Baidu, Inc. v. Register. Com, Inc.

760 F. Supp. 2d 312, 97 U.S.P.Q. 2d (BNA) 1590, 2010 U.S. Dist. LEXIS 73905, 2010 WL 2900313
CourtDistrict Court, S.D. New York
DecidedJuly 22, 2010
Docket10 Civ. 444 (DC)
StatusPublished
Cited by15 cases

This text of 760 F. Supp. 2d 312 (Baidu, Inc. v. Register. Com, Inc.) is published on Counsel Stack Legal Research, covering District Court, S.D. New York primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Baidu, Inc. v. Register. Com, Inc., 760 F. Supp. 2d 312, 97 U.S.P.Q. 2d (BNA) 1590, 2010 U.S. Dist. LEXIS 73905, 2010 WL 2900313 (S.D.N.Y. 2010).

Opinion

*314 OPINION

CHIN, Circuit Judge:

Plaintiffs Baidu, Inc. and Beijing Baidu Netcom Science & Technology Co., Ltd. (together, “Baidu”) operate an Internet search engine service in China. Baidu registered its domain name “baidu.com” with defendant Register.com, Inc. (“Register”), a domain name registrar. Register provides its clients, including Baidu, with Internet traffic routing services.

On January 11, 2010, someone engaged in a cyber-attack on Baidu by gaining unauthorized access to Baidu’s account at Register. As a consequence, Internet traffic intended for Baidu’s web site was re-directed to a web page showing an Iranian flag and a broken Star of David and proclaiming: “This site has been hacked by the Iranian Cyber Army.” Web traffic was diverted in this manner for about five hours.

In this ease, Baidu sues Register for damages, asserting claims for, inter alia, contributory trademark infringement under the Lanham Act, 15 U.S.C. § 1114(1)(a), breach of contract, and gross negligence and recklessness. Baidu asserts that Register committed gross negligence by failing to follow its own security protocols, and permitting the intruder to gain unauthorized access to Baidu’s confidential and proprietary account information.

Register moves to dismiss the complaint pursuant to Fed.R.Civ.P. 12(b)(6) for failure to state a claim upon which relief may be granted. For the reasons that follow, the motion is granted in part and denied in part. Baidu will be permitted to proceed with its claims of gross negligence, recklessness, and breach of contract.

STATEMENT OF THE CASE

A. The Facts

The facts alleged in the complaint are assumed to be true for purposes of this motion and may be summarized as follows:

1. The Parties

Baidu, Inc. is incorporated under the laws of the Cayman Islands and has its principal place of business in China. (Compl. ¶ 6). Beijing Baidu Netcom Science & Technology Co., Ltd. is incorporated under the laws of China and has its principal place of business in China. (Id. ¶ 7). Baidu is the third largest search engine service provider in the world and the largest in China, with an estimated more than 70% share of the Chinese-language market. (Id. ¶ 13). Baidu owns the registered trademark “Baidu” and the domain name “baidu.com.” (Id. ¶¶ 15, 16). It generates revenue through the public’s use of its search engine service on its web site. (Id. ¶¶ 14, 24).

Register is incorporated under Delaware law and has its principal place of business in New York. (Id. ¶ 8). Register is an accredited domain name registrar and provides domain name registration, Internet traffic routing, and related services for its customers. (Id. ¶ 16).

2. Baidu’s Relationship with Register

Baidu registered its domain name with Register in 1999. (Id. ¶ 16; see Jacobson Decl. ¶ 3). The parties entered into a series of written agreements; the currently operative agreement is the Master Services Agreement dated December 18, 2009 (the “MSA”). (Compl. ¶¶ 11, 16; see Jacobson Decl. ¶ 4 & Ex. A). 1

*315 Under the MSA, Baidu agreed to use Register’s services “entirely at [Baidu’s] own risk.” (MSA at 9). 2 The MSA includes a “Limitation of Liability” clause limiting Register’s liability for the use by customers of its “Services.” The clause provides in part as follows:

You agree that [Register] will not be liable, under any circumstances, for any (a) termination, suspension, loss, or modification of your Services, (b) use of or the inability to use the Service(s), (c) interruption of business, (d) access delays or access interruptions to this site or a service (including, without limitation, to web site(s) accessed by the domain name registered in your name), ... (f) events beyond [Register’s] ... reasonable control, ... (j) transactions conducted on a user web site, including fraudulent transactions, (k) loss incurred in connection with your service(s) including in connection with e-commerce transactions, (l) unauthorized access to or alteration of your transmissions or data, (m) statements or conduct of any third party using your service(s), or (n) any other matter relating to your use of the Service(s). [Register] also will not be liable for any indirect, special, incidental, or consequential damages of any kind (including lost profits, goodwill, data, the cost of replacement goods or services, or other intangible losses) regardless of the form of action whether in contract, tort (including negligence), or otherwise, even if [Register] has been advised of the possibility of such damages. In no event shall [Register’s] maximum aggregate liability exceed the total amount paid by you for the Services, but in no event greater than five hundred dollars ($500). Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, in such states, our liability is limited to the maximum extent permitted by law.

(Id.).

With respect to user names and passwords, the MSA provides that it is the customer’s “responsibility to safeguard the User name, password and any secret question/secret answer you select from any unauthorized use.” (Id. at 6). The MSA provides: “In no event will [Register] be liable for the unauthorized use or misuse of your user name or password.” (Id.). The MSA also provides that the customer is “responsible for maintaining the security of your account.” (Id.).

The MSA provides, with certain exceptions not applicable here, that New York law will govern. (Id. at 10).

3. The Cyber-Attack

On January 11, 2010, at approximately 5:03 p.m. EST, an unauthorized individual falsely claiming to be an agent of Baidu (the “Intruder”) contacted Register through a " 'tech support’ Internet chat” service operated by Register. The Intruder asked to change the email address on file for Baidu. The Register service representative (the “Rep”) asked the Intruder to provide security verification information. The Intruder gave an incorrect answer, but the Rep nonetheless emailed a security code to the email address that Baidu had on file. The Rep then asked the Intruder to repeat the security code back via the Internet chat. (Compl. ¶ 18). *316 Because the Intruder did not have access to Baidu’s email account, he did not receive the security code. Instead, he responded with a different and inaccurate code.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
760 F. Supp. 2d 312, 97 U.S.P.Q. 2d (BNA) 1590, 2010 U.S. Dist. LEXIS 73905, 2010 WL 2900313, Counsel Stack Legal Research, https://law.counselstack.com/opinion/baidu-inc-v-register-com-inc-nysd-2010.