[ PUBLISH] 

## In the 

# United States Court of Appeals For the Eleventh Circuit

____________________
No. 21

- 14051

____________________
SKYHOP TECHNOLOGIES, INC., a Delaware corporation, SKYHOP GLOBAL, LLC, a Florida limited liability company, KRISTINE SCOTTO, an Individual,
Plaintiffs

- Appellants,

versus PRAVEEN NARRA, an Individual, INDYZEN, INC., a California corporation d.b.a. AppDevelopment.com, Inc. d.b.a. Tech. US , Inc, USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 1 of 322 Opinion of the Court 21

- 14051

Defendants

- Appellees.

____________________ Appeal from the United States District Court for the Southern District of Florida D.C. Docket No. 0:21

- cv

- 60799

- AHS

____________________ Before W ILLIAM P RYOR , Chief Judge, R OSENBAUM , and M ARCUS , Circuit Judges.

R OSENBAUM , Circuit Judge :Nobody enjoys flight delays. They are disruptive for airlines, passengers, and crew members alike. And any number of things can cause them : to name just a few, severe weather, faulty equipment, or the unavailability of pilots and crew members.
Plaintiff s

- Appellants SkyHop Global, LLC, SkyHop Technologies, Inc., and Kristine Scotto (collectively, “SkyHop” ) and Defendant s

- Appellees Praveen Narra and his company Indyzen , Inc. (collectively
, “Indyzen” ( unle ss otherwise indicated) ) have taken aim at that last problem source: the unavailability of pilots and crew members . Together, they have developed and deployed digital software aimed at transporting crew members to and from airports across the country. A nd business has taken off. SkyHop has about eighty contracts with fifteen airlines, including major carriers like Delta, American, and United. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 2 of 3221

- 14051 Opinion of the Court 3

But now SkyHop and Indyzen dispute who owns the digital software . And beyond that, they disagree on where their dispute should be decided. Indyzen has filed an arbitration action in California ( where it is based ) , alleging various forms of breach of contract and other promises. Meanwhile, SkyHop has filed this federal lawsuit in Florida (where it is b ased)
, alleging that Indyzen violated the federal Computer Fraud and Abuse Act (“CFAA”) and the Florida Computer Abuse and Data Recovery Act (“CADRA”)

. In response, Indyzen sought to dismiss this action for lack of personal jurisdiction. It argued that th e exercise of personal jurisdiction over it in Florida satisfied neither the Florida long

- arm statute nor the Due Process Clause of the Fourteenth Amendment. The district court agreed and entered an order dismissing SkyHop’s complaint. We see things diffe rently. T he allegations in SkyHop’s complaint, which we must accept as true on a motion to dismiss , suggest that SkyHop is the rightful owner of the digital software. And because Indyzen ha s refused to relinquish possession of the digital software withou t additional payment , SkyHop’s complaint states a cause of action under the CFAA

. The complaint therefore satisfies the Florida long

- arm statute. And i t also meets the requirements of the Due Process Clause because the emails that Indyzen sent into Flori da triggered SkyHop’s claims. So after careful review, and with the benefit of oral argument, we reverse the district court’s order and remand for further proceedings. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 3 of 324 Opinion of the Court 21

- 14051

I. Background 1 SkyHop Global , LLC , primarily offers a service to airlines : itprovides ground transportation for flight crews to and from airports across the nation

. To do this, SkyHop uses proprietary digital software
, including a web

- based program called SkyPlan and two mobile applicat ions, SkyHop Crew and SkyHop Drive r (collectively, the “Software”). SkyPlan uses flight manifests and real

- time data to create schedules to pick up and drop off flight

- crew members. Meanwhile, the mobile apps communicate and coordinate between flight crew s and drivers on the ground. According to the First Amended Complaint , the operative complaint here, SkyHop Technologies, Inc. (“SkyHop Tech”), owns all this technology, and it licenses it to SkyHop Global . In turn, SkyHop Global has contracts with fifte en airlines and operates in twenty

- one cities in eleven

states. Both SkyHop Tech and SkyHop Global operate from their headquarters in Broward County, Florida

. T wo password

- protected cloud servers that are hosted by Amazon Web Services (“AWS”) and physica lly located in Virginia house the SkyPlan program

. One AWS account has the production server and SkyPlan’s operational version, while the other account

1 Because this case arrives here after the district court granted a motion to dismiss, for purposes of our analysis, we accept as true the factual allegations in the complaint. Sil berman v. Miami Dade Transit , 927 F.3d 1123, 1128 (11th Cir. 2019). The actual facts may or may not be as alleged. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 4 of 3221

- 14051 Opinion of the Court 5 contains the staging server and its testing version. SkyHop Tech pays for both accounts

. Of course, t he Software did not always exist. Rather, t he process to develop it began in June 2014. Plaintiff Kristine Scotto

— a Florida resident and one of SkyHop’s founders

— met with developers to discuss the development of what would become the Software. One of th ese developer s was Defendant Praveen Narra

. Narra resides in California and traveled to Fort Lauderdale, Florida
, in 2014 to meet with Scotto. Scotto and her then

- business partner reached an understanding with Narra that each of the three would own 32% of a newly formed entity that would become SkyHop Tech, with a fourth partner owning the remaining 4%. After bringing Narra on board, SkyHop Tech contracted with Narra’s California

- based development company, Indyzen
, Inc.

— which does business und er the name Tech. US

— to develop and maintain the Software. That partnership has lasted for a few years. Since 2014, SkyHop Tech and Indyzen have signed several software

- development and maintenance contracts for the ongoing services that Indyzen has provid ed. And in total, Narra has made three separate trips to Florida ( in 2014, 2016, and 2018) to meet with Scotto about the relationship between the companies. All told, SkyHop Tech has paid Indyzen roughly $2.6 million

— the full amount it owes under the agr eements between the companies

— for the development and maintenance of the Software. As the part y who developed and maintain s the Software, Indyzen possess es what SkyHop Tech calls SkyHop’s Digital USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 5 of 326 Opinion of the Court 21

- 14051
Property: the source code for SkyHop’s mobile apps, the ou tside vendor accounts th ose apps use to function (including the AWS accounts), the application programming interfaces for the apps , the relevant domain names, DNS service, 2 signing keys, and all corresponding passwords required to operate, develop, and ma intain the Software. 3 One of the relevant AWS accounts is in Narra’s name while the other is in Indyzen’s name (in its own right) , and both

accounts use Narra’s personal residence as the account address. Around the time Narra joined the venture and the parties sought to incorporate SkyHop Tech, the relationship between Scotto and her then

- business partner began to break down, resulting in a lawsuit fi led in January 2015. While Narra was never a party to that lawsuit, he twice represented during the course of those proceedings that he relinquishe d any ownership interest he had in SkyHop Tech. The parties based their settlement agreement resolving that dispute

— five years later , in March 2020

— on Narra’s relinquishment of the ownership interest

.

2 “DNS” means the “Domain Name System.” Register.com, Inc. v. Verio, Inc. , 356 F.3d 393, 409

– 18 (2d Cir. 2004) (providing background on how the DNS works). “ A DNS service

. . . is a globally distributed service that translates human readable names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect to each other .” Amazon Web Services, What is DNS?
, https://aws.amazon.com/route53/what

- is

- dns (last accessed Jan

. 24 , 2023 ).

3 Because the parties have incorporated the meaning of the term Digital Property into the meaning of the term Soft ware, we will too. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 6 of 3221

- 14051 Opinion of the Court 7 A few months later, on January 9, 2021, Scotto, i n her role as the chief executive officer of SkyHop Global and President of SkyHop Tech, informed Narra that Sky Hop Tech planned to hire in

- house developers to take over development and maintenance of the Software. As a result, Scotto explained, SkyHop Tech planned to terminate its relationship with Indyzen. Two days later , Narra responded by email that he would “turn over all the source code and intellectual property developed for SkyHop Tech [] ” in exchange for slightly over $1.1 million. In reply, SkyHop Tech counteroffer ed $75,000 for three months of support and consulting . Indyzen did not accept. Instead, T ech.US ’s c hief r evenue o fficer, Rob Milks, emailed Scotto and reiterated Narra’s offer to turn over the Software for roughly $1.1 million. A few days later , Narra sent another email to say that, if the parties could not reach a financial agreement, Scotto should transfer a 32% stake in SkyHop Tech to Narra individually. On February 9 , SkyHop Tech, through its counsel, sent a demand letter to Narra. I n that letter, SkyHop Tech asserte d that Indyzen lack ed any property right in the Software and that Indyzen’s refusal to transfer was “inconsistent with SkyHop Tech’s ownership rights in its Property.” The letter “demand[ed] that by March 1, 2021, Indyzen transfer possession of SkyHop’s Property to SkyHop Tec h.” That did not occur. Rather, o n March 12, in San Jose, California, Indyzen (in its own right) filed a Demand for Arbitration against SkyHop Global, SkyHop Tech, and Scotto with the American Arbitration USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 7 of 328 Opinion of the Court 21

- 14051
Association. A few months later, Indyzen filed an Amended Demand listing Narra as an additional claimant

. SkyHop responded by suing Indyzen in the Southern District of Florida. SkyHop raised six causes of action, including three claims under the CFAA , 18 U.S.C. § 1030; one claim under the Florida CADR A , Fla. Stat. § 668.803; and two claims seeking a declaratory judgment concern ing the arbitrability of the dispute

. Indyzen moved to dismiss for lack of personal jurisdiction and, in the alternative, for improper venue. 4 In support of the motion, Indyz en included Narra’s affidavit , which asserted additional facts relevant to the jurisdiction inquiry. In the motion, Indyzen argued that personal jurisdiction was improper in Florida because the Florida long

- arm statute was not satisfied and the exercise o f jurisdiction d id not comport with the Due Process Clause. Indyzen also contend ed that a valid and applicable forum

- selection clause in the contracts require d any litigation between the parties to be brought in Santa Clara County, California. SkyHop opposed Indyzen’s motion seeking dismissal

. In support of its position, SkyHop argued Florida’s long

- arm statute support ed jurisdiction because, in relevant part, Narra claimed an ownership interest in a Florida

- based company and Indyzen committed a tortious act in Florida. SkyHop also assert ed that Indyzen

4 Indyzen moved once before to dismiss for lack of personal jurisdiction or improper venue , but SkyHop filed an amended complaint in response. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 8 of 3221

- 14051 Opinion of the Court 9had sufficient contacts with Florida to justify the exercise of jurisdiction under the Due Process Clause. A s to the forum

- selection clauses, SkyH op rejected their a pplicab ility because , SkyHop asserted, its claims d id not arise from or relate to the contracts that contain the forum

- selection clauses. The district court granted Indyzen’s motion to dismiss for lack of personal jurisdiction. The dist rict court concluded that the Florida long

- arm statute was not satisfied because Indyzen is not conducting a business in Florida
, and Narra’s purported ownership interest in SkyHop Tech is insufficient for jurisdiction. Nor did Indyzen commit a tortious act in Florida , the district court found, because , in its view, the allegations in the c omplaint failed to state a claim for relief under the CFAA or CADRA. Finally, the district court held that due process is not satisfied because SkyH op didn’t establish that its claims “‘arise out of or relate to’ at least one of [ Indyzen’s ] contacts in Florida.” (Citation omitted.) Because thedistrict court granted the motion to dismiss for lack of personal jurisdiction, it did not reach Indyzen’s a lternative argument that the forum

- selection clauses render ed venue improper. SkyHop timely appealed the district court’s order dismissing the case for lack of personal jurisdiction. Before wheels up on our legal flight, we must make o ne last

announcement important to understanding the issues here : as this litigation has progressed, Indyzen has retained possession and control of the relevant passwords and digital property . While SkyHop Tech can operate the Software, it cannot develop or maint ain the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 9 of 3210 Opinion of the Court 21

- 14051

Software itself . N or can it reproduce the Software or prepare derivatives of it. SkyHop Tech has also continued to pay Indyzen monthly to ensure against outage or interruption in the availability of the Software.

II. Standard of Review

We review de novo the dismissal for lack of personal jurisdiction, accepting the allegations in the complaint as true. Don’t Look Media LLC v. Fly Victor Ltd. , 999 F.3d 1284, 1292 (11th Cir. 2021). When a defendant submits an affidavit contesting the basis for personal jurisdiction, “ the burden shifts back to the plaintiff to produce evidence to support personal jurisdiction.” Id. “[W] here the plaintiff ’ s co mplaint and the defendant ’ s affidavits conflict, the district court must construe all reasonable inferences in favor of the plaintiff. ” Madara v. Hall , 916 F.2d 1510, 1514 (11th Cir. 1990).

Because part of the analysis Florida’s long

- arm statute requires us to consider includes whether SkyHop’s complaint states a cause of action
, we also review de novo the district court’s conclusions on that score. See United Techs. Corp. v. Mazer , 556 F.3d 1260, 1274

– 75 (11th Cir. 2009). In so doing, we treat e xhibits attached to a complaint as part of the complaint. Crowder v. Delta Air Lines , Inc. , 963 F.3d 1197, 1202 (11th Cir. 2020).

III. Discussion

This appeal presents a dispute about personal jurisdiction. “Federal courts ordinarily follow state law in determining th e USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 10 of 3221

- 14051 Opinion of the Court 11 bounds of their jurisdiction over persons.” Daimler AG v. Bauman
, 571 U.S. 117, 125 (2014). We do so “because a federal district court’s authority to assert personal jurisdiction in most cases is linked to service of process on a defendant ‘who is subj ect to the jurisdiction of a court of general jurisdiction in the state where the district court is located.’” Walden v. Fiore , 571 U.S. 277, 283 (2014) (quoting Fed. R. Civ. P. 4(k)(1)(A)).
So we have two stops on our personal

- jurisdiction itinerary

. First, we must “determine whether the Florida long

- arm statute provides a basis for personal jurisdiction.” Sculptchair, Inc. v. Century Arts, Ltd. , 94 F.3d 623, 626 (11th Cir. 1996). If it does, we then examine “whether the exercise of perso nal jurisdiction over the defendant would violate the Due Process Clause of the Fourteenth Amendment to the United States Constitution, which requires that the defendant have minimum contacts with the forum state and that the exercise of jurisdiction over the defendant does not offend ‘traditional notions of fair play and substantial justice.’” Mut. Serv. Ins. Co. v. Frit Indus., Inc. , 358 F.3d 1312, 13 19 (11th Cir. 2004) (quoting Int’l Shoe Co. v. Washington , 326 U.S. 310, 316 (1945)). Our opinion follow s that structure. In Part A, we consider whether the Florida long

- arm statute provides a basis for personal jurisdiction

. Part A has two subparts

— whether SkyHop alleged a tortious act in Florida and whether the cause of action has “connexity” with the alle ged tort that occurred in Florida. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 11 of 3212 Opinion of the Court 21

- 14051
And in Part B, we evaluate whether exercising jurisdiction in this case satisfies the Due Process Clause ’s minimum

- contacts and fair

- play requirements

.

A. T he Florida long

- arm statute supports the exercise of personal juri sdiction over Indyzen

. Florida’s long

- arm statute subjects to the jurisdiction of Florida state courts any one “ who personally or through an agent ” engages in any of nine enumerated acts, as long as the cause of action arises from that act. Fla. Stat. § 48.193(1)(a). Because the construction and interpretation of the Florida long

- arm statute raises question s of Florida law, we must construe the long

- arm statute as would the Florida Supreme Court. United Techs. , 556 F.3d at 1274. On appeal, SkyHop argues that its allegations satisfy Florida’s long

- arm statute for two independent reasons

. More specifically, i n SkyHop’s view, Indyzen has engaged in two of the nine acts Florida’s statute identifies as submitting to personal jurisdiction in Florida

. First, SkyHop contends that Indyzen has “ [ o ] perat[ed], conduct[ed], engag[ed] in, or carr[ied] on a business or business venture” in Florida. See Brief for Appellant at 19 ( quoting Fla. Stat. § 48.193(1)(a )(1) )

. Second, it assert s that Indyzen has “ [ c ] ommitt[ed] a tortious act” in Florida. Id. ( quoting Fla. Stat. § 48.193(1)(a)(2)). SkyHop need establish only one of these acts to satisfy the long

- arm statute. Because we conclude that SkyHop sufficiently alleged that Indyzen committed a tortious act in Florida, USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 12 of 3221

- 14051 Opinion of the Court 13
we need not (and therefore do not) consider whether it also engaged in a business or business ventur e in Florida. We analy ze whether SkyHop alleged a tortious act sufficient to bring its complaint within Florida’s long

- arm statute in two sub

parts. First, we explain why SkyHop’s complaint sufficiently allege s that Indyzen committed a tortious act in Flo rida. See Fla. Stat. § 48.193(1)(a)(2). Second, we show why the tortious act s SkyHop alleged satisfy the Florida statute’s “ connexity ” requirement

— that is, its requirement that at least one of SkyHop’s claims arises out of the act or acts that qualify fo r personal jurisdiction under the long

- arm statute. Wendt v. Horowitz , 822 So. 2d 1252, 1260 (Fla. 2002) (citing Fla. Stat. § 48.193(1)).

1. Because the complaint states a cause of action under 18 U.S.C. § 1030(a)(7) (A) , SkyHop has alleged that Indyzen committed a tortious act within Florida

. We start by considering whether Indyzen “ [ c ] ommitt[ed] a tortious act within” Florida. Fla. Stat. § 48.193(1)(a)(2). SkyHop argue s that Indyzen’s emails refusing to transmit the So ftware unless SkyHop paid $1.1 million amounted to a tortious act in Florida. We agree. To determine whether SkyHop alleged a tortious act, we must determine whether it stated a claim for its tortious act. Wendt , 822 So. 2d at 1260. The Florida Supreme Court has held that “a defendant’s physical presence is not required” to “commit a tortious act in Florida .” Id

. (citation and internal quotation marks USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 13 of 3214 Opinion of the Court 21

- 14051
omitted). Indeed, a tortious act “can occur through the nonresident defendant’s telephonic, electronic, or written communications into Florida.” Id. But as the Florida Supreme Court has explained, w hen a plaintiff attempts to use communications as the basis of a tortious act, “[t]he threshold question that must be determined is whether the allegations of the complaint state a cause of action.” Id. So we must consider whether the complaint states a claim under the CFAA or Florida’s CADRA. 5 We begin (and as it turns out , end) with SkyHop ’s first CFAA claim

. SkyHop contends that Indyzen’s emails amount to extortion and impede SkyHop’s access to its digital property in violation of 18 U.S.C. § 1030(a)(7) (A) . That section imposes liability on anyone who “ with intent to ex tort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any

— (A) threat to cause damage

5 When interpreting this provision, the Florida Supreme Court has recognized
, “Broadly speaking, a tort is a civil wrong, other than a breach of contract, for which the court will provide a remedy in the form of an action for damages.” Execu

- Tech Bus. Sys., Inc. v. New Oji Paper Co. , 752 So. 2d 582, 585 n.8 (Fla. 2000) (quoting Prosser and Keeton on the Law of Torts 2 (W. Page Keeton ed., 5th ed. 1984) ) . Because a CFAA violation entitles victims to compensation based on principles similar to those of tort law, a CFAA violation is analogous to the commission of a tort. See Van Buren v. United States
, 141 S. Ct. 1648, 1652 (2021) (explaining CFAA was enacted, in part, because “traditional theft and trespass statu tes were ill suited to address cybercrimes that did not deprive computer owners of property in the traditional sense”) ; 18 U.S.C. § 1030(g) (creating a private cause of action for victims of CFAA violations)

. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 14 of 3221

- 14051 Opinion of the Court 15 to a protected computer.” 18 U.S.C. § 1030(a)(7) (A)

. The elements of a CFAA claim under § 103 0(a)(7)(A) are therefore the following: (1) with the intent to extort from any person any money (or thing of value ) , (2) transmit ting in interstate or foreign commerce any communication containing (3) a threat to cause damage to a protected computer.
Our C ircuit has not yet had an opportunity to discuss the scope of § 1030(a)(7) (A)

. Here, the dispute under it centers on element (3)

— in particular, whether SkyHop has sufficiently alleged that Indyzen’s emails constitute “threat [s] ” and
, if so, whether those threats were threats to cause “damage.” We’ll address those

terms in turn.

a. SkyHop sufficiently alleges that Indyzen made threats.
T o determine whether the emails could rise to the level of being a “threat ,” we begin, as we always do, with the statutory text. See United States v. Henco Holding Corp. , 985 F.3d 1290, 1297 (11th Cir. 2021). T he CFAA does not define “threat

. ” So we inte rpret that term using its “ordinary meaning at the time Congress enacted the statute.” New Prime, Inc. v. Oliveira , 139 S. Ct. 532, 539 (2019) (alterations adopted ) (citation omitted). The CFAA was initially enacted in 1986. See Pub. L. No. 99

- 474 , 100 Stat. 1213 (1986). Ten years later, Congress amended the CFAA to add t he term “threat” as part of the Economic Espionage Act of 1996

. See Pub. L. No. 104

- 294 , § 201, 110 Stat. 3488 , 3492 (1996). Contemporary dictionaries defined a “threat” as “[ a] USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 15 of 3216 Opinion of the Court 21

- 14051

comm unicated intent to inflict physical or other harm on any person or on property.” Black’s Law Dictionary (6th ed. 1990); see also Webster’s Collegiate Dictionary (10th ed. 1993) (defining “threat” as “an expression of intention to inflict evil, injury
, or damage”); Oxford English Dictionary (2d ed. 1989) (defining “threat” as “ a declaration of hostile determination or of loss, pain, punishment, or damage to be inflicted in retribution for or conditionally upon
some course; a menace”).
T he Supreme Court’s discussion of the meaning of “threat” in United States v. Taylor
, a case about a different criminal statute ( the Armed Career Criminal Act ), supports this definition . 142 S. Ct. 2015, 2020 (2022) (discussing 18 U.S.C. § 924(c)(3)(A)). In Taylor
, the Court surveyed definitions of the term “threat” and concluded the term had the same meaning we use today . As the Court explained
, “in the criminal law the word ‘threat’ and its cognates usually denote ‘a communicated intent to inflict physi cal or other harm on any person or on property.’” Id. at 2022 & n.2 (citation omitted)

. And the CFAA is in part a criminal statute and is codified in the criminal

- law title
, Title 18. See 18 U.S.C. § 1030(a)(7) (A)

. When we apply this definition, we think that
, viewed in the light most favorable to SkyHop, Indyzen’s emails could constitute threats under the CFAA. The emails state d that Indyzen w ould “turn over all the source code and intellectual property developed for [SkyHop Tech]” only if SkyHop Tech tender ed payment of $1.1 million. Without that payment, Indyzen would not provide the passwords or other electronic property. And based on the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 16 of 3221

- 14051 Opinion of the Court 17

alle gations in the c omplaint , SkyHop owned these digital materials that Indyzen asserted it would withh o ld unless and until it received additional payment.

P ut another way, SkyHop has alleged that (1) Indyzen possess es SkyHop ’s intellectual property, (2) Sky Hop asked Indyzen to return its property, and (3) Indyzen said it would not do so unless SkyHop paid $1.1 million. We think SkyHop has plausibly alleged that these emails communicate an intent to inflict harm on SkyHop ’s property and therefore can be cons idered “threats” under the CFAA. To be sure, a fact

- finder may ultimately determine that Indyzen did not intend to cause harm or that Indyzen was , in fact
, entitled to the $1.1 million or the 32% stake in SkyHop Tech that Narra sought. Or the fact

- finder may conclude that Indyzen intended its emails as negotiations rather than threats. That determination may turn on whether Indyzen has a legitimate claim to the property. Cf. Crawford’s Auto Ctr., Inc. v. State Farm Mut. Auto. Ins. Co. , 945 F.3d 1150, 1160 (11th Cir. 2019) (citing Levitt v. Yelp! Inc. , 765 F.3d 1123, 1130 (9th Cir. 2014)) (explaining the “well

established principle” that “ [t]hreats of economic harm made to obtain property from another are not generally considere d wrongful where the alleged extortioner has a legitimate claim to the property obtained through such threats ”). But at this early stage, we assess only whether SkyHop has sufficiently alleged that Indyzen’s emails were “threats ” within the meaning of the CFAA. SkyHop has cleared that bar. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 17 of 3218 Opinion of the Court 21

- 14051

b. SkyHop sufficiently allege s that Indyzen caused damage. Next, we turn to the term “damage .” But this time, Congress has expressly defined the term : “damage” means “any impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). That definition doesn’t tell the full story
, though, because the statute does not define three key terms —“ impairment, ” “ integrity, ” or “ availability .” So we once again c onsult the ordinary meaning of those words to determine what Congress meant.An “impairment” is a “deterioration” or an “injurious lessening or weakening.” Oxford English Dictionary (2d ed. 1989). “Integrity” means an “unimpaired or uncorrupted conditi on,” an “original perfect state,” or “soundness.” Id. And “availability” means the “capability of being employed or made use of.” Id. Putting it all together , we conclude that a transmission that does “damage” is one that weakens the condition of a computer system or program, or one that diminishes a plaintiff’s ability to use that system or any associated data. See Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am. , 648 F.3d 295, 301 (6th Cir. 2011). Here, the relevant question is whether Indyzen’s withholding of the passwords and SkyHop ’s other digital property diminished SkyHop ’s ability to use its computer system or the associated data. We conclude it did . SkyHop alleged that it owns the Software, including the relevant passwords, and that it pays for the AWS accounts that house the SkyPlan. SkyHop further averred that it seeks to access its Software so it can make desired changes USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 18 of 3221

- 14051 Opinion of the Court 19 and updates to the programs with its in

- house team rather than funnel all its requests through Indyzen (in its own right) . SkyHop cannot assume control of the Software only because of Indyzen’s decision to withhold the passwords and account information until SkyHop pays another $1.1 million or transfers a 32% equity stake to Narra. Since SkyHop cannot access and independently modify its Software without the passwords, Indyzen’s refusal to provide those passwords “impair[s]” the “availability” of the Software and therefore causes “damage.” Our holding aligns with those of o ther circuits in cases raising similar issues. For instance , the Seventh Circuit, a fter a defendant reset the victim’s password and prevented the victim from accessing his computer system, affirmed the conviction because “a reasonable jury could find that [the defendant’s] actions ‘impairedthe availability of the system’ by temporarily diminishing its readiness for [the victim’s] immediate use.” United States v. Soybel , 1 3 F.4th 584, 595 (7th Cir. 2021) (quoting 18 U.S.C. § 1030(e)(8)) (alterations adopt ed) . And after a defendant changed a plaintiff’s social

- media passwords and locked her out of her accounts, the Second Circuit suggested that the plaintiff had a CFAA claim at the time she “discovered that someone had impaired the integrity of each of her relevant Internet account s .” Sewell v. Bernardin , 795 F.3d 337, 340 (2d Cir. 2015). Indyzen argues , without any authority, that no “damage” occurred here because the Software has continued to function in an uninterrupted manner. But SkyHop alleged (and Indyzen USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 19 of 3220 Opinion of the Court 21

- 14051 acknowledged at oral argument
, Oral Arg. 22:50

- 24:26 ) that SkyHop cannot access the Software itself

. Rather, it must continue to pay Indyzen a nd rely on its benevolence to keep the Software operational, even though SkyHop desires to move its Software development and maintenance in

- house. SkyHop ’s inability to access its own Software renders its Software un available to it

— even if the technology continues to function
, and SkyHop ’s customers continue to receive SkyHop ’s services.

c. SkyHop sufficiently alleges the remaining statutory terms. The parties squarely dispute only the meanings of “threat [s] ” and “damage” under § 1030(a)(7)(A)

. But because SkyHop must sufficiently allege a cause of action to satisfy personal jurisdiction here, we must still verify that SkyHop’s allegations satisfy the remaining statutory terms and elements

. Namely, SkyHop must have sufficiently alleged that Indyzen (1 ) act ed “with intent to extort” money or another thing of value ; (2) transmitted a communication in interstate or foreign commerce; and (3 ) made alleged threats that would have damaged “a protected computer.”

First , SkyHop has sufficiently alleged that Indyzen acted “with intent to extort from any person any money or other thing of value.” 18 U.S.C. § 1030(a)(7). While the CFAA does not define “extort
, ” the plain meaning of the term is “ [t] o gain by wrongful methods” or “to obtain in an unlawful manner, as to c ompel payments by means of threats of injury to person, property, or reputation.” Black’s Law Dictionary (6th ed. 1990). Here, the complaint alleges that Indyzen seeks to obtain $1.1 million or 32% of SkyHop USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 20 of 3221

- 14051 Opinion of the Court 21 Tech through wrongful methods

— withholding SkyH op ’s digital property until it meets their demands.
While Indyzen does not dispute the meaning of “extort,” i t suggests that we should infer the “obvious alternative explanation [] ” for its emails: that this is simply an ownership dispute rather than an extortion attempt

. And that may turn out to be true. But at this stage, we must make all factual inferences in SkyHop ’s favor, and given the allegations, this inference does not strike us as so obvious that we should adopt it here. SkyHop has alleged th at it owns the Software, and we must accept that allegation as true. Second, Indyzen’s emails clearly constitute communications. See Missouri v. McNeely, 569 U.S. 141, 154 (2013) (describing emails as a type of “electronic communication”). And the c ompl aint easily satisfies t he interstate

- commerce requirement here : Indyzen transmitted the emails from California to Florida over the internet. See United States v. Hornaday , 392 F.3d 1306, 1311 (11th Cir. 2004) (“The internet is an instrumentality of inter state commerce.”).
Third , the “threat to cause damage” must be to a “protected computer.” As relevant here, t he CFAA defines “computer” as “ an electronic

. . . or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any datastorage facility or communications facility directly related to or operating in conjunction with such device .” 18 U.S.C. § 1030(e)(1). And a “protected computer” includes one that is “used in or affecting interstate or foreign commerce.” Id. § 1030(e)(2) (B)

. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 21 of 3222 Opinion of the Court 21

- 14051
Here, the complaint’s allegations satisfy the “protected computer” term

. Indyzen has withheld the passwords to SkyHop ’s AWS accou nts and the associated servers , which clearly qualify as “computer[s]

. ” See hiQ Labs, Inc. v. LinkedIn Corp. , 31 F.4th 1180, 1195 (9th Cir. 2022) (explaining that servers are “computers that manage network resources and provide data to other computers”). It makes no difference that SkyHop does not own the server s ( Amazon does )

. Those servers are cloud

- based and permit users to access their data and information from anywhere via the internet. Cf. Riley v. California
, 573 U.S. 373, 397 (2014) (“ Cloud comp uting is the capacity of Internet

- connected devices to display data stored on remote servers rather than on the device itself. ”). In other words, they are “used in or affecting interstate or foreign commerce,” 18 U.S.C. § 1030(e)(2) (B) , so they meet the CFAA’s definition of “protected computer.” And by retaining the passwords, Indyzen has diminished SkyHop’s ability to access the programs and data that are housed on the server s and ha s therefore caused “damage.” In sum, we conclude that SkyHop has stated a cause of action under § 1030(a)(7)(A) because it has plausibly alleged that Indyzen sent its emails to SkyHop with an “intent to extort

. ” Viewing the allegations in the light most favorable to SkyHop, it has also plausibly alleged that the emails amounted to a “threat to cause damage to a protected computer.” We therefore conclude that SkyHop has sufficiently alleged a cause of action under Count I

. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 22 of 3221

- 14051 Opinion of the Court 23

2. Florida’s connexity requirement is satisfied. Establishing one of the Florida long

- arm statute’s e numerated act s alone is not enough to satisfy the Florida statute . The long

- arm statute also imposes a connexity requirement betweenthe enumerated activity in Florida and the plaintiff’s cause of action. Knepfle v. J

- Tech Corp. , 48 F.4th 1282, 1292 (11t h Cir. 2022). That is, the statute “ requires a connection . . . between the enumerated activity in Florida and the cause of action.” Id. (citation omitted). The connexity requirement stems from the long

- arm statute’s mandate that , to support jurisdictio n, the cause of action must “aris [ e ] from” the enumerated activity. Fla. Stat. § 48.193(1)(a); see Wendt , 822 So. 2d at 1260

. Under Florida Supreme Court precedent, a tortious act “can occur through the nonresident defendant’s telephonic, electronic, or written communications into Florida” so long as “the cause of action . . . arise[s] from the communications.” Wendt , 822 So. 2d
at 1260. Indeed, that court characterized as “straightforward” and “clear [the conclusion ] that the nonresident defendant’s communications were made into Florida” when the defendant sen t emails into Florida

. Internet Solutions Corp. v. Marshall , 39 So. 3d 1201, 1208 (Fla. 2010). That is so, the court explained, because those emails “ [we] re directed to reach a specific recipient in a specific forum.” Id. ; see also Del Valle v. Trivago GMBH , __ F.4th __, 2022 WL 17101160, at *4 (11th Cir. Nov. 22, 2022). Based on this Florida Supreme Court precedent, we conclude that SkyHop ’s CFAA claim arises from Indyzen’s USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 23 of 3224 Opinion of the Court 21

- 14051 communications into Florida. The emails informed SkyHop that Indyzen did not intend to return the passwords and other digital property unless SkyHop paid the additional $1.1 million or transferred an equity stake to Narra. Those communications constitute the alleged “threat [ s ] ” to cause “damage” to SkyHop ’s Software, and they serve as the basis for the inference that Indyzen had the requisite extorti ve intent to satisfy 18 U.S.C. § 1030(a)(7)(A). In other words, g iven that SkyHop alleged that Indyzen committed a tort in Florida
, and SkyHop is suing Indyzen for that tort , it is easy to conclude that the cause of action arises from the Florida tort.
B. The Due Process Clause does not prohibit personal jurisdiction over Indyzen in Florida.
The second (and final) st o p o n our personal

- jurisdiction journey requires us to assess whether the Due Process Clause supports the exercise of personal jurisdicti on in Florida.
The Due Process Clause limits “ a [ s ] tate’s authority to bind a nonresident defendant to a judgment of its courts.” Walden , 571 U.S. at 283 . Jurisdiction is proper only when the nonresident defendant has “certain minimum contacts with [the forum] such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’” In t’l Shoe , 326 U.S. at 316 (quoting Milliken v. Meyer , 311 U.S. 457, 463 (1940) ). The Supreme Court has recognized two types of personal jurisdiction: general jurisdiction, which attaches when a defendant is “essentially at home in the forum State,” and specific jurisdiction, USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 24 of 3221

- 14051 Opinion of the Court 25 which “depends on an affiliation between the forum and the u nderlying controversy.” Goodyear Dunlop Tires Operations, S.A. v. Brown , 564 U.S. 915, 919 (2011) (alteration adopted) ( internal quotation marks omitted). Specific jurisdiction is the only type at issue here, and it “derive[s] from and reflect[s] two sets of values

— treating defendants fairly and protecting ‘interstate federalism.’” Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct. , 141 S. Ct. 1017, 1025 (2021) (quoting World

- Wide Volkswagen Corp. v. Woodson , 444 U.S. 28 6, 293 (1980) ).To adhere to these values, our constitutional analysis proceeds in three steps: (1) we first consider “ whether [ a ] plaintiff’s claims ‘ arise out of or relate to ’ at least one of the defendant’s contacts with the forum ” state; (2) then we e valuate “ whether the

. . . defendant ‘ purposefully availed ’ himself of the privilege of conducting activities within the forum state ” ; and (3) finally, we assess

“ whether the exercise of personal jurisdiction comports with ‘ traditional notions of fair play and substantial justice. ’ ” Louis Vuitton Malletier, S.A. v. Mosseri , 736 F.3d 1339, 1355 (11th Cir. 2013) (citation s omitted) . SkyHop bears the burden of establishing the first two requirements. Id. If it does, Indyzen must then “make a ‘ compelling ca se’ that the exercise of jurisdiction would violate traditional notions of fair play and substantial justice.” Id. (quoting Diamond Crystal Brands, Inc. v. Food Movers Int’l, Inc. , 593 F.3d 1249, 1267 (11th Cir. 2010)). The first inquiry

— whether the claims “arise out of or relate to” one of the defendant’s contacts

— does not require direct USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 25 of 3226 Opinion of the Court 21

- 14051

causation

. Ford Motor , 141 S. Ct. at 1026 (emphasis omitted) (citation omitted) . Rather, it “contemplates that some relationships will support jurisdi ction without a causal showing.” Id. So we focus on the “‘essential foundation’ of specific jurisdiction”

— whether there is “a strong ‘relationship among the defendant, the forum, and the litigation.’” Id. at 1028 (quoting Helicopteros Nacionales de Colo mbia, S.A. v. Hall , 466 U.S. 408, 414 (1984)); Del Valle
, 2022 WL 17101160, at *5 . Th e principal way to establish this relationship is through an “activity or an occurrence that takesplace in the forum State and is therefore subject to the State’s regula tion.” Ford Motor , 141 S. Ct. at 1025 (quoting Bristol

- Myers Squibb Co. v. Superior Ct. of Cal. , 137 S. Ct. 1773, 1780 (2017)).
That essential foundation is present here. Indyzen knowingly and intentionally directed its emails demanding compensation an d withholding SkyHop ’s passwords into Florida
, and a Florida resident received them . Because those emails contained the alleged “threat [ s ] ” to do “damage” to SkyHop ’s Software and therefore triggered SkyHop ’s CFAA claim , this litigation has the required c onnection to Indyzen’s Florida

- based contacts. Indyzen responds by citing Walden for the proposition that “the plaintiff cannot be the only link between the defendant and the forum.” We agree that that is an accurate statement of the law. But it doesn’ t help Indyzen here . In Walden , Nevada

- resident plaintiffs sued a Georgia

- based Drug Enforcement Administration agent in Nevada after an incident that occurred wholly at the Atlanta Hartsfield

- Jackson Airport. 571 U.S. at 279

– 80. So there, the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 26 of 3221

- 14051 Opinion of the Court 27 defendant’s conduct provided no connection to the forum state. Id.

at 288

– 89 . By contrast , here, through its emails sent to SkyHop in Florida, Indyzen directed its conduct int o Florida . And that very

same conduct serves as the basis for the claims Sky Hop brings against it. So Walden does not apply here. Indyzen ’s reliance on Helicopteros and Hanson v. Denckla
, 357 U.S. 235 (1958) , fares no better. Helicopteros is inapposite

. T here, the Court limited its analysis to whether the defendant was subject to general jurisdiction in Texas becaus e the plaintiff conceded that its claims “did not arise out of, and [were] not related to” the defendant ’s activities within Texa s . 466 U.S. at 415

– 16 (internal quotation marks omitted)

. But the general

-jurisdiction analysis does not bear on our specific

- jurisdiction inquiry in which
, as we’ve explained
, at least one of SkyHop’s claims does “arise out of or relate to” Indyzen’s ac tivities in Florida. And in Hanson , the Court held that a Delaware

- based trustee , which had no contacts with Florida
, could not be forced to litigate a dispute that arose in Florida only because of the trust settlor’s decision to move there long after she had executed the trust in Delaware

. 357 U.S. at 251

– 52. Here, though, Indyzen is subject to jurisdiction in Florida because of its own choices to contract with a Florida

- based company and send emails to a Florida resident

— the subject of SkyHop’s first claim

. At the second inquiry, we consider whether Indyzen purposefully availed itself of the benefit of Florida’s laws. To support purposeful availment, the defendant must have had contacts with USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 27 of 3228 Opinion of the Court 21

- 14051

the forum that we re his “own choice and not ‘random, i solated, or fortuitous.’” Ford Motor , 141 S. Ct. at 1025 (quoting Keeton v. Hustler Mag. , Inc. , 465 U.S. 770, 774 (1984)). And those contacts “must show that the defendant deliberately ‘reached out beyond’ its home,” such as by “entering a contractual re lationship centered” in the forum. Id. (quoting Walden , 571 U.S. at 285)).In cases (like this one) involving an intentional tort, two applicable tests can determine whether purposeful availment occurred : the effects test and the traditional minimum

- co ntacts test

. Louis Vuitton , 736 F.3d at 1356; Del Valle
, 2022 WL 17101160, at *5 . Because either test suffices , and we conclude the effects test is satisfied, we do not consider the traditional minimum

- contacts
test.
A nonresident defendant’s single torti ous act in the forum

state can satisfy the effects test, even if the defendant lacks any other contacts with the forum state. Licciardello v. Lovelady , 544 F.3d 1280, 128 5

– 8 6 (11th Cir. 2008) (citing Calder v. Jones , 465 U.S. 783, 790 (1984)). To meet th e test, the tort must have been “intentional, aimed at the forum state, and caused harm that the defendant should have anticipated would be suffered in the forum state.” Del Valle
, 2022 WL 17101160, at *5

. In Lovelady , we concluded that a defendant who used a Florida plaintiff’s trademarked name and picture on a website accessible in Florida satisfied the effects test . 544 F.3d at 12 87

– 88. And in Del Valle , when the defendants ’ websites allowed Florida residents to reserve lodging at Cuban beachfront p roperties that USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 28 of 3221

- 14051 Opinion of the Court 29 had been expropriated from the forebearers of the Florida

- resident plaintiffs , we found that met the effects test

. 2022 WL 17101160, at *1, *6

. We have no difficulty reaching the same conclusion here. Indyzen undoubtedly sent its emails i nto Florida intentionally. And viewed in the light most favorable to SkyHop, Indyzen sent those emails to force SkyHop to pay additional funds so that SkyHop could regain control of its own property. It was certainly foreseeable to Indyzen that SkyHop wo uld feel the harm from its alleged threats in Florida, where SkyHop is based. And t hat is especially true here since Indyzen knew, from the outset, that it was in a partnership with a Florida

- based company. Indeed, Narra made three separate trips to Flor ida to meet with Scotto . So Indyzen had reason to know that its decision and the ensuing emails could force it to defend against a lawsuit in Florida. Trying to rebut these conclusion s , Indyzen rehashes its arguments that SkyHop has not alleged a cause of action under the CFAA. As we’ve explained, we disagree. The third and final inquiry ask s whether the exercise of jurisdiction in Florida accords with “traditional notions of fair play and substantial justice.” We ordinarily consider four factors to resolve this inquiry : “ the burden on the defendant ” ; “ the forum’s interest in adjudicating the dispute ” ; “ the plaintiff’s interest in obtaining convenient and effective relief ” ; and “ the judicial system’s interest in resolving the dispute. ” Del Valle
, 2022 WL 17101160, at *7 (quoting World

- Wide Vo lk

swagen , 444 U.S. at 292). But the USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 29 of 3230 Opinion of the Court 21

- 14051

defendant bears the burden of making “a compelling case” that the exercise of jurisdiction is improper. Louis Vuitton , 736 F.3d at 1355 (citation and internal quotation ma rks omitted) . And Indyzen has not even attempted to demonstrate that it satisfies the relevant factors. We therefore conclude that jurisdiction in Florida is consistent with the Due Process Clause. Because we conclude personal jurisdiction over Indyzen e xists under Count I, we need not and do not inquire whether additional claims independently support personal jurisdiction. Even if they do not, it makes no difference to the propriety of the district court’s exercise of personal jurisdiction over Indyzen here for all SkyHop’s claims because a “district court ha[s] personal jurisdiction over the entire case” when “all of the claims ar[i]se from the same jurisdiction generating event

. ” Cronin v. Wash. Nat’l Ins. Co. , 980 F.2d 663, 671 & n.10 (11th Cir. 1993)

. After all, the point of the personal

- jurisdiction inquiry is to ensure that the defendants had at least minimum contacts with the forum state so that hauling them into court in the forum state “does not offend ‘traditional notions of fa ir play and substantial justice.’” Int’l Shoe , 326 U.S. at 316 (citation omitted)

. So once it is established that the defendants hadenough contacts for it to be fair to haul them into court in the forum state on one claim, the personal

- jurisdiction inqu iry has served the bulk of its purpose. And here, all of SkyHop’s claims stem from Indyzen’s decision to retain SkyHop’s Software, which Indyzen USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 30 of 3221

- 14051 Opinion of the Court 31communicated to SkyHop through the emails. So personal jurisdiction over SkyHop is proper. 6

IV. Conclusion

One more note before we bring this appeal in for a landing:

w hen Indyzen brought its initial motion to dismiss for lack of personal jurisdiction , it also asserted an alternative basis to avoid litigating this case in Florida

. It contended that, under the for um non conveniens doctrine, venue is improper based on the forum

- selection clause in the agreements SkyHop and Indyzen signed

. SkyHop opposed this motion. But because the district court granted Indyzen’s motion to dismiss for lack of personal jurisdictio n, the district court had no reason to reach the forum non conveniens argument. And b ecause the district court did not consider this argument, we won’t
, either. MSP Recovery Claims, Series LLC v. Metro. Gen. Ins. Co. , 40 F.4th 1295, 1306 (11th Cir. 2022) (“[W]e generally will not consider issues which the district court did not decide.” ( c itation and internal quotation marks omitted) ) . On remand, then, the district court should first consider whether the forum

- selection clauses mandate dismissal bas ed on improper venue.

* * *

6 We express no view on whether the remaining c ounts in SkyHop’s Complaint state a claim upon which relief can be granted. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 31 of 3232 Opinion of the Court 21

- 14051 For the foregoing reasons , we reverse the district court’s order dismissing SkyHop ’s complaint and remand for further proceedings.
REVERSED AND REMANDED. USCA11 Case: 21-14051 Document: 39-1 Date Filed: 01/26/2023 Page: 32 of 32