State Criminal Jurisdiction in Cyberspace: Is There a Sheriff on the Electronic Frontier?*
*This article is adapted and excerpted from a forthcoming article by the author sponsored by the National Association of Attorneys General.
How far can state criminal authorities go in prosecuting crimes committed over the Internet, sometimes called "cybercrimes?" If several Michigan investors lose their life savings to a (hypothetical) scam offered on a fraudulent website called "GoldBars4U.com" which gives a real-world address in Florida but is hosted by an Internet service provider in Ohio, can a Michigan state or county prosecutor charge the out-of-state perpetrator and make it stick?
U.S. Attorney General Janet Reno recently highlighted the issue of unlawful conduct on the Internet in a speech to the National Association of Attorneys General at Stanford University in Palo Alto, California. After extolling the positive wonders of the Internet, Attorney General Reno explained:
There is a dark side. A dark side in terms of traditional crime, of threats, child pornography, fraud, gambling, stalking, and extortion. They are all crimes that, when perpetrated via the Internet, can reach a larger and more accessible pool of victims, and can transform local scams into crimes that encircle the globe. By connecting a worldwide network of users, the Internet has made it easier for wrongdoers to find each other, to congregate, to socialize, and to create an online community of support and social reinforcement for their antisocial behaviors.1
As the Internet increasingly becomes one of the mainstream forms of person-to-person communication, local law enforcement authorities will find themselves confronted with citizen complaints of crimes by perpetrators who are not located within their jurisdiction. Although Internet crimes of national or international scope may become federal cases,2 state and local authorities must be prepared to cope with citizen complaints of Internet crimes that fall within their traditional areas of primary responsibility.
What is the law that allows a state to exercise jurisdiction in cases when the crime occurs outside the state's territorial boundaries? In Michigan, the common law rule first adopted in 1911 by the U.S. Supreme Court3 is still the law of the land. In some other states, the reach of extraterritorial jurisdiction is codified in specific statutes.4
THE DETRIMENTAL EFFECTS TEST
In 1911, Justice Oliver Wendell Holmes wrote the opinion for the Supreme Court in Strassheim v Daily,5 a case that arose in Michigan and is still cited today as authority for the proposition that a state may exercise criminal jurisdiction over acts committed outside the territorial boundaries of a state. In Strassheim, the Supreme Court stated:
[a]cts done outside a jurisdiction, but intended to produce and producing detrimental effects within it, justify a state in punishing the cause of the harm as if he had been present at the effect, if the state should succeed in getting him within its power.
To satisfy the minimum requirements for an exercise of criminal jurisdiction over out-of-state conduct, there must be (1) an act occurring outside the state, which is (2) intended to produce detrimental effects within the state, and (3) is the cause of detrimental effects within the state. Unlike the jurisdictional analysis in civil cases, the "minimum contacts" analysis does not apply when determining criminal jurisdiction.6 In criminal cases, the analysis focuses on the intent of the defendant and the effects within the forum state.
In 1993, the Michigan Supreme Court had occasion to apply the Strassheim rule. In People v Blume, the Court concluded that jurisdiction could not be exercised over a Florida co-conspirator who had sold cocaine to a Michigan resident where there was insufficient proof that the Florida resident had intended that the cocaine be distributed in Michigan.7 The Blume court interpreted Strassheim as requiring both "specific intent to act and the intent that the harm occur in Michigan."8 Proof that the defendant knew the person to whom he sold the cocaine in Florida was from Michigan and would eventually return there was not considered sufficient to show that the defendant intended the cocaine to be sold in Michigan.9
The Blume decision was largely governed by its facts, i.e., the lack of any proof that the defendant agreed with the objects of the conspiracy or intended to affect Michigan. The Court made it clear that proof of a continuing drug supplier relationship, or repeated conduct, or knowledge of the co-defendant's intent would "certainly" have meant a different outcome.10
The challenge for prosecutors in charging cybercriminals based on acts committed out-of-state will be gathering sufficient proof that the defendant intended to cause harm in Michigan. Certainly in cases where the defendant ships contraband to Michigan, or receives payment from Michigan citizens or engages in a continuing course of conduct that affects Michigan, the intent to affect the forum will be easy to prove.11 Webserver logs that keep a history of web visits that can be tracked to Michigan citizens may also be relevant to proving knowledge and intent to impact the state.
STATE STATUTES GRANTING EXTRATERRITORIAL JURISDICTION
Many state legislatures have enacted jurisdictional statutes12 codifying bases of jurisdiction similar to the detrimental effects test set out in Strassheim, the Model Penal Code,13 or extending their jurisdictional reach even further. 14 Most of these statutes track the Model Penal Code's language, or adopt similar language, to the effect that for the state to exercise jurisdiction over an offense occurring partly outside the state, either an element of the offense, or a result of the offense that is also an element, must occur within the forum state.
The states that have adopted this kind of language include Colorado, Delaware, Florida, Georgia, Hawaii, Illinois, Indiana, Iowa, Kentucky, Maine, Minnesota, Montana, New Hampshire, New Jersey, Ohio, Oregon, Pennsylvania, Texas, and Utah. States that have broadened the Model Penal Code approach by also allowing jurisdiction where a result of the offense, whether an element or not, occurs in the forum state, are: Arizona, Kansas, New York, and Missouri.15
Wisconsin's statute permits jurisdiction even where no result occurs in the state, but where the out-of-state person "does an act with intent that it cause in this state a consequence set forth in a section defining a crime."16 Alabama, California, and South Dakota have statutes providing for jurisdiction where an offense is commenced outside the state and "consummated" within the state.17
Michigan, Ohio, and Mississippi are examples of states that have jurisdiction-related statutes specifically targeting computer or Internet-related crime.18 Michigan's statute aims at network-related computer crime by making it clear that if a person located in one county accesses a computer network located in another county to commit a computer crime, the offense may be prosecuted in either jurisdiction. Recently, the Michigan Senate also passed legislation amending the state's statute dealing with child pornography and solicitation of children over the Internet, and included a section to clarify the law's jurisdictional reach.19 Although current Michigan statutes do not expressly seek to define or extend extraterritorial jurisdiction generally,20 as do the laws of some states, they do provide foundations for arguments to extend such jurisdiction.
The Ohio statute creates a new basis of jurisdiction whenever a person "by means of a computer, computer system, computer network, [etc.]...causes or knowingly permits any writing, data, image, or other telecommunication to be disseminated or transmitted into this state in violation of the law of this state."21 Whether Ohio's statute actually extends state jurisdiction any further than the Strassheim detrimental effects test or the Model Penal Code approach must await judicial interpretation.
CYBERCRIMES AND STATE EXTRATERRITORIAL JURISDICTION
State courts have not yet seen many challenges to state assertions of extraterritorial jurisdiction in cases charging cybercrimes.22 Examination of the noncyber case law and statutes demonstrates, however, that state law currently would support an aggressive response to Internet-related unlawful activities that impact a particular state, even where the perpetrator is not physically located within the forum state. For example, Michigan Attorney General Jennifer Granholm has initiated criminal and civil enforcement actions against on-line distributors of alcohol, prescription drugs, GHB manufacture kits, as well as child pornography and child sexual predators.
Because on-line sales of regulated items such as alcohol, drugs, and tobacco present a typical area in which state criminal actions may arise, a recent Utah decision in a prosecution of a national beer distributor presents an analogous setting.23
In State v Amoroso, the state filed misdemeanor charges against Beer Across America (BAA) and its president arising out of sales of beer to minors. The trial court granted the defendant's motion to dismiss the charges for lack of jurisdiction, but the court of appeals reversed. The appellate court held the civil "minimum contacts" analysis to be inapplicable, and applied Utah's criminal jurisdiction statute and the Strassheim analysis.24 Although the defendant shipped the alcohol from Illinois, the court found that:
BAA is subject to prosecution in Utah for conduct committed in Illinois because its conduct caused an unlawful result in Utah. In sum, the information alleges conduct that resulted in unlawful importation of alcohol into Utah; unlawful sale or supply of alcohol in Utah; unlawful warehousing, distribution, or transportation of alcohol to Utah; unlawful supplying of alcohol to persons within Utah; and unlawful distribution or transportation for sale or resale to retail customers in Utah without a license.25
Although the Amoroso court mentioned that customers generally purchase their products from BAA "by mail, telephone 800 number or the Internet,"26 the court did not identify the specific means used to place the orders in that case, so it is unclear whether the case involved orders placed over the Internet. Nevertheless, the case offers support for the conclusion that an out-of-state supplier of regulated items may be prosecuted by a forum based on what appears to be a single course of conduct involving the shipment of items to the forum state.27 Thus, the analysis would clearly apply to Internet sales.
Both case law and (in many states) statutory authority provide a legal basis for states to rely upon in prosecuting out-of-state defendants who victimize their populations using the technology of the Internet. In common law jurisdictions like Michigan, the state's burden is to show (1) detrimental effects within the forum state and (2) intent to cause such effects. In states with extraterritorial jurisdictional statutes, the specific terms of the law must be examined to determine whether the conduct is covered. However, one thing is relatively certain: A showing of minimum contacts with the forum is not required for criminal prosecutions.
When criminals use the World Wide Web to host their fraudulent schemes or ply their illegal trade, they harm many jurisdictions by stealing their citizens' money or delivering contraband into their communities. Such cybercriminals clearly cause intentional "detrimental effects" in the forum state, and may be held accountable by that state. There may be a sheriff in the wild west of cyberspace after all.
1 For the full text of Attorney General Reno's Remarks of January 10, 2000, see www.cybercrime.gov, the website for the Computer Crime and Intellectual Property Section, Criminal Division, U.S. Department of Justice.
2 See The Electronic Frontier: The Challenge of Unlawful Conduct Involving the Use of the Internet: A Report of the President's Working Group on Unlawful Conduct on the Internet, March 2000 (Hereafter, 'President's Working Group Report'). The interagency report explained:
In responding to the challenge of law enforcement on the Internet, one of the problems that state and local governments face is that, although the crimes and schemes on the Internet may victimize local populations, the medium over which these crimes are committed permits a defendant to be located anywhere in the world.
Id. at 36. The Report and its appendices can also be accessed at www.cybercrime.gov
3 Strassheim v Daily, 221 US 280, 285; 31 S Ct 558; 55 L Ed 735 (1911) (noting that a state properly may punish a defendant for acts committed outside the state if those acts were intended to, and actually did, produce detrimental effects within the state).
4 See, e.g., NY Crim Proc § 20.20(2)(a)-(d) (adopting broad rule allowing jurisdiction for a criminal offense if it, inter alia, "was a result offense and the result occurred within this state," or if "the statute defining the [underlying] offense is designed to prevent the occurrence of a particular effect in this state and the conduct constituting the offense committed was performed with the intent that it would have such effect herein").
5 221 US 280; 31 S Ct 558; 55 L Ed 735 (1911).
6 See State v Amoroso, 975 P2d 505, 508 (Ct App Utah 1999) (collecting cases and stating that "the rule is well-settled that civil 'minimum contacts' analysis has no place in determining whether a state may assert criminal personal jurisdiction over a foreign defendant").
7 People v Blume, 443 Mich 476; 505 NW2d 843 (1993).
8 Id. at 480-481.
9 443 Mich at 489-490; 505 NW2d at850-851.
10 Id. at n 30; but cf. Moreno v Baskerville, 249 Va 16, 18-19; 452 SE2d 653, 654-655 (1995) (even where defendant knew that drugs sold in Arizona were bound for Virginia, jurisdiction was not established as to distribution charges because the 'immediate result' of drug sale to the intermediary occurred in Arizona, and the intermediary sold them to a Virginia person).
11 Of course, where the proof shows that an element of the crime actually occurred in Michigan, traditional criminal jurisdictional rules will allow prosecution because the crime occurred "in whole or in part" in Michigan. See, e.g., People v Kirby, 42 Mich App 97, 99; 201 NW2d 355, 357 (1972).
12 A nonexhaustive list of state statutes that establish bases for extraterritorial criminal jurisdiction includes: § 15-2-4 Ala Code 1975 (1999) (Alabama); § 13-108 ARS (1999) (Arizona); § 5-1-104 ACA (1999) (Arkansas); § 778 West's Ann Cal Penal Code, (1999) (California); § 18-1-201 CRSA (1999) (Colorado); § 204, 11 Del C (1999) (Delaware); § 910.005 West's FSA (1999) (Florida); § 17-2-1 Ga Code (1999) (Georgia); § 701-106 HRS (1999) (Hawaii); § 1-5 ILCS (1998) (Illinois); § 35-41-1-1 IC (1999) (Indiana); § 803.1 ICA (1999) (Iowa); § 21-3104 KSA (1998) (Kansas); § 500.060 KRS (1998) (Kentucky); § 17, 17-A MRSA (1999) (Maine); § 609.025 MSA (1999) (Minnesota); § 541.191 VAMS (1999) (Missouri); § 46-2-101 MCA (1999) (Montana); § 625:4 RSA (1999) (New Hampshire); § 2C:1-3 NJSA (1999) (New Jersey); § 20.20 McKinney's CPL (1999) (New York); § 2901.11 RC (1999) (Ohio); § 131.215 ORS (1998) (Oregon); § 102, 18 Pa CSA (1999) (Pennsylvania); § 23A-16-2 SDCL (1999) (South Dakota); § 1.04 VTCA (1999) (Texas); § 76-1-201 UCA (1999) (Utah); § 939.03 WSA (1999) (Wisconsin).
13 See The Model Penal Code; § 1.03 (Territorial Applicability).
14 See State v Miller, 157 Ariz 129, 130; 755 P2d 434, 435 (Ariz Ct App 1988). In Miller, the Arizona Court of Appeals explained that Arizona's jurisdictional statute is broader than the Model Penal Code. While the Model Penal Code would allow jurisdiction only when a result that is an element of the offense occurs in the forum state, Arizona's statute would allow jurisdiction where the conduct constituting the element of the offenses occurred outside the state, but the result of that conduct occurred within the state. Id. at 133-134; 755 P2d at 438-439.
15 For a discussion of state case law regarding the application of many of these statutes, see Rios v State, 733 P2d at 247-249 (Wyo 1987) (collecting cases).
16 § 939.03(c) WSA (1999) (Wisconsin).
17 § 15-2-4 Ala Code 1975 (1999) (Alabama); § 778 West's Ann Cal Penal Code, (1999) (California); § 23A-16-2 SDCL (1999) (South Dakota).
18 MCL 762.10b (Michigan); § 2901.11 RC (1999) (Ohio); § 97-45-11 Miss Code Ann (1999) (Mississippi).
19 SB No 894 amends MCL 750.145d(6) to make it clear that the statute is violated if a communication prohibited by the statute "originates in this state, is intended to terminate in this state, or is intended to terminate with a person in this state."
20 The Legislature is currently considering proposals for a general territorial jurisdiction statute.
21 § 2901.11(A)(7), RC (1999) (Ohio).
22 Most of the reported cases relate to the transmission of child pornography over the Internet, or sexual solicitation of children over the Internet, but do not directly address jurisdictional issues. See, e.g., People v Foley, 692 NYS2d 248, 257 AD2d 243 (Sup Ct App Div 1999) (conviction for Internet dissemination of indecent material to minors affirmed, constitutionality of state statute upheld). The New York Court of Appeals affirmed the decision of People v Foley (NY Ct App, April 11, 2000).
23 State v Amoroso, 975 P2d 505 (Ct App Utah 1999).
24 Id. at 508.
25 Id. at 509.
26 Id. at 506.
27 The fact that Amoroso was a criminal prosecution, where minimum contacts analysis was irrelevant, may have been decisive. See Butler v Beer Across America, 83 F Supp 2d 1261 (ND Ala 2000) (granting the defendant's motion to dismiss in civil action based on lack of minimum contacts where Alabama plaintiff's son, a minor, ordered beer over the Internet).