Ashton Investments Ltd. & Anor v OJSC Russian Aluminium (Rusal) & Ors

Factual and Procedural Background

The Claimants allege that the Defendants hacked into the Claimants' computer system located in London to access confidential and privileged information related to ongoing litigation involving the parties. The Defendants deny involvement and contend that any unauthorized access was unrelated to them.

The First Defendant, Company A, is a major international aluminium producer headquartered in Moscow, controlled by its Chairman, Defendant Individual A. The Fourth Defendant, Defendant Individual B, is the Chief Executive Officer of the group. The Second Claimant is a company incorporated in Guernsey controlled by a third party, while the First Claimant is an English consultancy company with offices in London.

Between 1999 and 2003, the Second Claimant and another aluminium company engaged in barter arrangements with a state-owned aluminium plant in Tajikistan. In 2003, the Second Claimant entered a joint venture with Company A to continue this arrangement, which operated successfully until repudiated in 2004 when the plant switched to a new partner allegedly linked to Company A. The existence of this joint venture and related facts are disputed.

In May 2005, the Tajik aluminium plant obtained worldwide freezing and search orders against the Claimants and one individual, alleging bribery. Execution of these orders led to seizure of thousands of documents from the First Claimant's offices, held under supervision by solicitors.

Company A and two senior individuals were joined as parties to the proceedings, though the individuals were later removed as defendants. The litigation is described as bitterly contested and ongoing, with related arbitration proceedings in London and other jurisdictions.

On 24 January 2006, a routine security scan of the First Claimant's London server revealed spyware known as "Perfect Keylogger," designed to capture keystrokes and screen images secretly. The spyware was installed around 20 January 2006, and earlier versions were found on a workstation used by the First Claimant's receptionist. Records showed multiple unauthorized remote access attempts to the server from IP addresses registered to Company A and associated internet providers in Moscow and Austria.

A forensic investigation was conducted by a retired police hi-tech crime expert, who confirmed multiple unauthorized access attempts over several days from IP addresses linked to Company A. Some access sessions lasted up to 37 minutes, with indications that remote desktop control was used.

On 8 February 2006, the Claimants issued a claim form in the Chancery Division against the Defendants alleging unauthorized access to their computer system and seeking damages, injunctions, and other relief. The Defendants applied for a declaration that the English Court lacked jurisdiction and for setting aside the claim form service.

The action was transferred to the Commercial Court, and the Defendants' jurisdictional challenge was heard on 27 September 2006.

Legal Issues Presented

1. Whether the English Court has jurisdiction to try the claim based on unauthorized access to a computer system located in England by Defendants allegedly acting from abroad.
2. Whether the Claimants have demonstrated a serious issue to be tried on the merits of their causes of action, including breach of confidence, unlawful interference with business, and unlawful means conspiracy.
3. Whether the Defendants' application to set aside the issue and service of the Claim Form should be granted.
4. Whether England is the appropriate forum conveniens for the dispute, considering alternative jurisdiction in Russia.
5. Whether the individual Defendants are necessary and proper parties to the claim.
6. The applicability of various CPR Part 6.20 gateways for service out of jurisdiction.

Arguments of the Parties

Defendants' Arguments

• The Claimants failed to establish a serious issue to be tried, as there was no direct evidence linking the Defendants to the unauthorized access.
• The claims did not fall within the relevant CPR Part 6.20 provisions justifying service out of jurisdiction.
• England is not the natural forum; Russia is more appropriate given the Defendants' residence and where the alleged tortious acts occurred.
• The IP address linked to Company A was associated with a wi-fi system that was unsecured and subject to unauthorized use by third parties, including possible cloning of MAC addresses, negating a direct link to the Defendants.
• The individual Defendants should not be parties as there was no sufficiently arguable case against them personally.
• The alleged damage was trivial and did not justify bringing foreign Defendants before the English court.

Claimants' Arguments

• The Defendants, specifically Company A, were responsible for the unauthorized access, as shown by IP addresses registered to them and the installation of spyware transmitting data to addresses controlled by them.
• The Claimants have a good arguable case that the Defendants obtained confidential and privileged information to gain an advantage in ongoing litigation.
• The tort and breach of confidence occurred in England where the server and confidential information were located.
• England is the proper forum given the location of the computer system, witnesses, experts, and the connection to ongoing litigation in England.
• The individual Defendants, as controlling officers of Company A, should be joined as necessary and proper parties.
• The claims fall within CPR Part 6.20 provisions allowing service out, including tort claims where damage was sustained within the jurisdiction and claims relating to property within the jurisdiction.

Table of Precedents Cited

Precedent	Rule or Principle Cited For	Application by the Court
Canada Trust Co. & ors v. Stolzenberg & ors (No. 2) [1998] 1 WLR 547	Standard for establishing a good arguable case to take jurisdiction, including the consideration of interlocutory evidence and avoiding pre-trial merits assessment.	Used to discuss the threshold for permission to serve out of jurisdiction, rejecting a requirement that Claimants show a "much better" case and focusing on whether there is a serious issue to try.
Seaconsar Ltd. v. Bank Markazi Jomhouri Islami Iran [1994] 1 AC 438	Clarification of standards on merits assessment and forum conveniens in jurisdictional challenges.	Affirmed that the Claimants must show a serious issue to be tried and that jurisdiction and forum conveniens are distinct considerations.
Konkola Copper Mines v. Coromin Limited [2006] EWCA Civ 5	Warning against pre-trying the merits at the jurisdiction stage and the applicability of the good arguable case test.	Supported the approach of focusing on whether there is a serious issue to try rather than deciding which party has a better case at this interlocutory stage.
Distiller's Co (Biochemicals) Ltd v. Thompson [1971] AC 458	Determination of where a tort is committed by examining the substance of the events constituting the tort.	Applied to assess whether the tort of unauthorized access was committed in England or Russia, concluding that significant acts occurred in England.
Metall & Rostoff v. Donaldson Inc. [1990] 1 QB 391	Interpretation of CPR 6.20(8) concerning tort claims and damage sustained within the jurisdiction.	Guided the court in concluding that damage was sustained in England where the server was accessed, justifying jurisdiction.
In Re Banco Nacional de Cuba [2001] 1 WLR 2039	Interpretation of CPR 6.20(10) regarding claims relating to property located within the jurisdiction.	Supported the argument that confidential information stored digitally on a server in England constitutes property located within the jurisdiction.
Douglas & ors v. Hello! Limited [2003] EWCA 139	Use of CPR 6.20(15) for claims in restitution and equitable relief.	Clarified that not all breach of confidence claims amount to claims in restitution and that this gateway was not properly invoked here.
Watson v. Daily Record Ltd [1907] 1 KB 853	Requirement that injunction claims for service out must be bona fide with a real prospect of repetition.	Considered in assessing whether an injunction to restrain interference with the server falls within CPR 6.20(2) and whether there are grounds to anticipate repetition.
Unilever Plc v. Chefaro Proprietaries Ltd. [1994] FSR 135	Criteria for joining necessary and proper parties.	Applied in rejecting the joinder of individual Defendants as necessary or proper parties absent a sufficiently arguable case against them.
Spiliada Maritime Corp v. Consulex Ltd [1987] AC 460	Principles governing forum conveniens and determination of the appropriate forum for trial.	Used to evaluate whether England or Russia was the appropriate forum, concluding England was the proper forum.

Court's Reasoning and Analysis

The Court carefully examined the factual evidence concerning the unauthorized access to the Claimants' server in London, including forensic reports indicating multiple access attempts from IP addresses registered to the Defendants and associated entities. While the Defendants offered an explanation that the wi-fi system was unsecured and that MAC addresses may have been cloned by third parties, the Court found that this did not sufficiently undermine the Claimants' case to dismiss it at this stage.

The Court emphasized the seriousness of the allegations, which, if proven, would constitute criminal conduct under the Computer Misuse Act 1990 and a significant breach of confidence. It applied the established legal standard for permission to serve out of jurisdiction, focusing on whether there is a serious issue to be tried rather than requiring Claimants to show a much better case.

Regarding jurisdiction, the Court concluded that the tort was substantially committed in England, where the server was located and accessed, and where confidential information was stored and allegedly obtained. The Court rejected the Defendants' argument that damage occurred only in Russia, reasoning that the unauthorized access and removal of information physically occurred in London.

The Court accepted that the claims for breach of confidence and unlawful interference fell within the CPR Part 6.20 gateways for service out, particularly paragraphs (8) and (10). However, it found that the claim for restitution under paragraph (15) was not properly invoked.

On the issue of the individual Defendants, the Court held that the Claimants had failed to establish a sufficiently arguable case against them personally. Their joinder as necessary and proper parties was therefore not justified.

In considering forum conveniens, the Court weighed the availability of Russian jurisdiction against the strong connections to England, including the location of the server, witnesses, experts, and ongoing related litigation. It acknowledged difficulties in Russian law concerning the legal status of information and the likely slower pace of proceedings there. The Court concluded that England was clearly the appropriate forum.

Finally, the Court exercised its discretion to allow the claims against Company A to proceed in England but ordered that the conspiracy claim be re-pleaded to provide sufficient particulars. It set aside the proceedings against the individual Defendants but left open the possibility of re-joining them if further evidence emerged.

Holding and Implications

The Court GRANTED the Defendants' application in part and DISMISSED it in part. Specifically:

• The claim against the individual Defendants was struck out for lack of a sufficiently arguable case.
• The claims against Company A and associated entities were allowed to proceed in the English Court.
• The conspiracy claim must be re-pleaded with adequate particulars or it will be struck out.

The Court confirmed that England is the appropriate forum for this dispute, ensuring that the litigation continues in London. No new legal precedent was established beyond the application and clarification of existing principles regarding jurisdiction, service out, and forum conveniens in the context of cross-border computer misuse and breach of confidence claims.