A federal court will permit Baidu, Inc., a leading Chinese search engine company, to sue Register.com for gross negligence, recklessness, and breach of contract.

The lawsuit arose after a hacker took over Baidu’s Register.com account and interrupted its service for two days in January 2010. Among other things, the hacker redirected Baidu’s users to the Web site of the Iranian Cyber Army. Baidu claimed the hacker wrested control of Baidu’s account as a result of errors made by Register.com’s tech support Internet “chat” staff. According to the complaint: ”Although the Intruder gave the Rep an incorrect response to [a] security question, the Rep nonetheless proceeded with processing the Intruder’s request to change Baidu’s email address; [and] [w]hen the Intruder sent the Rep a bogus security code, the Rep did not notice that it was the wrong code, apparently because the Rep didn’t even bother to check it against the original security code.” The Intruder then allegedly changed the password and hacked into Baidu’s account. Baidu claimed injury to its reputation and business totaling “millions” of dollars.

Register.com moved to dismiss the complaint, asserting a “Limitation of Liability” clause from its Master Services Agreement with Baidu. Among other things, the clause provided that Register. com “will not be liable, under any circumstances, for any (a) termination, suspension, loss, or modification of … Services, (b) use of or the inability to use the Service(s), (c) interruption of business, (d) access delays or access interruptions to this site or a service ….”

Judge Denny Chin of the US District Court for the Southern District of New York held that Register’s contractual limitation of liability clause did not shield the company from allegations of gross negligence and willful misconduct. The Judge held that while limitation of liability clauses are generally enforceable, “an exculpatory agreement … will not exonerate a party from liability under all circumstances. Under announced public policy, it will not apply to exemption of willful or grossly negligent acts [citation omitted].” The opinion notes that if Baidu proves its allegations, “then Register failed to follow its own security protocols and essentially handed over control of Baidu’s account to an unauthorized Intruder….”

The judge ordered a pre-trial conference for August 11th.