Cybersecurity Litigation Strategies: Jurisdiction

This article is the second in our series on patent litigation strategies for cybersecurity companies. It expands on Tactic #1, “Challenge the court’s jurisdiction,” from our earlier article, “Five Tactics for Cybersecurity Companies to Defeat Patent Infringement Claims.”

By taking a closer look at personal jurisdiction and the use of motions to dismiss for lack of personal jurisdiction under Rule 12(b)(2), cybersecurity companies can better understand how to avoid litigating in unfavorable forums and strengthen their overall defense strategy.

Here, we discuss the legal framework of personal jurisdiction, explore the role of internet presence in these cases, and offer practical strategies for cybersecurity companies to proactively mitigate jurisdictional risks and react when sued in unfavorable forums.

Key points

• Courts must have personal jurisdiction over defendants to render judgments in cases filed against them.
• Defendants can rebut personal jurisdiction by showing that they lack sufficient “minimum contacts” with the state in which a lawsuit is filed.
• Cybersecurity companies can take proactive steps to avoid personal jurisdiction in particularly unfavorable forums.

The basics of personal jurisdiction

Personal jurisdiction concerns whether a court has authority over a defendant company. Courts assess it under two primary frameworks:

1. General (all-purpose) jurisdiction: allows a court to hear any and all claims against a company when its affiliations with the forum state are so “continuous and systematic” that it is essentially “at home” in that state. Daimler AG v. Bauman, 571 U.S. 117, 127 (2014). Typically, this is limited to a company’s place of incorporation or its principal place of business.
2. Specific (case-linked) jurisdiction: permits a court to hear claims if the defendant has sufficient “minimum contacts” with the forum state that directly relate to the claims at issue. International Shoe Co. v. Washington, 326 U.S. 310, 316 (1945).

Cybersecurity companies often operate globally and serve clients remotely. As a consequence, they may face lawsuits in states where they have minimal or no meaningful business activity. A defendant that prevails on a Rule 12(b)(2) motion may force the plaintiff to walk away or refile the suit in a more appropriate venue.

Key factors for assessing specific jurisdiction

When general jurisdiction does not apply, courts consider three key factors related to the minimum contacts analysis to determine whether they may properly assert specific jurisdiction:

1. Purposeful availment: The defendant must have “purposefully availed” itself of the laws, protections, and benefits of the forum state. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985). This involves assessing whether the company has a deliberate presence or activities in the state, such as maintaining offices, employing personnel, marketing products, or entering contracts specifically targeting forum residents.
2. Relatedness of the claim: The claim must “arise out of or relate to” the defendant’s contacts with the forum state. Bristol-Myers Squibb Co. v. Superior Court of California, 582 U.S. 255, 262 (2017). For cybersecurity companies, this could include activities such as distributing or marketing products alleged to infringe patents within the forum state.
3. Reasonableness: The relationship between the company and the forum state must be such that it is “reasonable” to require the company to defend the particular suit there. World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 292 (1980). Courts evaluate reasonableness by considering factors like the burden on the defendant, the forum state’s interest in adjudicating the case, the plaintiff’s interest in obtaining convenient and effective relief, the efficiency of resolving the dispute in the chosen forum, and the broader interests of the states in maintaining sound policy.

Cybersecurity companies often rely on remote services and cloud-based products, which can complicate this analysis. For instance, the absence of a physical presence, targeted marketing, or forum-specific sales may challenge a claim of sufficient minimum contacts.

The role of internet presence in specific jurisdiction

A company’s internet presence can significantly impact the “minimum contacts” analysis for specific jurisdiction. Courts often apply a “sliding scale,” articulated in Zippo Manufacturing Co. v. Zippo Dot Com, Inc., 952 F. Supp. 1119, 1124 (W.D. Pa. 1997):

1. Passive websites: Websites that are merely informational and do not enable user interaction are insufficient to establish jurisdiction.
2. Interactive websites: Websites that allow user interaction are evaluated based on their level of interactivity and the nature of the exchanges.
3. Commercial websites: Websites conducting clear business transactions or entering contracts with forum residents are more likely to establish jurisdiction.

Timing a Rule 12(b)(2) motion

A Rule 12(b)(2) motion challenging personal jurisdiction must be filed before the defendant submits an answer to the complaint. Failure to raise this defense in a pre-answer motion or initial responsive pleading waives the right to assert it later. Filing promptly preserves the defense and ensures that the court addresses jurisdictional issues early.

Example

Consider a cybersecurity company incorporated in Delaware with its principal place of business in California. It licenses endpoint detection and response (EDR) software globally via a cloud-based platform. The company has no offices, employees, or targeted business activities in Texas but is sued there for patent infringement by a Texas-based plaintiff.

The company files a Rule 12(b)(2) motion, arguing:

1. No general jurisdiction: The company is “at home” only in Delaware and California, not Texas.
2. No specific jurisdiction: The company lacks sufficient minimum contacts with Texas because (1) it has not purposefully availed itself of Texas laws or directed specific activities at Texas residents, (2) the patent infringement claim does not arise out of or relate to any Texas-specific activity, and (3) requiring the company to litigate in Texas would be unreasonable given its lack of presence there.

If the court finds personal jurisdiction lacking, it will dismiss the case or require the plaintiff to refile in an appropriate forum.

Strategic considerations for cybersecurity companies

A particular forum state may be unfavorable for several reasons, such as its tendency to favor plaintiffs in patent disputes, procedural rules that increase discovery burdens on defendants, or local juries that may lack familiarity with complex cybersecurity technology. Furthermore, litigating in distant or costly venues can create substantial financial and logistical hurdles. Defendants should thus consider the following strategies for avoiding personal jurisdiction in such forums:

Proactive strategies to avoid personal jurisdiction in unfavorable forum states:

1. Minimize physical presence (e.g., establishing offices, hiring employees, and storing data) in forum states where the company wants to limit exposure.
2. Evaluate business activities (e.g., marketing, sales, and customer service) to ensure they do not inadvertently create sufficient minimum contacts in undesirable forum states.
3. Tailor online operations (e.g., websites, platforms, and cloud services) to avoid targeting specific forum states unnecessarily.
4. Use contracts to include forum-selection or arbitration clauses to limit potential venues.
5. Maintain documentation showing that activities are not directed at specific states.

Defensive strategies once a case is filed:

1. Consider the public relations implications of filing a motion to dismiss, especially in forum states with a significant customer base.
2. Be prepared to handle jurisdictional discovery while minimizing broader exposure to unrelated issues.
3. Leverage jurisdictional discovery to challenge overstated plaintiff claims about forum-related contacts.
4. Coordinate defense strategies across cases to ensure consistency in jurisdictional arguments to avoid contradictory positions that could undermine the defense.
5. If a Rule 12(b)(2) motion is unsuccessful, consider pursuing a venue transfer under 28 U.S.C. § 1404(a).

By understanding personal jurisdiction and employing Rule 12(b)(2) motions effectively, cybersecurity companies can avoid litigating in unfavorable forums and focus resources on more appropriate venues. Proactive strategies, careful documentation, and targeted defenses are essential tools for mitigating jurisdictional risks.