United States v. Ivanov, 175 F. Supp. 2d 367 (D. Conn. 2001) was decided by the United States District Court for the District of Connecticut on December 6, 2001 (No. 3:00CR00183(AWT)). The court denied Ivanov's motion to dismiss for lack of subject matter jurisdiction. It held that jurisdiction existed regardless of whether the charging statutes reach extraterritorially, because the intended and actual detrimental effects of the charged offenses occurred in the United States, and held in the alternative that § 1030, the Hobbs Act, and § 1029 were each intended by Congress to apply extraterritorially. This was a ruling on jurisdiction only, not an adjudication of guilt.

The question before the court

Does a United States district court have jurisdiction over Computer Fraud and Abuse Act, Hobbs Act, and access-device charges against a defendant who was physically in Russia throughout the alleged intrusion and extortion of a computer system located in the United States?

The governing rule

Two independent grounds supported jurisdiction. First, the effects doctrine: "[t]he intent to cause effects within the United States . . . makes it reasonable to apply to persons outside United States territory a statute which is not expressly extraterritorial in scope." United States v. Muench, 694 F.2d 28, 33 (2d Cir. 1982); see also Ford v. United States, 273 U.S. 593, 623 (1927) (approving the principle that one who outside a country puts in motion a force to take effect within it answers where the harm occurs); Marc Rich & Co. v. United States, 707 F.2d 663, 666 (2d Cir. 1983). Data is intangible property, and possession of intangibles is measured by control. Carpenter v. United States, 484 U.S. 19, 25 (1987); New York Credit Men's Ass'n v. Manufacturers Discount Corp., 147 F.2d 885, 887 (2d Cir. 1945). Second, the presumption against extraterritoriality may be overcome by clear evidence of congressional intent. EEOC v. Arabian American Oil Co., 499 U.S. 244, 248 (1991); United States v. Gatlin, 216 F.3d 207, 211 (2d Cir. 2000). The 1996 CFAA amendments, Pub. L. No. 104-294, 110 Stat. 3491, redefined "protected computer" to include any computer used in interstate or foreign commerce or communication, 18 U.S.C. § 1030(e)(2)(B), and added §§ 1030(a)(2)(C) and (a)(7). The Hobbs Act "speaks in broad language, manifesting a purpose to use all the constitutional power Congress has to punish interference with interstate commerce by extortion." Stirone v. United States, 361 U.S. 212, 215 (1960).

How the court applied it

The superseding indictment charged Ivanov with conspiracy, computer fraud under §§ 1030(a)(4), (a)(2)(C) and (a)(7), Hobbs Act extortion, and possession of unauthorized access devices, arising from his obtaining root passwords to the systems of Online Information Bureau, an e-commerce payment clearinghouse in Vernon, Connecticut, and then emailing the company demanding roughly $10,000 to secure its network. The parties agreed Ivanov was in Russia or another former Soviet Bloc country throughout. Judge Thompson located every prohibited effect inside the United States: the computers he accessed sat in Vernon, and the fact that access was achieved through a remote and complex process did not move the place of access. The "something of value" element was satisfied by root-level control over credit card and merchant account data, and because possession of intangible property follows control, Ivanov possessed that data while it still resided on the Connecticut servers — before he moved copies to Russia. The threat charged under § 1030(a)(7) and the Hobbs Act count were received in Connecticut. Jurisdiction over the conspiracy count followed from jurisdiction over the substantive offenses. Independently, the court found congressional intent to reach conduct abroad, resting principally on the 1996 amendment inserting "foreign" into the definition of a protected computer, which would be meaningless if the statute stopped at the border.

What the court concluded

The court denied Ivanov's motion to dismiss for lack of subject matter jurisdiction. It held that jurisdiction existed regardless of whether the charging statutes reach extraterritorially, because the intended and actual detrimental effects of the charged offenses occurred in the United States, and held in the alternative that § 1030, the Hobbs Act, and § 1029 were each intended by Congress to apply extraterritorially. This was a ruling on jurisdiction only, not an adjudication of guilt.

From the opinion

Why it matters for cyber conflict

Ivanov supplies the jurisdictional foundation for prosecuting foreign intruders who never set foot in the United States, holding that an intrusion happens where the targeted server sits rather than where the attacker's keyboard is. That reasoning underwrites the indictments the United States now brings against state-linked hacking units operating entirely from abroad.

Editorial note: this case note was drafted with AI assistance by the JLCW Research Desk, checked against the text of the opinion, and reviewed by a human editor before publication. Every quotation above is carried through from the opinion itself. See our editing policy.

Read the opinion: United States v. Ivanov on CourtListener. This note is a summary prepared by the Journal, not legal advice, and not a substitute for the opinion itself.

More on International Law · All case notes · Peer-reviewed scholarship