Opinion
No. 5:16-CV-367-BO
02-15-2017
SAGEWORKS, INC., Plaintiff, v. RONALD M. CREATORE, Defendant.
ORDER
This cause comes before the Court on defendant's motions to dismiss plaintiff's claims and plaintiff's motion to dismiss defendant's counterclaims. The appropriate responses and replies have been filed and the motions are ripe for ruling. For the reasons discussed below, defendant's motions are denied and plaintiff's motion is granted in part.
BACKGROUND
Plaintiff filed this action against defendant, a former employee, in Wake County Superior Court alleging claims for violations of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, the Electronic Communications Privacy Act, 18 U.S.C. § 2511, and the Computer Related Crimes Act, N.C. Gen. Stat. § 14-458(a), as well as for breach of contract, misappropriation of trade secrets, unfair and deceptive trade practices, and breach of fiduciary duty. Defendant, proceeding pro se, removed plaintiff's complaint to this Court on the basis of its federal question jurisdiction. 28 U.S.C. §§ 1331; 1441.
Plaintiff alleges that defendant was hired by plaintiff in May 2014 as Vice President of Operations & Finance and that defendant's employment was terminated in November 2014 for poor performance. Plaintiff alleges that upon his hiring as an employee defendant executed a business protection agreement in which defendant agreed to keep plaintiff's proprietary information confidential during the term of his employment and for five years following termination of his employment for any reason. Plaintiff alleges that defendant copied thousands of its proprietary documents and saved them to a personal Dropbox account and that defendant also set up a fraudulent scheme to divert executive level email communications to a personal email account.
Plaintiff filed a motion for preliminary injunction pursuant to Rule 65 of the Federal Rules of Civil Procedure seeking the return or restraint of defendant's use or dissemination of plaintiff's confidential information and documents containing personal information about plaintiff's employees. A hearing was held on the motion before the undersigned and the request for a preliminary injunction was granted. [DE 52; 54]. Plaintiff noticed an interlocutory appeal of the preliminary injunction but subsequently voluntarily dismissed his appeal. See Sageworks v. Creatore, No. 16-2118, (4th Cir. Oct. 25, 2016).
Defendant now proceeds in this Court though duly admitted counsel. [DE 70 & 71]. Still pending for the Court's consideration are two motions to dismiss filed by defendant while proceeding pro se. In his first motion, defendant seeks dismissal of plaintiff's first claim for relief for failure to state a claim upon which relief could be granted. Fed R. Civ. P. 12(b)(6); [DE 6]. Defendant's second motion to dismiss seeks to dismiss plaintiff's fifth and sixth claims for relief as failing to state a claim. [DE 23]. Also pending is plaintiff's motion to dismiss counterclaims asserted in defendant's answer for failure to state a claim. [DE 91].
DISCUSSION
Rule 8 of the Federal Rules of Civil Procedure "requires only a short and plain statement of the claim showing that the pleader is entitled to relief and which provides "the defendant fair notice of what the claim is and the grounds upon which it rests." Erickson v. Pardus, 551 U.S. 89, 93 (2007) (internal quotations, alterations, and citations omitted). A Rule 12(b)(6) motion tests the legal sufficiency of the complaint. Papasan v. Allain, 478 U.S. 265, 283 (1986). When acting on a motion to dismiss under Rule 12(b)(6), "the court should accept as true all well-pleaded allegations and should view the complaint in a light most favorable to the plaintiff." Mylan Labs., Inc. v. Matkari, 7 F.3d 1130, 1134 (4th Cir.1993). A complaint must allege enough facts to state a claim for relief that is facially plausible. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). Facial plausibility means that the facts pled "allow[] the court to draw the reasonable inference that the defendant is liable for the misconduct alleged," and mere recitals of the elements of a cause of action supported by conclusory statements do not suffice. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A complaint must be dismissed if the factual allegations do not nudge the plaintiff's claims "across the line from conceivable to plausible." Twombly, 550 U.S. at 570.
I. Defendant's motions to dismiss
In his first-filed motion defendant seeks to dismiss plaintiff's claim under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. The CFAA is primarily a criminal statute, but it also provides for a private right of action for compensatory damages and equitable relief by someone who suffers damage or loss as a result of a violation of the statute. WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199, 201 (4th Cir. 2012). "The CFAA is concerned with the unauthorized access of protected computers," id. at 204, and prohibits intentional access of a computer without authorization or intentional access of a computer which exceeds authorization. 18 U.S.C. § 1030(a). In Miller, the Fourth Circuit held that an employee
accesses a computer "without authorization" when he gains admission to a computer without approval. Similarly, we conclude that an employee "exceeds authorized access" when he has approval to access a computer, but uses his access to obtain or alter information that falls outside the bounds of his approved access.Miller, 687 F.3d at 204 (internal citation omitted). Here, plaintiff has alleged that defendant both accessed information without authorization and that he exceeded his authorized access to obtain information. [DE 1-1], Compl. ¶¶ 48; 88.
Defendant contends that plaintiff has failed to state a plausible CFAA claim because plaintiff has only alleged that defendant violated the company policy or breached his contract, and, under Miller, such facts are insufficient to bring a claim under CFAA. The claim in Miller is distinguishable, however, as the facts alleged in that case supported only unauthorized use of company information, not unauthorized access. See Miller, 687 F.3d at 203 (noting that the "district court held that Appellees' alleged conduct—the violation of policies regarding the use and downloading of confidential information—did not contravene any of these provisions [of CFAA]" and holding that "WEC fails to allege that [defendants] accessed a computer or information on a computer without authorization."). Unlike in Miller, plaintiff has specifically alleged that defendant exceeded his access authorization or accessed information without authorization. For example, plaintiff alleges that defendant engaged in a scheme to fraudulently intercept emails from plaintiff's executive management. Compl. ¶¶ 30-35. Although plaintiff contends that he had unfettered access to all of plaintiff's computer systems and electronically stored documents without limitation, [DE 31-1], such is an issue of fact better determined on summary judgment than at the pleading stage.
The Court finds that plaintiff's has made sufficient allegations relating to defendant's access to state a plausible claim under CFAA and provide defendant with fair notice of the claim against him. See also Tech. Partners, Inc. v. Papaioannou, No. 3:15CV63, 2015 WL 9304562, at *4 (W.D.N.C. Dec. 21, 2015) (where "Plaintiffs make numerous, specific allegations concerning (1) the specific scope of Defendant's data access privileges, and (2) Defendant's unauthorized access to Plaintiffs' computer systems that exceeded that specifically defined scope) plaintiffs have stated a claim under CFAA). Defendant's first motion to dismiss is denied.
In a second-filed motion to dismiss, defendant seeks to dismiss plaintiff's fifth and sixth claims for relief for failure to state a claim. Fed. R. Civ. P. 12(b)(6). Defendant is procedurally barred from raising subsequent 12(b)(6) defenses by the consolidation principle of Fed. R. Civ. P. 12(g). Rule 12(g) provides that, except in circumstances not applicable here, a party must assert all available defense or objections when making a motion under Rule 12. See, e.g., Stoffels ex rel., SBC Concession Plan v. SBC Commc'ns, Inc., 430 F. Supp. 2d 642, 647 (W.D. Tex. 2006) ("A review of the relevant authorities confirms that Rule 12(g) normally bars successive pre-answer motions to dismiss.") (citing 5C Wright & Miller, Fed. Prac. & Proc.. ¶ 1385).
Review of defendant's second motion to dismiss does not reveal any defense or objection which would not have been available at the time of filing of his first motion to dismiss. This motion is therefore denied.
II. Plaintiff's motion to dismiss counterclaims
Defendant has answered plaintiff's complaint and filed counterclaims for wrongful termination in violation of North Carolina public policy, libel per se and libel per quod, and court-ordered indemnification. Plaintiff has moved to dismiss each of defendant's counterclaims for failure to state a claim upon which relief can be granted.
Wrongful termination
A claim for wrongful termination under North Carolina public policy is a "narrow exception to North Carolina's general rule of employment at will." White v. Rite Aid of N. Carolina, Inc., No. 5:15-CV-309-D, 2015 WL 7429996, at *2 (E.D.N.C. Nov. 20, 2015) (listing cases holding same). Such claims have been recognized where, for example, an employee was discharge for refusing to violate the law at the request of his employer or engaging in legally protected activity. Ridenhour v. Int'l Bus. Machines Corp., 132 N.C. App. 563, 568 (1999). A plaintiff must plead "specific conduct by a defendant that violated a specific expression of North Carolina public policy." Considine v. Compass Grp. USA, Inc., 145 N.C. App. 314, 321 (2001); see also White, 2015 WL 7429996, at *2 (plaintiff must plead a specific provision of the North Carolina Constitution or General Statutes as providing the public policy alleged to have been violated).
Defendant alleges that plaintiff violated North Carolina's strong public policy requiring companies to disclose data breaches, reflected in N.C. Gen. Stat. § 75-65. Defendant alleges that he advised plaintiff after what he has termed the "China Data Breach" occurred that plaintiff must report the breach to its affected customers. Defendant further alleges that plaintiff refused to report the China Data Breach and instead terminated defendant's employment "for his refusal to ignore the China Data Breach and [his] efforts to investigate and report the China Data Breach". [DE 89], Countercl. ¶ 48].
Viewing the allegations in defendant's counterclaim as true as the Court must at this stage, defendant has sufficiently stated a plausible claim for relief and put plaintiff on notice of the claim against it. The Court thus declines to dismiss defendant's wrongful termination counterclaim.
Libel claims
Defendant's next counterclaims are for libel per se and libel per quod based on the notification letter sent by plaintiff regarding a data breach arising from defendant's conduct. [DE 92-1]. As it is referenced explicitly in the counterclaim, the Court may consider the contents of the letter without converting the motion to one for summary judgment under Fed. R. Civ. P. 56. See Am. Chiropractic Assoc. v. Trigon Healthcare, Inc., 367 F.3d 212, 234 (4th Cir. 2004).
Libel per se is "a publication which, when considered alone without explanatory circumstances: (1) charges that a person has committed an infamous crime; (2) charges a person with having an infectious disease; (3) tends to impeach a person in that person's trade or profession; or (4) otherwise tends to subject one to ridicule, contempt or disgrace."Boyce & Isley, PLLC v. Cooper, 153 N.C. App. 25, 29 (2002) (citation omitted). "Defamatory words to be libelous per se must be susceptible of but one meaning" which allows a court to decide as a matter of law that the words "tend to disgrace and degrade the party". Flake v. Greensboro News Co., 212 N.C. 780 (1938). Truth is an absolute defense to libel claims. See Martin Marietta Corp. v. Wake Stone Corp., 111 N.C. App. 269, 276 (1993).
In pertinent part, the notification letter provides that in January 2015 plaintiff discovered that defendant retained personal information about certain employees after his employment with plaintiff was terminated in November 2014. [DE 92-1]. It notes that plaintiff immediately notified federal law enforcement upon discovery of defendant's retention of information and that the Federal Bureau of Investigation (FBI) asked plaintiff to refrain from providing notice regarding the incident while it conducted its investigation. It identifies the types of personally identifying information which might have been retained by defendant, as well as the steps plaintiff had taken to remedy the situation, including notifying law enforcement and conducting an internal investigation. The letter notes that plaintiff had made several demands to defendant to return the information, that as of the date of the letter defendant had not returned the information, and that plaintiff had no information regarding misuse of the personal information by defendant. Finally, letter references the filing of the instant lawsuit and notes that "[s]ince the discovery of this wrongdoing by [defendant], we have taken steps to place further limits and safeguards on confidential employee information." Id.
As plaintiff correctly notes, defendant has admitted the truth of much of what is contained in the notification letter. For example, defendant has admitted that he retained plaintiff's documents after his employment was terminated and that the FBI conducted an investigation. [DE 89], Answer ¶¶ 1, 29, 31. Although the letter does in one sentence refer to "wrongdoing" by defendant, the Court does not find that such statement tends to disgrace or degrade defendant. The Court "must [] consider the publication as a whole, looking at the allegedly defamatory statements, within the 'four corners' of the document." Nucor Corp. v. Prudential Equity Grp., LLC, 189 N.C. App. 731, 738 (2008). The overall tenor of the document is not focused on defendant, but rather on alerting plaintiff's employees of a breach of the security of their personal information. Further, "North Carolina cases have held consistently that alleged false statements . . ., calling [a former employee]'dishonest' or charging that [the employee] was untruthful and an unreliable employee, are not actionable per se." Stutts v. Duke Power Co., 47 N.C. App. 76, 82 (1980). The Court holds that defendant's libel per se counterclaim is properly dismissed. As defendant concedes that he has not pled special damages as is required for a libel per quod claim, this claim is also properly dismissed. See, e.g., id.
Court-order indemnification
Defendant seeks court-ordered indemnification under N.C. Gen. Stat. § 55-8-52, which provides that a corporation may have an obligation to indemnify a director "who was wholly successful, on the merits or otherwise, in the defense of any proceeding to which he was a party because he is or was a director of the corporation." Defendant alleges that he has incurred expenses related to the FBI's investigation of his actions and the actions taken which form the basis of plaintiff's suit. As defendant has identified no proceeding in the defense of which he was wholly successful, his claim for indemnification is premature and is properly dismissed without prejudice.
CONCLUSION
For the foregoing reasons, defendant's motions to dismiss [DE 6 & 23] are DENIED. Plaintiff's motion to dismiss counterclaims [DE 91] is GRANT IN PART and DENIED IN PART. Defendant's counterclaims for libel per se and libel per quod are DISMISSED and defendant's counterclaim for indemnification is DISMISSED WITHOUT PREJUDICE. SO ORDERED, this 15 day of February, 2017.
/s/_________
TERRENCE W. BOYLE
UNITED STATES DISTRICT JUDGE