Summary
finding that a defendant acted "without authorization" under the CFAA when he continued to access Facebook's site, even after Facebook "implemented a complete access restriction by sending [the defendant] two cease-and-desist letters and by taking technical measures to block his access."
Summary of this case from Couponcabin LLC v. Savings.Com, Inc.Opinion
No. C 14–02323 WHA
01-08-2015
Facebook, Inc., Plaintiff, v. Martin Grunin, Defendant.
Judith Bond Jennison, Joseph Perry Cutler, Perkins Coie LLP, Seattle, WA, for Plaintiff. Martin Grunin, Brooklyn, NY, pro se. Andrew B. Gordon, Gordon Law Group, Lake Zurich, IL, Seth Andrew Weinstein, Law Offices of Seth Weinstein, Sherman Oaks, CA, for Defendant.
Judith Bond Jennison, Joseph Perry Cutler, Perkins Coie LLP, Seattle, WA, for Plaintiff.
Martin Grunin, Brooklyn, NY, pro se.
Andrew B. Gordon, Gordon Law Group, Lake Zurich, IL, Seth Andrew Weinstein, Law Offices of Seth Weinstein, Sherman Oaks, CA, for Defendant.
ORDER GRANTING MOTION FOR DEFAULT JUDGMENT AND PERMANENT INJUNCTION
William Alsup, United States District Judge
INTRODUCTION
In this action involving alleged computer fraud and abuse, plaintiff moves for default judgment and a permanent injunction. For the reasons stated herein, plaintiff's motion is Granted . A copy of this order will also be referred to the Office of the United States Attorney.
STATEMENT
Prior orders recounted the history of this action so it will not be repeated herein (Dkt. Nos. 33, 65). In brief, Martin Grunin, the only defendant, was personally served with the summons and operative complaint on May 22, 2014 (Dkt. Nos. 13, 20). No responsive pleading was timely filed.
Instead, Grunin, an adult, larded the record with a hodgepodge of documents. Here are some details:
• In May 2014, Grunin filed a document purporting to confer “special limited power of attorney” on a non-attorney, “Brian–Robert: Costello.”
• Grunin also filed a copy of the summons and complaint with the following handwritten note:
I DO NOT ACCEPT THIS OFFER TO CONTRACT and I DO NOT CONSENT TO THESE PROCEEDINGS.
BY: Brian Robert: Costello
Public Minister/Diplomat
united states of America [sic]
For: Martin Grunin
• Grunin also filed a “declaration of Copyright Trademark,” purporting to claim a right to the phrase “MARTIN GRUNIN” (Dkt. No. 8).
• In June 2014, Grunin filed a “constructive notice of conditional acceptance,” stating that he would accept Facebook's “offer to stop deleting any/all files” on the condition that Facebook pay him $100,000. He further stated that future attempts to “communicate or summon” him to any “public court” would require “consideration” of one million dollars (Dkt. Nos. 10, 17).
• He also filed a “notice of offer to settle,” stating that he was tendering a check for $250 to “settle the matter.” He further stated that “failure to honor the contract” would result in a penalty of $50,000 and “all phone call(s) are two thousand ($2000.00) dollars, per call” (Dkt. Nos. 23, 27).
• Default was registered against Grunin on June 23, 2014 (Dkt. No. 22).
• In July 2014, Grunin filed a “notice,” stating that if Facebook wished to enter into a “contractual relationship” it must pay $100,000 (Dkt. No. 26).
• He also filed a “notice,” purporting to charge Facebook $300,000 for filing a motion (Dkt. No. 30).
• He also filed a “notice of default in dishonor consent to judgment,” stating that Facebook's failure to respond to his offer constituted an “agreement to settle the obligations” for zero dollars (Dkt. Nos. 31, 32, 36, 37, 38).
• He then filed an “affidavit of specific negative averment,” wherein he purported to deny that the “UNITED STATES DISTRICT COURT [was] the district court of the United States;” to deny that the “UNITED STATES DISTRICT COURT ha [d the] capacity for substantive due process;” and to “den[y] that Martin Grunin is liable to or for any of the
Federal Government statutes or codes” (Dkt. No. 35).
• In August 2014, Grunin filed an “affidavit, stating that “LAWYERS AND ATTORNEYS ARE NOT LICENSED TO PRACTICE LAW” and “CASE ‘LAW’ IS UNCONSTITUTIONAL” (Dkt. No. 39).
A week later, Attorneys Andrew Gordon (Gordon Law Group, located in Illinois) and Seth Weinstein (Law Offices of Seth Weinstein, located in Sherman Oaks) appeared on behalf of defendant Grunin (Dkt. Nos. 42, 45). Defense counsel then moved to set aside the default. Grunin's declaration, however, never stated innocence and failed to specifically identify any defenses.
After full briefing and oral argument by both sides, an October 2014 order denied Grunin's motion to set aside the default. Nevertheless, Grunin was given one more chance to move to lift the default on the condition that he agree to pay Facebook's reasonable attorney's fees and expenses incurred from his improper filings. Also, he was given another opportunity to file a declaration showing his innocence (Dkt. No. 65).
No declaration or renewed motion was filed. Facebook then moved for default judgment and a permanent injunction. No opposition was timely filed. Grunin was then given one more chance to oppose the motion. He filed a statement of non-opposition via counsel (Dkt. No. 70). Grunin then stated he wanted to proceed pro se and consented to the withdrawal of his attorneys (Grunin Decl. ¶ 1). His counsel were thus permitted to withdraw.
Grunin then appeared in person at oral argument. He made an oral request to lift the default. This request was denied because (1) it was untimely; (2) Grunin had been given a prior opportunity to file a renewed motion to lift the default (subject to the aforementioned reasonable condition) and he did not avail himself to that opportunity; (3) he never stated innocence and there is no evidence in the record that proceeding on the merits would be productive; and (4) he had filed a litany of inappropriate documents in this case. This order follows full briefing, supplemental briefing, and oral argument.
ANALYSIS
It is undisputed that (1) Grunin was personally served with the summons and operative complaint in May 2014; (2) he failed to timely file a responsive pleading; (3) default was registered against Grunin in June 2014; (4) he never identified any specific meritorious defenses backed by a sworn declaration; and (5) he filed a statement of non-opposition to the instant motion (even though he later made an untimely oral request to lift the default).
The operative complaint alleged the following claims for relief: (1) breach of contract, (2) fraud, (3) violation of the Computer Fraud and Abuse Act, 18 U.S.C. 1030, et seq ., and (4) violation of the California Comprehensive Computer Data Access and Fraud Act, California Penal Code 502. Facebook seeks damages “in excess of $340,000,” reasonable attorney's fees, and a permanent injunction. If default judgment is entered, Facebook seeks leave to file briefs and declarations proving-up damages (Br. 13–15).
Upon registration of default, all well-pled factual allegations in the complaint, except as to damages, are taken as true. TeleVideo Systems, Inc. v. Heidenthal, 826 F.2d 915, 917–18 (9th Cir.1987). In considering whether a default judgment is appropriate, the following factors are considered:
(1) the possibility of prejudice to the plaintiff, (2) the merits of plaintiff's substantive claim, (3) the sufficiency of the complaint, (4) the sum of money at stake
in the action; (5) the possibility of a dispute concerning material facts; (6) whether the default was due to excusable neglect, and (7) the strong policy underlying the Federal Rules of Civil Procedure favoring decisions on the merits.
Eitel v. McCool, 782 F.2d 1470, 1471–72 (9th Cir.1986).
At this point, it would be futile to proceed on the merits because (1) Grunin never filed a sworn declaration attesting to his innocence, never identified any specific disputes of material fact, and never identified any specific meritorious defenses, despite having adequate opportunity to make these filings; (2) the default was not due to excusable neglect; and (3) he has taken no sincere interest in defending himself on the merits in this action. These factors all tend to favor default judgment.
Facebook further argues that it would suffer prejudice in the absence of a default judgment because it would be without recourse to recover against Grunin's improper actions as alleged in the operative pleading. Indeed, Grunin continued to create Facebook accounts after two cease-and-desist letters were sent to him. Facebook has disabled more than seventy accounts linked to Grunin.
Having read the operative complaint and considered Facebook's supplemental brief, this order finds that the complaint sufficiently alleged each of the claims for relief.
Breach of Contract: To plead a claim for breach of contract, the complaint must allege sufficient facts to show: (1) the existence of a contract; (2) plaintiff's performance or excuse for non-performance; (3) defendant's breach; and (4) resulting damages. Maxwell v. Dolezal, 231 Cal.App.4th 93, 97–98, 179 Cal.Rptr.3d 807 (Cal.Ct.App.2014). Facebook's Statement of Rights and Responsibilities and Facebook's Advertising Guidelines (collectively, “Facebook's Terms”) were appended to and incorporated by reference in the complaint. Grunin agreed to Facebook's Terms when he created a Facebook account and accessed Facebook's services. In pertinent part, Grunin agreed not to post content that “contains nudity or graphic or gratuitous violence,” agreed “not to provide any false personal information on Facebook,” agreed not “to create an account for anyone other than [himself] without permission,” agreed not to create another account without Facebook's permission if his account was disabled, and so forth (Exh. A). Nevertheless, he breached Facebook's Terms by placing ads containing “sexually provocative content,” “running deceptive ads, transferring accounts without Facebook's permission, providing false information to Facebook, continuing to access Facebook after revocation, and failing to pay for advertisements.” Since 2011, Facebook has disabled “at least 70 accounts linked to Grunin.” Facebook has not been paid for “at least $340,000 worth of ads purchased by or for Grunin” (Compl. ¶¶ 7, 12, 19, 46, 53, 56, 60, 63).
Accordingly, the complaint sufficiently states a claim for breach of contract.
Fraud: To plead a fraud claim, the complaint must allege sufficient facts to show: (1) a misrepresentation; (2) knowledge of the falsity; (3) intent to induce another's reliance on the misrepresentation; (4) justifiable reliance; and (5) resulting damages. Fraud claims must meet the particularity requirement in Rule 9(b). Vess v. Ciba–Geigy Corp. USA, 317 F.3d 1097, 1103 (9th Cir.2003). The complaint alleged that Grunin intentionally defrauded Facebook into providing him advertising accounts and increased advertising credit by impersonating others. Specifically, after Grunin posted “sexually explicit” advertisements, including “a picture of a woman with a sexually explicit and profane caption,” Facebook took “technical measures” to block Grunin's access to Facebook's services and sent a cease-and-desist letter.
After receipt of the cease-and-desist letter, Grunin began using “unauthorized means to obtain and sell access to Facebook advertising accounts that were unaffiliated with him.” In November 2012, for example, Grunin sent emails under the name “Kayla Stewart,” purporting to represent an advertising company called Thinkmodo. Based on these representations, Grunin was able to run “approximately $40,000 worth of deceptive ads” (Compl. ¶¶ 31–37). In February and March 2013, Grunin sent emails under the names “Colan Neilson,” “Felix Ward,” and “Joy Hawkins,” purporting to represent an entity called Imprezzio Marketing. To establish credit, Grunin sent Facebook bank statements purportedly from Imprezzio. Based on these representations, Facebook provided Grunin with an advertising credit line, which Grunin used to run “approximately $300,000 worth of ads.” The “real” Imprezzio's representatives later denied opening these accounts and stated that the bank statements Grunin provided Facebook were falsified (Compl. ¶¶ 39–47). In short, Grunin intentionally provided Facebook false information so that he could obtain advertising accounts without paying for them. Grunin's “deceptive advertising and fraudulent advertising accounts” have caused Facebook to provide “at least $340,000” in unpaid ads, have “tainted the Facebook experience for Facebook users and advertisers,” and have caused “harm to [Facebook's] reputation and goodwill” (Compl. ¶¶ 53–55, 78, 83).
Accordingly, the complaint sufficiently states a fraud claim.
Computer Fraud and Abuse Act: The Computer Fraud and Abuse Act, 18 U.S.C. 1030, et seq., was enacted to enhance the government's ability to prosecute computer crimes and to “target hackers who accessed computers to steal information or to disrupt or destroy computer functionality, as well as criminals who possessed the capacity to access and control high technology processes vital to our everyday lives.” LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1130 (9th Cir.2009) (internal quotation marks omitted). Facebook's complaint invoked Sections 1030(a)(2) and (4).
To bring a Section 1030(a)(2) claim, Facebook must allege that Grunin:
(1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that he (3) thereby obtained information (4) from any protected computer (if the conduct involved an interstate or foreign communication), and that (5) there was loss to one or more persons during any one-year period aggregating at least $5,000 in value.
To bring a Section 1030(a)(4) claim, Facebook must allege that Grunin:
(1) accessed a “protected computer,” (2) without authorization or exceeding such authorization that was granted, (3) “knowingly” and with “intent to defraud,” and thereby (4) “further[ed] the intended fraud and obtain[ed] anything of value,” causing (5) a loss to one or more persons during any one-year period aggregating at least $5,000 in value.
Brekka, 581 F.3d at 1132 (brackets in original).
The complaint also invoked the California Comprehensive Computer Data Access and Fraud Act, California Penal Code Section 502, which criminalizes nine categories of acts regarding knowingly accessing and using without permission a computer or data from a computer. Private civil rights of action are allowed for claims brought under Section 1030(a) and Section 502(c) pursuant to Section 1030(g) and Section 502(e) respectively.
No decision from our court of appeals is squarely on point. Both United States v. Nosal, 676 F.3d 854, 856, 863–64 (9th Cir.2012) (en banc), and LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1134–35 (9th Cir.2009), involved former employees and “violations of use restrictions.” Nosal held that the phrase “exceeds authorized access” in the Computer Fraud and Abuse Act was “limited to violations of restrictions on access to information, and not restrictions on its use .” 676 F.3d at 864 (emphasis in original). Because the defendant's accomplices—his former colleagues still working for the company—had permission to access the company's information, the Section 1030(a)(4) counts were properly dismissed. Similarly, in Brekka, summary judgment for a former employee was appropriate, in part, because the former employee was authorized to use his former employer's computers while still employed by the company.
Our dispute, unlike those in Nosal and Brekka, involves a violation of a restriction on access to information. The operative pleading alleged that after Facebook sent two cease-and-desist letters to Grunin and after Facebook took technical measures to block Grunin's access to Facebook's site and services, Grunin nonetheless continued to access Facebook's site and services. Indeed, two days after Facebook's first cease-and-desist letter, Grunin confirmed receipt thereof by stating “I comply.” He then proceeded to acquire more fraudulent accounts and run more deceptive ads (Compl. ¶¶ 23, 25, 51, 56, 67, 73). Several specific examples of conduct by Grunin were detailed in the complaint. For example, in March 2013, after his access was terminated, Grunin impersonated another to obtain a new Facebook account and to secure a Facebook credit line based on “falsified” bank statements. Based on these representations, Grunin was provided with an account and credit line which he then used to run hundreds of thousands of dollars of ads. Each time Facebook implemented technical measures to disable one of Grunin's accounts, Grunin created more accounts to run more ads. Facebook consequently incurred damages attributable to its efforts identifying, investigating, and removing over seventy accounts associated with Grunin, and Facebook was never paid for “more than $340,000 worth of advertising” provided to Grunin (Compl. ¶¶ 30, 37, 45, 46, 56, 67, 68, 83).
This order holds that Facebook is entitled to default judgment on the Section 1030(a) and Section 502(c) claims because the complaint alleged, inter alia, that after Grunin's access was terminated and after he received two cease-and-desist letters, Grunin intentionally accessed Facebook's computers and servers to obtain account credentials, Facebook credit lines, Facebook ads, and other information, causing more than $5,000 in losses to Facebook. Grunin intentionally circumvented Facebook's technical measures by impersonating others to obtain Facebook accounts to run ads which were never paid for.
Several decisions in our district have found liability under the statutes invoked here based on similar conduct. In Facebook, Inc. v. Power Ventures, Inc., 844 F.Supp.2d 1025, 1036–39 (N.D.Cal.2012) (Judge James Ware), summary judgment was granted in favor of the plaintiff (Facebook) on the Section 502 and Section 1030(a)(2) claims, in part, because the defendants circumvented technical barriers designed to block their access to Facebook and the defendants admitted that they had obtained information from Facebook's website without authorization. See also Facebook, Inc. v. Power Ventures, Inc., No. 5:08–cv–05780–LHK, 2013 WL 5372341, at *14, 17 (N.D.Cal. Sept. 25, 2013) (Judge Lucy Koh). In Facebook, Inc. v. Fisher, No. 5:09–cv–05842–JF, 2011 WL 250395, at *1, 3 (N.D.Cal. Jan. 26, 2011) (Judge Jeremy Fogel), default judgment was entered against the defendant who allegedly obtained log-in credentials for more than 116,000 Facebook accounts without authorization and then sent more than 7.2 million spam messages. In craigslist, Inc. v. Kerbel, No. 3:11–cv–03309–EMC, 2012 WL 3166798, at *1–2, 15–18 (N.D.Cal. Aug. 2, 2012) (Judge Edward Chen), default judgment was entered against the defendant who allegedly created fraudulent accounts and offered services designed to enable craigslist customers to repeatedly auto-post ads to craigslist.
More recently, two post-Nosal decisions from our district have declined to dismiss claims based on similar conduct. In craigslist Inc. v. 3Taps Inc., 964 F.Supp.2d 1178, 1187 (N.D.Cal.2013) (Judge Charles Breyer), a renewed motion to dismiss the Section 1030(a) and Section 502(c) claims was denied. There, the plaintiff implemented a “complete access restriction” on defendants by sending cease-and-desist letters and placing technical barriers designed to cut-off defendants' ability to view the site, but the defendants continued to use anonymous proxies to bypass those measures. Similarly, in Oracle America, Inc. v. TERiX Computer Company, Inc., No. 5:13–CV–03385–PSG, 2014 WL 31344, at *7 (N.D.Cal. Jan. 3, 2014) (Magistrate Judge Paul Grewal), dismissal of the Sections 1030(a)(2) and (4) claims was not warranted because the defendants allegedly had no access rights whatsoever but nevertheless proceeded to access Oracle's secure, support website.
Here too, Facebook implemented a complete access restriction by sending Grunin two cease-and-desist letters and by taking technical measures to block his access. Grunin nevertheless continued to access Facebook's site and services without authorization and to impersonate others, resulting in alleged damages. Accordingly, Facebook is entitled to default judgment on the Section 1030(a) and Section 502(c) claims.
Injunction: Section 1030(g) and Section 502(e)(1) allow for injunctive relief. To obtain injunctive relief, plaintiff must demonstrate: (1) that it has suffered an irreparable injury; (2) that remedies available at law, such as monetary damages, are inadequate to compensate for that injury; (3) that, considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted; and (4) that the public interest would not be disserved by a permanent injunction. eBay Inc. v. MercExchange, LLC, 547 U.S. 388, 391, 126 S.Ct. 1837, 164 L.Ed.2d 641 (2006). That showing has been made. Even after two cease-and-desist letters, Grunin continued to fraudulently obtain Facebook accounts and to access Facebook's services. Facebook has already terminated more than seventy accounts associated with Grunin and the public would not be disserved by prohibiting Grunin from posting sexually provocative and deceptive ads on Facebook.
Facebook seeks the following injunction:
1. Accessing or using, or engaging, inducing, or encouraging third parties to access or use, any Facebook-owned or -operated website, service, platform, or computer system, including, but not limited to, Facebook, Instagram, and Whatsapp;
2. Engaging in any activity that violates Facebook's Terms; and
3. Engaging in any unlawful, misleading, or malicious activities directed at or relating to Facebook-owned or -operated websites, services, platforms, or computer systems.Grunin filed a statement of non-opposition to Facebook's motion. Nevertheless, because Facebook's proposal is too wordy, it has been revised as stated in the conclusion section.
CONCLUSION
For the reasons stated herein, Facebook's motion for default judgment and a permanent injunction is Granted . Grunin is Hereby Enjoined from accessing or using any Facebook website or Facebook service.
To determine the amount of damages and any fees, by January 14 at Noon , Facebook shall file a brief specifically identifying all of its claimed damages and fees with declarations, documents, and authorities supporting the sum requested. That submission must be promptly mailed to Grunin's last known address.
Grunin has until January 27, 2015 at Noon to file a response. It will not be enough to simply attack Facebook's numbers. If contested, Grunin must set forth a specific counter-analysis, appending all of his counter-proof in a sworn declaration.
Facebook has until February 3 at Noon to file a reply. The Court is likely to rule on the papers, but nevertheless, a prove-up hearing is hereby calendared for February 19 at 1:30 p.m. All parties and witnesses must appear in person (unless the hearing is vacated).
In light of the serious nature of the allegations herein, the Clerk shall send a copy of this order to our United States Attorney for her consideration and possible investigation. The Court, of course, takes no position on whether the United States Attorney's Office should or should not further pursue this matter.