Ashton Investments Ltd. & Anor v OJSC Russian Aluminium (Rusal) & Ors

In these proceedings, the Claimants make the fairly startling allegation that the Defendants have hacked into the Claimants’ computer system in London in order to view confidential and privileged information in relation to litigation in which the parties are jointly engaged. The Defendants vigorously deny having engaged in any such improper conduct and contend that, if there was unauthorised access to the Claimants’ computers (as it is fairly clear there was) it had nothing to do with them.

The Defendants now apply for a declaration that the English Court has no jurisdiction to try this action and for an order setting aside the issue and service of the Claim Form.

The first Defendant, OJSC Russian Aluminium RUSAL (“Rusal”) is the third largest aluminium producer in the world, producing about 9% of global output. The group has approximately 46,000 employees and in 2005 it had a sales revenue of some US$6.1 billion. Head office is in Moscow. The Group is privately owned. The Claimants contend that it is effectively solely owned ultimately by its Chairman, the third defendant, Mr Deripaska. That assertion has not been controverted before me. The Fourth Defendant, Mr Bulygin, is the Chief Executive Officer of the Group.

The Second Claimant (“Ansol”) was incorporated in Guernsey in September 1998. It is controlled by Mr Avaz Saidovich Nazarov. The First Claimant (“Ashton”) is an English company which provides consultancy services to Ansol. At the relevant time, it had offices at 6-10 Bruton Street, London W1.

According to evidence filed on behalf of the Claimants (Footnote: ¹), between 1999 and 2003, Ansol and Hydro Aluminium AS (“Hydro”) entered into a series of barter arrangements with Tajik Aluminium Plant (“TadAZ”) a state owned entity in Tajikistan which operated a large aluminium smelting plant. Tajikistan has large supplies of hydro-electric power but none of the raw materials (especially alumina) needed to produce aluminium. The barter arrangement was for Ansol to supply alumina (sourced from many parts of the world) and spare parts for the plant in return for which they received aluminium, which was exported by rail through Russia into Western Europe. This was a huge logistical operation.

In 2003, Ansol needed to find a new strategic partner to assist in financing this major enterprise. It claims that it entered into a joint venture with Rusal jointly to perform the barter arrangement that had previously been carried out by Ansol and Hydro. This joint venture operated successfully until December 2004. During that period, production at TadAZ continued to increase until it reached some 360,000 m.t., double what had been achieved in 1997. However, in December 2004, TadAZ suddenly stopped supplies under the existing arrangements and repudiated the barter arrangements. A few days later, it entered into a new arrangement with an off-the-shelf company registered in the British Virgin Islands, called CDH Investments Corp (“CDH”). It is alleged that CDH is really a front for Rusal. All this (including the existence of any joint venture involving Rusal) is hotly disputed.

On 12 May 2005, TadAZ applied to Etherton J. without notice for a world-wide freezing order and a search and seizure order against, inter alios, Ansol, Ashton and Mr Nazarov. It was alleged that Mr Nazarov had bribed the director of TadAZ, Abdukadir Ermatov, by gifts made to Mr Ermatov and his son over many years.

On 13 May 2005 Etherton J. granted wide ranging orders which included worldwide freezing orders against Ansol, Ashton and Mr Nazarov limited to the value of US$178 million and a search and seizure order against Mr Nazarov and Ashton. Execution of the order began on the same day. An application was made to Lewison J to stay further execution and he directed that the search should continue but all documents seized and all copies of computer hard disc drives were to be taken to the offices of DLA Piper Rudnick (“DLA”), who acted as the supervising solicitors. Between 1,500 and 2,000 files were removed from Ashton’s offices and stored at DLA’s offices.

Rusal was promptly joined to the proceedings by Ansol as an additional party under CPR Part 20. Ansol’s case is that Rusal, TadAZ and others in Tajikistan have conspired together to steal the business formerly done by the joint venture by diverting it to Rusal. Mr Deripaska and Mr Bulygin were also joined as additional parties on the grounds they were necessary or proper parties. In circumstances to which I shall return, they were removed from the action by Cresswell J. following a judgment delivered by him on 28 July 2006 – [2006] EWHC 2374 (Comm). The application by Rusal to be released from the proceedings failed.

In the meantime, applications were made by all Defendants to discharge the orders made by Etherton J. On 27 May 2005, there was a hearing before Laddie J. during which concerns were expressed as to the adequacy of the cross-undertakings given to preserve the confidentiality of documents seized. An undertaking was given by counsel on behalf of TadAZ that none of the documents or other information disclosed by the Defendants (including Ashton and Ansol) should be made available to Rusal or its employees. The judge directed that TadAZ should not have access to the documents held at DLA’s offices until the applications had been determined.

The applications came before Blackburne J. for a five day hearing in late July 2005. In his judgment delivered on 21 October 2005, he discharged the freezing injunction and the search and seizure orders (Footnote: ²), although he left a proprietary injunction intact (Footnote: ³). He directed that the files taken from Ashton’s offices be returned to their solicitors, Clyde & Co., so that they could first identify what needed to be disclosed in the proceedings, and to “minimise the risk of any of the documents, following their return [to their clients] being overlooked or going astray”. He was critical (Footnote: ⁴) of the failure by TadAZ to highlight sufficiently the extent of Rusal’s involvement in TadAZ’s affairs, in particular that Rusal was funding the litigation and that day to day instructions to Herbert Smith, TadAZ’s solicitors, came via Rusal. At §191 of his Judgment he said as follows:

“Pulling these various strands together, the strong overall impression which I have gained is that, notwithstanding the joint venture, Rusal has decided to further its own interests through the exploitation of TadAZ's aluminium production capacity, intends to do so shorn of any participation by Ansol through the joint venture, and, to that end and acting in conjunction with those who now control TadAZ, is backing these proceedings both by providing Herbert Smith with day to day instructions and by underwriting some or all of the cost to TadAZ of bringing them. In short, from once being Ansol's partner, through Hamer, in their joint dealings with TadAZ, Rusal has now become Ansol's rival and, as part of the pursuit of its commercial interest, is promoting this litigation. It does so while denying this court's jurisdiction to try Ansol's related cross-claims against it. This may turn out on closer examination at the trial to be a wrong conclusion but that is how it presently appears to me.”

This bitterly contested litigation continues.

There is also an arbitration proceeding in the London Court of International Arbitration between Hydro and TadAZ under the 2003 barter agreement. The case was due to be heard on 19 September 2005. On 22 August 2005 (with the permission of the Tribunal) TadAZ obtained from the Chancery Registry orders that Ashton produce at the hearing a wide range of documents and a number of witness summonses including one against Mr Nazarov. A further set of orders was obtained from the Admiralty and Commercial Registry on 5 September 2005. These orders would have encompassed many of the documents held at DLA’s offices and covered by the undertaking offered to Laddie J (§10 supra).

On 13 September Mann J. heard applications to set aside the witness summonses and the orders to produce documents. He refused to set aside the witness summonses, but set aside the orders to produce documents on the grounds that the documents were not properly identified. TadAZ appealed but its appeal was dismissed on 24 October 2005 – see [2005] EWCA Civ 1218, reported at [2006] 1 Lloyd’s Rep 155. Moore-Bick LJ said at the conclusion of his judgment:

There is other litigation and also arbitration proceedings in various jurisdictions involving a number of parties, including TadAZ and Ansol and corporations said to be affiliates of Rusal.

Ashton maintains a computer system in its offices in London. On 24 January 2006, Mr Vlad Sinani, the IT administrator employed by Ashton and Mr Makarov of Westbridge Associates, Ashton’s then independent IT consultants, were carrying out what Mr Sinani described as a routine security scan on the Ashton server. In the course of it, they used a new security product called “F-Secure Blacklight” – this product had not yet been released on the market and was still in the process of development. The evidence did not reveal why Mr Sinani and Mr Makarov had decided to do this. At all events, the scan revealed a hidden software product often called “spyware”. Further investigation showed that it was a product called “Perfect Keylogger” produced by a software company called Blazing Tools. The programme was designed to be installed surreptitiously on a computer – often via an innocent looking e-mail sent from a remote computer. The software manufacturers claim that the software is “absolutely undetectable” (Footnote: ⁵). Having been installed, the spyware makes a log of everything typed on the computer. It can also carry out “visual surveillance” by taking a snapshot of the computer screen and any information saved on file. This information can then be secretly transmitted to the person who installed it.

Records showed that the spyware had been installed on Ashton’s server at about 4 a.m. on 20 January 2006. As administrator of the system, Mr Sinani is the only person authorised to have access to the server. His access is protected by a password which is (allegedly) only known to him.

Mr Sinani and Mr Makarov disabled the spyware (having taken a copy of it) and deleted it from the list of processes set to run on start-up. The administrator’s password was re-set.

This led to further investigations the next morning. An earlier version of the Keylogger software called KS.exe was found on Workstation 12, which is operated by Ashton’s receptionist and secretary. The domain user or “owner”of the KS.exe file was called “Oroosinovich”. The software appeared to have been installed on either the 11 March or 3 November 2005 (depending on the dating system used) (Footnote: ⁶). The workstation was not normally used to store confidential information. The spyware had been transmitting information to an internet number “smtp.list.ru/194.67.23.115”. Mr Sinani had carried out a routine service on the workstation on 8 December 2005. In order to gain access he would have had to enter his administrator’s user name and secret password. Mr Sinani and Mr Makarov disabled the KS.exe spyware on the workstation.

Mr Sinani and Mr Makarov examined the internet traffic incoming to Ashton’s server between 19 and 24 January 2006. When a computer is accessed from a remote location, the user will usually leave a trace of information which includes details of the internet address from which access was obtained. The address is a unique number allocated to all users of the internet by an internet registrar, such as ICANN, Nominet or Réseaux IP Européens (“RIPE”). The latter maintains a searchable database of internet addresses.

This examination revealed that there had been two attempts to gain unauthorised access to the system on 19 January 2006. The first was at 5.44 a.m. from an internet address 213.248.20.172. It was made manually but was unsuccessful due to one mistake in the spelling of the word “remote” in the internet URL. A second attempt was made at 5.46 a.m. This was successful. The remote user appears to have entered the administrative account using the administrator’s username and the administrator’s secret password. The log on was for 38 seconds but the administrator user ID and password were not entered until 32 seconds into the event. The user appears to have signed out as soon as the successful log-in screen was completed.

Further at 3.31 a.m. on 20 January 2006, remote access was made from the internet address 83.237.37.9. And at 8.38 p.m. on 21 January via internet address 213.87.88.1. Changes made to the active directory of the server on 20 and 22 January 2006 also suggested that there had been further successful attempts to log into the server using the administrator’s username and Mr Sinani’s password.

The RIPE database revealed the following:

On about 1 February 2006, Ashton retained Mr James Kent, the retired head of Suffolk Police’s hi-tech crime unit, and a senior forensic investigator and head of forensics at 7Safe Limited, an IT firm specialising in penetration testing, computer forensics and risk management to assist in the enquiry. In his report, Mr Kent records that the actions taken by Mr Sinani and Mr Makarov to secure the system, whilst entirely understandable, had resulted in important files and information being removed. “Subsequent forensic examination of original evidence has been made very difficult due to changes made to the system. The changes will not have affected the information contained within the log files.”

Amongst many other things, Mr Kent examined the logs of the Ashton server from 14 January 2006. He confirmed the information that I have already set out. However, his investigations also revealed that on 14, 17, 18, 20, 21 and 22 January there were numerous successful attempts to gain access to the Ashton server from an internet address in Austria, addresses registered to ZAO MTU-Intel in Moscow and Mobile Telesystems OJSC in Moscow, using the administrator’s username and password. In most cases it was not possible to work out the duration of the log on, but in one case it was for 37 minutes and in another 22 minutes. Of the indeterminate log ons, the potential duration was in some cases several hours.

There were also indications that, in many cases, a remote desktop was being used. This is a facility whereby the user can control a computer from another remote computer, just as if the user was sitting in front of the computer. It is a service legitimately used by an administrator. In the hands of a hacker, it is of great value. He has full remote control of the machine. If the user closes the session by logging off at the web workplace, this will be recorded on the local web log. If he closes the session without logging off, there will be no record in the web log of the length of the session.

Mr Kent also examined the monthly summary logs going back to January 2005. These appear to reveal that (probably (Footnote: ⁷)) in March 2005 and August 2005, there were attempts to communicate with the server from IP addresses 213.248.20.196 and 213.248.20.1. Both these addresses are registered to Rusal. If these were attempts to log on – there were “web requests” which might indicate this was being attempted – they were prevented.

On 3 February 2006, a full port scan was conducted on the Ashton server from a remote location. The remote computer was trying to scan every port or entry point to discover which was open. This scan would have taken several hours to complete.

I have set out the information extracted by Mr Sinani and Mr Makarov and Mr Kent without comment. Most is I think not really in dispute at least for the purposes of this application. However, it has led to very differing conclusions being drawn by the parties.

The discovery that someone from an IP address registered to Rusal had attempted to log on and then successfully logged on to the Ashton server on 19 January 2006, using the administrator’s user name and password, was viewed by the Claimants with the utmost gravity in the context of the bitter disputes with Rusal. They concluded that by leaving its registered address 213.248.20.172 on the Ashton server, Rusal had left the equivalent of a finger print at a crime scene. They drew the inference that, in all probability, Rusal was behind the other attempts, successful and unsuccessful, to gain access to the Ashton system and that Rusal had managed to obtain secret and privileged information about the litigation. The chronology they suggested was as follows:

On the basis of this case, on 8 February 2006, the Claimants issued a claim form “not for service out of the jurisdiction” in the Chancery Division against the Defendants. The brief details given of the claim were that the claims against each defendant “arise from unauthorised access gained by one or more of the Defendants (or others acting on their behalf and with their authority) to the computer system of the First Claimant which contains confidential and legally privileged information belonging to both Claimants)”. The following relief was sought:

On the previous day, the Claimants had issued an application notice in the Part 20 proceedings seeking wide ranging injunctive relief against the Defendants. The application notice also sought an order for substituted service on Bryan Cave & Co. and “in so far as necessary, there be permission to serve out of the jurisdiction by a method specified by the court”. The application was supported by the 3^rd witness statement of Julian Connerty and the 1^st witness statement of Andrei Makarov both dated 8 February 2006. It came before Park J. on 9 February 2006. With admirable expedition, the Defendants were able by that date to produce a statement from Dennis Willetts, a computer expert who gave an initial report, and a statement from Paul Hauser, a partner in Bryan Cave. Mr Connerty had also filed a 4^th witness statement in which he clarified that the Claimants were seeking permission to serve the Claim Form on the four Defendants in Russia and that the paragraphs in CPR Part 6.20 on which they relied were:

Very sensibly, the parties reached agreement as to how this application was to be dealt with. The agreement was contained in a consent order made by Park J. on 9 February, and entered on 10 February 2006. Essentially,

The Claimants served their Particulars of Claim on 27 February 2006. They advanced the following causes of action:

On 5 May 2006, Cresswell J. ordered by consent that the action be transferred to the Commercial Court and he directed that any jurisdictional challenge was to be issued by 8 May. On 8 May, the Defendants duly issued their application for an order declaring that the English Court had no jurisdiction to try these proceedings, alternatively that it should not exercise any such jurisdiction, and setting aside the issue and service of the Claim Form.

I heard this application on 27 September 2006. It was accompanied by very extensive written argument and evidence. It was agreed that, although service of the proceedings had been effected in this jurisdiction, I should proceed on the basis that permission had been required to serve them out of the jurisdiction and that service had been effected in Russia – i.e. that in accordance with the spirit of the consent order made by Park J., the Defendants should in no way be prejudiced by their agreement to short-cut service. I have proceeded on the basis that the Defendants’ application is to be tested by asking whether the Claimants could justify obtaining permission to serve out under CPR Part 6.20 in the light of all the evidence before the Court.

In the course of her argument, Miss Barbara Dohmann QC for the Defendants developed the following primary submissions:

First, however, it is right that I should set out the factual case advanced before me on the basis of evidence filed by the Defendants. In addition to the preliminary evidence filed from Mr Willetts and Mr Hauser, the Defendants also filed witness statements from Elina Klimova, Paul Hauser (2^nd), Mikhail Erenburg (1^st and 2^nd), and Dennis Willetts (2^nd).

In their factual evidence, the Defendants vigorously dispute that they or anyone acting on their behalf ever sought to gain access to Ashton’s server, let alone successfully did so. As to the crucial log-ons on 19 January (one successful and the other unsuccessful) their evidence is as follows. The IP address 213.248.20.172 is one of the 782 internet addresses registered to Rusal, of which only 84 have ever been used. Of these, only 2 are in regular use. One is used by computers physically connected to the Moscow system. The other – 213.248.20.172 – is allocated exclusively to the wireless connection to the net (so called “wi-fi”). Radio transmitters were installed at Rusal’s head office at 13/1 and 15 Nikoloyamskaya Street in Moscow in November 2004. Computers with a “wi-fi” card and software could pick up the signal and connect to the internet. The radio beam had a range of about 100 metres outside the office, but this could be extended to about 5 kilometres if an antenna was used.

Despite warnings from Rusal’s IT department that, unless security measures (such as passwords) were put in place, third parties would be able to use the system to gain free access to the internet, the wi-fi system was not protected at first. It soon became apparent that the level of unauthorised use was so high that it was starting to cost Rusal money. A system of MAC numbers (short for media access control) was introduced. A MAC number is a unique number assigned to a computer. A wi-fi system can be programmed only to allow access to computers with recognised MAC numbers. As from April 2005, anyone wishing to use the wi-fi system had to register their computer’s MAC number with the IT department.

As at 19 January 2006, only two computer MAC numbers were authenticated for use with the IT department (Footnote: ⁸). One was operated by Ms Elena Klimova, Director of the Treasury Department of the Second Defendant. Mr Willetts examined this machine on 26 May 2006. It had not accessed the Ashton system on 19 January. Ms Klimova confirmed this, and added that she only ever connected the machine to the main system and did not use the wi-fi connection. The other had been operated by Mr A. Myshkin, but he was no longer employed by the Second Defendant. The machine had been handed back to the IT department in September 2005, since which time it had been left dormant in a locked cupboard. Mr Willetts examined the machine on 13 March 2006, and he confirmed that it was not in use on 19 January 2006.

Yet, Mr Erenburg discovered that these two MAC numbers had appeared with very great frequency in Rusal’s web authentication logs. So for example, on 8 September 2005, the number assigned to the dormant machine was authenticated to the wi-fi system over 100 times. Mr Erenburg and Mr Willetts consider that this is highly unusual behaviour for an individual and they believe that the MAC numbers must have been cloned and used by third parties. Rusal’s Moscow headquarters are only about 100 metres from the Moscow State Aviation Technological University, known as MATI. The most likely explanation was that the MAC numbers were obtained and distributed amongst university students, although they could have been used by someone much further away using an aerial attached to their computer. Anyone using the wi-fi system to access another computer via the internet would leave the Rusal IP address on the other computer, so that it would appear (falsely) that it was a Rusal employee who had obtained the unauthorised access, whereas in fact it was someone misusing the Rusal wi-fi system.

On the basis of this evidence, Miss Dohmann submitted that there was really no evidence to connect the unauthorised log-ons onto Ashton’s server with Rusal. The only “grain of sand” which supported the edifice of the Claimants’ case was the discovery of the log-on on 19 January 2006 using the Rusal internet address. Once this grain of sand was removed, there was nothing left of it. The remainder of their case was anyway based on impermissible and unsupportable inference. Miss Dohmann also emphasised that there was no evidence that anything was ever viewed or downloaded, or that any spyware or other malign programmes installed. It was obvious that in the 6 seconds on 19 January 2006, during which access was gained to the Ashton server, nothing could have been downloaded. As a result of the steps taken by Mr Sinani and Mr Makarov to prevent further unauthorised access, the alleged “crime scene” had been trampled over and any relevant foot prints were no longer discernible. There was no evidence of what, if anything, had been downloaded or viewed on any other occasion of unauthorised access.

On this basis, Miss Dohmann submitted that the Claimants had failed to surmount the first hurdle – to establish that there was a serious case to be tried. In considering this submission, I will deal first with the case against Rusal and Rusal Management Company (the “Rusal Defendants”) as to which no distinction was drawn in argument, and then with the case against Mr Deripaska and Mr Bulygin.

Counsel disagreed as to the right test to apply. Miss Dohmann relied on what she called the gloss introduced by Waller LJ in Canada Trust Co. & ors v. Stolzenberg & ors (No. 2)[1998] 1 WLR 547. She submitted that the Claimants had to show that they had a much better argument on the material available. She founded this submission on the following passage in the judgment (at p.555 b-g):

Mr Brian Doctor QC responded that Lord Goff’s speech in Seaconsar Ltd. v. Bank Markazi Jomhouri Islami Iran [1994] 1 AC 438 remained the leading authority. He cited these passages at pp. 455F-456E and 456G-457B:

“… it is difficult to see why the fact that the writ is to be served out of the jurisdiction should have any particular impact upon the standard of proof required in respect of the existence of the cause of action. On this point, I find myself in respectful disagreement with the opinion expressed by Lloyd L.J. to the contrary in the Court of Appeal [1993] 1 Lloyd's Rep. 236, 242. I prefer the approach of Stuart-Smith L.J. when, at p. 248, he commended his preferred view as consonant with common sense and policy, and continued:

"It seems to me to be wholly inappropriate once the question[s] of jurisdiction and forum [conveniens] are established for there to be prolonged debate and consideration of the merits of the plaintiffs' claim at the interlocutory stage."

It has been suggested that, since both the assessment of the merits of the plaintiff's claim and the principle of forum conveniens fall to be considered as elements in the exercise of the court's discretion, these should be regarded as interrelated in the sense that "the more conspicuous the presence of one element the less insistent the demands of justice that the other should also be conspicuous:" see Societe Commerciale de Reassurance v. Eras International Ltd.(formerly Eras (U.K.) [1992] 1 Lloyd's Rep. 570, 588, per Mustill L.J. This approach originated in the speech of Lord Oaksey in Korner's case, at pp. 881-882, to the effect that the strength of the evidence in that case as to forum conveniens was such that only the slightest evidence was required of there having been a breach of contract within the jurisdiction. Lord Oaksey's speech also provided the inspiration for an expression of opinion by Parker L.J. to the effect that, if there is overwhelming evidence that England is the appropriate forum, it will be enough that, on the merits, the plaintiff's case is worthy of serious consideration: see Overseas Union Insurance Ltd. v. Incorporated General Insurance Ltd. [1992] 1 Lloyd's Rep. 439, 448, and see also. [1991] 2 Lloyd's Rep. 19, Banque Paribas v. Cargill International S.A 25. I must however express my respectful disagreement with this approach. Suppose that, for example, the plaintiff's case is very strong on the merits. If so, I cannot see that a case particularly strong on the merits can compensate for a weak case on forum conveniens. Likewise, in my opinion, a very strong connection with the English forum cannot justify a weak case on the merits, if a stronger case on the merits would otherwise be required. In truth, as I see it, the two elements are separate and distinct. The invocation of the principle of forum conveniens springs from the often expressed anxiety that great care should be taken in bringing before the English court a foreigner who owes no allegiance here. But if jurisdiction is established under rule 1(1), and it is also established that England is the forum conveniens, I can see no good reason why any particular degree of cogency should be required in relation to the merits of the plaintiff's case.

…

Once it is recognised that, so far as the merits of the plaintiff's claim are concerned, no more is required than that the evidence should disclose that there is a serious issue to be tried, it is difficult to see how this matter, although it falls within the ambit of the court's discretion, has not in practice to be established in any event. This is because it is very difficult to conceive how a judge could, in the proper exercise of his discretion, give leave where there was no serious issue to be tried. Accordingly, a judge faced with a question of leave to serve proceedings out of the jurisdiction under Order 11 will in practice have to consider both (1) whether jurisdiction has been sufficiently established, on the criterion of the good arguable case laid down in Korner’s case, under one of the paragraphs of rule 1(1), and (2) whether there is a serious issue to be tried, so as to enable him to exercise his discretion to grant leave, before he goes on to consider the exercise of that discretion, with particular reference to the issue of forum conveniens.

Waller LJ was not seeking to change the principles established in Seaconsar, nor could he. Properly interpreted, he was referring to the case where jurisdiction was founded on a disputed factor that only went to jurisdiction – eg the alleged domicile of the Defendant. In such cases, where the issue would never be argued again, there was much to be said for the proposition that a Claimant should have to establish that he had much the better of the argument.

This submission gained considerable support from the judgment of Rix LJ in Konkola Copper Mines v. Coromin Limited [2006] EWCA Civ 5; [2006] 1 Lloyd’s Reps 410, where he said:

After Mr Doctor had handed up his submissions on this part of the case, I gave Miss Dohmann the opportunity to respond in writing, but she did not avail herself of that opportunity.

In my judgment, Miss Dohmann’s arguments would require me to do exactly what Lord Goff warned against – to enter a prolonged consideration of whether the Claimants had a much better overall case than the Defendants. This would go to the heart of what the trial court will have to decide. I think the right question for me to ask is whether the Claimants have shown that there is a serious issue to be tried. In considering that question, I bear in mind that the Claimants are making extremely serious allegations against the Defendants, involving conduct which would be criminal under sections 1 and 2 of the Computer Misuse Act 1990, and which would constitute an outrageous attempt to gain access to privileged information held by the other party to litigation, and will have to produce commensurate proof.

I am satisfied that the Claimants have shown that there is a serious issue to be tried. They have done more than just scrape over the hurdle. Without (I hope) trespassing excessively on the merits of the case:

The position of Mr Deripaska and Mr Bulygin is very different. The Claimants’ pleaded case against them is as follows:

In evidence the Claimants added that Rusal is an unidentifiable and amorphous group which cannot be definitely identified. Its international trade was carried out by a complex, impregnable and impenetrable web of offshore entities, registered primarily in the BVI and other offshore jurisdictions such as Gibraltar and Cyprus.

The Claimants mounted a similar argument in the Part 20 proceedings (Footnote: ¹¹). Cresswell J. held (at §181) that Mr Deripaska and Mr Bulygin were not proper defendants. He considered that the case against them had not been properly particularised.

In my judgment, the case that the individual defendants were behind the hacking into Ashton’s server goes beyond what might be a legitimate inference and enters the realms of conjecture. Rusal is a very large group with thousands of employees which, on the evidence, is ultimately owned and controlled by Mr Deripaska and in which Mr Bulygin plays a very senior role. Even assuming that it is amorphous and operates through a number BVI companies – and I should note that it was a group with which Ansol was willing to do business on a large scale – and that these two individuals do take the major strategic decisions in the business, I do not think that it follows that it can be reasonably inferred that they were personally party to gaining improper access to the Ashton server. The Claimants have failed to establish on the evidence that they have a seriously arguable case against the individuals that they committed the substantive torts. I will revert to the additional question argued before me whether they can nevertheless be joined as necessary and proper parties to the action.

The Claimants submitted that they could establish the following causes of action against the Rusal Defendants:

On the basis of these causes of action, the Claimants asserted that they could justify service out of the jurisdiction on the Rusal Defendants through the following gateways of CPR Part 6.20:

Miss Dohmann challenged each of these propositions.

Miss Dohmann argued that the tort was committed in Russia. The issue was where the substance of the tort was committed – see the Privy Counsel’s Judgment in Distiller’s Co (Biochemicals) Ltd v. Thompson [1971] AC 458, 468:

“It is not the right approach to say that, because there was no complete tort until the damage occurred, therefore the cause of action arose wherever the damage happened to occur. The right approach is, when the tort is complete, to look back over the series of events constituting it and ask the question: where in substance did this cause of action arise?”

Here the substance of the acts occurred in Russia – that is where the intention was formed to gain unauthorised access, where the electronic installation of the software occurred and where the administrator’s username and password were improperly entered. Further the damage was caused where the confidential information was received. That is where the tort was complete.

Miss Dohmann also argued that no real damage was caused to the Claimants. The Particulars of Claim plead as follows:

The applicable legislation in Distillers was section 18(4) of the New South Wales Common Law Procedure Act 1899. The Court would have jurisdiction over the foreign Defendant if the cause of action arose within the jurisdiction. The test under CPR 6.20(8) is not the same. More relevant guidance was given by the Court of Appeal in Metall & Rostoff v. Donaldson Inc. [1990] 1 QB 391,437:

“As the rule (Footnote: ¹²) now stands it is plain that jurisdiction may be assumed only where (a) the claim is founded on a tort and either (b) the damage was sustained within the jurisdiction or (c) the damage resulted from an act committed within the jurisdiction. Condition (a) poses a question which we consider below: what law is to be applied in resolving whether the claim is "founded on a tort?" Condition (b) raises the question: what damage is referred to? It was argued for A.C.L.I. that since the draftsman had used the definite article and not simply referred to "damage," it is necessary that all the damage should have been sustained within the jurisdiction. No authority was cited to support the suggestion that this is the correct construction of the Convention to which the rule gives effect and it could lead to an absurd result if there were no one place in which all the plaintiff's damage had been suffered. The judge rejected this argument and so do we. It is enough if some significant damage has been sustained in England. Condition (c) prompts the inquiry: what if damage has resulted from acts committed partly within and partly without the jurisdiction? This will often be the case where a series of acts, regarded by English law as tortious, are committed in an international context. It would not, we think, make sense to require all the acts to have been committed within the jurisdiction, because again there might be no single jurisdiction where that would be so. But it would certainly contravene the spirit, and also we think the letter, of the rule if jurisdiction were assumed on the strength of some relatively minor or insignificant act having been committed here, perhaps fortuitously. In our view condition (c) requires the court to look at the tort alleged in a common sense way and ask whether damage has resulted from substantial and efficacious acts committed within the jurisdiction (whether or not other substantial and efficacious acts have been committed elsewhere): if the answer is yes, leave may (but of course need not) be given. But the defendants are, we think, right to insist that the acts to be considered must be those of the putative defendant, because the question at issue is whether the links between him and the English forum are such as to justify his being brought here to answer the plaintiffs’ claim.”

Ashton’s computer server was in London. That is where the confidential and privileged information was stored. The attack emanated from Russia but it was directed at the server in London and that is where the hacking occurred. In my view, significant damage occurred in England where the server was improperly accessed and the confidential and privileged information was viewed and downloaded. The fact that it was transmitted almost instantly to Russia does not mean that the damage occurred only in Russia. If a thief steals a confidential letter in London but does not read it until he is abroad, damage surely occurs in London. It should not make a difference that, in a digital age of almost instantaneous communication, the documents are stored in digital form rather than hard copy and information is transmitted electronically abroad where it is read. The removal took place in London. I also emphatically reject the proposition that the damages claimed are so trivial that the Court should decline to bother the Defendants with the claim. On the contrary, if the Claimants make good the pleaded allegations at trial, then I think this is a very serious and substantial case indeed, with considerable potential ramifications. The costs of replacing the computer and the investigation/consultancy costs may not be very great, but the Court will also have to consider what damages and other relief it should grant for the substantial injury caused – viz the improper obtaining of confidential and privileged information.

I also consider that substantial and efficacious acts occurred in London, as well as Russia. That is where the hacking occurred and access to the server was achieved. This may have been as a result of actions taken in Russia but they were designed to make things happen in London, and they did so. Effectively the safe was opened from afar so that its contents could be removed. It would be artificial to say that the acts occurred only in Russia. On the contrary, substantial and effective acts occurred in London.

So both limbs of CPR Part 6(20)(8) are satisfied.

The Claimants did not originally seek permission to serve out on these grounds, but Mr Connerty put forward these additional grounds as justification for service out in his 6^th witness statement. No application was issued prior to the hearing, but after considerable prodding from Miss Dohmann, Mr Doctor made an oral application in the course of the hearing to add these grounds. This is not a case where the Claimants are seeking to add a cause of action for which permission has not previously been obtained for service out: the breach of confidence claim was included as the first of the potential causes of action listed by Mr Connerty in paragraph 123 of his 3^rd witness statement. Rather, on the basis of facts set out in the original witness statements and in the pleadings, the Claimants are now saying that there are further gateways available under Part 6.20. I cannot see that any prejudice is caused to the Defendants and I give permission for the Claimants to rely on these grounds, subject to the appropriate application notice being issued. So I turn to the substance of these grounds.

CPR Part 6(20)(10) permits service out where “the whole subject-matter of a claim relates to property located within the jurisdiction”. Mr Doctor submitted that property was not confined to real property, but extended to personal property, intellectual property and confidential information. Here the property to which the claim related was the Ashton computer system and the confidential information contained thereon.

Support for this argument is given by In Re Banco Nacional de Cuba [2001] 1 WLR 2039, where Lightman J. said (at §33):

Miss Dohmann did not seek to challenge this argument. In my judgment, Part 6.20(10) extends to claims in respect of confidential information if it can be established that the information was really located in the jurisdiction. Information contained in digital form on a server in London satisfies this test.

Part 6.20(15) allows service out where the claim is made for restitution and the Defendant’s alleged liability arises out of acts committed within the jurisdiction. Mr Doctor cited Douglas & ors v. Hello! Limited [2003] EWCA 139 [2003] EMLR 585 at §§23-26 for the proposition that paragraph 15 has been successfully relied upon for service out of claims for equitable relief for breach of duty. That is a pretty frail foundation – the focus of the Court of Appeal was whether there was a sufficient case of tortious conduct to justify service out. It is far too sweeping an assertion that any claim for equitable relief in respect of a breach of confidence is a claim in restitution. Some may be, but each case needs to be looked at closely on its own facts. The Particulars of Claim includes a claim for an account of profits but that does not seem a very realistic remedy on the facts of this case – it seems improbable indeed that the Defendants will have sold any ill-gotten information. This case is not in substance a claim in restitution and I am not satisfied that Part 6.20(15) can be properly invoked.

Part 6.20(2) permits service out where a claim is made for an injunction ordering the Defendant to do or refrain from doing an act within the jurisdiction. In the Particulars of Claim, the Claimants seek a permanent injunction restraining the Defendants from using or disclosing any information unlawfully obtained and an order for delivery up of any documents containing such information. Rather oddly, no injunction is sought restraining the Defendants from interfering with the Ashton server, although undertakings were obtained in these terms.

The Claimants do not need to rely on Part 6.20(2) to obtain relief restraining use of information improperly obtained, or for delivery up. That relief can be granted (if appropriate) in connection with the claim for breach of confidence and, possibly, the claim for wrongful interference. The information is now presumably in Russia and any documents are likely to be there. I am not satisfied that the injunction would in substance be ordering the Defendant to do or refrain from doing an act in the jurisdiction.

By contrast, if a claim were added for an injunction restraining the Defendants from interfering with the server (as I anticipate it will be), that would be restraining the Defendants from doing an act in the jurisdiction. Miss Dohmann submitted that in order to rely on this as a ground for jurisdiction, the Claimants would have to show that there were real grounds on which to anticipate a repetition: Watson v. Daily Record Ltd [1907] 1 KB 853 where Cozens-Hardy LJ held, in the context of an unusual libel action:

“Now it seems plain that the Court has a discretion, and that a plaintiff cannot acquire a right to serve a defendant out of the jurisdiction by the mere fact that his writ claims an injunction. The Court must at least be satisfied that the claim for an injunction is made in good faith. This was decided by the Divisional Court in De Bernales v. New York Herald, where Lopes L.J. said: “I do not believe the claim for an injunction is made bona fide, but merely to bring the case within Order XI. There is no evidence of any apprehended repetition of the libel, and indeed, having regard to the circumstances, it is most improbable that it will be repeated. ... The giving leave to serve notice of writs out of the jurisdiction is a matter of judicial discretion.” It must not be inferred from the language used by Lopes L.J. in that case that want of good faith is a complete or exhaustive statement of the grounds for refusing to order service out of the jurisdiction. If the Court is satisfied that, even assuming the plaintiff to have a good cause of action, there is no reasonable probability that he will obtain an injunction, the Court ought not to consider the insertion of a claim for an injunction as sufficient to justify service on a person resident out of the jurisdiction. The Court is bound to consider all the circumstances disclosed by the affidavits, and to take care that a Scotchman, or it may be a foreigner, is not improperly made amenable to the orders of an English tribunal.”

Miss Dohmann submitted that there were no grounds to anticipate a repetition and, anyway, now that Ashton had taken steps to improve the security of its server, there was no need for an injunction.

If the Claimants succeed in making good the allegations they have pleaded, I think it is quite likely that the Court would grant a permanent injunction: what will have been established is a persistent campaign on the part of Rusal to gain access to the Ashton server by use of secret passwords. The Court might take some considerable persuasion that there was no risk in the future. It is not necessarily a complete answer to such an injunction that the Claimant now has improved its security. So that sort of injunction would in my view come within Part 6.20(2), although the remedy would be available without need to rely on this ground on the basis of the torts alleged.

Mr Doctor submitted that, even if there was no sufficient case against Mr Deripaska and Mr Bulygin (as I have held), nevertheless they should be joined under Part 6.20(3) on the basis that they were necessary or proper parties, because they were the only persons with the authority and position to give instructions to the whole of Rusal. The injunction would be much more effective if it enjoined them as well.

In my view that does not make Mr Deripaska and Mr Bulygun necessary or proper parties. They have not been shown to be arguably liable to the Claimants: cf. Unilever Plc v. Chefaro Proprietaries Ltd. [1994] FSR 135, 139. If the Claimants wish to bring home to them their potential liabilities should an injunction be disobeyed, this can be achieved by serving on them a copy of any order with an appropriately drawn penal notice: see White Book (2006) sc45.7.6. at p. 1974.

Finally, Miss Dohmann submitted that the Claimants had failed to demonstrate that England was clearly the appropriate forum. She reminded me of the well known principles in Spiliada Maritime Corp v. Consulex Ltd [1987] AC 460. The Court should first consider the natural forum for the trial of the action – the country with which the action has the most real and substantial connection. Factors to be taken into account included convenience, expense and the proper law applicable to the dispute. Where another forum appeared to be as suitable or more suitable than England, then the Court should refuse permission, unless there were exceptional circumstances.

She submitted that in this case:

In response, Mr Doctor contended:

I think the first question is whether Russia is an alternative forum for the resolution of this dispute. Expert Russian legal evidence was given on behalf of the Defendants by Colonel Anatoly Osipenko, Head of Department of the Omsk Academy of the Internal Affairs of the Russian Federation, and Gainan Avilov, Deputy Chairman of the Council of the Private Law Research Centre in Moscow. In response, evidence was filed by Professor William Elliott Butler, the John Fowler Distinguished Professor of Law at the Dickinson School of Law at Pennsylvania State University and Emeritus Professor of Comparative Law at London University. He has specialised in the legal systems of the former Soviet Union, including the Russian Federation. These witnesses were well qualified to assist the Court.

Colonel Osipenko explained that the acts complained of could give rise to criminal liability under Articles 183, 272 and 273 of the Russian Criminal Code. A civil claim could also be made under Article 3 of the Federal Law on Commercial Secrets of 29 July 2004 No. 98-Φ3. In cases where a civil action was based on facts which could also give rise to criminal proceedings, normally a civil action would be brought within the criminal proceedings. This would have the advantage that the burden of proof was on the State. Separate civil proceedings could however be brought without commencing criminal proceedings. They could however be stayed under Article 215 of the Russian Civil Procedure Code if it were not possible to resolve the case before the conclusion of criminal proceedings.

Mr Avilov considered that a civil cause of action could be brought under Article 1064 of the Civil Code which sets out general grounds for liability for causing harm to arise as a result of unlawful conduct and fault on the part of the wrongdoer. A claim might also be possible under the Law on Commercial Secrets but that rather depended on whether the information stored on the computer had been protected in accordance with the statutory regime for a commercial secret. He confirmed the possibility of criminal proceedings and a stay. He emphasised the advantages gained by having a law enforcement body collect the evidence – they had considerably more authority.

Professor Butler largely concurred but he thought that criminal proceedings were rather unlikely. There were, in his view, real difficulties in pursuing civil proceedings, arising from the legal status of information, whether held on computer or otherwise, in Russian law. It was controversial whether you could “steal” information as opposed to the carrier – the paper on which it is written or the disc on which it is stored. That is why the Russian legislators introduced the Law on Commercial Secrets, but it is a cumbersome, complicated and often unrealistic regime.

In my view, it would be possible for the Claimants to bring civil proceedings in Russia against the Rusal Defendants, but those proceedings would not be without considerable difficulty due to the state of Russian law on the legal status of information and the technicalities of the Law on Commercial Secrets.

Given the availability of an alternative jurisdiction, have the Claimants clearly established that England is the proper place to bring the claim (CPR 6.21(2A)), that is that it is clearly the appropriate forum where the case can most suitably be tried for the interests of all the parties and the ends of justice? In my judgment, they have for the following reasons:

For these reasons in my judgment the forum conveniens for this litigation is clearly in London.

In the light of all these considerations, and also drawing back to consider the justice of the position overall, I am satisfied that, as a matter of discretion, this case against the Rusal Defendants ought to proceed in this Court.

I will set aside the proceedings against Mr Deripaska and Mr Bulygin. Of course, if evidence were to arise on disclosure which implicated them personally, an application could be made to re-join them to the action.

The proceedings against the Rusal Defendants will continue. However, the claim in conspiracy must be re-pleaded if it is to be maintained. I will reconsider it if that occurs. Otherwise, I will set aside that claim.

I will hear counsel on costs and on whether any further directions should be made at this stage.