Federal Circuit Rules That Foreign Defendants Cannot Rely On 28 U.S.C. § 1400(b) To Challenge Venue

After the Supreme Court’s TC Heartland[1] decision reaffirmed 28 U.S.C. § 1400(b) to be “the sole and exclusive provision controlling venue in patent infringement actions,” one important question remained as to whether foreign defendants (especially foreign corporations) in a patent case may invoke that provision to challenge venue.  On May 9, 2018, the Federal Circuit denied HTC Corporation’s attempt to defeat venue based on § 1400(b), and held that provision does not provide an exception to the “long-established rule that suits against aliens are wholly outside the operation of all federal venue law, general and special.”  In re HTC Corp., No. 2018-130, slip op. at 7 (Fed. Cir. May 9, 2018).

In In re HTC Corp., HTC Corporation, a Taiwanese corporation with its principal place of business in Taiwan, petitioned the Federal Circuit for a writ of mandamus seeking dismissal for improper venue pursuant to 28 U.S.C. § 1406(a) of a patent infringement action pending against HTC Corporation in the District of Delaware.  Id. at 2.  The Federal Circuit denied the mandamus petition after finding that HTC Corporation failed to meet each of the three conditions necessary for obtaining such a drastic remedy.  Id. at 3-20.

First, the Federal Circuit found that HTC Corporation failed to demonstrate that it had “no other adequate means to attain the relief [it] desires.”  Id. at 3-7.  The Court noted that “unlike a defendant challenging the denial of a [28 U.S.C.] § 1404(a) transfer motion, a defendant aggrieved by the denial of an improper-venue motion has an adequate remedy on appeal from a final judgment,” namely, by obtaining an appellate “order vacating the judgment . . . and directing the remand of the action to the [appropriate venue].”[2]  Id. at 4-5 (citations omitted).

Next, the Federal Circuit held that HTC Corporation failed to show a clear and indisputable right to the issuance of the writ.  Id. at 7.  The Court examined two Supreme Court decisions directly addressing whether the venue laws protect alien defendants.  In In re Hohorst, the Supreme Court established what the Federal Circuit referred to as the “alien-venue rule.”  150 U.S. 653, 662 (1893) (holding that the venue restriction was “inapplicable to an alien or a foreign corporation sued here, . . . and that, consequently, such a person or corporation may be sued by a citizen of a state of the Union in any district in which valid service can be made upon the defendant”); In re HTC Corp., No. 2018-130, slip op. at 8.  Later in Brunette Machine Works, Ltd. v. Kockum Industries, Inc., the Supreme Court upheld the alien-venue rule, despite the existence of § 1400(b).  406 U.S. 706, 714 (1972) (concluding that the “broad and overriding” principle stated in then-§ 1391(d)[3] “cannot be confined in its application to cases that would otherwise fall under the general venue statutes,” as the statute merely reflected the “long-established rule that suits against aliens are wholly outside the operation of all the federal venue laws, general and special”); In re HTC Corp., No. 2018-130, slip op. at 9-10.

The Federal Circuit further rejected HTC Corporation’s contention that “§ 1400(b) should apply to it because Congress abrogated Brunette—and the alien-venue rule—through the Federal Courts Jurisdiction and Venue Clarification Act of 2011 (‘the 2011 amendments’).”  In re HTC Corp., No. 2018-130, slip op. at 10-11.  The Court noted that § 1400(b) “was not intended to supplant the longstanding rule that the venue laws do not protect alien defendants.”  In re HTC Corp., No. 2018-130, slip op. at 11; see also Brunette, 406 U.S. at 713-14 (“Since the general venue statutes did not reach suits against alien defendants, there is no reason to suppose the new substitute in patent cases was intended to do so”).  The Court then held that the recent “TC Heartland [decision] d[id] not alter this conclusion” because “while § 1400(b) governs venue in patent cases, it governs only to displace otherwise-applicable venue standards, not where there are no such standards due to the alien-venue rule.”  In re HTC Corp., No. 2018-130, slip op. at 12-13.  The Court also found no indication that Congress intended to either “modify the alien-venue rule specifically for patent cases” or “discard the well-established alien-venue rule in favor of generally bringing alien defendants, including foreign corporations . . ., within the protection of the venue laws.”[4]  Id. at 14-15.  Although abiding by the alien-venue rule may create a loophole for a plaintiff to forum shop, the Court emphasized that HTC Corporation’s argument would “create[] a far more unsatisfactory loophole—a complete inability for a patent owner to bring its infringement claims against alien defendants that fall outside the non-residence-based clause of § 1400(b).”  Id. at 19.

Therefore, the Federal Circuit determined that “[w]ith the Supreme Court having spoken on this issue twice [in In re Hohorst and Brunette], this court—without clear guidance from Congress—will not broadly upend the well-established rule that suits against alien defendants are outside the operation of the federal venue laws.”  Id.

Finally, as to the third condition of obtaining the mandamus relief, the Federal Circuit was not convinced that a writ would be warranted in this case “even if [HTC Corporation] had satisfied the first two mandamus requirements,” because HTC Corporation cited no case adopting its interpretation while “characterize[ing] this legal issue as ‘unsettled’ and resulting in ‘inconsistent’ holdings.”  Id. at 20.

Implications

  • In patent infringement actions, venue is now proper in any judicial district for foreign defendants, including foreign corporations.  The foreign defendants cannot rely on § 1400(b) or even the general venue statutes to dismiss or transfer a case pursuant to § 1406(a).
  • Depending on the particular facts in a case, foreign defendants may still seek to transfer the patent infringement action pursuant to § 1404(a).
  • In patent infringement actions against foreign defendants, plaintiffs’ ability to force foreign defendants into an unfavorable forum can give the plaintiffs additional leverage in settlement negations.

[1] TC Heartland LLC v. Kraft Foods Grp. Brands LLC, 137 S. Ct. 1514 (2017).

[2] The Court did recognize that “while an appeal will usually provide an adequate remedy for a defendant challenging the denial of an improper-venue motion, there may be circumstances in which it is inadequate.”  But the Court determined that it was unnecessary to articulate such
circumstances in this case, because HTC Corporation’s “only argument is that it should be able to avoid the inconvenience of litigation by having this issue decided at the outset of its case,” which was rejected by the Supreme Court in Bankers Life & Cas. Co. v. Holland, 346 U.S. 379, 383 (1953) (“[T]he extraordinary writs cannot be used as substitutes for appeals, even though hardship may result from delay and perhaps unnecessary trial.”).  In re HTC Corp., No. 2018-130, slip op. at 6-7. 

[3] Section 1391(d), at the time, stated that “[a]n alien may be sued in any district.” 28 U.S.C. § 1391(d) (1970).

[4] The Court noted that “Congress made only one clear change to the alien-venue rule in 2011” by “grant[ing] venue protection to alien natural persons having permanent resident status” but implemented “no comparable change with respect to foreign corporations.”  In re HTC Corp., No. 2018-130, slip op. at 13-17. 

© Copyright 2018 Brinks, Gilson & Lione
This article was written by Sen (Alex) Wang and Heidi Dare of Brinks, Gilson & Lione

Commission Overrules Xu v. Epic Systems, Finds Valid Arbitration Agreement or Waiver Bars Prosecution of WFEA Claims Before ERD

In Ionetz v. Menard, Inc., the Wisconsin Labor and Industry Review Commission overruled its previous and highly controversial decision Xu v. Epic Systems, Inc..

In Xu, the commission held that an employee cannot waive his or her right to file a discrimination complaint against his or her employer under the Wisconsin Fair Employment Act (WFEA). It further held that an employee may prosecute his or her WFEA claims on the merits against his or her former employer and that he or she can potentially receive a judgment against the former employer before the Wisconsin Equal Rights Division (ERD), even if he or she waived and released all such claims against his or her employer in a valid severance agreement. The commission based its decision on the conclusion that the ERD is an agency comparable to the Equal Employment Opportunity Commission (EEOC) and that the “language used in the severance agreement . . . was intended to preserve the complainant’s right to file a complaint with the ERD.” Also, the commission incorrectly concluded that, as with federal agencies such as the EEOC, “the complainant cannot be prohibited from . . . filing a complaint with the ERD.”

However, just months later in Ionetz, the commission overruled Xu and held that the law is just the opposite for WFEA claims before the ERDAs declared in Ionetz, “[u]nlike the broad investigative, enforcement and prosecutorial authority granted to EEOC . . . ERD’s statutory authority is limited to that of an adjudicative body charged with deciding particular disputes that are filed with it.” Also, “’unlike the EEOC . . . [ERD] has no independent ability to prosecute claims for violations of the WFEA.” Rather, according to the commission in Ionetz, the ERD’s “only statutory role in enforcing the WFEA is to adjudicate claims between employers and their employees.” (Emphasis in original)

“Consequently, where an employee has agreed to waive his or her discrimination claim against an employer, or to have it adjudicated in another forum [e.g., in arbitration], there remains no ancillary ERD authority that requires protection.” Also, “parties cannot by contract impose obligations on ERD that are inconsistent with the authority granted to it under the WFEA.” Ultimately, “the parties’ agreement to preserve the employee’s right to file a claim with the agency cannot require—or even empower—ERD to investigate or adjudicate claims that have been waived or committed to an alternate forum for resolution.”  The commission then held that ERD was without authority to advance such claims and overruled Xu.

As a result, a valid arbitration agreement or a waiver of claims in a settlement or severance agreement bars prosecution of WFEA claims before the ERD. “[O]nce the individual claim is waived (or . . . required to be submitted to another forum for resolution) there remains no additional investigative, enforcement or other function for ERD to perform.”

© 2018, Ogletree, Deakins, Nash, Smoak & Stewart, P.C., All Rights Reserved.

CMS Pushes for Hospital Price Transparency in Proposed Rule

On April 24, 2018, the Centers for Medicare & Medicaid Services (“CMS”) announced a new proposed rule (CMS-1694-P) (“Proposed Rule”). In an attempt to “empower patients through better access to hospital price information,” CMS plans to alter the requirements previously established by Section 2718(e) of the Affordable Care Act.[1]

Under Section 2718(e), “each hospital operating within the United States shall for each year establish (and update) and make public…a list of the hospital’s standard charges for items and services provided by the hospital.” CMS has previously interpreted Section 2718(e) to require hospitals to either make public a list of standard charges or implement policies for allowing the public to view a list of the standard charges by individual request. It was originally believed by CMS that patients could use such information to compare charges for similar services across hospitals, just as someone “shops around” for the best price in plumbing services. However, CMS contends that Section 2718(e), as is currently written, is insufficient to establish the necessary hospital price transparency.

The Proposed Rule takes Section 2718(e) a step further, and provides that beginning January 1, 2019, CMS will update the guidelines to require hospitals to make available a list of their current standard charges via the Internet in a machine readable format, which requirement a hospital may satisfy by publishing its chargemaster (i.e., a hospital’s comprehensive list of services and charges billable to a hospital patient). In addition to the publication requirement, the Proposed Rule further requires hospitals to update the standard charges they publicize at least annually.

Recently, some states, such as California and Colorado, have also taken steps to promote hospital price transparency. Under California’s “Payers’ Bill of Rights,”[2] California hospitals are required to either post an electronic copy of the charges for its services on the hospital’s website, or make a written or electronic copy available at the hospital’s location. Under Colorado law,[3] a healthcare provider must make available to the public, either electronically or by posting on the provider’s website, the healthcare prices of at least the 15 most common services rendered by the provider. Nevertheless, despite the move toward transparency at the state level, many states still lack extensive hospital price transparency statutes.

In addition to the Proposed Rule’s push toward price transparency, CMS has asked for public comments on a series of questions regarding price transparency, including the following:

  • Should “standard charges” be defined as the average rates for the items on the chargemaster; average rates for groups of services commonly billed together; or the average discount off the chargemaster amount across all payers?
  • What types of information would be most beneficial to patients; how can hospitals best enable patients to use charge information in their decision-making; and how can CMS and providers help third parties create patient-friendly interfaces with these data?
  • Should healthcare providers be required to inform patients how much their out-of-pocket costs for a service will be before those patients are furnished that service?
  • What is the most appropriate mechanism for CMS to enforce price transparency requirements? Should CMS impose civil monetary penalties on hospitals that fail to comply with the publication requirement?

Comments on the Proposed Rule are due by June 25, 2018.


[1] 42 U.S. Code § 300gg-18.

[2] California Health and Safety Code Sections 1339.50-1339.59.

[3] Colorado Revised Statutes Section 25-49-103(I).

Copyright © 2018, Sheppard Mullin Richter & Hampton LLP.

The Hacked & the Hacker-for-Hire: Lessons from the Yahoo Data Breaches (So Far)

The fallout from the Yahoo data breaches continues to illustrate how cyberattacks thrust companies into the competing roles of crime victim, regulatory enforcement target and civil litigant.

Yahoo, which is now known as Altaba, recently became the first public company to be fined ($35 million) by the Securities and Exchange Commission for filing statements that failed to disclose known data breaches. This is on top of the $80 million federal securities class action settlement that Yahoo reached in March 2018—the first of its kind based on a cyberattack. Shareholder derivative actions remain pending in state courts, and consumer data breach class actions have survived initial motions to dismiss and remain consolidated in California for pre-trial proceedings. At the other end of the spectrum, a federal judge has balked at the U.S. Department of Justice’s (DOJ) request that a hacker-for-hire indicted in the Yahoo attacks be sentenced to eight years in prison for a digital crime spree that dates back to 2010.

The Yahoo Data Breaches

In December 2014, Yahoo’s security team discovered that Russian hackers had obtained its “crown jewels”—the usernames, email addresses, phone numbers, birthdates, passwords and security questions/answers for at least 500 million Yahoo accounts. Within days of the discovery, according to the SEC, “members of Yahoo’s senior management and legal teams received various internal reports from Yahoo’s Chief Information Security Officer (CISO) stating that the theft of hundreds of millions of Yahoo users’ personal data had occurred.” Yahoo’s internal security team thereafter was aware that the same hackers were continuously targeting Yahoo’s user database throughout 2015 and early 2016, and also received reports that Yahoo user credentials were for sale on the dark web.

In the summer of 2016, Yahoo was in negotiations with Verizon to sell its operating business. In response to due diligence questions about its history of data breaches, Yahoo gave Verizon a spreadsheet falsely representing that it was aware of only four minor breaches involving users’ personal information.  In June 2016, a new Yahoo CISO (hired in October 2015) concluded that Yahoo’s entire database, including the personal data of its users, had likely been stolen by nation-state hackers and could be exposed on the dark web in the immediate future. At least one member of Yahoo’s senior management was informed of this conclusion. Yahoo nonetheless failed to disclose this information to Verizon or the investing public. It instead filed the Verizon stock purchase agreement—containing an affirmative misrepresentation as to the non-existence of such breaches—as an exhibit to a July 25, 2016, Form 8-K, announcing the transaction.

On September 22, 2016, Yahoo finally disclosed the 2014 data breach to Verizon and in a press release attached to a Form 8-K.  Yahoo’s disclosure pegged the number of affected Yahoo users at 500 million.

The following day, Yahoo’s stock price dropped by 3%, and it lost $1.3 billion in market capitalization. After Verizon declared the disclosure and data breach a “material adverse event” under the Stock Purchase Agreement, Yahoo agreed to reduce the purchase price by $350 million (a 7.25% reduction in price) and agreed to share liabilities and expenses relating to the breaches going forward.

Since September 2016, Yahoo has twice revised its data breach disclosure.  In December 2016, Yahoo disclosed that hackers had stolen data from 1 billion Yahoo users in August 2013, and had also forged cookies that would allow an intruder to access user accounts without supplying a valid password in 2015 and 2016. On March 1, 2017, Yahoo filed its 2016 Form 10-K, describing the 2014 hacking incident as having been committed by a “state-sponsored actor,” and the August 2013 hacking incident by an “unauthorized third party.”  As to the August 2013 incident, Yahoo stated that “we have not been able to identify the intrusion associated with this theft.” Yahoo disclosed security incident expenses of $16 million ($5 million for forensics and $11 million for lawyers), and flatly stated: “The Company does not have cybersecurity liability insurance.”

The same day, Yahoo’s general counsel resigned as an independent committee of the Yahoo Board received an internal investigation report concluding that “[t]he 2014 Security Incident was not properly investigated and analyzed at the time, and the Company was not adequately advised with respect to the legal and business risks associated with the 2014 Security Incident.” The internal investigation found that “senior executives and relevant legal staff were aware [in late 2014] that a state-sponsored actor had accessed certain user accounts by exploiting the Company’s account management tool.”

The report concluded that “failures in communication, management, inquiry and internal reporting contributed to the lack of proper comprehension and handling of the 2014 Security Incident.” Yahoo’s CEO, Marissa Mayer, also forfeited her annual bonus as a result of the report’s findings.

On September 1, 2017, a California federal judge partially denied Yahoo’s motion to dismiss the data breach class actions. Then, on October 3, 2017, Yahoo disclosed that all of its users (3 billion accounts) had likely been affected by the hacking activity that traces back to August 2013. During a subsequent hearing held in the consumer data breach class action, a Yahoo lawyer stated that the company had confirmed the new totals on October 2, 2017, based on further forensic investigation conducted in September 2017. That forensic investigation was prompted, Yahoo’s counsel said, by recent information obtained from a third party about the scope of the August 2013 breach. As a result of the new disclosures, the federal judge granted the plaintiffs’ request to amend their complaint to add new allegations and causes of action, potentially including fraud claims and requests for punitive damages.

The SEC Breaks New Cybersecurity Ground

Just a month after issuing new interpretive guidance about public company disclosures of cyberattacks (see our Post and Alert), the SEC has now issued its first cease-and-desist order and penalty against a public company for failing to disclose known cyber incidents in its public filings. The SEC’s administrative order alleges that Yahoo violated Sections 17(a)(2) & (3) of the Securities Act of 1933 and Section 13(a) of the Securities Exchange Act of 1934 and related rules when its senior executives discovered a massive data breach in December 2014, but failed to disclose it until after its July 2016 merger announcement with Verizon.

During that two-year window, Yahoo filed a number of reports and statements with the SEC that misled investors about Yahoo’s cybersecurity history. For instance, in its 2014-2016 annual and quarterly reports, the SEC found that Yahoo included risk factor disclosures stating that the company “faced the risk” of potential future data breaches, “without disclosing that a massive data breach had in fact already occurred.”

Yahoo management’s discussion and analysis of financial condition and results of operation (MD&A) was also misleading, because it “omitted known trends and uncertainties with regard to liquidity or net revenue presented by the 2014 breach.” Knowing full well of the massive breach, Yahoo nonetheless filed a July 2016 proxy statement relating to its proposed sale to Verizon that falsely denied knowledge of any such massive breach. It also filed a stock purchase agreement that it knew contained a material misrepresentation as to the non-existence of the data breaches.

Despite being informed of the data breach within days of its discovery, Yahoo’s legal and management team failed to properly investigate the breach and made no effort to disclose it to investors. As the SEC described the deficiency, “Yahoo senior management and relevant legal staff did not properly assess the scope, business impact, or legal implications of the breach, including how and where the breach should have been disclosed in Yahoo’s public filings or whether the fact of the breach rendered, or would render, any statements made by Yahoo in its public filings to be misleading.” Yahoo’s in-house lawyers and management also did not share information with its auditors or outside counsel to assess disclosure obligations in public filings.

In announcing the penalty, SEC officials noted that Yahoo left “its investors totally in the dark about a massive data breach” for two years, and that “public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors.” The SEC also noted that Yahoo must cooperate fully with its ongoing investigation, which may lead to penalties against individuals.

The First Hacker Faces Sentencing

Coincidentally, on the same day that the SEC announced its administrative order and penalty against Yahoo, one of the four hackers indicted for the Yahoo cyberattacks (and the only one in U.S. custody) appeared for sentencing before a U.S. District Judge in San Francisco. Karim Baratov, a 23-year-old hacker-for-hire, had been indicted in March 2017 for various computer hacking, economic espionage, and other offenses relating to the 2014 Yahoo intrusion.

His co-defendants, who remain in Russia, are two officers of the Russian Federal Security Service (FSB) and a Russian hacker who has been on the FBI’s Cyber Most Wanted list since November 2013. The indictment alleges that the Russian intelligence officers used criminal hackers to execute the hacks on Yahoo’s systems, and then to exploit some of that stolen information to hack into other accounts held by targeted individuals.

Baratov is the small fish in the group. His role in the hacking conspiracy focused on gaining unauthorized access to non-Yahoo email accounts of individuals of interest identified through the Yahoo data harvest.  Unbeknownst to Baratov, he was doing the bidding of Russian intelligence officers, who did not disclose their identities to the hacker-for-hire. Baratov asked no questions in return for commissions paid on each account he compromised.

In November 2017, Baratov pled guilty to conspiracy to commit computer fraud and aggravated identity theft. He admitted that, between 2010 and 2017, he hacked into the webmail accounts of more than 11,000 victims, stole and sold the information contained in their email accounts, and provided his customers with ongoing access to those accounts. Baratov was indiscriminate in his hacking for hire, even hacking for a customer who appeared to engage in violence against targeted individuals for money. Between 2014 and 2016, he was paid by one of the Russian intelligence officers to hack into at least 80 webmail accounts of individuals of interest to Russian intelligence identified through the 2014 Yahoo incident. Baratov provided his handler with the contents of each account, plus ongoing access to the account.

The government is seeking eight years of imprisonment, arguing that Baratov “stole and provided his customers the keys to break into the private lives of targeted victims.” In particular, the government cites the need to deter Baratov and other hackers from engaging in cybercrime-for-hire operations. The length of the sentence alone suggests that Baratov is not cooperating against other individuals. Baratov’s lawyers have requested a sentence of no more than 45 months, stressing Baratov’s unwitting involvement in the Yahoo attack as a proxy for Russian intelligence officers.

In a somewhat unusual move, the sentencing judge delayed sentencing and asked both parties to submit additional briefing discussing other hacking sentences. The judge expressed concern that the government’s sentencing request was severe and that an eight-year term could create an “unwarranted sentencing disparity” with sentences imposed on other hackers.

The government is going to the mat for Baratov’s victims.  On May 8, 2018, the government fired back in a supplemental sentencing memorandum that reaffirms its recommended sentence of 8 years of imprisonment. The memorandum contains an insightful summary of federal hacking sentences imposed on defendants, with similar records who engaged in similar conduct, between 2008 and 2018. The government surveys various types of hacking cases, from payment card breaches to botnets, banking Trojans and theft and exploitation of intimate images of victims.

The government points to U.S. Sentencing Guidelines Commission data showing that federal courts almost always have imposed sentences within the advisory Guidelines range on hackers who steal personal information and do not earn a government-sponsored sentence reduction (generally due to lack of cooperation in the government’s investigation). The government also expands on the distinctions between different types of hacking conduct and how each should be viewed at sentencing. It focuses on Baratov’s role as an indiscriminate hacker-for-hire, who targeted individuals chosen by his customers for comprehensive data theft and continuous surveillance. Considering all of the available data, the government presents a very persuasive argument that its recommended sentence of eight years of imprisonment is appropriate. Baratov’s lawyers may now respond in writing, and sentencing is scheduled for May 29, 2018.

Lessons from the Yahoo Hacking Incidents and Responses

There are many lessons to be learned from Yahoo’s cyber incident odyssey. Here are some of them:

The Criminal Conduct

  • Cybercrime as a service is growing substantially.

  • Nation-state cyber actors are using criminal hackers as proxies to attack private entities and individuals. In fact, the Yahoo fact pattern shows that the Russian intelligence services have been doing so since at least 2014.

  • Cyber threat actors—from nation-states to lone wolves – are targeting enormous populations of individuals for cyber intrusions, with goals ranging from espionage to data theft/sale, to extortion.

  • User credentials remain hacker gold, providing continued, unauthorized access to online accounts for virtually any targeted victim.

  • Compromises of one online account (such as a Yahoo account) often lead to compromises of other accounts tied to targeted individuals. Credential sharing between accounts and the failure to employ multi-factor authentication makes these compromises very easy to execute.

The Incident Responses

  • It’s not so much about the breach, as it is about the cover up. Yahoo ran into trouble with the SEC, other regulators and civil litigants because it failed to disclose its data breaches in a reasonable amount of time. Yahoo’s post-breach injuries were self-inflicted and could have been largely avoided if it had properly investigated, responded to, and disclosed the breaches in real time.

  • SEC disclosures in particular must account for known incidents that could be viewed as material for securities law purposes.  Speaking in the future tense about potential incidents will no longer be sufficient when a company has actual knowledge of significant cyber incidents.

  • Regulators are laying the foundation for ramped-up enforcement actions with real penalties. Like Uber with its recent FTC settlement, Yahoo received some leniency for being first in terms of the SEC’s administrative order and penalty. The stage is now set and everyone is on notice of the type of conduct that will trigger an enforcement action.

  • Yahoo was roundly applauded for its outstanding cooperation with law enforcement agencies investigating the attacks. These investigations go nowhere without extensive victim involvement. Yahoo stepped up in that regard, and that seems to have helped with the SEC, at least.

  • Lawyers must play a key role in the investigation and response to cyber incidents, and their jobs may depend on it. Cyber incident investigations are among the most complex types of investigations that exist. This is not an area for dabblers and rookies. Organizations need to hire in-house lawyers with actual experience and expertise in cybersecurity and cyber incident investigations.

  • Senior executives need to become competent in handling the crisis of cyber incident response. Yahoo’s senior executives knew of the breaches well before they were disclosed. Why the delay? And who made the decision not to disclose in a timely fashion?

  • The failures of Yahoo’s senior executives illustrate precisely why the board of directors now must play a critical role not just in proactive cybersecurity, but in overseeing the response to any major cyber incident. The board must check senior management when it makes the wrong call on incident disclosure.

The Litigation

  • Securities fraud class actions may fare much better than consumer data breach class actions. The significant stock drop coupled with the clear misrepresentations about the material fact of a massive data breach created a strong securities class action that led to an $80 million settlement.  The lack of financial harm to consumers whose accounts were breached is not a problem for securities fraud plaintiffs.

  • Consumer data breach class actions are more routinely going to reach the discovery phase. The days of early dismissals for lack of standing are disappearing quickly.  This change will make the proper internal investigation into incidents and each step of the response process much more critical.

  • Although the jury is still out on how any particular federal judge will sentence a particular hacker, the data is trending in a very positive direction for victims. At least at the federal level, hacks focused on the exploitation of personal information are being met with stiff sentences in many cases. A hacker’s best hope is to earn government-sponsored sentencing reductions due to extensive cooperation. This trend should encourage hacking victims (organizations and individuals alike) to report these crimes to federal law enforcement and to cooperate in the investigation and prosecution of the cybercriminals who attack them.

  • Even if a particular judge ultimately goes south on a government-requested hacking sentence, the DOJ’s willingness to fight hard for a substantial sentence in cases such as this one sends a strong signal to the private sector that victims will be taken seriously and protected if they work with the law enforcement community to combat significant cybercrime activity.

Copyright © by Ballard Spahr LLP
This post was written by Edward J. McAndrew of Ballard Spahr LLP.

At Risk Of Providing Free Construction Work In Illinois? When A Contractor May Rely On Quantum Meruit To Recover For ‘Extra Work’

In Archon Construction Co. v. U.S. Shelter, L.L.C., 2017 IL App (1st) 153409, the Illinois Appellate Court held that a contractor could not recover on a quantum meruit claim for extra work even though the contractor did not recover for the extras in a breach of contract action. The court’s ruling rejects the common contractor argument that a claim for quantum meruitexists where the defendant requested the services rendered but cannot recover payment for those services under the terms of an existing contract.

In so ruling, the court in Archon announced a clear test for determining whether a contractor is entitled to recover under quantum meruit: “[A] claim for quantum meruit lies when the work that the plaintiff performed was wholly beyond the subject matter of the contract that existed between the parties.” Stated differently, Archon reaffirms that quantum meruit is not available in Illinois where the extra work involved the same “general subject matter” as a construction contract.

The case arose from the installation of a sanitary-sewer system in connection with the development of a new subdivision in the City of Elgin, Illinois. The subdivision was developed by U.S. Shelter, LLC, U.S. Shelter Group Inc., and Oak Ridge of Elgin, LLC (collectively, the developer). Archon Construction, the contractor, submitted a proposal to build the sewer system and other underground utilities not at issue in the case based on existing plans and the applicable specifications of both the city and the state of Illinois. The plans and specifications generally required the contractor to install a sewer system that was acceptable to the city. The developer accepted the contractor’s final proposal, and the proposal became the governing contract between the parties.

The plans and specifications permitted the contractor to install a sewer system made of either ductile iron or PVC, provided that the PVC had at least a specific wall thickness relative to the pipe’s diameter (a Minimum Wall Thickness). The contractor’s proposal was based entirely on the installation of PVC pipe and did not provide for the installation of ductile iron for any of the sewer lines. Under the proposal, “[a]ny additional work items not listed will be completed on negotiated price or [time and materials].” On three separate occasions during construction, the contractor excavated and repaired various portions of the sewer system that were constructed with PVC pipe that did not meet the requirements for Minimum Wall Thickness. The contractor did not seek additional payment for this work. Following final completion, the developer’s civil engineer confirmed that the contractor’s work complied with the plans and specifications.

Approximately two years after the contractor completed its work, and as a condition to final acceptance by the city, both the developer and the city inspected the sewer system for defects. The city claimed that a portion of the sewer system was cracked, with fill material entering the lines. The city refused to accept the sewer system unless the developer dug up the impacted portion and replaced the contractor’s PVC pipe with ductile iron in that section. The contractor completed the necessary repairs and sent the developer a bill for approximately $250,000 determined on a time-and-material basis. When the developer refused to pay, the contractor filed a lien claim. This lawsuit followed.

The contractor initially pursued claims for breach of contract. Under Illinois law, however, the contractor cannot collect contract damages for extra work unless it can prove by clear and convincing evidence that, in pertinent part, “the extra work was not made necessary through the fault of the contractor.” After discovery, the trial court granted summary judgment against the contractor on the grounds that the contractor could not present evidence to prove this essential fact. The appellate court reversed, with one justice dissenting on the grounds raised by the trial court. After remand, the contractor abandoned its contract claims and proceeded with a trial limited to its quantum meruitclaim. Following a bench trial, the trial court ruled that the contractor could not pursue claims for quantum meruit as a matter of law because the repair work was covered under the terms of the express contract between the developer and the contractor.

On review, the appellate court reiterated that “[i]t is long settled in Illinois that an action in quasi-contract, such as quantum meruit, is precluded by the existence of an express contract between the parties regarding the work that was performed.” However, the court noted the potential for confusion in the construction context:

Where do we draw the line between work being ‘outside the scope of a contract’ [a contractual claim for extras] versus there being no express contract governing the work [a quasi-contractual claim]? They would seem to cover a lot of the same territory, but as a matter of law, they cannot…. [T]he answer is that a claim for quantum meruit lies when the work that the plaintiff performed was wholly beyond the subject matter of the contract that existed between the parties.
***
If the work for which a plaintiff seeks remuneration under a quantum meruit theory concerned the same subject matter of the express contract, then the quantum meruit claim is barred as a matter of law.

In so holding, Archon foreclosed the common contractor argument that quantum meruit is available when the contractor cannot recover payment on a breach-of-contract claim. The court held: “[W]hether [the contractor] ultimately could have prevailed on that contractual claim or not, the fact remains that a contractual remedy was the only claim available to [the contractor] as a matter of law.”

Applying the law to the facts of the case, the contractor’s quantum meruit claim sought to recover the cost to repair the same sewer system that it contracted to install. The repairs “unquestionably involved the same ‘general subject matter’ as the contract” and, therefore, the contractor could not recover in quantum meruit even though it had little chance of success on proving its contract claim for the extra work.

Archon makes clear that a contractor assumes the risk that it will be paid for extra work that falls within the same general subject matter as its contract if it carries out that work without either a signed change order or a construction change directive. If the resulting contract claim for extra work fails for any reason, then Illinois law may not permit the contractor to recover for that extra work under the theory of quantum meruit.

© 2018 BARNES & THORNBURG LLP
This article was written by Gregory S. Gistenson of Barnes & Thornburg LLP

The 340B Ceiling Price and CMP Rule . . . Changes on the Horizon?

After more than eight years in the making, the 340B Drug Pricing Program Ceiling Price and Manufacturer Civil Monetary Penalties Regulation (the “Rule”) seems to be a rudderless ship on a shoreless sea. On Monday, the Health Resources and Services Administration (HRSA) issued a notice of proposed rulemaking delaying the implementation date of the final Rule from July 1, 2018 to July 1, 2019. The final Rule was published eighteen months ago (January 5, 2017) and the implementation date has since been delayed on four different occasions. HRSA has cited a variety of reasons for each delay—compliance with the Regulatory Freeze issued by the incoming Trump Administration; providing stakeholders additional time to prepare for compliance with the Rule; yet more time for compliance preparations; and additional time for HRSA to “fully consider the substantial questions of fact, law, and policy raised by the [R]ule.”

For this fifth and most recent delay, HRSA stated that implementation of the final Rule would be “counterproductive” in light of HRSA’s intention to “engage in additional or alternative rulemaking[s] on these issues.” See 83 FR 20008, May 5, 2018. Notably, these additional/alternative rulemakings are linked to broader Health and Human Services’ efforts to “develop[] new comprehensive policies to address the rising costs of prescription drugs” in government programs such as “Medicare Parts B & D, Medicaid, and the 340B discount drug program.” Id. at 5.

However, linking the intended additional regulatory activity to the broader efforts to address drug pricing is curious in light of the HRSA’s limited rulemaking authority. See PhRMA v. HHS, 43 F. Supp. 3d 28 (D.D.C. 2014). Since Judge Contreras determined that HRSA’s rulemaking authority is limited to (1) establishment of an alternative dispute resolution process; (2) defining standards of methodology to calculate ceiling prices; and (3) imposition of civil monetary penalties, HRSA has not completed a rulemaking or regulatory issuance. See id. (vacating the Orphan Drug Rule); PhRMA v. HHS, 138 F. Supp. 3d 31 (D.D.C. 2015) (vacating the subsequent Orphan Drug Interpretive Rule); Office of Management and Budget, RIN: 0906-AB08 (Jan. 30, 2017) (withdrawing the 340 Program Omnibus Guidance); 340B Ceiling Price and CMP Rule, 3 FR 20008 (delaying implementation until July 1, 2019).

It is unclear whether the most recent delay means that the 340B Ceiling Price and CMP Rule is doomed to join the wreckage of its 340B regulatory brethren. However, this most recent update from HRSA indicates three things: (1) stakeholders are still operating in the pre-2015 framework; (2) the debate over the 340B program’s role in drug pricing is sure to continue; and (3) further challenges to HRSA’s regulatory authority may be on the horizon.

© 2018 Covington & Burling LLP

Tax Reform – I.R.S. Updates Withholding Tax Guidance on Sales of Partnership Interests

On April 2, 2018, the Internal Revenue Service (“IRS”) released Notice 2018-29[1] (the “Notice”), announcing the intention of the IRS and the Department of the Treasury to issue regulations regarding the withholding requirements under Section 1446(f),[2] which was promulgated pursuant to recently enacted U.S. tax legislation, commonly referred to as the “Tax Cuts and Jobs Act”.[3] The Notice also provided interim guidance that taxpayers may rely on until further guidance is issued.

The Notice does not affect the suspension of withholding pursuant to Section 1446(f) for publicly traded partnerships under Notice 2018-08, issued in December of 2017, nor does the guidance related to Section 1446(f) affect a transferor’s tax liability under Section 864(c)(8).

General Rules

For dispositions of partnership interests occurring after December 31, 2017, Section 1446(f) generally requires the transferee to withhold and remit 10 percent of the “amount realized” by the transferor, if any portion of the gain (if any) realized by the transferor would be treated as effectively connected with the conduct of a trade or business in the United States under Section 864(c)(8). The “amount realized” generally includes proceeds (whether cash or other property) as well as any liabilities deemed assumed by the transferee for tax purposes. Though Section 1446(f) generally requires a transferee to effect the withholding, Section 1446(f)(4) imposes a secondary obligation on the transferred partnership: in the event the transferee fails to withhold and remit the appropriate amount, the partnership is required to withhold and remit the amount of the shortfall (together with interest) from its subsequent distributions to the transferee.

Reporting and Paying Over Withheld Amounts

In the Notice, the IRS has indicated that the procedural regime that exists under the Foreign Investment in Real Property Tax Act of 1980 (“FIRPTA”) and Section 1445 generally will also apply to Section 1446(f). Generally, this will mean reporting and paying over any withheld amounts within 20 days of the relevant transfer. The IRS has asserted that withholding agents will not be subject to interest and penalties on account of late payment if any withholding that, per the Notice, is due prior to May 31, 2018, is paid in full on or prior to May 31, 2018.

The IRS is not currently issuing new forms for Section 1446, and taxpayers are generally instructed to continue to use the forms required under Section 1445 (with “Section 1446(f)(1) withholding” noted on the relevant form).

Where withholding is required under both Section 1445 and Section 1446(f), the transferee need only withhold pursuant to Section 1445 (unless the transferor has obtained a withholding certificate pursuant to Treasury Regulations Section 1.1445-11T(d)(1), in which case the transferee must withhold the greater of the amount required to be withheld pursuant to Section 1445 and the amount required to be withheld pursuant to Section 1446(f)).

Suspension of Secondary Partnership Withholding Obligation

Until further guidance is provided, the IRS has suspended the secondary withholding obligation imposed on partnerships in the event a transferee fails to appropriately withhold in accordance with Section 1446(f).

Exceptions to Withholding Requirements

Pursuant to the statutory exception provided in Section 1446(f)(2), the IRS has provided that withholding will not be required where a transferor certifies its non-foreign status in an affidavit, signed under penalties of perjury, containing the transferor’s U.S. taxpayer identification number (if applicable). Generally, a correct and complete Form W-9 will satisfy these requirements. Until the IRS issues further guidance, such certifications should not be remitted to the IRS. As with FIRPTA, where a transferee has actual knowledge, or receives notice from its agent or the transferor’s agent, that a certification is false, the certification may not be relied upon.

In addition to the statutory exception, the Notice provides that withholding is generally not required where (i) a transferor certifies that no gain will be realized in the disposition, (ii) a transferor certifies, no more than 30 days prior to the date of transfer, that, for the “immediately prior taxable year”[4] and the two taxable years that precede it, it has been a partner in the partnership for the entirety of each such taxable year and its share of effectively connected taxable income (as determined under Treasury Regulations Section 1.1446-2) for each such taxable year was less than 25% of its total distributive share for such year,[5] or (iii) the transferred partnership certifies, no more than 30 days prior to the date of transfer, that the amount of gain that would be treated as effectively connected with the conduct of a trade or business within the United States if the partnership were to sell all of its assets as of the date of the certification would be less than 25% of the total gain.[6] As with the certification of non-foreign status, these certificates must be signed under penalties of perjury, and the certifications provided by the transferor must also contain the transferor’s U.S. taxpayer identification number (if applicable).

Lastly, the IRS has provided that no withholding is required in nonrecognition transactions where the transferor provides the transferee a notice that satisfies the requirements of Treasury Regulations Section 1.1445-2(d)(2) (which also requires that the relevant statement be made under penalties of perjury), treating references therein to “1445(a)” and “U.S. real property interest” as references to “1446(f)” and “partnership interest”, respectively (though until further guidance is issued, transferees should not remit such notices to the IRS). The IRS specifically noted that future regulations regarding the treatment of nonrecognition transactions under Section 864(c)(8) may impact this.

Determining Partnership Liabilities included in Amount Realized

For purposes of determining the amount of liabilities included in a transferor’s amount realized, the IRS has generally provided for certificates that may be issued (under penalties of perjury) in certain circumstances by certain transferors or transferred partnerships. These certificates will generally allow a transferee to rely on the amount of partnership liabilities reported as apportioned to the transferor on the most-recent Schedule K-1 (Form 1065) of the transferred partnership, and will need to state that the certifier has no actual knowledge of events that would alter such amount by 25 percent or more.

No Withholding in Excess of Proceeds Paid

The Notice generally provides that in no event shall a transferee be required to withhold an amount in excess of the amount realized less the liabilities deemed assumed by the transferee in the transfer. This means there is no “dry withholding” requirement – as a transferee’s obligation to withhold is capped by the cash or other property paid in the transaction.

Application to Distributions

In clarifying that Section 1446(f) also applied to certain partnership distributions, the IRS has provided that a partnership may rely on either its own books and records or a certification from the distributee partner when determining whether the distribution exceeds the partner’s basis in its partnership interest, and thus whether the distribution will be, at least in part, treated as a transfer subject to Section 1446(f).

Application to Tiered Partnerships

A look-through rule will be used to determine the amount of effectively connected taxable income realized pursuant to Section 864(c)(8) by a transferor that disposes of an ‘upper-tier’ partnership that also owns ‘lower-tier’ partnerships. The IRS has indicated that future regulations will require lower-tier partnerships to furnish information to upper-tier partnerships in order to effectuate this look-through rule and related withholding obligations.

Request for Comments

The IRS has also requested comments on the rules to be issued under Section 1446(f). Of specific interest, the IRS has asked for comments regarding (i) rules for determining the amount realized, including when the required withholding exceeds the proceeds of a sale and (ii) procedures that reduce the amount to be withheld, including in connection with “identifiable historically compliant taxpayers”.

Former summer associate Christine Sherman provided invaluable assistance in preparation of this update


[1] “Guidance Regarding the Implementation of New Section 1446(f) for Partnership Interests That Are Not Publicly Traded.”

[2] Unless otherwise noted, all references to ‘Sections’ herein are references to sections of the Internal Revenue Code of 1986, as amended.

[3] Public Law No: 115-97, enacted December 22, 2017. The legislation does not have a short title; the official title is “H.R.1 – An Act to provide for reconciliation pursuant to titles II and V of the concurrent resolution on the budget for fiscal year 2018.”

[4] A transferor’s “immediately prior taxable year” is the most recent taxable year of the transferor that includes the partnership taxable year that ends with or within the transferor’s taxable year and for which both a Form 8805, Foreign Partner’s Information Statement of Section 1446 Withholding Tax, and a Schedule K-1 (Form 1065) were due (including extensions) or filed (if earlier) by the time of the transfer. This appears to mean that, for a transferor that files on a calendar-year basis and transfers as of, say, January 1, 2018, the “immediately prior taxable year” would actually be 2016 – but further guidance from the IRS will be necessary to confirm that.

[5] Transferees may not rely on such certificates prior to the transferor’s receipt of the relevant Schedule K-1s (Forms 1065) and Forms 8805.

[6] For the 25% tests described in (ii) and (iii), the IRS is considering lowering the withholding threshold. This would have the impact of subjecting more transfers to withholding.

© 2018 Proskauer Rose LLP.
This article was written by Mary B KuusistoMartin T Hamilton, and Stephen Severo of Proskauer Rose LLP

President Trump Reimposes Secondary Sanctions on Non-U.S. Companies Doing Business with Iran

On May 8, 2018, President Trump announced that the United States would no longer be participating in the Joint Comprehensive Plan of Action (JCPOA), under which Iran agreed to curb its nuclear program in exchange for sanctions relief. Therefore, sanctions on non-U.S. companies doing business with Iran will “snap-back” and be re-imposed. In essence, and as explained below, the U.S. sanctions will return to the pre-January 2016 status quo.

The president directed that all sanctions be re-imposed as soon as possible, but no later than 180 days from the date of the May 8 announcement. In accordance with this directive, the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC), which administers and enforces U.S. sanctions against Iran, has published a detailed statement and Frequently Asked Questions (FAQs). OFAC has provided a 90-day and a 180-day “wind-down period” before certain sanctions will become effective.

Specifically, after the 90-day wind-down period ends on August 6, 2018, the U.S. will re-impose sanctions related to the following activities:

  • The purchase or acquisition of U.S. dollar banknotes by the Government of Iran.
  • Iran’s trade in gold or precious metals.
  • The direct or indirect sale, supply, or transfer to or from Iran of graphite, raw or semi-finished metals such as aluminum and steel, coal, and software for integrating industrial processes.
  • Significant transactions related to the purchase or sale of Iranian rials or the maintenance of significant funds or accounts outside the territory of Iran denominated in the Iranian rial.
  • The purchase, subscription to, or facilitation of the issuance of Iranian sovereign debt.
  • Sanctions on Iran’s automotive sector.
  • Activities undertaken pursuant to specific licensing issued in connection with the Statement of Licensing Policy for Activities Related to the Export or Re-export to Iran of Commercial Passenger Aircraft and Related Parts and Services, including those undertaken pursuant to OFAC’s General License I.

An additional group of secondary sanctions will snap back after a 180-day wind-down period ends on November 4, 2018. Specifically, effective November 5, 2018, the U.S. will re-impose sanctions related to the following activities and related services:

  • Sanctions on Iran’s port operators and shipping and shipbuilding sectors.
  • Sanctions on petroleum-related transactions with, among others, the National Iranian Oil Company, including the purchase of petroleum, petroleum products, or petrochemical products from Iran.
  • Sanctions on foreign financial institutions doing business with the Central Bank of Iran and designated Iranian financial institutions under Section 1245 of the National Defense Authorization Act for Fiscal Year 2012.
  • Sanctions on the provision of specialized financial messaging services to the Central Bank of Iran and Iranian financial institutions described in Section 103(c)(2)(E)(ii) of the Comprehensive Iran Sanctions and Divestment Act of 2010.
  • Sanctions on the provision of underwriting services, insurance, or re-insurance.
  • Sanctions on Iran’s energy sector.

Significantly, for any U.S. companies whose foreign subsidiaries were engaging in transactions with Iran pursuant to OFAC’s General License H, that general license will be revoked effective November 5, 2018. Also on November 5, 2018, the United States will re-impose sanctions on certain Iranian financial institutions and other persons who had been removed from OFAC’s Specially Designated Nationals and Blocked Persons List (SDN List) pursuant to the JCPOA and Executive Order 13599.

After the applicable wind-down period has completed, OFAC will allow payment for goods or services provided during the wind-down period so long as there was a written contract or agreement covering the activities that was entered into prior to May 8, 2018. This includes loans or credits if memorialized in writing prior to May 8, 2018. To qualify, the activities must have been consistent with U.S. sanctions at the time of delivery or provision of goods or services. Additionally, the payment must be consistent with U.S. sanctions (i.e., no involvement by U.S. persons or U.S. financial institutions, unless the transactions were exempt from regulation or authorized by OFAC).

Companies, financial institutions, and others who engage in prohibited transactions after the wind-down periods expire, or who perform activities outside the scope of permissible wind-down activities, can face sanctions and penalties. When considering enforcement actions, OFAC will evaluate the efforts and steps taken to comply with the wind-down requirements.

In the coming days, OFAC will publish additional information on its website and in the Federal Register concerning the re-imposition of sanctions. For now, all persons doing business with Iran, or considering entering into new business with Iran (even if previously authorized by the JCPOA), should carefully consider their positions.

©2018 Drinker Biddle & Reath LLP. All Rights Reserved
This article was written by Nate Bolin and Mollie D. Sitkowski of Drinker Biddle & Reath LLP

State Anti-Arbitration Statutes, the New York Convention and the McCarran-Ferguson Act

Arbitration provisions in insurance or reinsurance contracts periodically are challenged based on state anti-arbitration statutes.  Often, when non-US insurers or reinsurers are involved, the Convention on the Recognition and Enforcement of Foreign Arbitral Awards (the “New York Convention“) is raised as a basis to enforce the arbitration provisions in federal court.  The counterpoint to that argument is reverse preemption under the McCarran-Ferguson Act.  This is a heady academic subject that has real world consequences when a party is trying to enforce an arbitration provision in an insurance or reinsurance contract.

In a recent case, a Missouri federal court was faced with the question of whether it had subject matter jurisdiction underchapter 2 of the Federal Arbitration Act (“FAA”) to hear a dispute over whether arbitration could be compelled on a series of insurance policies. Foresight Energy, LLC. v. Certain London Market Ins. Cos., No. 17-CV-2266 CAS, 2018 U.S. Dist. LEXIS 69423 (E.D. Mo. Apr. 25, 2018).  The insurance policies required disputes to be arbitrated in London.  The policies, however, were governed by Missouri law and Missouri has an anti-arbitration statute that precludes arbitrations between insurers and policyholders. Mo. Rev. Stat. sec. 435.350 (2010).

The case was originally brought in state court, but one of the carriers removed it to federal court claiming federal subject matter jurisdiction under Chapter 2 of the FAA given the presence of non-US insurers.  The policyholder moved to remand the matter back to state court and the court granted the motion.

The gist of the argument came down to whether the New York Convention is self-executing, and therefore not an act of Congress, or whether its implementing legislation in chapter 2 of the FAA is an act of Congress that interferes with state law regulating the business of insurance. In granting the remand motion, the court found that the plain language of McCarran-Ferguson, stating that no act of Congress can supersede state law regulating the business of insurance, was applicable to Missouri’s anti-arbitration provision when faced with chapter 2 of the FAA, an act of Congress.

The court adopted the analysis of the Second and Eighth Circuits in Stephens v. American International Ins. Co., 66 F.3d 41 (2d Cir. 1995) and Transit Casualty Co. v. Certain Underwriters at Lloyd’s of London, 119 F.3d 619 (8th Cir. 1997) and rejected the reasoning of the Fourth Circuit, in EAB Group, Inc. v. Zurich Ins. PLC., 685 F.3d 376 (4th Cir. 2012), which limited McCarran-Ferguson to domestic legislation. The court agreed with the notion that the New York Convention was not self-executing and that the Missouri anti-arbitration statute was a state law regulating the business of insurance.  The court concluded that because chapter 2 of the FAA was an act of Congress and the New York Convention was not self-executing, McCarran-Ferguson reverse preempted the FAA and, accordingly, removed the basis for federal subject matter jurisdiction.  The case was remanded to state court for lack of subject matter jurisdiction.

At some point, the US Supreme Court will weigh in on this controversy, or perhaps the McCarran-Ferguson Act will be amended or, as some in Congress have promised, repealed.  In the interim, these arguments continue to play out differently depending on the federal circuit where the case is brought.

© Copyright 2018 Squire Patton Boggs (US) LLP
This article was written by Larry P. Schiffer of Squire Patton Boggs (US) LLP

U.S. District Court for DC Dismisses CSBS’ Challenge Regarding Federal Fintech Charter, All Eyes on the OCC

The U.S. District Court for the District of Columbia recently granted the Office of the Comptroller of the Currency’s (“OCC”) motion to dismiss a lawsuit brought by the Conference of State Bank Supervisors (“CSBS”) challenging the OCC’s authority to issue special purpose charters to FinTech companies.  According to the court, the CSBS currently lacks standing to bring the action because the OCC has not to-date issued such a charter.

In a press release about the decision, John Ryan, President and CEO of CSBS, emphasized that the court did not rule on the merits of the case.  Consequently, the CSBS may renew its challenge if and when the OCC issues such a charter. In December 2017, another federal district court dismissed a similar lawsuit brought by the New York Department of Financial Services on the same grounds.  Because the OCC is set to provide additional details about its views concerning the charter by the end of June or July, these legal disputes could restart sometime this summer.  Comptroller of the Currency Joseph Otting has reportedly stated that the OCC has not “concluded” its position and welcomes “people’s feedback.”  In the past, he has appeared to support the concept of a FinTech charter, recognizing the value it might add to the small dollar lending market.

Many FinTech firms have advocated for a federal charter from the OCC to avoid the need to obtain licenses on a state-by-state basis.  Some industry participants believe that such a charter would reduce the burden of regulatory compliance, increase access to capital for underserved consumers, and make the U.S. more competitive with countries that have adopted a more uniform approach to FinTech regulation.  The CSBS and others have argued that FinTech companies are currently subject to the 50-state licensing regime because the National Bank Act does not authorize the OCC to grant such non-depository institutions a national bank charter.  Moreover, they argue that state regulators are working to modernize regulations and to move toward a more integrated system of licensing and oversight.

Copyright 2018 K & L Gates
This article was written by Daniel S. Cohen and Eric A. Love of K&L Gates