MacDERMID, INC., Plaintiff-Appellant, v. Jackie DEITER, Defendant-Appellee, 702 F.3d 725

BARRINGTON D. PARKER, Circuit Judge: This appeal calls on us to decide whether a court in Connecticut may properly exercise long-arm jurisdiction over a defendant who, while domiciled and working in Canada, is alleged to have accessed a computer server located in Connecticut to misappropriate confidential information belonging to her employer. The United States District Court for the District of Connecticut (Eginton, J.) dismissed the complaint for lack of personal jurisdiction, reasoning that the defendant had not used a computer in Connecticut and consequently was not amenable to long-arm jurisdiction.

See Conn. GemStat. § 52 — 59b(a); Fed.R.Civ.P. 12(b)(2). We hold that, consistent with due process, the Connecticut statute authorizes jurisdiction, and we reverse. BACKGROUND Plaintiff-Appellant MacDermid, Inc. is a specialty chemical company with its principal place of business in Waterbury, Connecticut. Defendant-Appellee Jackie Deiter lives near Toronto in Fort Erie, Ontario, Canada, and she was employed in Canada by MacDermid’s Canadian subsidiary, MacDermid Chemicals, Inc., as an account manager from May 2008 until her termination in April 2011.

The facts that were adduced on Deiter’s Rule 12(b)(2) motion and are not disputed show that MacDermid stores proprietary and confidential electronic data on computer servers that it maintains in Waterbury and that employees of MacDermid Chemicals can access that information only by accessing the Waterbury servers. The record reflects that employees of MacDermid and its subsidiaries are, as a condition of employment, made aware of the housing of the companies’ email system and their confidential and proprietary information in Waterbury.

The record further reflects that Deiter agreed in writing to safeguard and to properly use MacDermid’s confidential information and that she was not authorized to transfer such information to a personal email account. For reasons not relevant here, MacDermid Chemicals decided to terminate Deiter effective April 7, 2011. Deiter became aware of her impending termination and, just prior to it, forwarded from her MacDermid email account to her personal email account allegedly confidential and proprietary MacDermid data files.

Deiter had to access MacDermid’s Waterbury computer servers both to obtain and to email the files. MacDermid then sued Deiter in United States District Court for the District of Connecticut, alleging unauthorized access and misuse of a computer system and misappropriation of trade secrets in violation of Conn. GemStat. §§ 53a-251 and 35-51 et seq. Jurisdiction was based on diversity of citizenship and the Connecticut long-arm statute. Deiter moved pursuant to Rule 12(b)(2) to dismiss the complaint for lack of personal jurisdiction.

The district court concluded that the long-arm statute did not reach Deiter’s conduct and dismissed the complaint. MacDermid appealed. DISCUSSION We review de novo the district court’s decision to dismiss under Rule 12(b)(2). Chloe v. Queen Bee of Beverly Hills, LLC, 616 F.3d 158, 163 (2d Cir. 2010). In such a case, [t]he plaintiff bears the burden of establishing personal jurisdiction over the defendant. Prior to trial, however, when a motion to dismiss for lack of jurisdiction is decided on the basis of affidavits and other written materials, the plaintiff need only make a prima facie showing.

The allegations in the complaint must be taken as true to the extent they are uncontroverted by the defendant’s affidavits. Seetransport Wiking Trader Schijfarhtsgesellschaft MBH & Co., Kommanditgesells chaft v. Navimpex Centrala Navala, 989 F.2d 572, 580 (2d Cir.1993) (citation and internal quotation marks omitted). Because Deiter’s motion to dismiss was decided without a hearing and because Deiter submitted no affidavit testimony with the motion, the facts asserted in MacDermid’s complaint and affidavit in opposition to Deiter’s motion are assumed to be true. See Hoffritz for Cutlery, Inc. v.

Amajac, Ltd., 763 F.2d 55, 56-57 (2d Cir.1985). In order for the district court to have jurisdiction over Deiter, it must be proper under both the Connecticut long-arm statute and the Due Process Clause of the Fourteenth Amendment. See Chloe, 616 F.3d at 163-65. I. Connecticut’s long-arm statute provides that a court may exercise personal jurisdiction over any nonresident individual ... who in person or through an agent:

(1) Transacts any business within the state; (2)commits a tortious act within the state ...; (3) commits a tortious act outside the state causing injury to person or property within the state ... if such person or agent (

A) regularly does or solicits business, or engages in any other persistent course of conduct, or derives substantial revenue from goods used or consumed or services rendered, in the state, or (

B) expects or should reasonably expect the act to have consequences in the state and derives substantial revenue from interstate or international commerce; ... or (5) uses a computer, as defined in subdivision (1) of subsection (

a) of

section 53-451, or a computer network, as defined in subdivision (3) of subsection (

a) of said section, located within the state. Conn. Gen.Stat. § 52-59b(a). The statute incorporates the following

definitions: (1) “Computer” means an electronic, magnetic or optical device or group of devices that, pursuant to a computer program, human instruction or permanent instructions contained in the device or group of devices, can automatically perform computer operations with or on computer data and can communicate the results to another computer or to a person. “Computer” includes any connected or directly related device, equipment or facility that enables the computer to store, retrieve or communicate computer programs, computer data or the results of computer operations to or from a person, another computer or another device .... (3)“Computer network” means a set of related, remotely connected devices and any communications facilities including more than one computer with the capability to transmit data among them through the communications facilities.

Conn. GemStat. § 53^451 (a). In concluding that Connecticut’s long-arm statute did not apply, the court reasoned that Deiter had not used a Connecticut computer or computer network but had simply sent email “from one computer in Canada to another computer in Canada”; that is, from her MacDermid computer at her home to her personal computer at her home. While it is true that Deiter physically interacted only with computers in Canada, we do not believe that this fact defeats long-arm jurisdiction.

The record before the district court indicated that, “[i]n order to use [her] MacDermid e-mail account and to obtain said confidential data files, Ms.

Deiter accessed computer servers located in MacDermid’s offices in Waterbury, Connecticut.” A computer server meets the Connecticut long-arm statute’s definition of computer because it is an electronic ... device ... that, pursuant to ... human instruction ... can automatically perform computer operations with ... computer data and can communicate the results to another computer or to a person [or is a] connected or directly related device ... that enables the computer to store, retrieve or communicate ... computer data ... to or from a person, another computer or another device. Conn. Gen.Stat. § SB^fSlCaXl).

Because we are constrained to accept as true MacDermid’s uncontroverted assertions that Deiter used the Connecticut servers and because the servers are computers under the long-arm statute, we conclude that Deiter used a computer in Connecticut and that the Connecticut district court had long-arm jurisdiction under § 52-59b(a)(5). It is not material that Deiter was outside of Connecticut when she accessed the Waterbury servers. The statute requires only that the computer or network, not the user, be located in Connecticut. See § 52-59b(aX5).

The statute reaches persons outside the state who remotely access computers within the state, and we read § 52-59b(a)(5) to apply to torts committed by persons not in Connecticut based on conduct not covered by § 52-59b(a)(l), (2), or (3). This conclusion is reinforced by the fact that § 52-59b(a)(5) was enacted as part of a statutory scheme intended to prohibit unauthorized persons from using computers or networks with intent to, among other things, cause a computer to malfunction, alter or erase data, or copy computer data or programs. See Conn. Pub. Act No. 99-160 § 1(b) (1999).

Extending the statute to reach a nonresident who committed any of the above activities while present in Connecticut would not have been necessary because that person would already have been subject to jurisdiction under § 52-59b(a)(2). Further, it cannot be said that Deiter’s conduct is covered by § 52-59b(a)(3) because she is not alleged to have regularly conducted business in Connecticut, or to have derived revenue from her conduct. See § 52-59b(a)(3).

Deiter also contends that she did not “use a computer” as that term is defined with regard to computer crimes in § 53-451(a)(13), another provision in the same statutory scheme. See Conn. Pub. Act No. 99-160 § 1(a) (1999). First, that definitional provision is not incorporated into the long-arm statute. See § 52-59b(a). And second, even if that provision did apply, she did “use a computer” under § 53-451(a)(13) because she “cause[d] a computer ... to perform ... computer operations.” § 53 — 451(a)(13). Accordingly, long-arm jurisdiction over Deiter is authorized by § 52-59b(a)(5). II.

Because jurisdiction over Deiter is proper under the Connecticut long-arm statute, we turn to the second step in our analysis: whether such jurisdiction accords with due process. Although the district court did not consider this issue, we may do so. See Bank Brussels Lambert v. Fiddler Gonzalez & Rodriguez, 305 F.3d 120, 129 n. 5 (2d Cir.2002) (Where a district court has not reached the due process reasonableness component of personal jurisdiction analysis before dismissing, “the issue remains reviewable on appeal because it was ‘pressed or passed upon below.’ ”).

Generally, a “court may exercise personal jurisdiction over a nonresident defendant only so long as there exist ‘minimum contacts’ between the defendant and the forum State.” World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 291, 100 S.Ct. 559, 62 L.Ed.2d 490 (1980). The contacts must be such that “maintenance of the suit does not offend traditional notions of fair play and substantial justice.” International Shoe Co. v. Washington, 326 U.S. 310, 316, 66 S.Ct. 154, 90 L.Ed. 95 (1945) (internal quotation marks omitted).

Connecticut courts have personal jurisdiction over a nonresident foreigner who has “purposefully directed his activities at residents of the forum” where “the litigation results from alleged injuries that arise out of or relate to those activities.” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 472, 105 S.Ct. 2174, 85 L.Ed.2d 528 (1985) (internal quotation marks omitted); see also Calder v.

Jones, 465 U.S. 783, 789, 104 S.Ct. 1482, 79 L.Ed.2d 804 (1984) (In the context of intentional torts, jurisdiction is proper over defendants whose “intentional, and allegedly tortious, actions were expressly aimed at [the forum state].”). “[I]t is essential in each case that there be some act by which the defendant purposefully avails itself of the privilege of conducting activities within the forum State, thus invoking the benefits and protections of its laws.” Burger King, 471 U.S. at 475, 105 S.Ct. 2174 (internal quotation marks omitted). Physical presence in the forum state, however, is not required.

Id. at 476, 105 S.Ct. 2174. We believe that this test is met here. Deiter purposefully availed herself of the privilege of conducting activities within Connecticut because she was aware “of the centralization and housing of the companies’ e-mail system and the storage of confidential, proprietary information and trade secrets” in Waterbury, Connecticut, and she used that email system and its Connecticut servers in retrieving and emailing confidential files. Most Internet users, perhaps, have no idea of the location of the servers through which they send their emails.

Here, however, MacDermid has alleged that Deiter knew that the email servers she used and the confidential files she misappropriated were both located in Connecticut. She used those servers to send an email which itself constituted the alleged tort. And in addition to purposefully availing herself of the privilege of conducting computer activities in Connecticut, she directed her allegedly tortious conduct towards MacDermid, a Connecticut corporation. Cf.

Calder, 465 U.S. at 790, 104 S.Ct. 1482 (holding California jurisdiction to be proper over Florida writer and publisher who directed their tortious conduct, defamation, toward a California resident). If a defendant has sufficient minimum contacts, as in this case, we must also determine whether the exercise of personal jurisdiction is reasonable under the Due Process Clause. Chloe, 616 F.3d at 172-73. The Supreme Court and our Court consider five factors for determining whether an exercise of jurisdiction is reasonable: Id. at 173 (quoting Asahi Metal Indus. Co. v.

Superior Court, 480 U.S. 102, 113-14, 107 S.Ct. 1026, 94 L.Ed.2d 92 (1987)). A court must consider [1] the burden on the defendant, [2] the interests of the forum State, and [3] the plaintiffs interest in obtaining relief. It must also weigh in its determination [4] the interstate judicial system’s interest in obtaining the most efficient resolution of controversies; and [5] the shared interest of the several States in furthering fundamental substantive social policies. Having considered these factors, we conclude that they support the exercise of personal jurisdiction in this case.

First, although Deiter would have to travel to Connecticut to defend this suit, this burden alone does not render the exercise of personal jurisdiction unreasonable. See Kernan v. Kurz-Hastings, Inc., 175 F.3d 236, 244 (2d Cir.1999) (holding that burden on Japanese defendant was insufficient to overcome its minimum contacts, particularly because “the conveniences of modern communication and transportation ease what would have been a serious burden only a few decades ago”). Second, both Connecticut and MacDermid have significant interests in resolving the matter in Connecticut.

Not only is the company based in Connecticut, which is where the majority of corporate witnesses are located, but also Connecticut has an interest in the proper

interpretation of its laws. Chloe, 616 F.3d at 173 (holding that exer cise of personal jurisdiction is reasonable where, inter alia, forum state has an interest “in providing effective means of redress for its residents”); Kernan, 175 F.3d at 244-45 (holding that exercise of personal jurisdiction is reasonable in New York where injured plaintiff was a New York resident and New York laws indisputably applied). Cf. Metropolitan Life Ins. Co. v.

Robertson-Ceco, Corp., 84 F.3d 560, 574 (2d Cir.1996) holding that exercise of personal jurisdiction was not reasonable where injury did not occur in forum state and plaintiff was not based in forum state. Further, efficiency and social policies against computer-based theft are generally best served by adjudication in the state from which computer files have been misappropriated. Accordingly, we conclude that jurisdiction is reasonable in this case. CONCLUSION For the reasons stated, we reverse the judgment of the district court and remand for further proceedings. .

Since MacDermid’s affidavit testimony refers to "servers,” plural, MacDermid may be asserting that Deiter used a "set” of devices that would satisfy the long-arm statute’s definition of "computer network.” Conn. Gen. Stat. § 53-451(a)(3). But since the servers utilized were at least "computers,” see Conn. Gen.Stat. § 53-451(a)(1), it is inconsequential whether they were also so connected that they constituted a network. .

Because we hold that jurisdiction is proper under § 52-59b(a)(5), we need not further address MacDermid’s alternative arguments that jurisdiction would be proper under the long-arm statute's § 52-59b(a)(2), (3).