Opinion
No. 3:09cv360 (SRU).
July 15, 2010
RULING ON MOTION FOR JUDGMENT ON THE PLEADINGS
Defendants Brent Wesler, Square 9 Softworks, Inc. ("Square 9"), and Infinet Business Systems, LLC ("IBS") filed a motion for a judgment on the pleadings (doc. # 95). On June 18, 2010, I heard argument on the motion and for reasons articulated on the record I indicated my intention to grant the motion and dismiss the case. I reserved ruling only to resolve and address in writing the distinguishing facts of this case in light of the recent holdings of Orbit One Communications, Inc. v. Numerex Corp., 692 F. Supp. 2d 373 (S.D.N.Y. 2010), and Starwood Hotels Resorts Worldwide, Inc., v. Hilton Hotels Corp. n/k/a Hilton Worldwide, et al., No. 09-3862, slip op. (S.D.N.Y. June 16, 2010), concerning conduct giving rise to civil liability under the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030 et seq. For the following reasons I find the facts of this case most analogous to those in Orbit One and distinguishable from those in Starwood. Accordingly, the motion for judgment on the pleadings is granted and I decline to exercise supplemental jurisdiction over plaintiff's state law claims and defendants' counterclaims. The second amended complaint is therefore dismissed without prejudice to refiling in state court.
After argument, on June 21, 2010, plaintiff filed a motion for clarification (doc. # 151) asking that I rule on WTI's motion to reconsider/vacate (doc. # 134) the order granting defendants' motion to file an amended answer and counterclaim. In light of this ruling, the motion for clarification (doc. # 151) is denied.
I. Standard of Review
"The standard for granting a Rule 12(c) motion for judgment on the pleadings is identical to that of a Rule 12(b)(6) motion for failure to state a claim." Patel v. Contemporary Classics of Beverly Hills, 259 F.3d 123, 126 (2d Cir. 2001). Pursuant to that standard, the defendants' motion will be granted only if "it is clear that no relief could be granted under any set of facts that could be proved consistent with the allegations." Hishon v. King Spaulding, 467 U.S. 69 (1984). When deciding a motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure, I must accept the material facts alleged in the complaint as true, draw all reasonable inferences in favor of the plaintiff, and decide whether the plaintiff has set forth a plausible claim for relief. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 562-63 (2007); Iqbal v. Hasty, 129 S. Ct. 1937 (2009); Leeds v. Meltz, 85 F.3d 51, 53 (2d Cir. 1996).
II. Background
For the purposes of this ruling and order the facts pled in the second amended complaint (doc. # 136) are accepted as true. WTI provides document management software solutions, consulting, educational and supportive services to its clients. See doc. # 136 at ¶ 15. WTI partners with resellers. Id. at ¶ 16. IBS became a reseller/partner with WTI around October 2001. Id. In July 2008 WTI and IBS entered into a partnership agreement. The agreement provided, among other things, that IBS would keep confidential certain information obtained under the partnership and IBS would not solicit WTI employees. Id. Square 9 and IBS act in concert and interchangeably share corporate officers. Id. at ¶ 9. Stephen Young is the Vice President of Sales for IBS and President of Square 9. Id. at ¶ 10. Anthony Bishop was/is President of IBS and Chief Financial Officer of Square 9. Id. at ¶ 11. Brian Banet was/is Vice President of Professional Development for IBS and Chief Technology Officer for Square 9. Id. at ¶ 12. Brent Wesler was employed by WTI as its Vice President of Promotional Services. Id. at ¶ 17. Wesler and WTI executed an employee non-disclosure, non-compete, non-solicitation and ownership of property agreement dated August 24, 2005. Id. at ¶ 18.
On June 19, 2008, Wesler tendered his resignation, which became effective on July 3, 2008. Id. While still employed at WTI, Wesler had "full and unique access to WTI's software source codes and software proprietary to WTI and also had access to other confidential and proprietary customer lists, customer information and marketing plans and other information and material." Id. After Wesler tendered his resignation, WTI discovered that Wesler accepted future employment with IBS. Id. at ¶ 26. WTI reminded Wesler that he was bound by the terms of his employment agreement. Id. at ¶ 27. After Wesler left WTI and joined IBS, WTI discovered that, while still employed at WTI, Wesler forwarded electronic communications to IBS containing sets of programming code developed and owned by WTI. Id. at ¶ 28. The disclosure was not authorized by WTI. WTI also discovered that IBS/Square 9 downloaded information that had been uploaded and transferred by Wesler. Id. at ¶ 29. At the hearing, plaintiff clarified that the downloading did not involve IBS directly accessing WTI's computer, but that Wesler served as the vehicle for the access.
Wesler sent e-mails to WTI's customers and partners in an effort to solicit business for IBS while still under WTI's employ. Id. at ¶ 55. He sent these e-mails from his personal hotmail account and an IBS e-mail account provided to him while he was still employed at WTI. Id. at ¶ 59. Wesler also uploaded WTI files into his IBS laptop. Id. at ¶ 62. At argument, WTI stated that the allegations, as pled, are not that the defendants "hacked" WTI's computers and unlawfully took information but that defendants used Wesler's authorized access to obtain WTI's protected information for use after Wesler joined IBS. The above conduct, WTI alleges, arises to the level of a violation of the CFAA.
III. Discussion
The first count of WTI's second amended complaint alleges that each of the defendants violated the CFAA. The CFAA is a criminal statute that also provides for civil liability where a person, inter alia, "knowingly and with intent to defraud, accesses a protected computer without authorization or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value" or "intentionally accesses a protected computer without authorization and as a result of such conduct, causes damage." 18 U.S.C. §§ 1030(a)(4) and (5)(C). WTI maintains that Wesler in both his individual capacity and as an instrument for the other defendants used his authorized access to download WTI's confidential and proprietary information for the defendants' benefit. Defendants argue that the alleged misconduct, as pled, is insufficient to sustain a cause of action under the CFAA because Wesler's access was authorized.
The second amended complaint alleges a single violation of the CFAA and fourteen state law violations.
WTI does not specify which provision the defendants allegedly violated, however, the conduct can best be construed as allegations brought under §§ 1030(a)(4) and (5)(C).
The question whether the CFAA applies to misappropriation claims has recently been addressed by two courts in this Circuit. See Orbit One Communications, Inc. v. Numerex Corp., 692 F. Supp. 2d 373 (S.D.N.Y. 2010) (hereinafter "Orbit One") and Starwood Hotels Resorts Worldwide, Inc., v. Hilton Hotels Corp. n/k/a Hilton Worldwide, et al., No. 09-3862, slip op. (S.D.N.Y. June 16, 2010) (hereinafter "Starwood"). In Orbit One the court, acknowledging a split of authority in federal courts, observed that:
Connecticut General Statutes § 35-51(b) defines misappropriation, in relevant part, as "(1) [a]cquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or (2) disclosure or use of a trade secret of another without express or implied consent by a person who . . . (B) at the time of disclosure or use knew or had reason to know that his knowledge of the trade secret was . . . (ii) acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use . . . or (iii) derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use . . . "
Courts have interpreted the CFAA's prohibitions of "access without authorization" and "exceed[ing] authorized access" in two different ways. At least two Circuits and one district court in our Circuit have applied agency law principles to the CFAA and held that an employee who misappropriates data residing on his employer's computer system or accesses it for an improper purpose violates the statute. But other courts, including at least one district court in our Circuit have disagreed, holding that the CFAA's prohibition of improper "access" does not encompass an employee's misuse or misappropriation of information that the employee lawfully accessed.Orbit One, 692 F. Supp. 2d at 385.
In Orbit One, defendant Numerex counterclaimed against three former officers alleging the officers had "intentionally accessed Numerex's computer system and downloaded confidential and proprietary information contained on that system, and removed that information . . . for the purpose of competing with Numerex" in violation of the CFAA. Id. at 384. The officers contended that they had, at all times relevant, authorization to access Numerex computers. Id. Adopting a narrow reading of the CFAA the Court agreed with defendants and held that an authorized user who takes proprietary information prior to leaving the employer for the purpose of later competing with that employer has not violated the CFAA.
Employing principles of statutory interpretation in support of its position, the Court first held that the CFAA's plain language "expressly prohibits improper `access' of computer information. It does not prohibit misuse or misappropriation." Id. at 385. The Court found support for its plain language analysis in the Second Circuit's affirmance of Nexans Wires S.A. v. Sark-USA, Inc., 319 F. Supp. 2d 468, (S.D.N.Y. 2004), aff'd, 166 Fed. Appx. 559 (2d Cir. 2006). Id. at 386. In Nexans Wires the panel affirmed the district court's holding that $10 million in lost profits linked to the alleged misappropriation of confidential data was not a loss as defined by the CFAA.
Additionally, the Court employed the rule of lenity, which instructs district courts to "resolv[e] ambiguity in a criminal statute as to apply it only to conduct clearly covered." Id. (quoting United States v. Velastegui, 199 F.3d 590, 593 (2d Cir. 1999) (quoting United States v. Lainer, 520 U.S. 259, 266 (1997))); see also LVRC Holdings, LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009) (Holding that "[n]o language in the CFAA supports LVRC's argument that authorization to use a computer ceases when an employee resolves to use the computer contrary to the employer's interest . . . Rather, we hold that a person uses a computer `without authorization' . . . when the person has not received permission to use the computer for any purpose (such as when a hacker accesses someone's computer without any permission), or when the employer has rescinded permission to access the computer and the defendant uses the computer anyway.").
At argument, WTI argued for distinguishing Wesler's conduct from that of the former officers' in Orbit One and comparing the conduct to that at issue in Starwood. The facts before the court in Starwood follow. See Starwood, No. 09-3862, slip op. at 2-5. Defendant Hilton Worldwide is a direct competitor of Starwood Worldwide. Id. at 2. Hilton Worldwide solicited two of Starwood Worldwide's executive officers, entered into employment agreements with the officers and began paying the officers while the officers continued their employment with an unawares Starwood Worldwide. Id. at 2-3. While on the payroll of Hilton Worldwide, the officers, acting as corporate spies, secretly utilized their knowledge of Starwood Worldwide's computers and electronic information to steal hundreds of thousands of pages of Starwood Worldwide's confidential documents. Id.
The Court, also recognizing the split of authority on misappropriation claims, noted that "this case presents the Court with a factual scenario not yet addressed in the Second Circuit." Id. at 9. Distinguishing defendants' conduct from that of the "insider who lawfully accesses the employer's information in the ordinary course of his duties and eventually uses that information against the employer's interests" the Court characterized Hilton and the officers' conduct as corporate espionage. Id. at 9-10. Because the access was obtained through trickery and deceit, not run-of-the-mill misappropriation, the Court held that the conduct alleged was sufficient to state a claim under the CFAA for unauthorized access.
In the instant case, WTI argues that Wesler's conduct is most similar to the corporate espionage at issue in Starwood and not the mere misappropriation at issue in Orbit One. The facts as pled in the second amended complaint do not support plaintiff's interpretation. First, even though Wesler intended to join IBS after leaving WTI, there is no allegation that Wesler was serving two masters or deceiving WTI about his future employment plans as was the case in Starwood. On the contrary, WTI, wholly aware of Wesler's future employment with IBS, reminded Wesler at his exit interview of the terms of his employment agreement. See doc. # 136 at ¶ 27. WTI did not revoke Wesler's access despite his future employment plans. Indeed, to the extent that Wesler later misused information obtained by accessing WTI's computer and information system, at all times relevant, Wesler was authorized and expected to access the information.
WTI also conceded at argument that at no time did Wesler use WTI's computer to transmit WTI's proprietary information to the other defendants. The facts in the complaint indicated the Wesler utilized his personal e-mail account to transmit information to IBS. Lastly, the facts of the second amended complaint lack the force of the deceptive conduct at issue in Starwood. IBS, at the time Wesler left WTI, was a partner of WTI, not a direct competitor. At best the complaint supports a claim that Wesler, while still employed at WTI, undertook efforts to leave with WTI's proprietary information for the later benefit of IBS, not for the benefit of an entity in direct competition with WTI. Much like the counterclaim defendants in Orbit One, Wesler's conduct fails to rise to the level of a CFAA claim and is nothing more than a run-of-the-mill misappropriation claim. Accordingly, the first count of the second amended complaint is dismissed.
With respect to plaintiff's remaining state law claims and the counterclaims, I am generally obligated to dismiss the state claims along with the federal one under circumstances where federal subject matter jurisdiction does not exist because the claims set forth in the pleading fail as a matter of law. See United Mine Workers v. Gibbs, 383 U.S. 717, 725, 727 (1966); cf. Crane Co. v. American Standard, Inc., 603 F.2d 244, 254 (2d Cir. 1979) ("even where substantial time and resources have been expended in the trial of an action in federal court, pendent state claims must be dismissed if it later is determined that there never existed a federal claim sufficient to invoke the jurisdiction of the federal court."). Failure to do so, the Second Circuit has instructed, may be an abuse of discretion. Nolan v. Meyeri, 520 F.2d 1276, 1280 (2d Cir. 1975). Defendant's motion for judgment on the pleadings (doc. # 95) is GRANTED. Plaintiff's second amended complaint (doc. # 136) is dismissed without prejudice to the refiling of the parties' claims and counterclaims in state court. The clerk shall close the file and terminate all pending motions.
It is so ordered.