Summary
finding that the CFAA requires a plaintiff to plead both damage and loss in order to survive a motion to dismiss
Summary of this case from Cassetica Software, Inc. v. Computer Sciences Corp.Opinion
No. 07 C 6227.
January 16, 2008.
David N. Michael, Mark Douglas Brookstein, Gould Ratner, Chicago, IL, Robert G. Riegel, Jr., Fowler White Boggs Banker PA, Jacksonville, FL, for Plaintiffs.
Daniel Patrick Hogan, McCabe Hogan, Palatine, IL, for Defendant.
MEMORANDUM OPINION
Before this Court is Defendant's motion to dismiss Plaintiff's three-count Complaint. For the following reasons, Defendant's motion is granted.
BACKGROUND
According to the allegations of the complaint, which we must accept as true for purposes of this motion, Plaintiff Garelli Wong and Associates, Inc. ("Garelli Wong") is an Illinois corporation. Garelli Wong operates three Illinois offices located in the cities of Chicago, Schaumburg, and Oakbrook. Garelli Wong provides temporary and permanent accounting and financial personnel and services to its clients. The company has devoted substantial time and expense to identify clients receptive to Garelli Wong's services by finding the decision makers within their clients' organizations, cultivating their client relationships and learning their clients' needs and preferences, determining how those needs match the capabilities of its employees, and by working out client-specific pricing and service arrangements.
Garelli Wong employees who are temporarily assigned to work for clients are referred to as its "consultants," and prospective consultants are termed "candidates." Garelli Wong created a database ("the Database") that contains candidate and client activity tracking information (including billing rates; margins; candidate identities and status; employee information; client identities and the names of client contacts; decision makers; and requirements). Garelli Wong does not share this information with its competitors but rather has made efforts to maintain the confidentiality of the information contained in the Database. The Database is housed in a secure server and can only be accessed by an authorized user who enters a personalized password. Garelli Wong's employees use the information in the Database to expand client relationships and build goodwill.
Around April 2006, MPS Group, Inc. ("MPS") purchased and became the owner of Garelli Wong. As owner, MPS acquired Garelli Wong's existing assets, which included any employment agreements that Garelli Wong had with its employees. Defendant William Nichols ("Nichols") was one such employee who had entered into an employment agreement with Garelli Wong prior to the purchase.
Nichols, an Illinois resident, began working as a Senior Staffing Consultant out of Garelli Wong's Chicago office around December 1, 2003. In that capacity, Nichols was Garelli Wong's primary contact with certain of its clients and prospective clients. Nichols met with candidates and clients and used the Database in an effort to match the candidates' and clients' needs, preferences, and requirements. In doing so, Nichols developed personal relationships with certain clients, employees, candidates, and consultants whom Garelli Wong recruited. From these relationships, Nichols acquired knowledge about the clients' hiring managers, who according to Garelli Wong are often the most important client contacts. Nichols' employment with Garelli Wong also allowed him to obtain information about Garelli Wong's pool of screened consultants who serve its clients, including the rates Garelli Wong pays to its various consultants, the mark-up on those rates, and the flexibility Garelli Wong has for different clients on project-specific, or sometimes client-specific, placement.
When Nichols began working for Garelli Wong he signed a Confidentiality and Non-Solicitation Agreement ("the Agreement") "that would be governed by, construed, and enforced in accordance with the laws of the state of Illinois." Paragraph 2 of the Agreement states:
Except as permitted by this Agreement or with the written consent of the Company, the Employee shall not at any time during or after employment with the Company, divulge, disclose or communicate, directly or indirectly, to any person, corporation or other entity, or use for his/her own benefit or for the benefit of anyone other than the Company, any of the Company's trade secrets or confidential or proprietary information, including, but not limited to, Client or Potential Client identities and contacts; Client or Potential Client lists; Client or Potential Client financial, business or personal information; other information relating to Client or Potential Client accounts, feedback or directions; financial and business information relating to the Company and its transactions; and any other confidential information relating to the Company, its business, or its Clients or Potential Clients, including the Company's candidate database.
Employee agrees that all confidential and proprietary information shall belong to and be the sole and exclusive property of the Company.
Paragraph 3 of the Agreement states:
Immediately upon termination of employment with the Company, the Employee shall return to the Company all materials that relate to the Company, its business, its Clients or Potential Clients which came into the Employee's possession during the Employee's employment by the Company.
Paragraph 4 of the Agreement states that for the six-month period following the end of Nichols' employment with Garelli Wong, he would not, for the benefit of any "Competitive Business":
directly or indirectly perform services for or solicit (or assist other persons or entities to perform services for, or solicit) any Client for which the Employee, during the one-year period prior to the termination of the Employee's employment with the Company: 1) performed services, 2) had any direct Client or Potential client, or 3) received financial credit for any placements.
After MPS purchased Garelli Wong, Nichols entered into a Restricted Stock Agreement (the "RSA") with MPS. The RSA specifically provided that, for purposes of the restrictive covenants set forth in the RSA, the term "Employer" included subsidiaries or affiliates of MPS. As per the RSA, Nichols was entitled to 1,500 unvested shares of MPS Group's common stock, which had a vesting date (the "Vesting Date") of March 7, 2008. If Nichols ended his employment prior to the Vesting Date, he forfeited all 1,500 shares. Nichols also agreed to a restrictive covenant clause in the RSA, which states, in part:
In consideration of being offered the Award herein, Employee hereby agrees that during his . . . employment with the Company . . . and for the period of twelve (12) months immediately following the termination of Employee's employment such that Employee is no longer employed in any capacity with the . . . Company . . . Employee shall not, either directly or indirectly . . . engage in or assist others in . . .:
(c) entering into, engaging in, being employed by, being connected to, consulting or rendering services for, any enterprise that is offering or performing services similar to, or in competition with, business or services offered or performed by Employer at the time of the termination of Employee's employment from the Employer . . . within a 50 square mile radius of each office to which Employee was assigned or, if in management, each office or offices under Employee's managerial authority, at any time during the twelve (12) month period immediately preceding the termination of Employee's employment from the Employer . . .
On September 28, 2007, Nichols voluntarily resigned from employment with Garelli Wong. According to the complaint, Nichols is currently working in direct competition with Garelli Wong. Prior to his resignation, Garelli Wong alleges that Nichols compiled significant amounts of Garelli Wong's confidential and proprietary client and candidate information by entering the Database without proper authority to do so. According to Garelli Wong, Nichols attempted to send this information to his personal e-mail account and/or copied it for his personal use.
Garelli Wong alleges that immediately following Nichols' resignation, he contacted a Garelli Wong candidate and attempted to recruit that candidate for a position on behalf of his new and current employer. In order to contact that candidate, Nichols used information to which only Garelli Wong employees had access.
In October 2007, Garelli Wong learned that Nichols had solicited and attempted to recruit a Garelli Wong candidate. Garelli Wong also learned that Nichols contacted or was trying to contact one or more Garelli Wong clients to set up meetings. Garelli Wong believes that Nichols is now working for a new company in a capacity similar to the position he held with Garelli Wong and is using the confidential and proprietary information he obtained from Garelli Wong to contact, solicit, recruit, or attempt to solicit and recruit Garelli Wong's candidates in order to compete against Garelli Wong for those clients.
On November 2, 2007, Garelli Wong filed a three-count complaint against Nichols. The complaint sets out two breach of contract claims and one violation of federal law. The first count alleges that Nichols violated the Agreement he entered into with Garelli Wong. The second count alleges Nichols breached the RSA he entered into with MPS. The final count states that Nichols violated the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030 et seq. Nichols filed a motion to dismiss Garelli Wong's complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) and (6). Nichols argues that Garelli Wong's CFAA count fails to state a claim upon which relief can be granted and contends that if the CFAA claim is dismissed, Garelli Wong's two remaining counts should be dismissed pursuant to Fed.R.Civ.P. 12(b)(1) because federal jurisdiction would not be present.
LEGAL STANDARD
Fed.R.Civ.P. 12(b)(6) evaluates the legal sufficiency of a plaintiff's complaint. Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In ruling on a motion to dismiss, a court must draw all reasonable inferences in favor of the plaintiff, construe all allegations of a complaint in the light most favorable to the plaintiff, and accept as true all well-pleaded facts and allegations in the complaint. Bontkowski v. First Nat'l Bank of Cicero, 998 F.2d 459, 461 (7th Cir. 1993); Perkins v. Silverstein, 939 F.2d 463, 466 (7th Cir. 1991). To be cognizable, the factual allegations contained within a complaint must raise a claim for relief "above the speculative level." Bell Atlantic Corp. v. Twombly, ___ U.S. ___, 127 S. Ct. 1955, 1965 (2007). However, a pleading need only convey enough information to allow the defendant to understand the gravamen of the complaint. Payton v. Rush-Presbyterian-St. Luke's Med. Ctr., 184 F.3d 623, 627 (7th Cir. 1999).
The purpose of a motion to dismiss pursuant to Fed.R.Civ.P. 12(b)(1) is to dismiss claims over which a federal court lacks subject matter jurisdiction. Jurisdiction is the "power to decide" and must be conferred upon a federal court. In re Chicago, Rock Island Pac. R.R. Co., 794 F.2d 1182, 1188 (7th Cir. 1986). The plaintiff bears the burden of establishing that the jurisdiction requirements have been met. see Kontos v. U.S. Dep't of Labor, 826 F.2d 573, 576 (7th Cir. 1987). When a defendant moves for dismissal pursuant to Fed.R.Civ.P. 12(b)(1), the plaintiff must support its allegations with competent proof of jurisdictional facts. Thomson v. Gaskillwsa, 315 U.S. 442, 446 (1942).
With these principles in mind, we consider the instant motion.
DISCUSSION
I. Computer Fraud and Abuse Act
The subject matter jurisdiction of Garelli Wong's complaint is premised entirely upon its CFAA count. As such, we will look to the sufficiency of this claim first. As Nichols correctly points out, the complaint does not specify the sections of the statute upon which it relies. However, 18 U.S.C. § 1030(g) mandates that a civil action pursuant to the CFAA "may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B)." The allegations in Garelli Wong's complaint contain language that could apply to violations of § 1030(a)(5)(B)(i) as it pertains to § 1030(a)(5)(A)(i), (ii), and (iii):
Whoever —
(5)(A)(i) knowingly causes the transmission of . . . information . . . and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
(ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage ; or
(iii) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage . . .; and
(5)(B)(i) by conduct described in clause (i), (ii), or (iii) of subparagraph (A), caused . . . loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.
(emphasis added).
A point of contention between the parties exists at to whether a plaintiff must allege both damage and loss in order to sufficiently plead a civil action under the CFAA or whether pleading damage or loss is enough. A thorough reading of the text above shows that it is necessary for a plaintiff to plead both damage and loss in order to properly allege a civil CFAA violation.
The CFAA defines "damage" as "impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). "Loss" is defined under the CFAA to mean:
any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.
18 U.S.C. § 1030(e)(11).
Incorporating these definitions into its argument, Nichols contends that his alleged unauthorized acts of copying and emailing Garelli Wong's computer files did not impair the integrity or availability of the information in the Database and did not cause any interruption to the computer service. More pointedly, Nichols' argument is that one cannot be held civilly liable under the CFAA for copying information from a computer without authority to do so; a violation requires more.
A. Damage
According to Nichols, Garelli Wong's CFAA count should be dismissed because the complaint does not and cannot allege damage or loss as defined by the CFAA. Nichols cites Airport Centers, LLC v. Citrin in support of his position that the unauthorized copying and emailing of files from a computer is not enough to form the basis of a civil action under the CFAA. 440 F.3d 418 (7th Cir. 2006). In Citrin, the defendant was employed by the plaintiff and given a company laptop to use and record data he collected while working. Id. at 419. The defendant then quit his job with the plaintiff and began working for himself. Id. Before returning the laptop to the plaintiff, the defendant deleted all the data on it and installed a secure-erasure program to prevent recovery of the deleted files. Id. In finding that the plaintiff had sufficiently stated a civil claim under the CFAA, the Seventh Circuit confirmed that installing a program intended to erase and delete files is sufficient to show damage as it is defined under the CFAA because the installation of such a program impairs the integrity or availability of data, programs, or information on the computer. Id.
Although the principal discussion in Citrin involved the meaning of the term "transmission" as used in § 1030(a)(5)(i), the damage referred to the computer files (as opposed to the physical computer), that is, the deletion of data stored in the computer. The statutory requirement of damage was satisfied since the defendant's acts impaired the integrity or availability of data. No similar allegation is made in the instant case.
In further support of his position, Nichols cites ResDev v. Lot Builders and Worldspan v. Orbitz, LLC, two unpublished cases, which discuss "integrity" as it is used in the CFAA's definition of damage. 2005 WL 1924743 (M.D. Fla. Aug. 10, 2005); 2006 WL 1069128 (N.D. Ill. April. 19, 2006). We believe the discussion of "integrity" in these cases lends guidance in the instant matter. In ResDev, defendants allegedly visited their former employer's website and accessed information that was not password protected. 2005 WL 1924743 at *1. The plaintiff in ResDev sought to recover damages under the CFAA based on the defendants viewing of the information and the information's alleged trade secret value. Id. Ultimately, the ResDev court held that the CFAA's use of the word "integrity" to define damage required "some diminution in the completeness or useability of data or information on a computer system" and concluded that the defendants' alleged conduct "did not come within the CFAA's meaning[;]" and therefore did not violate the CFAA. Id. at *5.
The Orbitz court's analysis of the ResDev court's discussion of "integrity" is also worth mentioning. In Orbitz, the court found that the plaintiff's complaint "merely parrot[ed] the `causing damage' text of the CFAA in conclusory fashion and fail[ed] to allege any facts indicating that the completeness, useability, or availability of [the plaintiff's] data was impaired." Orbitz 2006 WL 1069128 at *5. As a result, the Orbitz court rejected the plaintiff's argument that "the mere `taking of information' constitute[d] `damage' under the CFAA." Id.
Garelli Wong cites several district court cases in opposition of Nichols' arguments. However, we find none of these cases persuasive. First, Garelli Wong cites George S. May Intern. Co. v. Hostetler, a 2004 case decided by this court, where we held: "we see no principled reason, nor has [defendant] offered one, why infringement of copyrighted material taken from a protected computer system would not qualify as impairment of the integrity of the copyrighted information." 2004 WL 1197395, *4. In Hostetler, the plaintiff alleged that the defendant used his access to his company's computer system to take several copyrighted documents with him when he ended his employment and, then, later used these documents to the detriment of his former employer. Id. at *3. As our holding in Hostetler makes clear, the defendant in Hostetler did not provide us with any reasons on which to base a finding in its favor. Id. at *4. We also point out that the CFAA was amended after the decision in Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc., 119 F. Supp. 2d 1121. (W.D.Wash. 2000), a case relied on in Hostetler. Such reliance is no longer compelling in light of the statutory amendments and other cases decided post-amendment.
Similarly, we are not inclined to follow Pacific Aerospace Electronics, Inc. v. Taylor, which Garelli Wong cites to show that misappropriation is considered to be damage or loss under the CFAA. The Taylor court conducted an extensive review of the CFAA before it explained that "caselaw supports an employer's use of the CFAA's civil remedies to sue [its] former employees and their new companies who seek a competitive edge through wrongful use of information from the former employer's computer systems." 295 F. Supp. 2d 1188, 1195 (E.D.Wash. 2003). The conclusion reached in Taylor does not take into account that a civil violation of the CFAA requires "impairment to the integrity or availability of data, a program, a system, or information" and "interruption in service." 18 U.S.C. § 1030. Allegations of trade secret theft and misappropriation do not suggest such a violation. Furthermore, the Taylor court partly based its conclusion on Shurgard, which we no longer find influential for reasons given above.
Ultimately, we find that ResDev and Orbitz set out the correct analysis to be performed in deciding whether allegations are sufficient to properly plead damage under the CFAA. Though Garelli Wong would like us to believe that recent amendments to the CFAA are intended to expand the use of the CFAA to cases where a trade secret has been misappropriated through the use of a computer, we do not believe that such conduct alone can show "impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). Therefore, we conclude that Garelli Wong has failed to sufficiently plead damage under the CFAA.
B. Loss
As previously mentioned, Nichols believes that Garelli Wong's CFAA count should be dismissed because the complaint does not and cannot allege loss as defined by the CFAA. Garelli Wong cites Patriot Homes, Inc. v. Forest River Housing, Inc. for the proposition that it asserted a cognizable claim under the CFAA by alleging that it suffered "losses" in excess of $5,000 as a result of Nichols' conduct. 2006 WL 1752143, *4 (N.D. Ind. June 21, 2006). Nichols counters with the discussion set out in ResDev that it is not enough to simply allege any monetary expenditure to assert a cognizable claim under the CFAA; instead, "loss" is limited to costs that are "directly associated with, or with addressing, an unauthorized computer-access event." 2005 WL 1924743 at *4. The Supreme Court recently clarified that to properly plead a cause of action, a plaintiff must "provide the `grounds' of his `entitle[ment] to relief' [with] more than labels and conclusions, and a formulaic recitation of a cause of action's elements will not do." Twombly, 127 S. Ct. at 1959. In its current form, the complaint states only that "Defendant's conduct caused losses to Garelli Wong in excess of $5,000" with no further elaboration. While we agree with Nichols that Garelli Wong does not presently allege loss, we disagree that it cannot do so. Conceivably, Garelli Wong could provide the necessary information in an amended complaint (consistent with its obligations under Fed.R.Civ.P. 11 that such an allegation is made only after reasonable inquiry into its factual foundation). However, in light of our conclusions that both damage and loss are necessary to state a cause of action under the CFAA and that Garelli Wong cannot allege damage, dismissal of Count III is warranted even though Garelli Wong could address the deficiencies within its allegations of loss in an amended complaint.
II. State Law Claims
The sole jurisdictional basis asserted for Counts I and II is the supplementary jurisdiction provided by 28 U.S.C. § 1367(a). When a district court dismisses all claims over which it has original jurisdiction, it may decline to exercise supplemental jurisdiction over the remaining claims. 28 U.S.C. § 1367(c)(3). In our circuit, the preferred course of action is to relinquish jurisdiction in such circumstances without good reasons to do otherwise. Kennedy v. Schoenberg, Fisher Newman, Ltd., 140 F.3d 716, 727 (7th Cir. 1998). Garelli Wong has not offered a compelling reason for us to maintain jurisdiction over its state-law claims, and in light of the early stage of this case, we will decline to exercise jurisdiction over Counts I and II. Therefore, those counts are dismissed for lack of subject matter jurisdiction.
CONCLUSION
For the foregoing reasons, Count III of Garelli Wong's complaint is dismissed for failure to state a claim. Counts I and II are dismissed for lack of subject matter jurisdiction.