USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 1 of 32

[PUBLISH] In the United States Court of Appeals For the Eleventh Circuit

____________________

No. 21-14051 ____________________

SKYHOP TECHNOLOGIES, INC., a Delaware corporation, SKYHOP GLOBAL, LLC, a Florida limited liability company, KRISTINE SCOTTO, an Individual, Plaintiffs-Appellants, versus PRAVEEN NARRA, an Individual, INDYZEN, INC., a California corporation d.b.a. AppDevelopment.com, Inc. d.b.a. Tech.US, Inc, USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 2 of 32

2 Opinion of the Court 21-14051

Defendants-Appellees.

____________________

Appeal from the United States District Court for the Southern District of Florida D.C. Docket No. 0:21-cv-60799-AHS ____________________

Before WILLIAM PRYOR, Chief Judge, ROSENBAUM, and MARCUS, Circuit Judges. ROSENBAUM, Circuit Judge: Nobody enjoys flight delays. They are disruptive for air- lines, passengers, and crew members alike. And any number of things can cause them: to name just a few, severe weather, faulty equipment, or the unavailability of pilots and crew members. Plaintiffs-Appellants SkyHop Global, LLC, SkyHop Tech- nologies, Inc., and Kristine Scotto (collectively, “SkyHop”) and De- fendants-Appellees Praveen Narra and his company Indyzen, Inc. (collectively, “Indyzen” (unless otherwise indicated)) have taken aim at that last problem source: the unavailability of pilots and crew members. Together, they have developed and deployed dig- ital software aimed at transporting crew members to and from air- ports across the country. And business has taken off. SkyHop has about eighty contracts with fifteen airlines, including major carriers like Delta, American, and United. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 3 of 32

21-14051 Opinion of the Court 3

But now SkyHop and Indyzen dispute who owns the digital software. And beyond that, they disagree on where their dispute should be decided. Indyzen has filed an arbitration action in Cali- fornia (where it is based), alleging various forms of breach of con- tract and other promises. Meanwhile, SkyHop has filed this federal lawsuit in Florida (where it is based), alleging that Indyzen violated the federal Computer Fraud and Abuse Act (“CFAA”) and the Flor- ida Computer Abuse and Data Recovery Act (“CADRA”). In response, Indyzen sought to dismiss this action for lack of personal jurisdiction. It argued that the exercise of personal juris- diction over it in Florida satisfied neither the Florida long-arm stat- ute nor the Due Process Clause of the Fourteenth Amendment. The district court agreed and entered an order dismissing SkyHop’s complaint. We see things differently. The allegations in SkyHop’s com- plaint, which we must accept as true on a motion to dismiss, sug- gest that SkyHop is the rightful owner of the digital software. And because Indyzen has refused to relinquish possession of the digital software without additional payment, SkyHop’s complaint states a cause of action under the CFAA. The complaint therefore satisfies the Florida long-arm statute. And it also meets the requirements of the Due Process Clause because the emails that Indyzen sent into Florida triggered SkyHop’s claims. So after careful review, and with the benefit of oral argument, we reverse the district court’s order and remand for further proceedings. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 4 of 32

4 Opinion of the Court 21-14051

I. Background1

SkyHop Global, LLC, primarily offers a service to airlines: it provides ground transportation for flight crews to and from air- ports across the nation. To do this, SkyHop uses proprietary digital software, including a web-based program called SkyPlan and two mobile applications, SkyHop Crew and SkyHop Driver (collec- tively, the “Software”). SkyPlan uses flight manifests and real-time data to create schedules to pick up and drop off flight-crew members. Mean- while, the mobile apps communicate and coordinate between flight crews and drivers on the ground. According to the First Amended Complaint, the operative complaint here, SkyHop Tech- nologies, Inc. (“SkyHop Tech”), owns all this technology, and it li- censes it to SkyHop Global. In turn, SkyHop Global has contracts with fifteen airlines and operates in twenty-one cities in eleven states. Both SkyHop Tech and SkyHop Global operate from their headquarters in Broward County, Florida. Two password-protected cloud servers that are hosted by Amazon Web Services (“AWS”) and physically located in Virginia house the SkyPlan program. One AWS account has the production server and SkyPlan’s operational version, while the other account

1 Because this case arrives here after the district court granted a motion to dismiss, for purposes of our analysis, we accept as true the factual allegations in the complaint. Silberman v. Miami Dade Transit, 927 F.3d 1123, 1128 (11th Cir. 2019). The actual facts may or may not be as alleged. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 5 of 32

21-14051 Opinion of the Court 5

contains the staging server and its testing version. SkyHop Tech pays for both accounts. Of course, the Software did not always exist. Rather, the process to develop it began in June 2014. Plaintiff Kristine Scotto— a Florida resident and one of SkyHop’s founders—met with devel- opers to discuss the development of what would become the Soft- ware. One of these developers was Defendant Praveen Narra. Narra resides in California and traveled to Fort Lauderdale, Florida, in 2014 to meet with Scotto. Scotto and her then-business partner reached an understanding with Narra that each of the three would own 32% of a newly formed entity that would become SkyHop Tech, with a fourth partner owning the remaining 4%. After bringing Narra on board, SkyHop Tech contracted with Narra’s California-based development company, Indyzen, Inc.—which does business under the name Tech.US—to develop and maintain the Software. That partnership has lasted for a few years. Since 2014, SkyHop Tech and Indyzen have signed several software-development and maintenance contracts for the ongoing services that Indyzen has provided. And in total, Narra has made three separate trips to Florida (in 2014, 2016, and 2018) to meet with Scotto about the relationship between the companies. All told, SkyHop Tech has paid Indyzen roughly $2.6 million—the full amount it owes under the agreements between the companies— for the development and maintenance of the Software. As the party who developed and maintains the Software, In- dyzen possesses what SkyHop Tech calls SkyHop’s Digital USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 6 of 32

6 Opinion of the Court 21-14051

Property: the source code for SkyHop’s mobile apps, the outside vendor accounts those apps use to function (including the AWS ac- counts), the application programming interfaces for the apps, the relevant domain names, DNS service, 2 signing keys, and all corre- sponding passwords required to operate, develop, and maintain the Software.3 One of the relevant AWS accounts is in Narra’s name while the other is in Indyzen’s name (in its own right), and both accounts use Narra’s personal residence as the account address. Around the time Narra joined the venture and the parties sought to incorporate SkyHop Tech, the relationship between Scotto and her then-business partner began to break down, result- ing in a lawsuit filed in January 2015. While Narra was never a party to that lawsuit, he twice represented during the course of those proceedings that he relinquished any ownership interest he had in SkyHop Tech. The parties based their settlement agreement resolving that dispute—five years later, in March 2020—on Narra’s relinquishment of the ownership interest.

2 “DNS” means the “Domain Name System.” Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 409–18 (2d Cir. 2004) (providing background on how the DNS works). “A DNS service . . . is a globally distributed service that translates hu- man readable names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect to each other.” Amazon Web Services, What is DNS?, https://aws.amazon.com/route53/what-is-dns (last accessed Jan. 24, 2023). 3 Because the parties have incorporated the meaning of the term Digital Prop- erty into the meaning of the term Software, we will too. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 7 of 32

21-14051 Opinion of the Court 7

A few months later, on January 9, 2021, Scotto, in her role as the chief executive officer of SkyHop Global and President of SkyHop Tech, informed Narra that SkyHop Tech planned to hire in-house developers to take over development and maintenance of the Software. As a result, Scotto explained, SkyHop Tech planned to terminate its relationship with Indyzen. Two days later, Narra responded by email that he would “turn over all the source code and intellectual property developed for SkyHop Tech[]” in exchange for slightly over $1.1 million. In reply, SkyHop Tech counteroffered $75,000 for three months of support and consulting. Indyzen did not accept. Instead, Tech.US’s chief revenue officer, Rob Milks, emailed Scotto and re- iterated Narra’s offer to turn over the Software for roughly $1.1 million. A few days later, Narra sent another email to say that, if the parties could not reach a financial agreement, Scotto should transfer a 32% stake in SkyHop Tech to Narra individually. On February 9, SkyHop Tech, through its counsel, sent a demand letter to Narra. In that letter, SkyHop Tech asserted that Indyzen lacked any property right in the Software and that In- dyzen’s refusal to transfer was “inconsistent with SkyHop Tech’s ownership rights in its Property.” The letter “demand[ed] that by March 1, 2021, Indyzen transfer possession of SkyHop’s Property to SkyHop Tech.” That did not occur. Rather, on March 12, in San Jose, California, Indyzen (in its own right) filed a Demand for Arbitration against SkyHop Global, SkyHop Tech, and Scotto with the American Arbitration USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 8 of 32

8 Opinion of the Court 21-14051

Association. A few months later, Indyzen filed an Amended De- mand listing Narra as an additional claimant. SkyHop responded by suing Indyzen in the Southern Dis- trict of Florida. SkyHop raised six causes of action, including three claims under the CFAA, 18 U.S.C. § 1030; one claim under the Flor- ida CADRA, Fla. Stat. § 668.803; and two claims seeking a declara- tory judgment concerning the arbitrability of the dispute. Indyzen moved to dismiss for lack of personal jurisdiction and, in the alternative, for improper venue. 4 In support of the mo- tion, Indyzen included Narra’s affidavit, which asserted additional facts relevant to the jurisdiction inquiry. In the motion, Indyzen argued that personal jurisdiction was improper in Florida because the Florida long-arm statute was not satisfied and the exercise of jurisdiction did not comport with the Due Process Clause. Indyzen also contended that a valid and applicable forum-selection clause in the contracts required any litigation between the parties to be brought in Santa Clara County, California. SkyHop opposed Indyzen’s motion seeking dismissal. In support of its position, SkyHop argued Florida’s long-arm statute supported jurisdiction because, in relevant part, Narra claimed an ownership interest in a Florida-based company and Indyzen com- mitted a tortious act in Florida. SkyHop also asserted that Indyzen

4 Indyzen moved once before to dismiss for lack of personal jurisdiction or improper venue, but SkyHop filed an amended complaint in response. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 9 of 32

21-14051 Opinion of the Court 9

had sufficient contacts with Florida to justify the exercise of juris- diction under the Due Process Clause. As to the forum-selection clauses, SkyHop rejected their applicability because, SkyHop as- serted, its claims did not arise from or relate to the contracts that contain the forum-selection clauses. The district court granted Indyzen’s motion to dismiss for lack of personal jurisdiction. The district court concluded that the Florida long-arm statute was not satisfied because Indyzen is not conducting a business in Florida, and Narra’s purported ownership interest in SkyHop Tech is insufficient for jurisdiction. Nor did In- dyzen commit a tortious act in Florida, the district court found, be- cause, in its view, the allegations in the complaint failed to state a claim for relief under the CFAA or CADRA. Finally, the district court held that due process is not satisfied because SkyHop didn’t establish that its claims “‘arise out of or relate to’ at least one of [Indyzen’s] contacts in Florida.” (Citation omitted.) Because the district court granted the motion to dismiss for lack of personal ju- risdiction, it did not reach Indyzen’s alternative argument that the forum-selection clauses rendered venue improper. SkyHop timely appealed the district court’s order dismissing the case for lack of personal jurisdiction. Before wheels up on our legal flight, we must make one last announcement important to understanding the issues here: as this litigation has progressed, Indyzen has retained possession and con- trol of the relevant passwords and digital property. While SkyHop Tech can operate the Software, it cannot develop or maintain the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 10 of 32

10 Opinion of the Court 21-14051

Software itself. Nor can it reproduce the Software or prepare de- rivatives of it. SkyHop Tech has also continued to pay Indyzen monthly to ensure against outage or interruption in the availability of the Software.

II. Standard of Review

We review de novo the dismissal for lack of personal juris- diction, accepting the allegations in the complaint as true. Don’t Look Media LLC v. Fly Victor Ltd., 999 F.3d 1284, 1292 (11th Cir. 2021). When a defendant submits an affidavit contesting the basis for personal jurisdiction, “the burden shifts back to the plaintiff to produce evidence to support personal jurisdiction.” Id. “[W]here the plaintiff’s complaint and the defendant’s affidavits conflict, the district court must construe all reasonable inferences in favor of the plaintiff.” Madara v. Hall, 916 F.2d 1510, 1514 (11th Cir. 1990). Because part of the analysis Florida’s long-arm statute re- quires us to consider includes whether SkyHop’s complaint states a cause of action, we also review de novo the district court’s con- clusions on that score. See United Techs. Corp. v. Mazer, 556 F.3d 1260, 1274–75 (11th Cir. 2009). In so doing, we treat exhibits at- tached to a complaint as part of the complaint. Crowder v. Delta Air Lines, Inc., 963 F.3d 1197, 1202 (11th Cir. 2020).

III. Discussion

This appeal presents a dispute about personal jurisdiction. “Federal courts ordinarily follow state law in determining the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 11 of 32

21-14051 Opinion of the Court 11

bounds of their jurisdiction over persons.” Daimler AG v. Bauman, 571 U.S. 117, 125 (2014). We do so “because a federal district court’s authority to assert personal jurisdiction in most cases is linked to service of process on a defendant ‘who is subject to the jurisdiction of a court of general jurisdiction in the state where the district court is located.’” Walden v. Fiore, 571 U.S. 277, 283 (2014) (quoting Fed. R. Civ. P. 4(k)(1)(A)). So we have two stops on our personal-jurisdiction itinerary. First, we must “determine whether the Florida long-arm statute provides a basis for personal jurisdiction.” Sculptchair, Inc. v. Cen- tury Arts, Ltd., 94 F.3d 623, 626 (11th Cir. 1996). If it does, we then examine “whether the exercise of personal jurisdiction over the de- fendant would violate the Due Process Clause of the Fourteenth Amendment to the United States Constitution, which requires that the defendant have minimum contacts with the forum state and that the exercise of jurisdiction over the defendant does not offend ‘traditional notions of fair play and substantial justice.’” Mut. Serv. Ins. Co. v. Frit Indus., Inc., 358 F.3d 1312, 1319 (11th Cir. 2004) (quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). Our opinion follows that structure. In Part A, we consider whether the Florida long-arm statute provides a basis for personal jurisdiction. Part A has two subparts—whether SkyHop alleged a tortious act in Florida and whether the cause of action has “con- nexity” with the alleged tort that occurred in Florida. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 12 of 32

12 Opinion of the Court 21-14051

And in Part B, we evaluate whether exercising jurisdiction in this case satisfies the Due Process Clause’s minimum-contacts and fair-play requirements. A. The Florida long-arm statute supports the exercise of personal jurisdiction over Indyzen.

Florida’s long-arm statute subjects to the jurisdiction of Flor- ida state courts anyone “who personally or through an agent” en- gages in any of nine enumerated acts, as long as the cause of action arises from that act. Fla. Stat. § 48.193(1)(a). Because the construc- tion and interpretation of the Florida long-arm statute raises ques- tions of Florida law, we must construe the long-arm statute as would the Florida Supreme Court. United Techs., 556 F.3d at 1274. On appeal, SkyHop argues that its allegations satisfy Flor- ida’s long-arm statute for two independent reasons. More specifi- cally, in SkyHop’s view, Indyzen has engaged in two of the nine acts Florida’s statute identifies as submitting to personal jurisdic- tion in Florida. First, SkyHop contends that Indyzen has “[o]pe- rat[ed], conduct[ed], engag[ed] in, or carr[ied] on a business or busi- ness venture” in Florida. See Brief for Appellant at 19 (quoting Fla. Stat. § 48.193(1)(a)(1)). Second, it asserts that Indyzen has “[c]om- mitt[ed] a tortious act” in Florida. Id. (quoting Fla. Stat. § 48.193(1)(a)(2)). SkyHop need establish only one of these acts to satisfy the long-arm statute. Because we conclude that SkyHop suf- ficiently alleged that Indyzen committed a tortious act in Florida, USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 13 of 32

21-14051 Opinion of the Court 13

we need not (and therefore do not) consider whether it also en- gaged in a business or business venture in Florida. We analyze whether SkyHop alleged a tortious act sufficient to bring its complaint within Florida’s long-arm statute in two sub- parts. First, we explain why SkyHop’s complaint sufficiently al- leges that Indyzen committed a tortious act in Florida. See Fla. Stat. § 48.193(1)(a)(2). Second, we show why the tortious acts SkyHop alleged satisfy the Florida statute’s “connexity” require- ment—that is, its requirement that at least one of SkyHop’s claims arises out of the act or acts that qualify for personal jurisdiction un- der the long-arm statute. Wendt v. Horowitz, 822 So. 2d 1252, 1260 (Fla. 2002) (citing Fla. Stat. § 48.193(1)). 1. Because the complaint states a cause of action under 18 U.S.C. § 1030(a)(7)(A), SkyHop has alleged that Indyzen committed a tortious act within Florida. We start by considering whether Indyzen “[c]ommitt[ed] a tortious act within” Florida. Fla. Stat. § 48.193(1)(a)(2). SkyHop ar- gues that Indyzen’s emails refusing to transmit the Software unless SkyHop paid $1.1 million amounted to a tortious act in Florida. We agree. To determine whether SkyHop alleged a tortious act, we must determine whether it stated a claim for its tortious act. Wendt, 822 So. 2d at 1260. The Florida Supreme Court has held that “a defendant’s physical presence is not required” to “commit a tortious act in Florida.” Id. (citation and internal quotation marks USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 14 of 32

14 Opinion of the Court 21-14051

omitted). Indeed, a tortious act “can occur through the nonresi- dent defendant’s telephonic, electronic, or written communica- tions into Florida.” Id. But as the Florida Supreme Court has ex- plained, when a plaintiff attempts to use communications as the basis of a tortious act, “[t]he threshold question that must be deter- mined is whether the allegations of the complaint state a cause of action.” Id. So we must consider whether the complaint states a claim under the CFAA or Florida’s CADRA. 5 We begin (and as it turns out, end) with SkyHop’s first CFAA claim. SkyHop contends that Indyzen’s emails amount to extortion and impede SkyHop’s access to its digital property in vi- olation of 18 U.S.C. § 1030(a)(7)(A). That section imposes liability on anyone who “with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any— (A) threat to cause damage

5 When interpreting this provision, the Florida Supreme Court has recog- nized, “Broadly speaking, a tort is a civil wrong, other than a breach of con- tract, for which the court will provide a remedy in the form of an action for damages.” Execu-Tech Bus. Sys., Inc. v. New Oji Paper Co., 752 So. 2d 582, 585 n.8 (Fla. 2000) (quoting Prosser and Keeton on the Law of Torts 2 (W. Page Keeton ed., 5th ed. 1984)). Because a CFAA violation entitles victims to compensation based on principles similar to those of tort law, a CFAA viola- tion is analogous to the commission of a tort. See Van Buren v. United States, 141 S. Ct. 1648, 1652 (2021) (explaining CFAA was enacted, in part, because “traditional theft and trespass statutes were ill suited to address cybercrimes that did not deprive computer owners of property in the traditional sense”); 18 U.S.C. § 1030(g) (creating a private cause of action for victims of CFAA vi- olations). USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 15 of 32

21-14051 Opinion of the Court 15

to a protected computer.” 18 U.S.C. § 1030(a)(7)(A). The elements of a CFAA claim under § 1030(a)(7)(A) are therefore the following: (1) with the intent to extort from any person any money (or thing of value), (2) transmitting in interstate or foreign commerce any communication containing (3) a threat to cause damage to a pro- tected computer. Our Circuit has not yet had an opportunity to discuss the scope of § 1030(a)(7)(A). Here, the dispute under it centers on ele- ment (3)—in particular, whether SkyHop has sufficiently alleged that Indyzen’s emails constitute “threat[s]” and, if so, whether those threats were threats to cause “damage.” We’ll address those terms in turn. a. SkyHop sufficiently alleges that Indyzen made threats. To determine whether the emails could rise to the level of being a “threat,” we begin, as we always do, with the statutory text. See United States v. Henco Holding Corp., 985 F.3d 1290, 1297 (11th Cir. 2021). The CFAA does not define “threat.” So we inter- pret that term using its “ordinary meaning at the time Congress enacted the statute.” New Prime, Inc. v. Oliveira, 139 S. Ct. 532, 539 (2019) (alterations adopted) (citation omitted). The CFAA was initially enacted in 1986. See Pub. L. No. 99- 474, 100 Stat. 1213 (1986). Ten years later, Congress amended the CFAA to add the term “threat” as part of the Economic Espionage Act of 1996. See Pub. L. No. 104-294, § 201, 110 Stat. 3488, 3492 (1996). Contemporary dictionaries defined a “threat” as “[a] USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 16 of 32

16 Opinion of the Court 21-14051

communicated intent to inflict physical or other harm on any per- son or on property.” Black’s Law Dictionary (6th ed. 1990); see also Webster’s Collegiate Dictionary (10th ed. 1993) (defining “threat” as “an expression of intention to inflict evil, injury, or damage”); Oxford English Dictionary (2d ed. 1989) (defining “threat” as “a declaration of hostile determination or of loss, pain, punishment, or damage to be inflicted in retribution for or conditionally upon some course; a menace”). The Supreme Court’s discussion of the meaning of “threat” in United States v. Taylor, a case about a different criminal statute (the Armed Career Criminal Act), supports this definition. 142 S. Ct. 2015, 2020 (2022) (discussing 18 U.S.C. § 924(c)(3)(A)). In Tay- lor, the Court surveyed definitions of the term “threat” and con- cluded the term had the same meaning we use today. As the Court explained, “in the criminal law the word ‘threat’ and its cognates usually denote ‘a communicated intent to inflict physical or other harm on any person or on property.’” Id. at 2022 & n.2 (citation omitted). And the CFAA is in part a criminal statute and is codified in the criminal-law title, Title 18. See 18 U.S.C. § 1030(a)(7)(A). When we apply this definition, we think that, viewed in the light most favorable to SkyHop, Indyzen’s emails could constitute threats under the CFAA. The emails stated that Indyzen would “turn over all the source code and intellectual property developed for [SkyHop Tech]” only if SkyHop Tech tendered payment of $1.1 million. Without that payment, Indyzen would not provide the passwords or other electronic property. And based on the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 17 of 32

21-14051 Opinion of the Court 17

allegations in the complaint, SkyHop owned these digital materials that Indyzen asserted it would withhold unless and until it received additional payment. Put another way, SkyHop has alleged that (1) Indyzen pos- sesses SkyHop’s intellectual property, (2) SkyHop asked Indyzen to return its property, and (3) Indyzen said it would not do so unless SkyHop paid $1.1 million. We think SkyHop has plausibly alleged that these emails communicate an intent to inflict harm on SkyHop’s property and therefore can be considered “threats” un- der the CFAA. To be sure, a fact-finder may ultimately determine that In- dyzen did not intend to cause harm or that Indyzen was, in fact, entitled to the $1.1 million or the 32% stake in SkyHop Tech that Narra sought. Or the fact-finder may conclude that Indyzen in- tended its emails as negotiations rather than threats. That deter- mination may turn on whether Indyzen has a legitimate claim to the property. Cf. Crawford’s Auto Ctr., Inc. v. State Farm Mut. Auto. Ins. Co., 945 F.3d 1150, 1160 (11th Cir. 2019) (citing Levitt v. Yelp! Inc., 765 F.3d 1123, 1130 (9th Cir. 2014)) (explaining the “well- established principle” that “[t]hreats of economic harm made to ob- tain property from another are not generally considered wrongful where the alleged extortioner has a legitimate claim to the property obtained through such threats”). But at this early stage, we assess only whether SkyHop has sufficiently alleged that Indyzen’s emails were “threats” within the meaning of the CFAA. SkyHop has cleared that bar. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 18 of 32

18 Opinion of the Court 21-14051

b. SkyHop sufficiently alleges that Indyzen caused damage. Next, we turn to the term “damage.” But this time, Con- gress has expressly defined the term: “damage” means “any im- pairment to the integrity or availability of data, a program, a sys- tem, or information.” 18 U.S.C. § 1030(e)(8). That definition doesn’t tell the full story, though, because the statute does not de- fine three key terms—“impairment,” “integrity,” or “availability.” So we once again consult the ordinary meaning of those words to determine what Congress meant. An “impairment” is a “deterioration” or an “injurious less- ening or weakening.” Oxford English Dictionary (2d ed. 1989). “Integrity” means an “unimpaired or uncorrupted condition,” an “original perfect state,” or “soundness.” Id. And “availability” means the “capability of being employed or made use of.” Id. Put- ting it all together, we conclude that a transmission that does “dam- age” is one that weakens the condition of a computer system or program, or one that diminishes a plaintiff’s ability to use that sys- tem or any associated data. See Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d 295, 301 (6th Cir. 2011). Here, the relevant question is whether Indyzen’s withhold- ing of the passwords and SkyHop’s other digital property dimin- ished SkyHop’s ability to use its computer system or the associated data. We conclude it did. SkyHop alleged that it owns the Soft- ware, including the relevant passwords, and that it pays for the AWS accounts that house the SkyPlan. SkyHop further averred that it seeks to access its Software so it can make desired changes USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 19 of 32

21-14051 Opinion of the Court 19

and updates to the programs with its in-house team rather than funnel all its requests through Indyzen (in its own right). SkyHop cannot assume control of the Software only because of Indyzen’s decision to withhold the passwords and account information until SkyHop pays another $1.1 million or transfers a 32% equity stake to Narra. Since SkyHop cannot access and independently modify its Software without the passwords, Indyzen’s refusal to provide those passwords “impair[s]” the “availability” of the Software and therefore causes “damage.” Our holding aligns with those of other circuits in cases rais- ing similar issues. For instance, the Seventh Circuit, after a defend- ant reset the victim’s password and prevented the victim from ac- cessing his computer system, affirmed the conviction because “a reasonable jury could find that [the defendant’s] actions ‘impaired the availability of the system’ by temporarily diminishing its readi- ness for [the victim’s] immediate use.” United States v. Soybel, 13 F.4th 584, 595 (7th Cir. 2021) (quoting 18 U.S.C. § 1030(e)(8)) (al- terations adopted). And after a defendant changed a plaintiff’s so- cial-media passwords and locked her out of her accounts, the Sec- ond Circuit suggested that the plaintiff had a CFAA claim at the time she “discovered that someone had impaired the integrity of each of her relevant Internet accounts.” Sewell v. Bernardin, 795 F.3d 337, 340 (2d Cir. 2015). Indyzen argues, without any authority, that no “damage” occurred here because the Software has continued to function in an uninterrupted manner. But SkyHop alleged (and Indyzen USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 20 of 32

20 Opinion of the Court 21-14051

acknowledged at oral argument, Oral Arg. 22:50-24:26) that SkyHop cannot access the Software itself. Rather, it must continue to pay Indyzen and rely on its benevolence to keep the Software operational, even though SkyHop desires to move its Software de- velopment and maintenance in-house. SkyHop’s inability to access its own Software renders its Software unavailable to it—even if the technology continues to function, and SkyHop’s customers con- tinue to receive SkyHop’s services. c. SkyHop sufficiently alleges the remaining statutory terms. The parties squarely dispute only the meanings of “threat[s]” and “damage” under § 1030(a)(7)(A). But because SkyHop must sufficiently allege a cause of action to satisfy personal jurisdiction here, we must still verify that SkyHop’s allegations sat- isfy the remaining statutory terms and elements. Namely, SkyHop must have sufficiently alleged that Indyzen (1) acted “with intent to extort” money or another thing of value; (2) transmitted a com- munication in interstate or foreign commerce; and (3) made al- leged threats that would have damaged “a protected computer.” First, SkyHop has sufficiently alleged that Indyzen acted “with intent to extort from any person any money or other thing of value.” 18 U.S.C. § 1030(a)(7). While the CFAA does not define “extort,” the plain meaning of the term is “[t]o gain by wrongful methods” or “to obtain in an unlawful manner, as to compel pay- ments by means of threats of injury to person, property, or reputa- tion.” Black’s Law Dictionary (6th ed. 1990). Here, the complaint alleges that Indyzen seeks to obtain $1.1 million or 32% of SkyHop USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 21 of 32

21-14051 Opinion of the Court 21

Tech through wrongful methods—withholding SkyHop’s digital property until it meets their demands. While Indyzen does not dispute the meaning of “extort,” it suggests that we should infer the “obvious alternative explana- tion[]” for its emails: that this is simply an ownership dispute rather than an extortion attempt. And that may turn out to be true. But at this stage, we must make all factual inferences in SkyHop’s favor, and given the allegations, this inference does not strike us as so ob- vious that we should adopt it here. SkyHop has alleged that it owns the Software, and we must accept that allegation as true. Second, Indyzen’s emails clearly constitute communica- tions. See Missouri v. McNeely, 569 U.S. 141, 154 (2013) (describ- ing emails as a type of “electronic communication”). And the com- plaint easily satisfies the interstate-commerce requirement here: Indyzen transmitted the emails from California to Florida over the internet. See United States v. Hornaday, 392 F.3d 1306, 1311 (11th Cir. 2004) (“The internet is an instrumentality of interstate com- merce.”). Third, the “threat to cause damage” must be to a “protected computer.” As relevant here, the CFAA defines “computer” as “an electronic . . . or other high speed data processing device perform- ing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or op- erating in conjunction with such device.” 18 U.S.C. § 1030(e)(1). And a “protected computer” includes one that is “used in or affect- ing interstate or foreign commerce.” Id. § 1030(e)(2)(B). USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 22 of 32

22 Opinion of the Court 21-14051

Here, the complaint’s allegations satisfy the “protected com- puter” term. Indyzen has withheld the passwords to SkyHop’s AWS accounts and the associated servers, which clearly qualify as “computer[s].” See hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195 (9th Cir. 2022) (explaining that servers are “computers that manage network resources and provide data to other computers”). It makes no difference that SkyHop does not own the servers (Am- azon does). Those servers are cloud-based and permit users to ac- cess their data and information from anywhere via the internet. Cf. Riley v. California, 573 U.S. 373, 397 (2014) (“Cloud computing is the capacity of Internet-connected devices to display data stored on remote servers rather than on the device itself.”). In other words, they are “used in or affecting interstate or foreign commerce,” 18 U.S.C. § 1030(e)(2)(B), so they meet the CFAA’s definition of “pro- tected computer.” And by retaining the passwords, Indyzen has diminished SkyHop’s ability to access the programs and data that are housed on the servers and has therefore caused “damage.” In sum, we conclude that SkyHop has stated a cause of ac- tion under § 1030(a)(7)(A) because it has plausibly alleged that In- dyzen sent its emails to SkyHop with an “intent to extort.” View- ing the allegations in the light most favorable to SkyHop, it has also plausibly alleged that the emails amounted to a “threat to cause damage to a protected computer.” We therefore conclude that SkyHop has sufficiently alleged a cause of action under Count I. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 23 of 32

21-14051 Opinion of the Court 23

2. Florida’s connexity requirement is satisfied. Establishing one of the Florida long-arm statute’s enumer- ated acts alone is not enough to satisfy the Florida statute. The long-arm statute also imposes a connexity requirement between the enumerated activity in Florida and the plaintiff’s cause of ac- tion. Knepfle v. J-Tech Corp., 48 F.4th 1282, 1292 (11th Cir. 2022). That is, the statute “requires a connection . . . between the enumer- ated activity in Florida and the cause of action.” Id. (citation omit- ted). The connexity requirement stems from the long-arm stat- ute’s mandate that, to support jurisdiction, the cause of action must “aris[e] from” the enumerated activity. Fla. Stat. § 48.193(1)(a); see Wendt, 822 So. 2d at 1260. Under Florida Supreme Court precedent, a tortious act “can occur through the nonresident defendant’s telephonic, electronic, or written communications into Florida” so long as “the cause of action . . . arise[s] from the communications.” Wendt, 822 So. 2d at 1260. Indeed, that court characterized as “straightforward” and “clear [the conclusion] that the nonresident defendant’s communi- cations were made into Florida” when the defendant sent emails into Florida. Internet Solutions Corp. v. Marshall, 39 So. 3d 1201, 1208 (Fla. 2010). That is so, the court explained, because those emails “[we]re directed to reach a specific recipient in a specific fo- rum.” Id.; see also Del Valle v. Trivago GMBH, __ F.4th __, 2022 WL 17101160, at *4 (11th Cir. Nov. 22, 2022). Based on this Florida Supreme Court precedent, we con- clude that SkyHop’s CFAA claim arises from Indyzen’s USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 24 of 32

24 Opinion of the Court 21-14051

communications into Florida. The emails informed SkyHop that Indyzen did not intend to return the passwords and other digital property unless SkyHop paid the additional $1.1 million or trans- ferred an equity stake to Narra. Those communications constitute the alleged “threat[s]” to cause “damage” to SkyHop’s Software, and they serve as the basis for the inference that Indyzen had the requisite extortive intent to satisfy 18 U.S.C. § 1030(a)(7)(A). In other words, given that SkyHop alleged that Indyzen committed a tort in Florida, and SkyHop is suing Indyzen for that tort, it is easy to conclude that the cause of action arises from the Florida tort. B. The Due Process Clause does not prohibit personal jurisdiction over Indyzen in Florida.

The second (and final) stop on our personal-jurisdiction journey requires us to assess whether the Due Process Clause sup- ports the exercise of personal jurisdiction in Florida. The Due Process Clause limits “a [s]tate’s authority to bind a nonresident defendant to a judgment of its courts.” Walden, 571 U.S. at 283. Jurisdiction is proper only when the nonresident de- fendant has “certain minimum contacts with [the forum] such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’” Int’l Shoe, 326 U.S. at 316 (quot- ing Milliken v. Meyer, 311 U.S. 457, 463 (1940)). The Supreme Court has recognized two types of personal jurisdiction: general jurisdiction, which attaches when a defendant is “essentially at home in the forum State,” and specific jurisdiction, USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 25 of 32

21-14051 Opinion of the Court 25

which “depends on an affiliation between the forum and the un- derlying controversy.” Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011) (alteration adopted) (internal quo- tation marks omitted). Specific jurisdiction is the only type at issue here, and it “derive[s] from and reflect[s] two sets of values—treat- ing defendants fairly and protecting ‘interstate federalism.’” Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1025 (2021) (quoting World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 293 (1980)). To adhere to these values, our constitutional analysis pro- ceeds in three steps: (1) we first consider “whether [a] plaintiff’s claims ‘arise out of or relate to’ at least one of the defendant’s con- tacts with the forum” state; (2) then we evaluate “whether the . . . defendant ‘purposefully availed’ himself of the privilege of con- ducting activities within the forum state”; and (3) finally, we assess “whether the exercise of personal jurisdiction comports with ‘tra- ditional notions of fair play and substantial justice.’” Louis Vuitton Malletier, S.A. v. Mosseri, 736 F.3d 1339, 1355 (11th Cir. 2013) (ci- tations omitted). SkyHop bears the burden of establishing the first two requirements. Id. If it does, Indyzen must then “make a ‘com- pelling case’ that the exercise of jurisdiction would violate tradi- tional notions of fair play and substantial justice.” Id. (quoting Dia- mond Crystal Brands, Inc. v. Food Movers Int’l, Inc., 593 F.3d 1249, 1267 (11th Cir. 2010)). The first inquiry—whether the claims “arise out of or relate to” one of the defendant’s contacts—does not require direct USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 26 of 32

26 Opinion of the Court 21-14051

causation. Ford Motor, 141 S. Ct. at 1026 (emphasis omitted) (cita- tion omitted). Rather, it “contemplates that some relationships will support jurisdiction without a causal showing.” Id. So we fo- cus on the “‘essential foundation’ of specific jurisdiction”— whether there is “a strong ‘relationship among the defendant, the forum, and the litigation.’” Id. at 1028 (quoting Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 (1984)); Del Valle, 2022 WL 17101160, at *5. The principal way to establish this relationship is through an “activity or an occurrence that takes place in the forum State and is therefore subject to the State’s reg- ulation.” Ford Motor, 141 S. Ct. at 1025 (quoting Bristol-Myers Squibb Co. v. Superior Ct. of Cal., 137 S. Ct. 1773, 1780 (2017)). That essential foundation is present here. Indyzen know- ingly and intentionally directed its emails demanding compensa- tion and withholding SkyHop’s passwords into Florida, and a Flor- ida resident received them. Because those emails contained the al- leged “threat[s]” to do “damage” to SkyHop’s Software and there- fore triggered SkyHop’s CFAA claim, this litigation has the re- quired connection to Indyzen’s Florida-based contacts. Indyzen responds by citing Walden for the proposition that “the plaintiff cannot be the only link between the defendant and the forum.” We agree that that is an accurate statement of the law. But it doesn’t help Indyzen here. In Walden, Nevada-resident plaintiffs sued a Georgia-based Drug Enforcement Administration agent in Nevada after an incident that occurred wholly at the At- lanta Hartsfield-Jackson Airport. 571 U.S. at 279–80. So there, the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 27 of 32

21-14051 Opinion of the Court 27

defendant’s conduct provided no connection to the forum state. Id. at 288–89. By contrast, here, through its emails sent to SkyHop in Florida, Indyzen directed its conduct into Florida. And that very same conduct serves as the basis for the claims SkyHop brings against it. So Walden does not apply here. Indyzen’s reliance on Helicopteros and Hanson v. Denckla, 357 U.S. 235 (1958), fares no better. Helicopteros is inapposite. There, the Court limited its analysis to whether the defendant was subject to general jurisdiction in Texas because the plaintiff con- ceded that its claims “did not arise out of, and [were] not related to” the defendant’s activities within Texas. 466 U.S. at 415–16 (in- ternal quotation marks omitted). But the general-jurisdiction anal- ysis does not bear on our specific-jurisdiction inquiry in which, as we’ve explained, at least one of SkyHop’s claims does “arise out of or relate to” Indyzen’s activities in Florida. And in Hanson, the Court held that a Delaware-based trustee, which had no contacts with Florida, could not be forced to litigate a dispute that arose in Florida only because of the trust settlor’s decision to move there long after she had executed the trust in Delaware. 357 U.S. at 251– 52. Here, though, Indyzen is subject to jurisdiction in Florida be- cause of its own choices to contract with a Florida-based company and send emails to a Florida resident—the subject of SkyHop’s first claim. At the second inquiry, we consider whether Indyzen pur- posefully availed itself of the benefit of Florida’s laws. To support purposeful availment, the defendant must have had contacts with USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 28 of 32

28 Opinion of the Court 21-14051

the forum that were his “own choice and not ‘random, isolated, or fortuitous.’” Ford Motor, 141 S. Ct. at 1025 (quoting Keeton v. Hustler Mag., Inc., 465 U.S. 770, 774 (1984)). And those contacts “must show that the defendant deliberately ‘reached out beyond’ its home,” such as by “entering a contractual relationship centered” in the forum. Id. (quoting Walden, 571 U.S. at 285)). In cases (like this one) involving an intentional tort, two ap- plicable tests can determine whether purposeful availment oc- curred: the effects test and the traditional minimum-contacts test. Louis Vuitton, 736 F.3d at 1356; Del Valle, 2022 WL 17101160, at *5. Because either test suffices, and we conclude the effects test is satisfied, we do not consider the traditional minimum-contacts test. A nonresident defendant’s single tortious act in the forum state can satisfy the effects test, even if the defendant lacks any other contacts with the forum state. Licciardello v. Lovelady, 544 F.3d 1280, 1285–86 (11th Cir. 2008) (citing Calder v. Jones, 465 U.S. 783, 790 (1984)). To meet the test, the tort must have been “inten- tional, aimed at the forum state, and caused harm that the defend- ant should have anticipated would be suffered in the forum state.” Del Valle, 2022 WL 17101160, at *5. In Lovelady, we concluded that a defendant who used a Florida plaintiff’s trademarked name and picture on a website ac- cessible in Florida satisfied the effects test. 544 F.3d at 1287–88. And in Del Valle, when the defendants’ websites allowed Florida residents to reserve lodging at Cuban beachfront properties that USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 29 of 32

21-14051 Opinion of the Court 29

had been expropriated from the forebearers of the Florida-resident plaintiffs, we found that met the effects test. 2022 WL 17101160, at *1, *6. We have no difficulty reaching the same conclusion here. Indyzen undoubtedly sent its emails into Florida intentionally. And viewed in the light most favorable to SkyHop, Indyzen sent those emails to force SkyHop to pay additional funds so that SkyHop could regain control of its own property. It was certainly foreseeable to Indyzen that SkyHop would feel the harm from its alleged threats in Florida, where SkyHop is based. And that is es- pecially true here since Indyzen knew, from the outset, that it was in a partnership with a Florida-based company. Indeed, Narra made three separate trips to Florida to meet with Scotto. So In- dyzen had reason to know that its decision and the ensuing emails could force it to defend against a lawsuit in Florida. Trying to rebut these conclusions, Indyzen rehashes its ar- guments that SkyHop has not alleged a cause of action under the CFAA. As we’ve explained, we disagree. The third and final inquiry asks whether the exercise of ju- risdiction in Florida accords with “traditional notions of fair play and substantial justice.” We ordinarily consider four factors to re- solve this inquiry: “the burden on the defendant”; “the forum’s in- terest in adjudicating the dispute”; “the plaintiff’s interest in obtain- ing convenient and effective relief”; and “the judicial system’s in- terest in resolving the dispute.” Del Valle, 2022 WL 17101160, at *7 (quoting World-Wide Volkswagen, 444 U.S. at 292). But the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 30 of 32

30 Opinion of the Court 21-14051

defendant bears the burden of making “a compelling case” that the exercise of jurisdiction is improper. Louis Vuitton, 736 F.3d at 1355 (citation and internal quotation marks omitted). And Indyzen has not even attempted to demonstrate that it satisfies the relevant fac- tors. We therefore conclude that jurisdiction in Florida is con- sistent with the Due Process Clause. Because we conclude personal jurisdiction over Indyzen ex- ists under Count I, we need not and do not inquire whether addi- tional claims independently support personal jurisdiction. Even if they do not, it makes no difference to the propriety of the district court’s exercise of personal jurisdiction over Indyzen here for all SkyHop’s claims because a “district court ha[s] personal jurisdic- tion over the entire case” when “all of the claims ar[i]se from the same jurisdiction generating event.” Cronin v. Wash. Nat’l Ins. Co., 980 F.2d 663, 671 & n.10 (11th Cir. 1993). After all, the point of the personal-jurisdiction inquiry is to ensure that the defendants had at least minimum contacts with the forum state so that hauling them into court in the forum state “does not offend ‘traditional no- tions of fair play and substantial justice.’” Int’l Shoe, 326 U.S. at 316 (citation omitted). So once it is established that the defendants had enough contacts for it to be fair to haul them into court in the fo- rum state on one claim, the personal-jurisdiction inquiry has served the bulk of its purpose. And here, all of SkyHop’s claims stem from Indyzen’s decision to retain SkyHop’s Software, which Indyzen USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 31 of 32

21-14051 Opinion of the Court 31

communicated to SkyHop through the emails. So personal juris- diction over SkyHop is proper. 6

IV. Conclusion

One more note before we bring this appeal in for a landing: when Indyzen brought its initial motion to dismiss for lack of per- sonal jurisdiction, it also asserted an alternative basis to avoid liti- gating this case in Florida. It contended that, under the forum non conveniens doctrine, venue is improper based on the forum-selec- tion clause in the agreements SkyHop and Indyzen signed. SkyHop opposed this motion. But because the district court granted Indyzen’s motion to dismiss for lack of personal jurisdic- tion, the district court had no reason to reach the forum non con- veniens argument. And because the district court did not consider this argu- ment, we won’t, either. MSP Recovery Claims, Series LLC v. Metro. Gen. Ins. Co., 40 F.4th 1295, 1306 (11th Cir. 2022) (“[W]e generally will not consider issues which the district court did not decide.” (citation and internal quotation marks omitted)). On re- mand, then, the district court should first consider whether the fo- rum-selection clauses mandate dismissal based on improper venue. * * *

6 We express no view on whether the remaining counts in SkyHop’s Com- plaint state a claim upon which relief can be granted. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 32 of 32

32 Opinion of the Court 21-14051

For the foregoing reasons, we reverse the district court’s or- der dismissing SkyHop’s complaint and remand for further pro- ceedings. REVERSED AND REMANDED.