisdiction analysis does not bear on our specific-jurisdiction inquiry in which, as we've explained, at least one of SkyHop's claims does "arise out of or relate to" Indyzen's activities in Florida. And in Hanson , the Court held that a Delaware-based trustee, which had no contacts with Florida, could not be forced to litigate a dispute that arose in Florida only because of the trust settlor's decision to move there long after she had executed the trust in Delaware. 357 U.S. at 251–52, 78 S.Ct. 1228. Here, though, Indyzen is subject to jurisdiction in Florida because of its own choices to contract with a Florida-based company and send emails to a Florida resident—the subject of SkyHop's first claim.
At the second inquiry, we consider whether Indyzen purposefully availed itself of the benefit of Florida's laws. To support purposeful availment, the defendant must have had contacts with the forum that were his "own choice and not ‘random, isolated, or fortuitous.’ " Ford Motor , 141 S. Ct. at 1025 (quoting Keeton v. Hustler Mag., Inc. , 465 U.S. 770, 774, 104 S.Ct. 1473, 79 L.Ed.2d 790 (1984) ). And those contacts "must show that the defendant deliberately ‘reached out beyond’ its home," such as by "entering a contractual relationship centered" in the forum. Id. (quoting Walden , 571 U.S. at 285, 134 S.Ct. 1115 )).
In cases (like this one) involving an intentional tort, two applicable tests can determine whether purposeful availment occurred: the effects test and the traditional minimum-contacts test. Louis Vuitton , 736 F.3d at 1356 ; Del Valle , 56 F.4th at 1275–76. Because either test suffices, and we conclude the effects test is satisfied, we do not consider the traditional minimum-contacts test.
A nonresident defendant's single tortious act in the forum state can satisfy the effects test, even if the defendant lacks any other contacts with the forum state. Licciardello v. Lovelady , 544 F.3d 1280, 1285–86 (11th Cir. 2008) (citing Calder v. Jones , 465 U.S. 783, 790, 104 S.Ct. 1482, 79 L.Ed.2d 804 (1984) ). To meet the test, the tort must have been "intentional, aimed at the forum state, and caused harm that the defendant should have anticipated would be suffered in the forum state." Del Valle , 56 F.4th at 1276.
In Lovelady , we concluded that a defendant who used a Florida plaintiff's trademarked name and picture on a website accessible in Florida satisfied the effects test. 544 F.3d at 1287–88. And in Del Valle , when the defendants’ websites allowed Florida residents to reserve lodging at Cuban beachfront properties that had been expropriated from the forebearers of the Florida-resident plaintiffs, we found that met the effects test. 56 F.4th at 1270–71, 1276–77.
We have no difficulty reaching the same conclusion here. Indyzen undoubtedly sent its emails into Florida intentionally. And viewed in the light most favorable to SkyHop, Indyzen sent those emails to force SkyHop to pay additional funds so that SkyHop could regain control of its own property. It was certainly foreseeable to Indyzen that SkyHop would feel the harm from its alleged threats in Florida, where SkyHop is based. And that is especially true here since Indyzen knew, from the outset, that it was in a partnership with a Florida-based company. Indeed, Narra made three separate trips to Florida to meet with Scotto. So Indyzen had reason to know that its decision and the ensuing emails could force it to defend against a lawsuit in Florida.
Trying to rebut these conclusions, Indyzen rehashes its arguments that SkyHop has not alleged a cause of action under the CFAA. As we've explained, we disagree.
The third and final inquiry asks whether the exercise of jurisdiction in Florida accords with "traditional notions of fair play and substantial justice." We ordinarily consider four factors to resolve this inquiry: "the burden on the defendant"; "the forum's interest in adjudicating the dispute"; "the plaintiff's interest in obtaining convenient and effective relief"; and "the judicial system's interest in resolving the dispute." Del Valle , 56 F.4th at 1277 (quoting World-Wide Volkswagen , 444 U.S. at 292, 100 S.Ct. 559 ). But the defendant bears the burden of making "a compelling case" that the exercise of jurisdiction is improper. Louis Vuitton , 736 F.3d at 1355 (citation and internal quotation marks omitted). And Indyzen has not even attempted to demonstrate that it satisfies the relevant factors. We therefore conclude that jurisdiction in Florida is consistent with the Due Process Clause.
Because we conclude personal jurisdiction over Indyzen exists under Count I, we need not and do not inquire whether additional claims independently support personal jurisdiction. Even if they do not, it makes no difference to the propriety of the district court's exercise of personal jurisdiction over Indyzen here for all SkyHop's claims because a "district court ha[s] personal jurisdiction over the entire case" when "all of the claims ar[i]se from the same jurisdiction generating event." Cronin v. Wash. Nat'l Ins. Co. , 980 F.2d 663, 671 & n.10 (11th Cir. 1993). After all, the point of the personal-jurisdiction inquiry is to ensure that the defendants had at least minimum contacts with the forum state so that hauling them into court in the forum state "does not offend ‘traditional notions of fair play and substantial justice.’ " Int'l Shoe , 326 U.S. at 316, 66 S.Ct. 154 (citation omitted). So once it is established that the defendants had enough contacts for it to be fair to haul them into court in the forum state on one claim, the personal-jurisdiction inquiry has served the bulk of its purpose. And here, all of SkyHop's claims stem from Indyzen's decision to retain SkyHop's Software, which Indyzen communicated to SkyHop through the emails. So personal jurisdiction over SkyHop is proper.
We express no view on whether the remaining counts in SkyHop's Complaint state a claim upon which relief can be granted.
IV. Conclusion
One more note before we bring this appeal in for a landing: when Indyzen brought its initial motion to dismiss for lack of personal jurisdiction, it also asserted an alternative basis to avoid litigating this case in Florida. It contended that, under the forum non conveniens doctrine, venue is improper based on the forum-selection clause in the agreements SkyHop and Indyzen signed. SkyHop opposed this motion. But because the district court granted Indyzen's motion to dismiss for lack of personal jurisdiction, the district court had no reason to reach the forum non conveniens argument.
And because the district court did not consider this argument, we won't, either. MSP Recovery Claims, Series LLC v. Metro. Gen. Ins. Co. , 40 F.4th 1295, 1306 (11th Cir. 2022) ("[W]e generally will not consider issues which the district court did not decide." (citation and internal quotation marks omitted)). On remand, then, the district court should first consider whether the forum-selection clauses mandate dismissal based on improper venue.
* * *
For the foregoing reasons, we reverse the district court's order dismissing SkyHop's complaint and remand for further proceedings.