Opinion
No. 07 C 6735.
April 30, 2008
MEMORANDUM OPINION AND ORDER
Plaintiff, The First Mortgage Corporation, brought suit against defendants, Michael Baser and America's Mortgage Choice, LLC, for breach of fiduciary duty, inducing a breach of fiduciary duty, breach of contract, tortious interference with contract, misappropriation of trade secrets and violation of the Computer Fraud and Abuse Act ("CFAA"). Defendant Baser moves for summary judgment as to Count VI of plaintiff's complaint and for dismissal of the remaining state law counts for lack of subject matter jurisdiction. In response, plaintiff argues under Rule 56(f) of the Federal Rules of Civil Procedure that Baser's motion should be dismissed or continued. For the reasons stated below, Baser's motion is continued and plaintiff is granted leave to depose Baser to determine what, if any, material facts are in dispute as to Count VI.
We do not express an opinion about whether Count VI was pled sufficiently in plaintiff's complaint. That issue is not presently before us as neither defendant has raised it.
BACKGROUND
The following facts are taken from plaintiff's complaint. Baser began working at First Mortgage in 2004 and became a shareholder in 2005. During his employment at First Mortgage, Baser signed a Shareholder Agreement and abided by an Employee Handbook, which contained certain non-compete and confidentiality provisions. Baser had access to First Mortgage customer information through his company-issued laptop, a second laptop (detailed in Baser's motion, not plaintiff's complaint), and possibly a home computer. In July 2007, Baser resigned and began working for America's Mortgage, a direct competitor of First Mortgage within close geographic proximity.With regard to the CFAA claim, plaintiff alleges it is entitled to compensatory damages because defendants violated three separate provisions of the CFAA: § 1030(a)(2)(A), § 1030(a)(2)(C) and § 1030(a)(4). The text of these provisions is as follows:
18 U.S.C. § 1030(a)(2)(A): Whoever-intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains — information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.)
18 U.S.C. § 1030(a)(2)(C): Whoever — intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains — information from any protected computer if the conduct involved an interstate or foreign communication
18 U.S.C. § 1030(a)(4): Whoever — knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period
The statute allows "any person who suffers damage or loss by reason of a violation of this section" to bring suit to recover compensatory damages or other relief. 18 U.S.C. § 1030(g). A civil action is only permitted under this section if the conduct "involves 1 of the factors set forth" in the five subsections of (a)(5)(B). See 18 U.S.C. § 1030(a)(5)(B). The violation alleged here is found in subsection (a)(5)(B)(I) and is described as "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." Id. at § 1030(a)(5)(B)(I). Recovery for such a violation is limited to economic damages only. Id. at § 1030(g).
Baser moves for summary judgment on Count VI of plaintiff's complaint, which alleges a violation of the CFAA against defendants Baser and America's Mortgage. In support of Baser's motion are a local rule 56.1 statement and the affidavit of Baser himself. Plaintiff responded with a Rule 56(f) request to deny or continue the summary judgment motion because no discovery has yet taken place. The request is supported by the declaration of plaintiff's counsel that discovery is necessary to appropriately respond to Baser's summary judgment motion.
ANALYSIS
Summary judgment under Rule 56(c) is appropriate if the pleadings, discovery and affidavits "show that there is no genuine issue as to any material fact and that the movant is entitled to judgment as a matter of law." See Diaz v. Prudential Ins. Co. of Am., 499 F.3d 640, 643 (7th Cir. 2007). Baser asserts, through his affidavit, that there is no genuine issue as to any material fact. However, we agree with plaintiff that genuine issues of material fact may exist for three issues and that limited discovery is warranted to explore those issues. We examine each in turn.
First, Baser contends that the two laptop computers he used during his employment were not "protected computers." Plaintiff alleges that the computers in question are "protected computers," as defined by 18 U.S.C. § 1030(e)(2)(B), because they are used in interstate commerce and communication. Whether the computers are "protected computers," used in interstate commerce and communication, is a fact wholly within plaintiff's possession. Plaintiff should be able to submit evidence showing that the computers in question are "protected computers," as defined in the Act, without discovery from Baser.
Second, Baser argues he did not "exceed authorized access" to the computers because he was authorized to access the information on the computers in question at all relevant times. Plaintiff opposes this assertion by alleging Baser intentionally "exceeded authorized access" to plaintiff's protected computers in order to gain information he was not entitled to access, and that Baser used the information with America's Mortgage in interstate commerce. The CFAA defines "exceeds authorized access" to mean "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6).
The inquiry into whether Baser exceeded his authorized access in this case has three factual components: (1) what access Baser was authorized to have at the times in question, (2) what Baser accessed at the times in question and (3) whether Baser obtained or altered information in the computer that he was not entitled to so obtain or alter. Id. These three factual inquiries can be addressed by information already in plaintiff's possession and through Baser's deposition. Plaintiff has possession of the laptop computer Baser was issued, and returned one laptop to Baser after removing all of Baser's information and software programs. The information on the retained laptop, and plaintiff's own records of remote logins to any other allegedly protected computers, along with the deposition of Baser, are sufficient for plaintiff to respond to Baser's motion.
The Seventh Circuit has pointed out that an employee's breach of his duty of loyalty terminates his agency relationship and also terminates the employee's authority to access a company laptop where the only basis of authority for access is the agency relationship. Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418, 420-21 (7th Cir. 2006).
The third issue relates to damages under the CFAA. Plaintiff alleges defendants' violations of the CFAA have caused First Mortgage to incur losses aggregating at least $5,000 during a one-year period. Baser asserts that pecuniary business losses asserted by plaintiff do not qualify as repressible losses under the CFAA. The CFAA defines "loss" as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(c)(11).
Plaintiff alleges that it has incurred and will incur at least $5,000 in losses in terms of responding to Baser's conduct. Plaintiff argues that "loss of business and business goodwill" constitute damage under the CFAA. It is true that these would be classified as compensable economic damages in some cases, but only where the loss of business and business goodwill is a result of the impairment or unavailability of data on the computer.Hazan v. Foley Lardner, LP, 2007 U.S. Dist. LEXIS 54930 (N.D. Ill. 2007). Costs plaintiff incurred to assess and repair the damage on Baser's laptop computer, or to re-secure remotely accessed computers or databases, would qualify as compensable because they are a "cost of investigating or remedying damage to a computer, or a cost incurred because the computer's service was interrupted." Id. However, contrary to plaintiff's arguments, costs unrelated to the computer itself, such as litigation expenses or speculative future damages do not qualify. Id. Since information about costs is exclusively in plaintiff's possession, it should be able to submit evidence of losses incurred as a result of the alleged CFAA violation without further discovery.
The CFAA defines "damage" as "any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(c)(8) (2006).
In sum, we find that the only discovery plaintiff requires to respond to Baser's motion is a deposition of Baser himself.
Plaintiff argues it needs to depose other various America's Mortgage employees to respond to Baser's motion. As we outlined above, none of the elements plaintiff is required to prove necessitates such testimony. Therefore, the information is neither relevant nor necessary at this stage.