Opinion
4:22-cv-07709-KAW
08-11-2023
LEONARD DUPRAZ, et al., Plaintiffs, v. DOES 1-10, Defendant.
ORDER TO SHOW CAUSE TO PLAINTIFFS; ORDER VACATING 8/17/23 HEARING
RE: DKT. NO. 1
KANDIS A. WESTMORE, United States Magistrate Judge
On December 7, 2022, Plaintiffs Leonard Dupraz and Celeste Lee filed this lawsuit agains Doe Defendants alleging that their respective Instagram accounts were “hacked,” which led to the accounts being disabled. (Compl., Dkt. No. 1 ¶¶ 1, 8-11, 14-15.) Plaintiffs have not been able to reactivate their accounts. (FAC ¶¶ 12, 14-15.) In February 2023, Plaintiffs served an amended subpoena on nonparty Meta Platforms, Inc., which owns Instagram. On July 6, 2023, Meta filed a motion to quash the subpoena. (Dkt. No. 20.)
Plaintiff's complaint alleges four causes of action; only one of which is a federal claim. The Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, generally attaches criminal penalties to cyber-based crimes. Even so, subsection (g) provides a limited private right of action if the violation causes a loss of at least $5,000 in value. See 18 U.S.C. § 1030(g). Here, the crux of Plaintiffs' federal claim involves the disabling of their social media accounts. (See Compl. ¶¶ 8 15.) The CFAA, however, prohibits actual damage or impairment of a protected computer, such as the corruption of files. See Van Buren v. United States, 141 S.Ct. 1648, 1660, 210 L.Ed.2d 26 (2021). The Ninth Circuit explicitly declined to extend CFAA civil liability to public websites such as Instagram. hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1199 (9th Cir. 2022) (LinkedIn is a public website outside of CFAA's purview.).
In the operative complaint, Plaintiffs allege that
Doe Defendants accessed Plaintiffs' computers and/or cellular phones. They did so with the intent to manipulate various hardware and/or software in order to limit or restrict their access to online accounts, with the primary intention to have their Instagram accounts be disabled. Doe Defendants also retrieved data from Plaintiffs' computers and/or cellular phones without Plaintiffs' knowledge or consent. They also accessed various online accounts maintained by Plaintiffs and attempted to have them altered in a way that would [sic?] Plaintiffs from accessing their own data.(Compl. ¶ 29.) Plaintiffs' conclusory allegations fail to provide any factual basis for the allegation that their protected devices were accessed or that files located on those devices were altered or corrupted. See Id. To the contrary, the factual allegations concern improperly accessing Instagram-a public website-which, on its face, does not constitute a CFAA violation. As courts of limited jurisdiction, “federal courts have an independent obligation to ensure that they do not exceed the scope of their jurisdiction.” Henderson ex rel. Henderson v. Shinseki, 562 U.S. 428, 434 (2011); Valdez v. Allstate Ins. Co., 372 F.3d 1115, 1116 (9th Cir. 2004) (noting that district courts are “obligated to consider sua sponte whether [they] have subject matter jurisdiction”).
Accordingly, by August 31, 2023, Plaintiffs are ordered to show cause why federal question jurisdiction exists. Specifically, Plaintiffs must identify facts that plausibly suggest that their cell phones and/or computers were improperly accessed, rather than their social media accounts. In doing so, Plaintiff must either cite to facts contained in the original complaint or they must file and cite to an amended complaint. Alternatively, Plaintiffs may voluntarily dismiss this lawsuit and refile it in state court. After review of Plaintiff s response, the Court may set a hearing or reassign this case to a district judge with the recommendation that the case be dismissed for lack of subject matter jurisdiction.
Finally, the August 17, 2023 hearing on Meta's motion to quash the subpoena is VACATED. The Court will reset the hearing once the jurisdictional issue is resolved.
IT IS SO ORDERED.