SIM LAKE SENIOR UNITED STATES DISTRICT JUDGE

MEMORANDUM OPINION AND ORDER

Plaintiff Vest Safety Medical Services, LLC ("Vest") asserts claims against Arbor Environmental, LLC ("Arbor") and Robert Shelby (collectively, "Defendants") for breach of contract, misappropriation, conversion, theft of trade secrets, and violations of the Computer Fraud and Abuse Act ("CFAA"). Pending before the court is Defendants' Rule 12(b)(6) Motion to Dismiss (Docket Entry No. 12) ("Motion to Dismiss"). For the reasons stated below, the Motion to Dismiss will be granted in part and denied in part.

I. Factual and Procedural Background

Vest offers an online service to aid enterprises in assigning respirator equipment to employees working in hazardous atmospheres. The process requires an evaluation of employee's medical history known as "respirator clearance." Vest's founder developed a medical evaluation questionnaire and algorithm to enable online respirator clearance that served as an alternative to in-person medical examinations. Vest considers its questionnaire, algorithm, and software to be valuable trade secrets.

On April 14, 2015, Robert Shelby, a director of Arbor, expressed an interest in Vest's service. Vest gave Arbor a demonstration of the service on May 18, 2015, in which Vest's content was displayed in "view only" format. Vest alleges that Arbor was not given access to the online software or computer system. Following the demonstration Arbor requested a service contract, but ultimately declined to enter into an agreement with Vest.

Arbor requested a second demonstration of Vest's system, which was given on February 6, 2017. Vest alleges that Arbor intended to create its own competing online respirator clearance business, and repeatedly attempted to access Vest's system while developing its website. Vest alleges that shortly after the second demonstration Arbor successfully circumvented Vest's security measures, logged in to Vest's online software, and copied Vest's medical evaluation questionnaire, web pages, and error messages.

Vest alleges that it did not become aware of these injuries until Arbor launched its competing website between August of 2018 and August of 2019. Vest alleges that the website features copies of Vest's proprietary trade secrets, including Vest's questionnaire form and error messages. Vest alleges that it examined its website's IP address logs and discovered that Defendants had accessed the website.

On March 6, 2020, Vest filed this action against Defendants alleging federal law claims under the Computer Fraud and Abuse Act, the Economic Espionage Act, and the Defend Trade Secrets Act, and Texas state law claims of simple misappropriation, misappropriation of trade secrets, conversion, and breach of contract. On May 13, 2020, Defendants filed their Motion to Dismiss that argues Vest has not stated a claim for which relief may be granted. Plaintiff responded on June 15, 2020, and Defendants replied on June 25, 2020.

II. Standard of Review

The Federal Rules of Civil Procedure permit dismissal when a plaintiff fails to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). A Rule 12(b)(6) motion tests the formal sufficiency of the pleadings and is "appropriate when a defendant attacks the complaint because it fails to state a legally cognizable claim." Ramming v. United States, 281 F.3d 158, 161 (5th Cir. 2001), cert. denied sub nom. Cloud v. United States, 122 S. Ct. 2665 (2002). To defeat a motion to dismiss a plaintiff must plead "enough facts to state a claim to relief that is plausible on its face." Bell Atlantic Corp. v. Twombly, 127 S. Ct. 1955, 1974 (2007). "Detailed factual allegations" are not required at this stage, but a complaint that establishes the grounds that entitle the plaintiff to relief "requires more than labels and conclusions, and a formulaic recitation of a cause of action's elements will not do." Id. at 1959. In ruling on a Rule 12(b)(6) motion the court generally may not look beyond what appears in the complaint and its attachments. Wilson v. Birnberg, 667 F.3d 591, 595 (5th Cir. 2012). The court must "accept the plaintiff's well-pleaded facts as true and view them in the light most favorable to the plaintiff." Chauvin v. State Farm Fire & Casualty Co., 495 F.3d 232, 237 (5th Cir. 2007).

III. Analysis

A. Allegations Against Robert Shelby

Defendants argue that all claims should be dismissed as to Robert Shelby because the Complaint alleges that "Defendants" engaged in various acts but does not sufficiently allege that Shelby engaged in the acts. Vest argues that its pleadings are sufficient because Shelby is the only individual defendant named in the action.

The court is not persuaded that the Complaint's referral to Arbor and Shelby collectively as "Defendants" renders its allegations insufficiently specific as to Shelby. Shelby is alleged to be an officer of Arbor and is the only individual associated with Arbor described in the Complaint. Taking the Complaint in the light most favorable to Vest, it appears that all actions attributed to "Defendants" are alleged to have been done by Shelby as an agent of Arbor. Where only a single natural person is named as a co-defendant with a business entity in which he has an unambiguous relationship, combined allegations are not necessarily deficient. See, e.g., Flow Valve, LLC v. Forum Energy Technologies, Inc., No. CIV-13-1261-F, 2014 WL 3567814, at *3 (W.D. Okla. July 18, 2014). The authorities cited by Defendants are distinguishable because they involve claims against multiple natural defendants. See ATS Group, LLC v. Legacy Tank and Industrial Services LLC, 407 F. Supp. 3d 1186, 1197 (W.D. Okla. 2019) (involving three individual defendants); Segerdahl Corp. v. Ferruzza, Case No. 17-cv-3015, 2019 WL 77426, at *2 (N.D. Ill. Jan. 2, 2019) (involving six individual defendants). The court concludes that the Complaint sufficiently identifies Shelby as committing any acts generally alleged against "Defendants."

B. Computer Fraud and Abuse Act (Count 1)

Vest asserts a private claim under the Computer Fraud and Abuse Act pursuant to 18 U.S.C. § 1030. Defendants contend that Vest has not alleged circumstances that would permit a private claim under the act. Vest argues that it may bring a claim because it spent at least $5,000 of employee time to investigate the alleged unauthorized computer access.

The CFAA permits private actions for violations of 18 U.S.C. § 1030 only if a defendant's conduct involves certain specified factors. 18 U.S.C. § 1030(g). The only applicable factor raised by the parties applies if the plaintiff alleges qualifying losses of more than $5,000 in one year. 18 U.S.C. § 1030(c)(4)(A)(i)(I). Qualifying losses are (1) costs to investigate and respond to an offense and (2) costs incurred because of a service interruption. Alliantgroup, L.P. v. Feingold, 803 F. Supp. 2d 610, 630 (S.D. Tex. 2011) (Rosenthal, J.). The costs of the plaintiff's internal investigation, including employee time that otherwise could have been spent on other matters, is a qualifying loss. See SucccessFactors, Inc. v. Softscape, Inc., 544 F. Supp. 2d 975, 980 (N.D. Cal. 2008) (finding the "loss" element satisfied by evidence that the plaintiff engaged in internal investigation taking "many hours of valuable time away from day-to-day responsibilities" of its own personnel).

While Vest argues that it suffered at least $5,000 in internal losses by spending employee time to investigate the alleged access, there is no such allegation in its Complaint. The Complaint states that Vest incurred costs in "responding to the offense," "conducting a damage assessment," and "internal manhours," but does not allege the amount of costs incurred. Because Vest has not alleged any facts that could show that these damages amounted to at least $5,000, Vest has not stated a private claim for which relief may be granted under § 1030(g). See Alliantgroup, 803 F. Supp. 2d at 629.

As explained below, Vest will be permitted an opportunity to amend its pleadings. Vest may cure its CFAA claim by alleging additional facts that establish that it incurred at least $5,000 in qualifying damages as a result of the alleged unauthorized access.

C. Economic Espionage Act (Count 2)

Vest alleges a private claim under the Economic Espionage Act under 18 U.S.C. § 1832. Section 1832 is a criminal statute that establishes a crime and specifies a punishment. See 18 U.S.C § 1832. Private citizens have no right to enforce a federal criminal statute. Florance v. Buchmeyer, 500 F. Supp. 2d 618, 626 (N.D. Tex. 2007). Because Congress has not specifically provided for a private cause of action under § 1832, none exists. Steves and Sons, Inc. v. JELD-WEN, Inc., 271 F. Supp. 3d 835, 842 (E.D. Va. 2017).

Vest nonetheless argues that it may assert a count under § 1832 as part of its larger Defense of Trade Secrets Act ("DTSA") claim. Vest's only support for this argument is that some courts have characterized trade secret claims brought under the DTSA's civil claims provision, 18 U.S.C. § 1836, as claims under "the Defend Trade Secrets Act . . . 18 U.S.C. § 1832 et seq." See, e.g., Space Systems/Loral, LLC v. Orbital ATK, Inc., 306 F. Supp. 3d 845, 853 (E.D. Va. 2018). Courts refer to the statute in this manner because the DTSA amended Title 18 of the U.S. Code from sections 1832 to 1838, not because a private cause of action is located in § 1832. See Defend Trade Secrets Act of 2016, Pub. L. 114-153, 130 Stat. 382. That courts have referred to the DTSA generally does not mean every section within it supports a private cause of action. None of the authorities cited by Vest permit a private claim under § 1832. Accordingly, the court will dismiss Vest's claim under § 1832 with prejudice.

D. Statutory Trade Secret Claims (Counts 3 and 4)

Vest asserts misappropriations of trade secrets claims under both § 1836 of the DTSA and the Texas Uniform Trade Secrets Act ("TUTSA"). Defendants argue that Vest has not stated a claim for misappropriation of trade secrets because the information stolen was not secret. Vest responds that its medical evaluation questionnaire algorithm ("MEQ Algorithm") qualifies as a trade secret. Because the definitions of "trade secret" in the DTSA and TUTSA are functionally identical, the court will consider the sufficiency of Vest's federal and state trade secret misappropriation claims together. Compare 18 U.S.C. § 1839(3) with Tex. Civ. Prac. & Rem. Code § 134A.002(6).

A plaintiff bringing a misappropriation of trade secrets claim must allege facts that would show that a trade secret existed. See GE Betz, Inc. v. Moffitt-Johnston, 885 F.3d 318, 326 (5th Cir. 2018). TUTSA defines "trade secret" as:

[A]ll forms and types of information . . . if:

(A) the owner of the trade secret has taken reasonable measures under the circumstances to keep the information secret; and

(B) the information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from the disclosure or use of the information.

(1) the extent to which the information is known outside of the business; (2) the extent to which it is known by employees and others involved in the business; (3) the extent of measures taken to guard the secrecy of the information; (4) the value of the information to the business and to its competitors; (5) the amount of effort or money expended in developing the information; (6) the ease or difficulty with which the information could be properly acquired or duplicated by others.

Defendants argue that the pleaded facts do not suffice to plausibly establish that the MEQ Algorithm was kept secret or derives economic value from its secrecy. While the Complaint alleges an array of different types of misappropriated information, Vest only argues that its MEQ Algorithm constitutes a trade secret. The term "MEQ Algorithm" does not appear in the Complaint, but the court understands this to refer to the described combination of "a new and useful medical evaluation questionnaire ('MEQ') and physician-developed algorithms" developed by Vest's founder.

According to the Complaint the MEQ Algorithm served as the foundation of a novel business model for online respirator clearance, and competitors were "limited" and used "different methodology." The MEQ Algorithm "required hundreds of thousands of dollars and significant manhours to research, design and implement." The Complaint alleges that Vest uses "electronic access restrictions, including various data-encryption technologies" to "prevent online access" to Vest's software, and that only customers subject to confidentiality agreements that prohibit the copying of any information on the website are granted access.

The court is persuaded that the pleaded facts, taken as true, suffice to establish both that Vest took steps to keep the MEQ Algorithm confidential and that it has economic value dependant on that confidentiality. The allegations are specific and speak to several of the factors Texas courts use to assess a trade secret: the MEQ Algorithm was not known outside of Vest, required significant time and resources to develop, formed the foundation of a successful business, and was kept confidential by digital security and contractual arrangements. Federal courts do not require highly specific pleadings for trade secret claims because relevant facts are often unavailable before discovery, and the plaintiff must be permitted to plead the claim without destroying the information's secrecy. See, e.g., Church Mutual Insurance Co. v. Smith, Civil Action No. 3:14-cv-749-JHM, 2015 WL 3480656, at *4 (W.D. Ky. June 2, 2015); Motorola, Inc. v. Lemko Corp., 609 F. Supp. 2d 760, 771 (N.D. Ill. 2009).

Defendants make multiple arguments that rely on facts outside of those alleged in the Complaint. For example, Defendants argue that the questionnaire information is readily accessible to the public or anyone who sees the demo or that the questionnaire is based on readily available and well-known OSHA guidelines. These facts do not appear within the Complaint. Because the court must take Vest's well-pleaded allegations as true and may not look beyond the Complaint, these arguments are not relevant to whether the trade secret claims must be dismissed under Rule 12(b)(6). Defendants' Motion to Dismiss will be denied as to the trade secret claims.

E. Common Law Misappropriation (Count 5)

Vest alleges a Texas state-law claim of misappropriation. Defendants argue that this claim is preempted by federal copyright law.

Federal copyright law preempts state law claims if (1) "the intellectual property at issue is within the subject matter of copyright" and (2) the state law claim "protects rights in that property that are equivalent to any of the exclusive rights within the general scope of copyright." Ultraflo Corp. v. Pelican Tank Parts, Inc., 845 F.3d 652, 656 (5th Cir. 2017). A misappropriation claim is preempted by the Copyright Act when the alleged misappropriation is of "original works of authorship fixed in a tangible medium of expression." Motion Medical Technologies, L.L.C. v. Thermotek, Inc., 875 F.3d 765, 774 (5th Cir. 2017). Misappropriation claims are therefore preempted when based on the theft of information in documents or electronic files. See Utex Industries, Inc. v. Wiegand, Civil Action No. H-18-1254, 2020 WL 873985, at *11 (S.D. Tex. Feb. 21, 2020) (Lake, J.). A district court may decide a preemption question in ruling on a 12(b)(6) motion if the allegations are "sufficient to allow the court to rule." See DynaEnergetics GmbH & Co. KG v. Hunting Titan, Inc., Civil Action No. H-19-1615, 2019 WL 5191024, at *2, 5 (S.D. Tex. Oct. 15, 2019) (Rosenthal, J.).

Vest's misappropriation claim is based on the theft of its "product, including medical evaluation questionnaires, materials and content used in its online respirator clearance process." The claim incorporates the remainder of the Complaint by reference, which makes clear that this theft was specifically the "copying" of the contents of Vest's online software and web pages. The Complaint does not allege any misappropriation of anything other than information contained in software or on a website. The claim as stated therefore is preempted by federal copyright law and will be dismissed with prejudice.

F. Conversion (Count 6)

Vest alleges a Texas state law claim for conversion. Defendants argue that this claim fails as a matter of law because a conversion claim requires the taking of physical property.

In Texas conversion claims are limited in scope to the taking of physical property. Carson v. Dynegy, Inc., 344 F.3d 446, 456 (5th Cir. 2003) (citing Waisath v. Lack's Stores, Inc., 474 S.W.2d 444, 447 (Tex. 1971)). Claims asserting conversion of intangible rights are permitted only when those rights are embodied in or merged with physical documents that are converted. D'Onofrio v. Vacation Publications, Inc., 888 F.3d 197, 212 (5th Cir. 2018). Allegations of theft or copying of information found in computer software without an alleged taking of a tangible object such as a hard disk or computer cannot support a conversion claim. Quantlab Technologies Ltd. (BVI) v. Godlevsky, 719 F. Supp. 2d 766, 779 (S.D. Tex. 2010) (Ellison, J.). The authorities cited by Vest do not address the physical taking requirement. See Windsor v. Olson, Civil Action No. 3:16-CV-934-L, 2019 WL 2080021, at *21 (N.D. Tex. May 10, 2019); Cuidado Casero Home Health of El Paso, Inc. v. Ayuda Home Health Care Services, LLC, 404 S.W.3d 737, 748 (Tex. App.-El Paso 2013, no pet.). The court is therefore persuaded that the limitation applies.

Vest alleges the conversion of "online software, including Vest's proprietary, confidential and trade secret information, such as is embodied by Vest's medical evaluation questionnaires." Vest alleges that Defendants accessed its website and copied this information, but does not allege the conversion of any physical property. Accordingly, Vest's misappropriation claim fails as a matter of law. The court will dismiss this claim with prejudice because Vest has not argued that Defendants converted physical property.

G. Breach of Contract (Count 7)

Vest alleges that Defendants breached an agreement not to modify or reproduce the content of Vest's online software. Defendants argue that Vest has failed to allege facts that would establish that a contract exists.

The Complaint does not specify what contract was breached and only states "Defendants agreed not to engage in the unauthorized modification, transmittal, reproduction, distribution, and/or exploitation of content included in Vest's online software." The Complaint describes two contracts, but is unclear whether either of them serves as the basis for the claim. The first is the Terms of Use that is linked below Vest's website's log-in fields. A website's terms and conditions that do not require affirmative assent through a click on an "accept" or "I agree" button are only enforceable if the website user had actual or constructive knowledge of the terms. Southwest Airlines Co. v. BroadFirst, L.L.C., Civil Action No. 3:06-CV-0891-B, 2007 WL 4823761, at *4-5 (N.D. Tex. Sept. 12, 2007). The Complaint does not allege that Defendants necessarily saw or agreed to the terms of use or used the log-in fields; it only states that "Defendants circumvented the security measures on Vest's online software and impermissibly gained access to content on Vest's computer systems." These allegations are not sufficient to establish that Defendants agreed to the Terms of Use. The second contract described is Vest's new service contract; the Complaint states that it was sent to Defendants but not that it was signed or agreed to.

The court concludes that Vest has not alleged facts that would establish Defendants agreed to a contract. The court will dismiss this claim without prejudice. Vest may cure the claim by alleging facts that establish the existence of a contract between Vest and Arbor or Shelby.

IV. Conclusions and Order

For the reasons explained above, Vest has failed to state a claim for which relief may be granted except as to its state and federal trade secret claims (Counts 3 and 4). However, federal courts generally give a plaintiff an opportunity to cure pleading defects before dismissing with prejudice unless the defect is incurable. Great Plains Trust Co. v. Morgan Stanley Dean Witter & Co., 313 F.3d 305, 329 (5th Cir. 2002). Vest has not had an opportunity to amend its claims and has requested leave to amend should the court find them deficient. Vest's Economic Espionage Act claim is not curable because 18 U.S.C. § 1832 does not create a private cause of action, the state law misappropriation claim is not curable because it is preempted by federal copyright law, and the state law conversion claim is not curable because Vest has not suggested that Defendants converted physical property. The factual deficiencies in Vest's CFAA and contract claims described above, however, are not clearly incurable and therefore should not be dismissed with prejudice.

Accordingly, Defendants' Rule 12(b)(6) Motion to Dismiss (Docket Entry No. 12) is DENIED with respect to Plaintiff's claims for misappropriation of trade secrets under the Defend Trade Secrets Act and Texas Uniform Trade Secrets Act, and GRANTED with respect to Plaintiff's other claims. Plaintiff's Economic Espionage Act claim, common law misappropriation claim, and conversion claim are DISMISSED WITH PREJUDICE; and the other claims are DISMISSED WITHOUT PREJUDICE. Plaintiff may file an amended complaint to cure the claims dismissed without prejudice pursuant to a schedule that will be established at the July 17, 2020, pretrial and scheduling conference.

SIGNED at Houston, Texas, on this the 15th day of July, 2020.

/s/_________

SIM LAKE

SENIOR UNITED STATES DISTRICT JUDGE