[PUBLISH]

In the

United States Court of Appeals

For the Eleventh Circuit

____________________

No. 21-14051

____________________

SKYHOP TECHNOLOGIES, INC., 

a Delaware corporation, 

SKYHOP GLOBAL, LLC, 

a Florida limited liability company, 

KRISTINE SCOTTO, 

an Individual, 

Plaintiffs-Appellants,

versus

PRAVEEN NARRA, 

an Individual, 

INDYZEN, INC., 

a California corporation d.b.a. AppDevelopment.com, Inc. 

d.b.a. Tech.US, Inc, 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 1 of 32
2 Opinion of the Court 21-14051

Defendants-Appellees.

____________________

Appeal from the United States District Court

for the Southern District of Florida

D.C. Docket No. 0:21-cv-60799-AHS

____________________

Before WILLIAM PRYOR, Chief Judge, ROSENBAUM, and MARCUS, 

Circuit Judges.

ROSENBAUM, Circuit Judge:

Nobody enjoys flight delays. They are disruptive for airlines, passengers, and crew members alike. And any number of 

things can cause them: to name just a few, severe weather, faulty 

equipment, or the unavailability of pilots and crew members.

Plaintiffs-Appellants SkyHop Global, LLC, SkyHop Technologies, Inc., and Kristine Scotto (collectively, “SkyHop”) and Defendants-Appellees Praveen Narra and his company Indyzen, Inc.

(collectively, “Indyzen” (unless otherwise indicated)) have taken 

aim at that last problem source: the unavailability of pilots and 

crew members. Together, they have developed and deployed digital software aimed at transporting crew members to and from airports across the country. And business has taken off. SkyHop has 

about eighty contracts with fifteen airlines, including major carriers 

like Delta, American, and United.

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 2 of 32
21-14051 Opinion of the Court 3

But now SkyHop and Indyzen dispute who owns the digital 

software. And beyond that, they disagree on where their dispute

should be decided. Indyzen has filed an arbitration action in California (where it is based), alleging various forms of breach of contract and other promises. Meanwhile, SkyHop has filed this federal 

lawsuit in Florida (where it is based), alleging that Indyzen violated 

the federal Computer Fraud and Abuse Act (“CFAA”) and the Florida Computer Abuse and Data Recovery Act (“CADRA”).

In response, Indyzen sought to dismiss this action for lack of 

personal jurisdiction. It argued that the exercise of personal jurisdiction over it in Florida satisfied neither the Florida long-arm statute nor the Due Process Clause of the Fourteenth Amendment. 

The district court agreed and entered an order dismissing SkyHop’s 

complaint.

We see things differently. The allegations in SkyHop’s complaint, which we must accept as true on a motion to dismiss, suggest that SkyHop is the rightful owner of the digital software. And

because Indyzen has refused to relinquish possession of the digital 

software without additional payment, SkyHop’s complaint states a 

cause of action under the CFAA. The complaint therefore satisfies 

the Florida long-arm statute. And it also meets the requirements 

of the Due Process Clause because the emails that Indyzen sent 

into Florida triggered SkyHop’s claims. So after careful review, and 

with the benefit of oral argument, we reverse the district court’s 

order and remand for further proceedings. 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 3 of 32
4 Opinion of the Court 21-14051

I. Background1 

SkyHop Global, LLC, primarily offers a service to airlines: it

provides ground transportation for flight crews to and from airports across the nation. To do this, SkyHop uses proprietary digital 

software, including a web-based program called SkyPlan and two 

mobile applications, SkyHop Crew and SkyHop Driver (collectively, the “Software”).

SkyPlan uses flight manifests and real-time data to create 

schedules to pick up and drop off flight-crew members. Meanwhile, the mobile apps communicate and coordinate between 

flight crews and drivers on the ground. According to the First 

Amended Complaint, the operative complaint here, SkyHop Technologies, Inc. (“SkyHop Tech”), owns all this technology, and it licenses it to SkyHop Global. In turn, SkyHop Global has contracts 

with fifteen airlines and operates in twenty-one cities in eleven 

states. Both SkyHop Tech and SkyHop Global operate from their 

headquarters in Broward County, Florida.

Two password-protected cloud servers that are hosted by 

Amazon Web Services (“AWS”) and physically located in Virginia

house the SkyPlan program. One AWS account hasthe production 

server and SkyPlan’s operational version, while the other account 

1 Because this case arrives here after the district court granted a motion to 

dismiss, for purposes of our analysis, we accept as true the factual allegations 

in the complaint. Silberman v. Miami Dade Transit, 927 F.3d 1123, 1128 (11th 

Cir. 2019). The actual facts may or may not be as alleged.

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 4 of 32
21-14051 Opinion of the Court 5

contains the staging server and its testing version. SkyHop Tech 

pays for both accounts. 

Of course, the Software did not always exist. Rather, the 

process to develop it began in June 2014. Plaintiff Kristine Scotto—

a Florida resident and one of SkyHop’s founders—met with developers to discuss the development of what would become the Software. One of these developers was Defendant Praveen Narra. 

Narra resides in California and traveled to Fort Lauderdale, Florida,

in 2014 to meet with Scotto. Scotto and her then-business partner 

reached an understanding with Narra that each of the three would

own 32% of a newly formed entity that would become SkyHop 

Tech, with a fourth partner owning the remaining 4%. 

After bringing Narra on board, SkyHop Tech contracted 

with Narra’s California-based development company, Indyzen,

Inc.—which does business under the name Tech.US—to develop 

and maintain the Software. That partnership has lasted for a few

years. Since 2014, SkyHop Tech and Indyzen have signed several 

software-development and maintenance contracts for the ongoing 

services that Indyzen has provided. And in total, Narra has made 

three separate trips to Florida (in 2014, 2016, and 2018) to meet 

with Scotto about the relationship between the companies. All 

told, SkyHop Tech has paid Indyzen roughly $2.6 million—the full 

amount it owes under the agreements between the companies—

for the development and maintenance of the Software. 

As the party who developed and maintains the Software, Indyzen possesses what SkyHop Tech calls SkyHop’s Digital 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 5 of 32
6 Opinion of the Court 21-14051

Property: the source code for SkyHop’s mobile apps, the outside 

vendor accounts those apps use to function (including the AWS accounts), the application programming interfaces for the apps, the 

relevant domain names, DNS service,2 signing keys, and all corresponding passwords required to operate, develop, and maintain the 

Software.3 One of the relevant AWS accounts is in Narra’s name 

while the other is in Indyzen’s name (in its own right), and both 

accounts use Narra’s personal residence as the account address. 

Around the time Narra joined the venture and the parties 

sought to incorporate SkyHop Tech, the relationship between 

Scotto and her then-business partner began to break down, resulting in a lawsuit filed in January 2015. While Narra was never a 

party to that lawsuit, he twice represented during the course of

those proceedings that he relinquished any ownership interest he 

had in SkyHop Tech. The parties based their settlement agreement 

resolving that dispute—five years later, in March 2020—on Narra’s 

relinquishment of the ownership interest. 

2 “DNS” means the “Domain Name System.” Register.com, Inc. v. Verio, Inc., 

356 F.3d 393, 409–18 (2d Cir. 2004) (providing background on how the DNS 

works). “A DNS service . . . is a globally distributed service that translates human readable names like www.example.com into the numeric IP addresses 

like 192.0.2.1 that computers use to connect to each other.” Amazon Web 

Services, What is DNS?, https://aws.amazon.com/route53/what-is-dns (last 

accessed Jan. 24, 2023).

3 Because the parties have incorporated the meaning of the term Digital Property into the meaning of the term Software, we will too. 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 6 of 32
21-14051 Opinion of the Court 7

A few months later, on January 9, 2021, Scotto, in her role

as the chief executive officer of SkyHop Global and President of 

SkyHop Tech, informed Narra that SkyHop Tech planned to hire 

in-house developers to take over development and maintenance of 

the Software. As a result, Scotto explained, SkyHop Tech planned 

to terminate its relationship with Indyzen. 

Two days later, Narra responded by email that he would 

“turn over all the source code and intellectual property developed 

for SkyHop Tech[]” in exchange for slightly over $1.1 million. In 

reply, SkyHop Tech counteroffered $75,000 for three months of 

support and consulting. Indyzen did not accept. Instead,

Tech.US’s chief revenue officer, Rob Milks, emailed Scotto and reiterated Narra’s offer to turn over the Software for roughly $1.1 

million. A few days later, Narra sent another email to say that, if 

the parties could not reach a financial agreement, Scotto should 

transfer a 32% stake in SkyHop Tech to Narra individually. 

On February 9, SkyHop Tech, through its counsel, sent a 

demand letter to Narra. In that letter, SkyHop Tech asserted that 

Indyzen lacked any property right in the Software and that Indyzen’s refusal to transfer was “inconsistent with SkyHop Tech’s 

ownership rights in its Property.” The letter “demand[ed] that by 

March 1, 2021, Indyzen transfer possession of SkyHop’s Property 

to SkyHop Tech.” That did not occur.

Rather, on March 12, in San Jose, California, Indyzen (in its 

own right) filed a Demand for Arbitration against SkyHop Global, 

SkyHop Tech, and Scotto with the American Arbitration 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 7 of 32
8 Opinion of the Court 21-14051

Association. A few months later, Indyzen filed an Amended Demand listing Narra as an additional claimant. 

SkyHop responded by suing Indyzen in the Southern District of Florida. SkyHop raised six causes of action, including three 

claims under the CFAA, 18 U.S.C. § 1030; one claim under the Florida CADRA, Fla. Stat. § 668.803; and two claims seeking a declaratory judgment concerning the arbitrability of the dispute. 

Indyzen moved to dismiss for lack of personal jurisdiction 

and, in the alternative, for improper venue.4 In support of the motion, Indyzen included Narra’s affidavit, which asserted additional 

facts relevant to the jurisdiction inquiry. In the motion, Indyzen 

argued that personal jurisdiction was improper in Florida because 

the Florida long-arm statute was not satisfied and the exercise of 

jurisdiction did not comport with the Due Process Clause. Indyzen

also contended that a valid and applicable forum-selection clause in 

the contracts required any litigation between the parties to be 

brought in Santa Clara County, California.

SkyHop opposed Indyzen’s motion seeking dismissal. In 

support of its position, SkyHop argued Florida’s long-arm statute 

supported jurisdiction because, in relevant part, Narra claimed an 

ownership interest in a Florida-based company and Indyzen committed a tortious act in Florida. SkyHop also asserted that Indyzen

4 Indyzen moved once before to dismiss for lack of personal jurisdiction or 

improper venue, but SkyHop filed an amended complaint in response.

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 8 of 32
21-14051 Opinion of the Court 9

had sufficient contacts with Florida to justify the exercise of jurisdiction under the Due Process Clause. As to the forum-selection 

clauses, SkyHop rejected their applicability because, SkyHop asserted, its claims did not arise from or relate to the contracts that

contain the forum-selection clauses.

The district court granted Indyzen’s motion to dismiss for 

lack of personal jurisdiction. The district court concluded that the 

Florida long-arm statute was not satisfied because Indyzen is not 

conducting a business in Florida, and Narra’s purported ownership 

interest in SkyHop Tech is insufficient for jurisdiction. Nor did Indyzen commit a tortious act in Florida, the district court found, because, in its view, the allegations in the complaint failed to state a 

claim for relief under the CFAA or CADRA. Finally, the district 

court held that due process is not satisfied because SkyHop didn’t 

establish that its claims “‘arise out of or relate to’ at least one of 

[Indyzen’s] contacts in Florida.” (Citation omitted.) Because the 

district court granted the motion to dismiss for lack of personal jurisdiction, it did not reach Indyzen’s alternative argument that the 

forum-selection clauses rendered venue improper. 

SkyHop timely appealed the district court’s order dismissing 

the case for lack of personal jurisdiction.

Before wheels up on our legal flight, we must make one last 

announcement important to understanding the issues here: as this 

litigation has progressed, Indyzen has retained possession and control of the relevant passwords and digital property. While SkyHop 

Tech can operate the Software, it cannot develop or maintain the 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 9 of 32
10 Opinion of the Court 21-14051

Software itself. Nor can it reproduce the Software or prepare derivatives of it. SkyHop Tech has also continued to pay Indyzen 

monthly to ensure against outage or interruption in the availability 

of the Software. 

II. Standard of Review 

We review de novo the dismissal for lack of personal jurisdiction, accepting the allegations in the complaint as true. Don’t 

Look Media LLC v. Fly Victor Ltd., 999 F.3d 1284, 1292 (11th Cir. 

2021). When a defendant submits an affidavit contesting the basis 

for personal jurisdiction, “the burden shifts back to the plaintiff to 

produce evidence to support personal jurisdiction.” Id. “[W]here 

the plaintiff’s complaint and the defendant’s affidavits conflict, the 

district court must construe all reasonable inferences in favor of the 

plaintiff.” Madara v. Hall, 916 F.2d 1510, 1514 (11th Cir. 1990).

Because part of the analysis Florida’s long-arm statute requires us to consider includes whether SkyHop’s complaint states 

a cause of action, we also review de novo the district court’s conclusions on that score. See United Techs. Corp. v. Mazer, 556 F.3d 

1260, 1274–75 (11th Cir. 2009). In so doing, we treat exhibits attached to a complaint as part of the complaint. Crowder v. Delta 

Air Lines, Inc., 963 F.3d 1197, 1202 (11th Cir. 2020).

III. Discussion 

This appeal presents a dispute about personal jurisdiction. 

“Federal courts ordinarily follow state law in determining the 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 10 of 32
21-14051 Opinion of the Court 11

bounds of their jurisdiction over persons.” Daimler AG v. Bauman, 

571 U.S. 117, 125 (2014). We do so “because a federal district 

court’s authority to assert personal jurisdiction in most cases is 

linked to service of process on a defendant ‘who is subject to the 

jurisdiction of a court of general jurisdiction in the state where the 

district court is located.’” Walden v. Fiore, 571 U.S. 277, 283 (2014) 

(quoting Fed. R. Civ. P. 4(k)(1)(A)).

So we have two stops on our personal-jurisdiction itinerary. 

First, we must “determine whether the Florida long-arm statute 

provides a basis for personal jurisdiction.” Sculptchair, Inc. v. Century Arts, Ltd., 94 F.3d 623, 626 (11th Cir. 1996). If it does, we then 

examine “whether the exercise of personal jurisdiction over the defendant would violate the Due Process Clause of the Fourteenth 

Amendment to the United States Constitution, which requires that 

the defendant have minimum contacts with the forum state and 

that the exercise of jurisdiction over the defendant does not offend 

‘traditional notions of fair play and substantial justice.’” Mut. Serv. 

Ins. Co. v. Frit Indus., Inc., 358 F.3d 1312, 1319 (11th Cir. 2004) 

(quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)).

Our opinion follows that structure. In Part A, we consider 

whether the Florida long-arm statute provides a basis for personal 

jurisdiction. Part A has two subparts—whether SkyHop alleged a 

tortious act in Florida and whether the cause of action has “connexity” with the alleged tort that occurred in Florida.

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 11 of 32
12 Opinion of the Court 21-14051

And in Part B, we evaluate whether exercising jurisdiction 

in this case satisfies the Due Process Clause’s minimum-contacts 

and fair-play requirements. 

A. The Florida long-arm statute supports the exercise of 

personal jurisdiction over Indyzen. 

Florida’s long-arm statute subjects to the jurisdiction of Florida state courts anyone “who personally or through an agent” engages in any of nine enumerated acts, as long as the cause of action 

arises from that act. Fla. Stat. § 48.193(1)(a). Because the construction and interpretation of the Florida long-arm statute raises questions of Florida law, we must construe the long-arm statute as 

would the Florida Supreme Court. United Techs., 556 F.3d at 1274.

On appeal, SkyHop argues that its allegations satisfy Florida’s long-arm statute for two independent reasons. More specifically, in SkyHop’s view, Indyzen has engaged in two of the nine 

acts Florida’s statute identifies as submitting to personal jurisdiction in Florida. First, SkyHop contends that Indyzen has “[o]perat[ed], conduct[ed], engag[ed] in, or carr[ied] on a business or business venture” in Florida. See Brief for Appellant at 19 (quoting Fla. 

Stat. § 48.193(1)(a)(1)). Second, it asserts that Indyzen has “[c]ommitt[ed] a tortious act” in Florida. Id. (quoting Fla. Stat. 

§ 48.193(1)(a)(2)). SkyHop need establish only one of these acts to 

satisfy the long-arm statute. Because we conclude that SkyHop sufficiently alleged that Indyzen committed a tortious act in Florida, 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 12 of 32
21-14051 Opinion of the Court 13

we need not (and therefore do not) consider whether it also engaged in a business or business venture in Florida.

We analyze whether SkyHop alleged a tortious act sufficient 

to bring its complaint within Florida’s long-arm statute in two subparts. First, we explain why SkyHop’s complaint sufficiently alleges that Indyzen committed a tortious act in Florida. See Fla. 

Stat. § 48.193(1)(a)(2). Second, we show why the tortious acts 

SkyHop alleged satisfy the Florida statute’s “connexity” requirement—that is, its requirement that at least one of SkyHop’s claims 

arises out of the act or acts that qualify for personal jurisdiction under the long-arm statute. Wendt v. Horowitz, 822 So. 2d 1252, 

1260 (Fla. 2002) (citing Fla. Stat. § 48.193(1)).

1. Because the complaint states a cause of action under 18 

U.S.C. § 1030(a)(7)(A), SkyHop has alleged that Indyzen

committed a tortious act within Florida.

We start by considering whether Indyzen “[c]ommitt[ed] a 

tortious act within” Florida. Fla. Stat. § 48.193(1)(a)(2). SkyHop argues that Indyzen’s emails refusing to transmit the Software unless 

SkyHop paid $1.1 million amounted to a tortious act in Florida. 

We agree.

To determine whether SkyHop alleged a tortious act, we 

must determine whether it stated a claim for its tortious act. 

Wendt, 822 So. 2d at 1260. The Florida Supreme Court has held 

that “a defendant’s physical presence is not required” to “commit a 

tortious act in Florida.” Id. (citation and internal quotation marks 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 13 of 32
14 Opinion of the Court 21-14051

omitted). Indeed, a tortious act “can occur through the nonresident defendant’s telephonic, electronic, or written communications into Florida.” Id. But as the Florida Supreme Court has explained, when a plaintiff attempts to use communications as the 

basis of a tortious act, “[t]he threshold question that must be determined is whether the allegations of the complaint state a cause of 

action.” Id. So we must consider whether the complaint states a 

claim under the CFAA or Florida’s CADRA.5 

We begin (and as it turns out, end) with SkyHop’s first 

CFAA claim. SkyHop contends that Indyzen’s emails amount to 

extortion and impede SkyHop’s access to its digital property in violation of 18 U.S.C. § 1030(a)(7)(A). That section imposes liability 

on anyone who “with intent to extort from any person any money 

or other thing of value, transmits in interstate or foreign commerce 

any communication containing any— (A) threat to cause damage 

5 When interpreting this provision, the Florida Supreme Court has recognized, “Broadly speaking, a tort is a civil wrong, other than a breach of contract, for which the court will provide a remedy in the form of an action for 

damages.” Execu-Tech Bus. Sys., Inc. v. New Oji Paper Co., 752 So. 2d 582, 

585 n.8 (Fla. 2000) (quoting Prosser and Keeton on the Law of Torts 2 (W. 

Page Keeton ed., 5th ed. 1984)). Because a CFAA violation entitles victims to 

compensation based on principles similar to those of tort law, a CFAA violation is analogous to the commission of a tort. See Van Buren v. United States, 

141 S. Ct. 1648, 1652 (2021) (explaining CFAA was enacted, in part, because 

“traditional theft and trespass statutes were ill suited to address cybercrimes 

that did not deprive computer owners of property in the traditional sense”); 

18 U.S.C. § 1030(g) (creating a private cause of action for victims of CFAA violations).

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 14 of 32
21-14051 Opinion of the Court 15

to a protected computer.” 18 U.S.C. § 1030(a)(7)(A). The elements 

of a CFAA claim under § 1030(a)(7)(A) are therefore the following: 

(1) with the intent to extort from any person any money (or thing 

of value), (2) transmitting in interstate or foreign commerce any 

communication containing (3) a threat to cause damage to a protected computer.

Our Circuit has not yet had an opportunity to discuss the 

scope of § 1030(a)(7)(A). Here, the dispute under it centers on element (3)—in particular, whether SkyHop has sufficiently alleged 

that Indyzen’s emails constitute “threat[s]” and, if so, whether 

those threats were threats to cause “damage.” We’ll address those 

terms in turn.

a. SkyHop sufficiently alleges that Indyzen made threats.

To determine whether the emails could rise to the level of 

being a “threat,” we begin, as we always do, with the statutory text. 

See United States v. Henco Holding Corp., 985 F.3d 1290, 1297 

(11th Cir. 2021). The CFAA does not define “threat.” So we interpret that term using its “ordinary meaning at the time Congress 

enacted the statute.” New Prime, Inc. v. Oliveira, 139 S. Ct. 532, 

539 (2019) (alterations adopted) (citation omitted). 

The CFAA was initially enacted in 1986. See Pub. L. No. 99-

474, 100 Stat. 1213 (1986). Ten years later, Congress amended the 

CFAA to add the term “threat” as part of the Economic Espionage 

Act of 1996. See Pub. L. No. 104-294, § 201, 110 Stat. 3488, 3492

(1996). Contemporary dictionaries defined a “threat” as “[a] 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 15 of 32
16 Opinion of the Court 21-14051

communicated intent to inflict physical or other harm on any person or on property.” Black’s Law Dictionary (6th ed. 1990); see also

Webster’s Collegiate Dictionary (10th ed. 1993) (defining “threat” 

as “an expression of intention to inflict evil, injury, or damage”); 

Oxford English Dictionary (2d ed. 1989) (defining “threat” as “a 

declaration of hostile determination or of loss, pain, punishment, 

or damage to be inflicted in retribution for or conditionally upon 

some course; a menace”).

The Supreme Court’s discussion of the meaning of “threat” 

in United States v. Taylor, a case about a different criminal statute 

(the Armed Career Criminal Act), supports this definition. 142 S. 

Ct. 2015, 2020 (2022) (discussing 18 U.S.C. § 924(c)(3)(A)). In Taylor, the Court surveyed definitions of the term “threat” and concluded the term had the same meaning we use today. As the Court

explained, “in the criminal law the word ‘threat’ and its cognates 

usually denote ‘a communicated intent to inflict physical or other 

harm on any person or on property.’” Id. at 2022 & n.2 (citation 

omitted). And the CFAA is in part a criminal statute and is codified 

in the criminal-law title, Title 18. See 18 U.S.C. § 1030(a)(7)(A).

When we apply this definition, we think that, viewed in the 

light most favorable to SkyHop, Indyzen’s emails could constitute 

threats under the CFAA. The emails stated that Indyzen would

“turn over all the source code and intellectual property developed 

for [SkyHop Tech]” only if SkyHop Tech tendered payment of $1.1 

million. Without that payment, Indyzen would not provide the 

passwords or other electronic property. And based on the 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 16 of 32
21-14051 Opinion of the Court 17

allegations in the complaint, SkyHop owned these digital materials 

that Indyzen asserted it would withhold unless and until it received 

additional payment. 

Put another way, SkyHop has alleged that (1) Indyzen possesses SkyHop’s intellectual property, (2) SkyHop asked Indyzen to 

return its property, and (3) Indyzen said it would not do so unless 

SkyHop paid $1.1 million. We think SkyHop has plausibly alleged

that these emails communicate an intent to inflict harm on 

SkyHop’s property and therefore can be considered “threats” under the CFAA. 

To be sure, a fact-finder may ultimately determine that Indyzen did not intend to cause harm or that Indyzen was, in fact,

entitled to the $1.1 million or the 32% stake in SkyHop Tech that 

Narra sought. Or the fact-finder may conclude that Indyzen intended its emails as negotiations rather than threats. That determination may turn on whether Indyzen has a legitimate claim to 

the property. Cf. Crawford’s Auto Ctr., Inc. v. State Farm Mut. 

Auto. Ins. Co., 945 F.3d 1150, 1160 (11th Cir. 2019) (citing Levitt v. 

Yelp! Inc., 765 F.3d 1123, 1130 (9th Cir. 2014)) (explaining the “wellestablished principle” that “[t]hreats of economic harm made to obtain property from another are not generally considered wrongful 

where the alleged extortioner has a legitimate claim to the property 

obtained through such threats”). But at this early stage, we assess 

only whether SkyHop has sufficiently alleged that Indyzen’s emails 

were “threats” within the meaning of the CFAA. SkyHop has 

cleared that bar.

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 17 of 32
18 Opinion of the Court 21-14051

b. SkyHop sufficiently alleges that Indyzen caused damage.

Next, we turn to the term “damage.” But this time, Congress has expressly defined the term: “damage” means “any impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). That definition 

doesn’t tell the full story, though, because the statute does not define three key terms—“impairment,” “integrity,” or “availability.” 

So we once again consult the ordinary meaning of those words to 

determine what Congress meant. 

An “impairment” is a “deterioration” or an “injurious lessening or weakening.” Oxford English Dictionary (2d ed. 1989). 

“Integrity” means an “unimpaired or uncorrupted condition,” an 

“original perfect state,” or “soundness.” Id. And “availability” 

means the “capability of being employed or made use of.” Id. Putting it all together, we conclude that a transmission that does “damage” is one that weakens the condition of a computer system or 

program, or one that diminishes a plaintiff’s ability to use that system or any associated data. See Pulte Homes, Inc. v. Laborers’ Int’l 

Union of N. Am., 648 F.3d 295, 301 (6th Cir. 2011).

Here, the relevant question is whether Indyzen’s withholding of the passwords and SkyHop’s other digital property diminished SkyHop’s ability to use its computer system or the associated 

data. We conclude it did. SkyHop alleged that it owns the Software, including the relevant passwords, and that it pays for the 

AWS accounts that house the SkyPlan. SkyHop further averred

that it seeks to access its Software so it can make desired changes 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 18 of 32
21-14051 Opinion of the Court 19

and updates to the programs with its in-house team rather than 

funnel all its requests through Indyzen (in its own right). SkyHop 

cannot assume control of the Software only because of Indyzen’s 

decision to withhold the passwords and account information until 

SkyHop pays another $1.1 million or transfers a 32% equity stake 

to Narra. Since SkyHop cannot access and independently modify

its Software without the passwords, Indyzen’s refusal to provide 

those passwords “impair[s]” the “availability” of the Software and 

therefore causes “damage.”

Our holding aligns with those of other circuits in cases raising similar issues. For instance, the Seventh Circuit, after a defendant reset the victim’s password and prevented the victim from accessing his computer system, affirmed the conviction because “a 

reasonable jury could find that [the defendant’s] actions ‘impaired 

the availability of the system’ by temporarily diminishing its readiness for [the victim’s] immediate use.” United States v. Soybel, 13

F.4th 584, 595 (7th Cir. 2021) (quoting 18 U.S.C. § 1030(e)(8)) (alterations adopted). And after a defendant changed a plaintiff’s social-media passwords and locked her out of her accounts, the Second Circuit suggested that the plaintiff had a CFAA claim at the 

time she “discovered that someone had impaired the integrity of 

each of her relevant Internet accounts.” Sewell v. Bernardin, 795 

F.3d 337, 340 (2d Cir. 2015).

Indyzen argues, without any authority, that no “damage” 

occurred here because the Software has continued to function in 

an uninterrupted manner. But SkyHop alleged (and Indyzen

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 19 of 32
20 Opinion of the Court 21-14051

acknowledged at oral argument, Oral Arg. 22:50-24:26) that 

SkyHop cannot access the Software itself. Rather, it must continue 

to pay Indyzen and rely on its benevolence to keep the Software 

operational, even though SkyHop desires to move its Software development and maintenance in-house. SkyHop’s inability to access 

its own Software renders its Software unavailable to it—even if the 

technology continues to function, and SkyHop’s customers continue to receive SkyHop’s services.

c. SkyHop sufficiently alleges the remaining statutory terms.

The parties squarely dispute only the meanings of 

“threat[s]” and “damage” under § 1030(a)(7)(A). But because

SkyHop must sufficiently allege a cause of action to satisfy personal 

jurisdiction here, we must still verify that SkyHop’s allegations satisfy the remaining statutory terms and elements. Namely, SkyHop

must have sufficiently alleged that Indyzen (1) acted “with intent 

to extort” money or another thing of value; (2) transmitted a communication in interstate or foreign commerce; and (3) made alleged threats that would have damaged “a protected computer.”

First, SkyHop has sufficiently alleged that Indyzen acted 

“with intent to extort from any person any money or other thing 

of value.” 18 U.S.C. § 1030(a)(7). While the CFAA does not define 

“extort,” the plain meaning of the term is “[t]o gain by wrongful 

methods” or “to obtain in an unlawful manner, as to compel payments by means of threats of injury to person, property, or reputation.” Black’s Law Dictionary (6th ed. 1990). Here, the complaint 

alleges that Indyzen seeks to obtain $1.1 million or 32% of SkyHop 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 20 of 32
21-14051 Opinion of the Court 21

Tech through wrongful methods—withholding SkyHop’s digital 

property until it meets their demands.

While Indyzen does not dispute the meaning of “extort,” it 

suggests that we should infer the “obvious alternative explanation[]” for its emails: that this is simply an ownership dispute rather 

than an extortion attempt. And that may turn out to be true. But 

at this stage, we must make all factual inferences in SkyHop’sfavor, 

and given the allegations, this inference does not strike us as so obvious that we should adopt it here. SkyHop has alleged that it owns 

the Software, and we must accept that allegation as true. 

Second, Indyzen’s emails clearly constitute communications. See Missouri v. McNeely, 569 U.S. 141, 154 (2013) (describing emails as a type of “electronic communication”). And the complaint easily satisfies the interstate-commerce requirement here:

Indyzen transmitted the emails from California to Florida over the 

internet. See United States v. Hornaday, 392 F.3d 1306, 1311 (11th 

Cir. 2004) (“The internet is an instrumentality of interstate commerce.”).

Third, the “threat to cause damage” must be to a “protected 

computer.” As relevant here, the CFAA defines “computer” as “an 

electronic . . . or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data 

storage facility or communications facility directly related to or operating in conjunction with such device.” 18 U.S.C. § 1030(e)(1).

And a “protected computer” includes one that is “used in or affecting interstate or foreign commerce.” Id. § 1030(e)(2)(B).

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 21 of 32
22 Opinion of the Court 21-14051

Here, the complaint’s allegations satisfy the “protected computer” term. Indyzen has withheld the passwords to SkyHop’s

AWS accounts and the associated servers, which clearly qualify as 

“computer[s].” See hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 

1195 (9th Cir. 2022) (explaining that servers are “computers that 

manage network resources and provide data to other computers”). 

It makes no difference that SkyHop does not own the servers (Amazon does). Those servers are cloud-based and permit users to access their data and information from anywhere via the internet. Cf. 

Riley v. California, 573 U.S. 373, 397 (2014) (“Cloud computing is 

the capacity of Internet-connected devices to display data stored on 

remote servers rather than on the device itself.”). In other words, 

they are “used in or affecting interstate or foreign commerce,” 18 

U.S.C. § 1030(e)(2)(B), so they meet the CFAA’s definition of “protected computer.” And by retaining the passwords, Indyzen has 

diminished SkyHop’s ability to access the programs and data that 

are housed on the servers and has therefore caused “damage.” 

In sum, we conclude that SkyHop has stated a cause of action under § 1030(a)(7)(A) because it has plausibly alleged that Indyzen sent its emails to SkyHop with an “intent to extort.” Viewing the allegations in the light most favorable to SkyHop, it has also 

plausibly alleged that the emails amounted to a “threat to cause 

damage to a protected computer.” We therefore conclude that

SkyHop has sufficiently alleged a cause of action under Count I.

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 22 of 32
21-14051 Opinion of the Court 23

2. Florida’s connexity requirement is satisfied.

Establishing one of the Florida long-arm statute’s enumerated acts alone is not enough to satisfy the Florida statute. The 

long-arm statute also imposes a connexity requirement between 

the enumerated activity in Florida and the plaintiff’s cause of action. Knepfle v. J-Tech Corp., 48 F.4th 1282, 1292 (11th Cir. 2022). 

That is, the statute “requires a connection . . . between the enumerated activity in Florida and the cause of action.” Id. (citation omitted). The connexity requirement stems from the long-arm statute’s mandate that, to support jurisdiction, the cause of action must 

“aris[e] from” the enumerated activity. Fla. Stat. § 48.193(1)(a); see

Wendt, 822 So. 2d at 1260.

Under Florida Supreme Court precedent, a tortious act “can 

occur through the nonresident defendant’s telephonic, electronic, 

or written communications into Florida” so long as “the cause of 

action . . . arise[s] from the communications.” Wendt, 822 So. 2d

at 1260. Indeed, that court characterized as “straightforward” and 

“clear [the conclusion] that the nonresident defendant’s communications were made into Florida” when the defendant sent emails 

into Florida. Internet Solutions Corp. v. Marshall, 39 So. 3d 1201, 

1208 (Fla. 2010). That is so, the court explained, because those 

emails “[we]re directed to reach a specific recipient in a specific forum.” Id.; see also Del Valle v. Trivago GMBH, __ F.4th __, 2022 

WL 17101160, at *4 (11th Cir. Nov. 22, 2022).

Based on this Florida Supreme Court precedent, we conclude that SkyHop’s CFAA claim arises from Indyzen’s

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 23 of 32
24 Opinion of the Court 21-14051

communications into Florida. The emails informed SkyHop that 

Indyzen did not intend to return the passwords and other digital 

property unless SkyHop paid the additional $1.1 million or transferred an equity stake to Narra. Those communications constitute 

the alleged “threat[s]” to cause “damage” to SkyHop’s Software, 

and they serve as the basis for the inference that Indyzen had the 

requisite extortive intent to satisfy 18 U.S.C. § 1030(a)(7)(A). In 

other words, given that SkyHop alleged that Indyzen committed a 

tort in Florida, and SkyHop is suing Indyzen for that tort, it is easy 

to conclude that the cause of action arises from the Florida tort.

B. The Due Process Clause does not prohibit personal 

jurisdiction over Indyzen in Florida. 

The second (and final) stop on our personal-jurisdiction 

journey requires us to assess whether the Due Process Clause supports the exercise of personal jurisdiction in Florida.

The Due Process Clause limits “a [s]tate’s authority to bind 

a nonresident defendant to a judgment of its courts.” Walden, 571 

U.S. at 283. Jurisdiction is proper only when the nonresident defendant has “certain minimum contacts with [the forum] such that 

the maintenance of the suit does not offend ‘traditional notions of 

fair play and substantial justice.’” Int’l Shoe, 326 U.S. at 316 (quoting Milliken v. Meyer, 311 U.S. 457, 463 (1940)). 

The Supreme Court has recognized two types of personal 

jurisdiction: general jurisdiction, which attaches when a defendant 

is “essentially at home in the forum State,” and specific jurisdiction, 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 24 of 32
21-14051 Opinion of the Court 25

which “depends on an affiliation between the forum and the underlying controversy.” Goodyear Dunlop Tires Operations, S.A. v. 

Brown, 564 U.S. 915, 919 (2011) (alteration adopted) (internal quotation marks omitted). Specific jurisdiction is the only type at issue 

here, and it “derive[s] from and reflect[s] two sets of values—treating defendants fairly and protecting ‘interstate federalism.’” Ford 

Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1025 

(2021) (quoting World-Wide Volkswagen Corp. v. Woodson, 444 

U.S. 286, 293 (1980)).

To adhere to these values, our constitutional analysis proceeds in three steps: (1) we first consider “whether [a] plaintiff’s 

claims ‘arise out of or relate to’ at least one of the defendant’s contacts with the forum” state; (2) then we evaluate “whether the . . . 

defendant ‘purposefully availed’ himself of the privilege of conducting activities within the forum state”; and (3) finally, we assess 

“whether the exercise of personal jurisdiction comports with ‘traditional notions of fair play and substantial justice.’” Louis Vuitton 

Malletier, S.A. v. Mosseri, 736 F.3d 1339, 1355 (11th Cir. 2013) (citations omitted). SkyHop bears the burden of establishing the first 

two requirements. Id. If it does, Indyzen must then “make a ‘compelling case’ that the exercise of jurisdiction would violate traditional notions of fair play and substantial justice.” Id. (quoting Diamond Crystal Brands, Inc. v. Food Movers Int’l, Inc., 593 F.3d 1249, 

1267 (11th Cir. 2010)).

The first inquiry—whether the claims “arise out of or relate 

to” one of the defendant’s contacts—does not require direct 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 25 of 32
26 Opinion of the Court 21-14051

causation. Ford Motor, 141 S. Ct. at 1026 (emphasis omitted) (citation omitted). Rather, it “contemplates that some relationships 

will support jurisdiction without a causal showing.” Id. So we focus on the “‘essential foundation’ of specific jurisdiction”—

whether there is “a strong ‘relationship among the defendant, the 

forum, and the litigation.’” Id. at 1028 (quoting Helicopteros 

Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 (1984)); Del 

Valle, 2022 WL 17101160, at *5. The principal way to establish this 

relationship is through an “activity or an occurrence that takes 

place in the forum State and is therefore subject to the State’s regulation.” Ford Motor, 141 S. Ct. at 1025 (quoting Bristol-Myers 

Squibb Co. v. Superior Ct. of Cal., 137 S. Ct. 1773, 1780 (2017)). 

That essential foundation is present here. Indyzen knowingly and intentionally directed its emails demanding compensation and withholding SkyHop’s passwords into Florida, and a Florida resident received them. Because those emails contained the alleged “threat[s]” to do “damage” to SkyHop’s Software and therefore triggered SkyHop’s CFAA claim, this litigation has the required connection to Indyzen’s Florida-based contacts. 

Indyzen responds by citing Walden for the proposition that 

“the plaintiff cannot be the only link between the defendant and 

the forum.” We agree that that is an accurate statement of the law. 

But it doesn’t help Indyzen here. In Walden, Nevada-resident 

plaintiffs sued a Georgia-based Drug Enforcement Administration

agent in Nevada after an incident that occurred wholly at the Atlanta Hartsfield-Jackson Airport. 571 U.S. at 279–80. So there, the 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 26 of 32
21-14051 Opinion of the Court 27

defendant’s conduct provided no connection to the forum state. Id.

at 288–89. By contrast, here, through its emails sent to SkyHop in 

Florida, Indyzen directed its conduct into Florida. And that very 

same conduct serves as the basis for the claims SkyHop brings 

against it. So Walden does not apply here.

Indyzen’s reliance on Helicopteros and Hanson v. Denckla, 

357 U.S. 235 (1958), fares no better. Helicopteros is inapposite. 

There, the Court limited its analysis to whether the defendant was 

subject to general jurisdiction in Texas because the plaintiff conceded that its claims “did not arise out of, and [were] not related 

to” the defendant’s activities within Texas. 466 U.S. at 415–16 (internal quotation marks omitted). But the general-jurisdiction analysis does not bear on our specific-jurisdiction inquiry in which, as 

we’ve explained, at least one of SkyHop’s claims does “arise out of 

or relate to” Indyzen’s activities in Florida. And in Hanson, the 

Court held that a Delaware-based trustee, which had no contacts 

with Florida, could not be forced to litigate a dispute that arose in 

Florida only because of the trust settlor’s decision to move there 

long after she had executed the trust in Delaware. 357 U.S. at 251–

52. Here, though, Indyzen is subject to jurisdiction in Florida because of its own choices to contract with a Florida-based company 

and send emails to a Florida resident—the subject of SkyHop’s first 

claim.

At the second inquiry, we consider whether Indyzen purposefully availed itself of the benefit of Florida’s laws. To support 

purposeful availment, the defendant must have had contacts with 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 27 of 32
28 Opinion of the Court 21-14051

the forum that were his “own choice and not ‘random, isolated, or 

fortuitous.’” Ford Motor, 141 S. Ct. at 1025 (quoting Keeton v. 

Hustler Mag., Inc., 465 U.S. 770, 774 (1984)). And those contacts 

“must show that the defendant deliberately ‘reached out beyond’ 

its home,” such as by “entering a contractual relationship centered” 

in the forum. Id. (quoting Walden, 571 U.S. at 285)). 

In cases (like this one) involving an intentional tort, two applicable tests can determine whether purposeful availment occurred: the effects test and the traditional minimum-contacts test. 

Louis Vuitton, 736 F.3d at 1356; Del Valle, 2022 WL 17101160, at 

*5. Because either test suffices, and we conclude the effects test is 

satisfied, we do not consider the traditional minimum-contacts 

test.

A nonresident defendant’s single tortious act in the forum 

state can satisfy the effects test, even if the defendant lacks any 

other contacts with the forum state. Licciardello v. Lovelady, 544 

F.3d 1280, 1285–86 (11th Cir. 2008) (citing Calder v. Jones, 465 U.S. 

783, 790 (1984)). To meet the test, the tort must have been “intentional, aimed at the forum state, and caused harm that the defendant should have anticipated would be suffered in the forum state.” 

Del Valle, 2022 WL 17101160, at *5. 

In Lovelady, we concluded that a defendant who used a 

Florida plaintiff’s trademarked name and picture on a website accessible in Florida satisfied the effects test. 544 F.3d at 1287–88. 

And in Del Valle, when the defendants’ websites allowed Florida 

residents to reserve lodging at Cuban beachfront properties that

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 28 of 32
21-14051 Opinion of the Court 29

had been expropriated from the forebearers of the Florida-resident 

plaintiffs, we found that met the effects test. 2022 WL 17101160, at 

*1, *6. 

We have no difficulty reaching the same conclusion here. 

Indyzen undoubtedly sent its emails into Florida intentionally. 

And viewed in the light most favorable to SkyHop, Indyzen sent 

those emails to force SkyHop to pay additional funds so that 

SkyHop could regain control of its own property. It was certainly

foreseeable to Indyzen that SkyHop would feel the harm from its

alleged threats in Florida, where SkyHop is based. And that is especially true here since Indyzen knew, from the outset, that it was

in a partnership with a Florida-based company. Indeed, Narra 

made three separate trips to Florida to meet with Scotto. So Indyzen had reason to know that its decision and the ensuing emails 

could force it to defend against a lawsuit in Florida.

Trying to rebut these conclusions, Indyzen rehashes its arguments that SkyHop has not alleged a cause of action under the 

CFAA. As we’ve explained, we disagree.

The third and final inquiry asks whether the exercise of jurisdiction in Florida accords with “traditional notions of fair play 

and substantial justice.” We ordinarily consider four factors to resolve this inquiry: “the burden on the defendant”; “the forum’s interest in adjudicating the dispute”; “the plaintiff’s interest in obtaining convenient and effective relief”; and “the judicial system’s interest in resolving the dispute.” Del Valle, 2022 WL 17101160, at 

*7 (quoting World-Wide Volkswagen, 444 U.S. at 292). But the 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 29 of 32
30 Opinion of the Court 21-14051

defendant bears the burden of making “a compelling case” that the 

exercise of jurisdiction is improper. Louis Vuitton, 736 F.3d at 1355

(citation and internal quotation marks omitted). And Indyzen has 

not even attempted to demonstrate that it satisfies the relevant factors. We therefore conclude that jurisdiction in Florida is consistent with the Due Process Clause.

Because we conclude personal jurisdiction over Indyzen exists under Count I, we need not and do not inquire whether additional claims independently support personal jurisdiction. Even if 

they do not, it makes no difference to the propriety of the district 

court’s exercise of personal jurisdiction over Indyzen here for all 

SkyHop’s claims because a “district court ha[s] personal jurisdiction over the entire case” when “all of the claims ar[i]se from the 

same jurisdiction generating event.” Cronin v. Wash. Nat’l Ins. 

Co., 980 F.2d 663, 671 & n.10 (11th Cir. 1993). After all, the point 

of the personal-jurisdiction inquiry is to ensure that the defendants 

had at least minimum contacts with the forum state so that hauling 

them into court in the forum state “does not offend ‘traditional notions of fair play and substantial justice.’” Int’l Shoe, 326 U.S. at 316

(citation omitted). So once it is established that the defendants had 

enough contacts for it to be fair to haul them into court in the forum state on one claim, the personal-jurisdiction inquiry has served 

the bulk of its purpose. And here, all of SkyHop’s claims stem from 

Indyzen’s decision to retain SkyHop’s Software, which Indyzen 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 30 of 32
21-14051 Opinion of the Court 31

communicated to SkyHop through the emails. So personal jurisdiction over SkyHop is proper.6 

IV. Conclusion 

One more note before we bring this appeal in for a landing: 

when Indyzen brought its initial motion to dismiss for lack of personal jurisdiction, it also asserted an alternative basis to avoid litigating this case in Florida. It contended that, under the forum non 

conveniens doctrine, venue is improper based on the forum-selection clause in the agreements SkyHop and Indyzen signed. 

SkyHop opposed this motion. But because the district court 

granted Indyzen’s motion to dismiss for lack of personal jurisdiction, the district court had no reason to reach the forum non conveniens argument. 

And because the district court did not consider this argument, we won’t, either. MSP Recovery Claims, Series LLC v. 

Metro. Gen. Ins. Co., 40 F.4th 1295, 1306 (11th Cir. 2022) (“[W]e 

generally will not consider issues which the district court did not 

decide.” (citation and internal quotation marks omitted)). On remand, then, the district court should first consider whether the forum-selection clauses mandate dismissal based on improper venue.

* * *

6 We express no view on whether the remaining counts in SkyHop’s Complaint state a claim upon which relief can be granted.

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 31 of 32
32 Opinion of the Court 21-14051

For the foregoing reasons, we reverse the district court’s order dismissing SkyHop’s complaint and remand for further proceedings.

REVERSED AND REMANDED. 

USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 32 of 32