Opinion
Case No. 15-cv-13781
11-04-2015
DOW CORNING CORPORATION, Plaintiff, v. ANJANEYULU CHAGANTI and HOMI SYODIA, Defendants.
OPINION AND ORDER GRANTING IN PART MOTION FOR TEMPORARY RESTRAINING ORDER, TEMPORARILY RESTRAINING AND ENJOINING DEFENDANTS, DIRECTING SERVICE, SCHEDULING HEARING ON MOTION FOR PRELIMINARY INJUNCTION, DIRECTING APPEARANCE, AND PERMITTING RESPONSE
Plaintiff Dow Corning Corporation filed a verified complaint against Defendants Anjaneyulu Chaganti and Homi Syodia on October 26, 2015. See Pl.'s Compl., ECF No. 1. The complaint alleges that Defendants exceeded their authorized access to Dow Coming's computers under the Master Agreement between Plaintiff and Defendants' employer, HCL America, Inc. The Master Agreement obligated HCL to meet certain data privacy standards. HCL is not, however, an identified defendant. Plaintiff alleges three counts in its complaint: (1) violation of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030; (2) conversion; and (3) breach of fiduciary duty. Id.
Dow Corning has moved for injunctive relief against Defendants. Dow Corning has titled the motion "Plaitniff [sic] Dow Corning Corporation's Verified Emergency Motion for Injunctive Relief." See Pl.'s Mot., ECF No. 7. In the motion Dow Corning seeks injunctive relief under both Rule 65 and the Court's power to do equity. Because Dow Corning desires the motion to be addressed ex parte, only the request for a temporary restraining order may be considered. See Fed. R. Civ. P. 65 (limiting any ex parte relief available to a temporary restraining order).
The motion was submitted in twelve-point font. The Local Rules require that papers be submitted in fourteen point font. Dow Corning's counsel should become familiar with the Local Rule's practice requirements in advance of further filings.
I.
Dow Corning Corporation is a Michigan corporation located in Midland, Michigan. See Pl.'s Compl. ¶ 1, ECF No. 1. Defendants are employees of HCL America, Inc. Id. at ¶ 6. HCL contracted with Dow Corning in March, 2012 "to provide certain IT services" to Dow Corning. Id. The agreement between the parties was memorialized in the Master Agreement attached to Dow Corning's complaint and motion. See Pl.'s Compl., Ex. A, ECF No. 1-1.
A.
The Master Agreement between Dow Corning and HCL governs the manner in which HCL provides information technology ("IT") services to Dow Corning. Part of HCL providing IT services to Dow Corning involves being exposed to Dow Corning's data. The Master Agreement refers to this data as "Customer Data." Master Agreement Section 12.01, Pl.'s Mot., Ex. A, ECF No. 7-2. HCL's exposure to Customer Data is governed by Section 12.01 of the Master Agreement, which provides:
As between the Parties, all Customer Data is and shall remain the property of Customer. Without the prior approval of Customer, to be given in its sole discretion, Customer Data shall not be (a) used by Supplier [(HCL)] other than as required to perform the Services, (b) disclosed, sold, assigned, leased, licensed or otherwise provided or made available in any manner to third parties by Supplier, (c) monitored, analyzed, individualized, anonymized, aggregated, stored, or copied by Supplier, or (d) commercially exploited in any form (including any
individualized, anonymized, or aggregated form) by or on behalf of Supplier. Any archival tapes containing Customer Data shall be used by Supplier solely for back-up purposes. Supplier hereby does, and shall cause its Affiliates and Supplier Agents to, irrevocably, perpetually and unconditionally assign to Customer without further consideration all rights, title, and interest each may have in any Customer Data, including all intellectual property and other proprietary rights. Such rights shall vest in Customer upon creation of the relevant Customer Data.Master Agreement Section 12.01, ECF No. 7-2.
The Master Agreement also establishes "General Confidentiality Obligations" between the parties. Section 12.04, which sets forth these obligations, provides:
Each Party acknowledges and agrees that, as between the Parties, title to and ownership and use rights of Confidential Information shall remain with the Party that disclosed the Confidential Information, and that the Confidential Information disclosed in connection with the Agreement is confidential and proprietary information of the disclosing Party. Each Party shall use at least the same degree of care as it employs to avoid unauthorized disclosure of and unauthorized access to its own Confidential Information of like kind and import, but in any evnt no less than a reasonable degree of care, to prevent disclosure of and unauthorized access to the Confidential Information of the other Party in its possession. Neither Customer nor Supplier shall disclose, publish, release, transfer or otherwise make available Confidential Information of, or obtained from, the other in any form to, or for the use or benefit of, any person or Entity without the disclosing Party's prior consent, to be given in the disclosing Party's sole discretion. Each of Customer and Supplier shall, however, be permitted to disclose relevant aspects of the other's Confidential Information to its officers, directors, employees, agents, professional advisors (including attorneys, bankers and consultants), contractors, subcontractors, suppliers, vendors and representatives, and to the officers, directors, employees, agents, professional advisors, contractors, subcontractors, suppliers, vendors and representatives of its Affiliates, in each case on a need to know basis to the extent that such disclosure is not restricted under any applicable agreements or any Laws and is necessary for the performance of its duties and obligations under or with respect to the Agreement or the determination, preservation or exercise of its rights and remedies under the Agreement or under Law; provided, however, that the recipient shall take all reasonable measures to ensure that Confidential Information of the disclosing Party is not disclosed or duplicated in the contravention of the provisions of the Agreement by such persons and Entities.Master Agreement Section 12.04, ECF No. 7-2. The Master Agreement defines Confidential Information as "all information (regardless of form) of Customer and Supplier, respectively, whether disclosed to or accessed by Customer or Supplier in connection with the Agreement, including with respect to Customer, the existence and provisions of the Agreement, all Customer Data, and all information of Customer and Customer Agents[.]" Id. at Schedule 1, Defined Terms, ECF No. 7-2 (emphasis added).
In situations where Confidential Information is in the possession of HCL or its "Supplier Agents" (individuals like Defendants), the Master Agreement entitles Dow Corning to have that information returned upon request. Section 12.05 provides that:
Upon request by Customer, Supplier shall (a) promptly provide to Customer, in the format and on the media requested by Customer, all or any part of Customer's Confidential Information, and (b) securely and permanently erase or destroy all or any part of Customer's Confidential Information in Supplier's or any Supplier Agent's possession or control, in each case to the extent so requested by Customer.Id. at Section 12.05.
The Master Agreement provides even further protections for certain types of Customer Data that it defines as "Personal Data." Id. at Section 12.06. Personal Data is defined as "any Customer Data that identifies or is capable of identifying an individual, or is otherwise defined as 'personal information,' 'personal data,' 'sensitive personal data,' 'personally identifiable information,' 'personal health information,' 'non-public personal information' or similar terms under applicable Laws." Id. at Schedule 1, Defined Terms. The Master Agreement limits the use of Personal Data. Specifically:
(a) Other than where expressly requested by an individual data subject, Supplier shall not use or disclose Personal Data for any purpose other than fulfilling its obligations under the Agreement without the prior approval of Customer and, to the extent required by applicable Law, the individual data subject. . . . Supplier shall promptly comply (which shall in no event be longer than any time frame for compliance required by applicable Law) with any request from Customer with respect to Personal Data that is necessary to allow Customer to comply with applicable Law.
(b) Supplier shall not disclose Personal Data to any Supplier Agent without the prior approval of Customer and an agreement in writing from the Supplier Agent to use and disclose such Personal Data only to the extent necessary to fulfill Supplier's obligations under the Agreement and for no other purposes.Id. at Section 12.06. The section also sets forth limitations on the transportation of Personal Data outside of certain jurisdictions and limits access to certain health information. Id.
. . .
(g) If any unauthorized or impermissible disclosure, loss of or access to any Personal Data occurs, Supplier shall (i) assist in the identification of affected persons, (ii) allocate call center resources and training to manage inquiries from affected persons, (iii) provide affected persons with credit monitoring services, (iv) assist with the delivery of Customer-provided electronic, hard copy and/or telephonic notifications to affected persons, and (v) take such other actions as may be reasonably required by Customer.
It appears, on the face of the Master Agreement, that personal information (addresses, social security numbers, financial information, etc.) of Dow Corning employees would constitute Personal Data, Consumer Data, and Confidential Information. That information would then be subject to the protections established for each type of information.
B.
Pursuant to the Master Agreement, prior to Defendants beginning on-site work they entered into two different agreements with Dow Corning. The first was a "Contractor Confidentiality and Inventions Agreement." See Confidentiality Agreement, Pl.'s Mot., Ex. B, ECF No. 7-3. Under the Confidentiality Agreement, each Defendant covenanted in pertinent part, that:
I acknowledge that certain trade secrets and other confidential information may become known to me during my assignment with Dow Corning.
1. During the term of my assignment with Dow Corning and after the termination of this assignment, I will keep secret all Dow Corning technical and business information and information received by Dow Corning under obligations of confidence and will not reveal or divulge the same to third parties, or use or
publish it in a any [sic] manner, without prior written approval from Dow Corning[.]Id.
. . .
4. I understand and agree that I shall be liable to Dow Corning for any breach of this agreement and that all of the obligations under this agreement are binding upon my heirs, assigns and legal representatives.
The second agreement between Defendants and Dow Corning was a "Network Computer Usage Agreement." See Network Agreement, Pl.'s Mot., Ex. C, ECF No. 7-4. Under this agreement, each Defendant agreed
. . . to the following conditions for use of any component of the Dow Corning Information Network (DCIN):Id. The agreement lists further covenants not relevant to the present matter. It also requires that Defendants agree to abide by certain information and security policies that have not been attached to Dow Corning's motion.
1. All computer equipment, software, data and supplies that are the property of Dow Corning will be used solely for approved Dow Corning business purposes.
2. I will protect information to which I have access from unauthorized disclosure or misuse.
C.
On September 24, 2015, Defendants downloaded confidential information about Dow Corning employees from Dow Corning computers and computer systems to personal drives. See Pl.'s Compl. ¶ 9, ECF No. 1. Defendants were not authorized, under the term of their retention, to download that information onto personal hardware. Id. at ¶ 11. The information in question consisted of "over 4,000 confidential documents." Id. at ¶ 10. The documents "contain highly confidential information about [Dow Corning] employees, former employees, and their dependents, including names, addresses, financial information (such as retirement calculations, salary information, and bonus calculations), social security numbers, salary, and account numbers." Pl.'s Mot. 7, ECF No. 7.
In response to the download, Dow Corning initiated an investigation with HCL to determine the scope of Defendants' download. See Pl.'s Compl. ¶ 12. The investigation has uncovered at least one download, but it is possible there are more. Id. Dow Corning has been able to work with HCL to make requests that Defendants return the devices onto which they downloaded the information. Defendants' response to HCL has been "incomplete and evasive at best." Pl.'s Mot. 7, ECF No. 7. To this date, Defendants have not "turned over their laptops or other electronic devices to [Dow Corning] and/or HCL for forensic analysis to determine the full extent of the information taken and whether any or all of the information was further transferred . . . to others." Id. at 12. Defendants represented to HCL that they have turned over all USB drives used to download the information. Id. But Dow Corning's forensic analysis has revealed that "[t]here is at least one other USB software drive that was used and not returned by [D]efendants." Id. For that reason, Dow Corning has sought injunctive relief to prevent Defendants from disseminating any of this information and to compel Defendants to comply with Dow Corning's requests for production of devices.
II.
A.
Federal Rule of Civil Procedure 65 provides that a "court may issue a [TRO] without written or oral notice to the adverse party or its attorney" if two requirements are satisfied: (1) "specific facts in an affidavit or a verified complaint clearly show that immediate and irreparable injury, loss, or damage will result to the movant before the adverse party can be heard in opposition"; and (2) "the movant's attorney certifies in writing any efforts made to give notice and the reasons why it should not be required." Fed. R. Civ. P. 65(b)(1).
Four factors govern whether the Court will issue a TRO (the same four factors governing whether to issue a preliminary injunction): (1) whether the plaintiff has demonstrated a substantial likelihood of success on the merits; (2) whether there is a threat of irreparable harm to the plaintiff; (3) whether issuance of the injunction would harm others; and (4) whether the public interest is served by granting injunctive relief. Hamilton's Bogarts, Inc. v. Michigan, 501 F.3d 644, 649 (6th Cir. 2007) (citation omitted); see also Ne. Ohio Coal. for Homeless and Serv. Emps. Intern. Union, Local 1199 v. Blackwell, 467 F.3d 999, 1009 (6th Cir. 2006). "These factors are not prerequisites, but are factors that are to be balanced against each other." Overstreet v. Lexington-Fayette Urban Cnty. Gov't, 305 F.3d 566, 573 (6th Cir. 2002) (citations omitted).
B.
Dow Corning's motion for a temporary restraining order does not comply in all respects with Rule 65. Nowhere in the motion does Dow Corning's "attorney certify[y] in writing any efforts made to give notice and the reasons why it should not be required." Fed. R. Civ. P. 65(b)(1). Because injunctive relief, particularly ex parte injunctive relief, is such an extreme remedy, the Federal Rules of Civil Procedure require that the attorney for the party seeking such relief attest, under penalty of sanction, why the movant should be relieved from normal notice requirements. Heyman v. Kline, 456 F.2d 123, 127 n.2 (2d Cir. 1972) (explaining that it is the rare case where even last minute notice would result in dire consequences requiring ex parte hearing and admonishing attorney for not making certification). "[T]he Rule 65(b) restrictions on the availability of ex parte temporary restraining orders reflect the fact that our entire jurisprudence runs counter to the notion of court action taken before reasonable notice and an opportunity to be heard has been granted both sides of a dispute." First Tech. Safety Sys., Inc. v. Depinet, 11 F.3d 641, 650 (6th Cir. 1993) (quoting Reed v. Cleveland Bd. of Educ., 581 F.2d 570, 573 (6th Cir. 1978)) (internal quotation marks omitted). Normally, a district court is "justified in proceeding ex parte . . . where notice to the adverse party is impossible, as in the cases where the adverse party is unknown or is unable to be found." First Tech. Safety Sys., 11 F.3d at 650. A court may also proceed ex parte in another "limited circumstance . . . where notice to the defendant would render fruitless further prosecution of the action." Id.
Dow Corning's attorney does not certify that either situation exists here. Dow Corning does represent that there are open lines of communication between HCL and Defendants and possibly even Dow Corning and Defendants. Dow Corning also represents that requests have been made to recover the materials at issue without recourse to a legal proceeding and that those efforts were partially successful but have reached a dead end. But despite this contact, no mention of notice or lack thereof is made. Dow Corning's attorney needs to certify to the Court that it engaged in some discussion, albeit informal, with Defendants about the possibility of seeking this relief or why they could not engage in such discussions. It appears from the face of Dow Corning's pleadings, however, that the circumstances present in this case may support a certification that notice would be futile or harmful. This cannot be confirmed until a certification is made. The absence of a certification is not presently fatal, but Dow Corning will be directed to file a supplemental certification within 24 hours of this order. If Dow Corning does not, or if the certification is insufficient, the temporary injunction will be lifted.
III.
Although each of the factors need not be conclusively found to favor the issuance of injunctive relief, each will be analyzed in turn. Dow Corning argues that all four TRO factors support the issuance of emergency injunctive relief.
A.
First, Dow Corning contends that it has a likelihood of succeeding on the merits. Dow Corning's complaint alleges three causes of action: violation of the Computer Fraud and Abuse Act; Conversion; and Breach of Fiduciary Duty. See Pl.'s Compl., ECF No. 1. In its motion, Dow Corning only analyzes its likelihood of success with respect to its CFAA claim. Accordingly, analysis of Dow Corning's entitlement to a TRO turns, at this juncture, only on the likelihood of Dow Corning's success on the merits of its CFAA claim. This analysis will proceed in two steps. First, Dow Corning's CFAA claim and its pleading deficiencies must be discussed. This is an unwelcome, but necessary digression; necessary, in part, because of the state of the law. After the initial statutory and pleading issues have been resolved, the likelihood of Dow Corning succeeding on a CFAA claim will be examined. This step will also involve a digression that addresses pleading problems. As with the prior digression, it is necessary to ensuring proper adjudication of the dispute and assurance of a justiciable case or controversy.
1.
The CFAA was enacted in 1984. Pub. L. No. 98-473, 98 Stat. 2190. Its broad purpose is to impose criminal liability for the misuse of computers and data stored thereon. In addition to providing for broad criminal liability, the CFAA also provided a private right of action to certain individuals harmed by acts made unlawful by the statute. See 18 U.S.C. § 1030(g). The civil enforcement provision of the CFAA reads, in its entirety:
Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages
and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses4 (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware.Id.
From the face of the provision it appears that the scope of civil actions under the CFAA is coextensive with the scope of criminal liability. The statute unambiguously states that "[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief." Id. Dow Corning cites to this provision in support of its claim for temporary injunctive relief. But the statute goes on to qualify the circumstances under which civil actions may be maintained, cutting back on the broad grant in the prior sentence: "A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclause[] (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i)." Id. In turn, the subclause list at subsection (c)(4)(A)(i) is as follows:
(I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value;
(II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals;
(III) physical injury to any person;
(IV) a threat to public health or safety;
(V) damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security[.]Id. at § 1030(c)(4)(A)(i)(I)-(V).
Finally, the civil enforcement grant includes another caveat: "Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages." Id. at § 1030(g).
The interplay between the broad civil enforcement grant in the first sentence and the two subsequent limiting provisions poses difficulties for Dow Corning. First, Dow Corning does not acknowledge the limiting provisos in the civil enforcement provision. It quotes only the first sentence in support of its ability to maintain an action against Defendants under the CFAA. Some courts have sub silentio conceded this liberal reading by ignoring the limiting clauses. See, e.g., Sewell v. Bernardin, 795 F.3d 337, 339-40 (2d Cir. 2015) (holding that the CFAA allows a civil cause of action to "any person who suffers damage or loss by reason of a violation of this section" without any other limitation). But this reading cannot be correct since it would necessarily nullify the subsequent limitations.
The question then, is what effect the limitations have on the seemingly broad civil enforcement grant. Courts have not provided uniform solutions to this problem. The statute is susceptible to two readings. First, a civil action for a violation of the statute may only be maintained if it falls under one of the five numerated provisions listed in the first limiting clause. Second, the civil action grant is coextensive with the criminal liability provisions, but the conduct on which the civil action is based must include at least one of the five factors listed in the first limiting clause. Courts have struggled with this question. Some courts have abided by the first option and significantly limited civil actions under the CFAA to the five forms of conduct listed at 18 U.S.C. § 1030(c)(4)(A)(i)(I)-(V). See, e.g., Jones v. Liberty Mut. Ins., Case No. CV 15-02, 2015 WL 6511526, at *3 (E.D. Ky. Oct. 28, 2015) (holding that under the CFAA "private plaintiffs may only bring suit . . . in a narrowly defined set of circumstances").
The majority of circuit courts of appeals that have faced the issue, however, have decided that the language of the statute more appropriately supports the second approach: that the civil enforcement grant is broad and a civil action must merely include one of the five enumerated forms of conduct. See, e.g., Fiber Sys. Int'l, Inc. v. Roehrs, 470 F.3d 1150, 1156-58 (5th Cir. 2006) (holding that a civil action under the CFAA need only include one of the enumerated forms of conduct); P.C. Yonkers, Inc. v. Celebrations the Party & Seasonal Superstore, LLC., 428 F.3d 504, 511-13 (3d Cir. 2005) (same); WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199, 201 (4th Cir. 2012) (same); LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1130-32 (9th Cir. 2009) (same). But see Triad Consultants, Inc. v. Wiggins, 249 F. App'x 38, 39 n.1 (10th Cir. 2007) (holding that a civil action may be maintained for exceeding authorized access but only by someone who suffers from one of the forms of enumerated conduct). The Sixth Circuit has not expressly adopted a reading of the statute, it has, in at least one instance, seemingly applied the narrow reading of the civil enforcement grant. Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 774 F.3d 1065, 1072-73 (6th Cir. 2014) (observing that "[t]he CFAA is primarily a criminal statute, but it provides for a civil right of action and economic damages in certain circumstances, such as when a violator causes "loss" of at least $5,000 in value to one or more persons during any one-year period").
The narrow reading of the statute is unpersuasive. To ignore the second clause of the civil enforcement provision, as Dow Corning does, would render it a nullity. The clause must have some limiting effect on the ability of parties to maintain civil actions under the act. Conversely, to read the second clause to be the entirety of the civil enforcement grant would render the first clause—the broad grant—redundant. A middle path is the most logical expression of the drafters' intent. Thus, the reasoning of the Third Circuit is persuasive:
We do not read section 1030(g)'s language that the claim must involve one or more of the numbered subsections of subsection (a)(5)(B) as limiting relief to claims that are entirely based only on subsection (a)(5), but, rather, as requiring that claims brought under other sections must meet, in addition, one of the five numbered (a)(5)(B) "tests."P.C. Yonkers, 428 F.3d at 512 (addressing a prior version of the statute before the five "tests" were reorganized to subsection (c)(4)(A)(i)). That is, any violation of the CFAA may be subject to civil enforcement as long as "the conduct [at issue] involves" one of the enumerated factors. 18 U.S.C. § 1030(g). The provision is not so stringent as to require that the conduct at issue be one of the enumerated factors.
But this explication of the civil enforcement provision does not resolve any of the issues presented by Dow Corning's complaint and motion for injunctive relief. Rather, it focuses on the most significant problem: that Dow Corning does not allege facts consistent with the requirements of the CFAA's civil enforcement provision. Nothing in Dow Corning's complaint alleges conduct involving one of the five enumerated "factors set forth in subclause[](I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i)." 18 U.S.C. § 1030(g). Taking the complaint at its face, it appears that only one of the factors would, in any event, be applicable: "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value[.]" 18 U.S.C. § 1030(c)(4)(A)(i)(I). But Dow Corning's complaint must allege "loss . . . . aggregating at least $5,000 in value" in connection with the conduct of Defendants. It does not do so.
The requirement for showing loss under the statute is not stringent. Loss is defined as: "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11). Because of the broad definition of loss in the statute, one may reasonably infer from Dow Corning's complaint that its loss would be in excess of $5,000. But the ability to infer as much does not excuse Dow Corning from basic pleading requirements. See Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 439-40 (2d Cir. 2004) (holding, consistent with the "(near) unanimous view", that the plaintiff could not maintain a cause of action under the CFAA because it did not plead "damages or losses of at least $5,000"). Such a defective pleading is amenable to dismissal without prejudice. Dow Corning's pleading will need to be rectified prior to any further relief being granted in this case. Dow Corning will be given 24 hours to file an amended pleading that comports with the requirements of the CFAA
Second, and finally, the significance of the second limiting proviso in the civil enforcement grant must be discussed. The clause provides that "[d]amages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages." 18 U.S.C. § 1030(g). This limitation on the civil enforcement grant creates at least some ambiguity as to the remedies available in a civil enforcement action alleging only conduct under subsection (c)(4)(A)(i)(I). The ambiguity would be mooted in this case but for the lack of specificity in Dow Corning's complaint. If conduct under subsection (c)(4)(A)(i)(I) makes up only a portion of the alleged culpable conduct, the limitation would not apply. But, since there is a possibility that all of the allegedly culpable conduct alleged by Dow Corning falls under subsection (c)(4)(A)(i)(I), the limitation may apply.
Although the second limitation in the civil enforcement grant could be construed as limiting all remedies available for conduct violating subsection (c)(4)(A)(i)(I) at least one court has held that it only limits the type of monetary damages that may be recovered. P.C. Yonkers, 428 F.3d at 511-12 (determining that injunctive relief is permitted for violations of the $5,000 loss provision since the "economic damages" language only limits monetary damages available, not forms of relief). This means that the limitation does not preclude injunctive relief. Although this Court was only able to identify one court—the Third Circuit in P.C. Yonkers—that addresses the issue, the reading of the second limitation in § 1030(g) is the most reasonable reading of the statute. The clause specifies that economic damages are the only form of damages available. Not the only form of relief available. Therefore, when read in conjunction with the first clause of the civil enforcement grant (making available "compensatory damages and injunctive relief or other equitable relief") it is evident that it does not preclude the availability of equitable relief in an action only alleging "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value[.]" 18 U.S.C. § 1030(c)(4)(A)(i)(I). If Dow Corning's claim arises only under subsection (c)(4)(A)(i)(I), then, equitable relief would still be available.
2.
Having considered the predicate issues of when civil enforcement is appropriate under the CFAA, Dow Corning's likelihood of success in its civil enforcement action must be analyzed. What follows is a discussion of the merits of Dow Corning's allegation that Defendants violated the CFAA.
Absent from the analysis is further discussion of the fact that Dow Corning has omitted any allegations that Defendants caused "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value[.]" 18 U.S.C. § 1030(c)(4)(A)(i)(I). It is understood, based on the foregoing, see supra § III.A.1, that loss in excess of $5,000 it is not alleged and that Dow Corning's pleading is deficient as a result. Since the Court need only examine the likelihood of success on the merits, not actual success, the fact that Dow Corning's pleadings omit this allegation is not fatal to Dow Corning's request for injunctive relief at this stage. That the pleading can reasonably be read to imply loss in excess of the $5,000 substantiality requirement suffices for the purposes of analyzing Dow Corning's likelihood of success on the merits. The pleading will still need to be rectified, as explained above.
Under the Computer Fraud and Abuse Act, "[w]hoever . . . intentionally accesses a computer without authorization or exceeds authorized access and thereby obtains . . . information from any protected computer . . . shall be punished as provided in [the Act.]" 18 U.S.C. § 1030(a)(2)(C). The CFAA defines a "protected computer" as "a computer . . . which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States[.]" 18 U.S.C. § 1030(e)(2)(B). Dow Corning alleges that the computers in the Dow Corning network are "protected computers" under the CFAA because they are connected to the internet. Authority is split, and spare, concerning whether a computer or network connected to the internet is a protected computer under the CFAA. But courts have held that the internet is itself an instrumentality of interstate commerce. See, e.g., United States v. Trotter, 478 F.3d 918, 921 (8th Cir. 2007); United States v. MacEwan, 445 F.3d 237, 245 (3d Cir. 2006) (holding that downloading an image from the internet is "intertwined with the use of the channels and instrumentalities of interstate commerce"); United States v. Hornaday, 392 F.3d 1306, 1311 (11th Cir. 2004) (holding that the internet is an instrumentality of interstate commerce). As a result, a number of courts, including two in this circuit, have concluded that computers and networks attached to the internet are protected computers under the CFAA. See, e.g., Freedom Banc Mortgage Servs., Inc. v. O'Harra, Case No. 11-CV-01073, 2012 WL 3862209, at *6 (S.D. Ohio Sept. 5, 2012) (citing additional cases); Jole v. Apple, Case No. 11-CV-0882, 2011 WL 6101553, at *3 (M.D. Tenn. Dec. 8, 2011) (same). These cases offer compelling guidance and support the conclusion that Dow Corning's network computers constitute protected computers under the CFAA.
The CFAA goes on to define "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter[.]" 18 U.S.C.A. § 1030(e)(6). The CFAA does not set forth when and under what circumstances an accesser exceeds his or her authorized access. By the plain language of the statute, an accesser exceeds authorized access by gaining access to information or areas in a computer or network to which he or she is not permitted to access. However, courts have held that individuals may also exceed authorized access by "exceeding the purposes for which access is 'authorized.'" United States v. John, 597 F.3d 263, 272 (5th Cir. 2010). See also EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 582-84 (1st Cir. 2001). Thus, material to potential liability under the statute is the scope of an individual's permissible access to information and the scope of an individual's ability to use that information. See John, 597 F.3d at 272 (determining liability on the basis of the defendant's "confined" access to Citigroup's data that was not "for any and all purposes but for limited purposes").
Here, Defendants' scope of authorized access is defined and delineated by the Master Agreement between Dow Corning and HCL. See Master Agreement, Ex. A, ECF No. 7-2. The Master Agreement contains prohibitions on the ownership and use of Dow Corning's data. Under the Agreement, "all Customer Data is and shall remain the property of [Dow Corning]." Id. at Section 12.01. Furthermore, the Agreement significantly restricts HCL's use of Dow Corning's data "[w]ithout prior approval of [Dow Corning.]" Id.
The Master Agreement's protections for Personal Data provide the most direct limitations on the use of Personal Data by HCL. It prohibits HCL from "us[ing] or disclos[ing] Personal Data for any purpose other than fulfilling its obligations under the Agreement without the prior approval of [Dow Corning] and, to the extent required by applicable Law the individual data subject[.]" Id. at Section 12.06. The Master Agreement further prohibits HCL from "disclosing Personal Data to any Supplier Agent without the prior approval of Customer and an agreement in writing from the Supplier Agent to use and disclose such Personal Data only to the extent necessary to fulfill Supplier's obligations under the Agreement and for no other purpose." Id. Defendants are Supplier Agents under the Agreement.
Nothing in the terms of the Master Agreement, however, imposes direct liability on Defendants. Dow Corning does not explain how the fact that Defendants are Supplier Agents means the Master Agreement imposes a limited scope of authorized access on Defendants, rather than merely on HCL. Courts have recognized situations where an implied duty of loyalty between an employer and employee would create a scope of reasonable access that should not be exceeded. See Int'l Airport Centers, L.L.C. v. Citrin, 440 F.3d 418, 420-21 (7th Cir. 2006) (holding that a breach of the duty of loyalty terminates agency relationship and scope of access). That limitation would apply in this case but for the fact that Defendants were not employees of Dow Corning but instead employees of HCL, a non-party that has not been joined by Dow Corning. To the extent Dow Corning believes Defendants' actions to be in violation of the Master Agreement or in violation of the Master Agreement's scope of access, HCL would likely need to be joined in this action. HCL is the counterparty to the Master Agreement and all duties, obligations, and liabilities for breach under the Agreement are imposed upon it and not its contractors or Supplier Agents.
In fact, Dow Corning alternatively identifies Defendants as independent contractors of HCL and employees of HCL. It is undisputable, based on the Confidentiality Agreements that Defendants are independent contractors of Dow Corning.
The absence of HCL from this matter, while potentially problematic at a later stage of litigation, is not necessary to resolve Dow Corning's motion. That is because Defendants entered into separate agreements with Dow Corning that impose limitations on Defendants' scope of access to Dow Corning data independent of the Master Agreement. Specifically, the Confidentiality Agreement and Network Computer Usage Agreement signed by both Defendants leave no doubt that their activities were beyond the authorized scope of their computer and network access. See Confidentiality Agreement, Ex. B, ECF No. 7-3 and Network Agreement, Ex. C, ECF No. 7-4.
Despite the problems present in Dow Corning's predominant theory of recovery, it has demonstrated a sufficient likelihood of success on the merits to warrant temporary injunctive relief as to this factor. The agreements between Dow Corning and Defendants appear to explicitly prohibit the downloading of employees' personal information by Defendants in the manner alleged. The weight of this factor is compelling due to the nature of Defendants' actions and the strength of Dow Corning's CFAA claim. Nevertheless, the other TRO factors should be analyzed and weighed.
B.
The second factor to consider when analyzing a request for a temporary restraining order is "whether there is a threat of irreparable harm to the plaintiff[.]" Hamilton's Bogarts, Inc. v. Michigan, 501 F.3d 644, 649 (6th Cir. 2007). This factor needs little explication. It cannot be reasonably debated that the unlawful download of the personal information of 4,000 employees could irreparably harm Dow Corning. With respect to customer information, many courts have held that such misuse of otherwise private data can lead to irreparable harm to the company. See, e.g., Reliable Prop. Servs., LLC v. Capital Growth Partners, LLC, 1 F. Supp. 3d 961, 965 (D. Minn. 2014). Dow Corning does not explain how the disclosure of employer information can and should be analogized to customer information, but the Court is comfortable that the potential for harm is significant. Furthermore, to the extent Dow Corning's employees make up part of its corporate body and inform Dow Corning's interests, the threat to employee welfare and privacy is significant and also justifies injunctive relief.
The only effort by Dow Corning to bridge the gap between cases addressing disclosure of customer information and this case is a citation to a Fifth Circuit case, Deerfield Medical Center v. City of Deerfield Beach, 661 F.2d 328 (5th Cir. 1981). According to Dow Corning this case stands for the general proposition that "privacy rights 'must be carefully guarded for once an infringement has occurred it cannot be undone by monetary relief.'" Pl.'s Mot. 16, ECF No. 7. This authority would certainly be powerful guidance, but Dow Corning does not explain the context for which the proposition was advanced by the Fifth Circuit. In Deerfield Medical Center, the Fifth Circuit was specifically addressing the threat to the plaintiffs' constitutional right to privacy. No allegation has been made, nor does it appear one conceivably could, that the privacy issues at stake here are of constitutional dimension. --------
C.
The third TRO factor is "whether issuance of the injunction would harm others[.]" Hamilton's Bogarts, 501 F.3d at 649. As with the previous factor, there can be little debate as to how this factor should be weighted. In fact, it is likely that significant harm would be done to others (Dow Corning employees) in the absence of a restraining order. Conversely, it is hard to conceive of a party that would be truly harmed by the imposition of a restraining order. To the extent Defendants acted unlawfully, their harm would only be in consistent measure with the harm they have already inflicted upon Dow Corning employees.
D.
Lastly, the Court must consider "whether the public interest is served by granting injunctive relief." Hamilton's Bogarts, 501 F.3d at 649. Once again, this factor permits little dispute. The public has an overwhelming interest in the privacy of personal information and the security of that information when it is provided to employers. While employees have little direct control over the manner and means by which that information is secured by an employer, it is in the interest of the public that an employer be able to swiftly and effectively take action to secure that data when it is compromised. In addition, to the extent Dow Corning is currently the only entity with the ability to safeguard the privacy rights of Dow Corning employees that may be implicated by Defendants' actions, injunctive relief, first initiated by a TRO, is an effective means by which it may do so.
IV.
In accordance with the procedures outlined by Federal Rule of Civil Procedure 65, certain procedural steps must be followed to ensure due process to all parties. First, notice must be served upon Defendants. Dow Corning will be directed to serve its complaint, its motion for injunctive relief, and this order on Defendants. Second, a hearing will be scheduled on Dow Corning's request for a preliminary injunction. The hearing will be scheduled before the expiration of this order, which is 14 days from the hour it is issued. Defendants will have an opportunity to respond to Dow Corning's motion but must do so prior to the motion hearing. Lastly, Dow Corning must provide the supplemental information discussed herein within 24 hours of this order being issued. That supplemental information must be served upon Defendants.
V.
Accordingly, it is ORDERED that Dow Corning Corporation's Motion for Injunctive Relief is GRANTED in part.
It is further ORDERED that Defendants Anjaneyulu Chaganti and Homi Syodia are TEMPORARILY RESTRAINED and ENJOINED as of 4:00 p.m. on November 4, 2015:
(i) from transferring, disseminating, erasing, and/or otherwise destroying or altering any information and/or data (including information and/or data in electronic form) taken from Dow Corning's computers and computer system, including information about past or present employees.
(ii) to take all reasonable measures, steps, and/or efforts to prevent future unauthorized disclosure and/or dissemination of any information and/or data (including information and/or data in electronic form) taken from Dow Corning's
computers and computer system, including information about past or present employees.
It is further ORDERED that Plaintiff Dow Corning Corporation is DIRECTED to file a supplemental certification in accordance with the instructions set out herein, not to exceed five pages, within 24 hours of the issuance of this order.
It is further ORDERED that Plaintiff Dow Corning Corporation is DIRECTED to amend its complaint in accordance with the instructions set out herein within 24 hours of the issuance of this order.
It is further ORDERED that Plaintiff Dow Corning Corporation is DIRECTED to serve the complaint, ECF No. 1, its motion for a temporary restraining order, ECF No. 7, a copy of this Order, and its supplemental filings on Defendants on or before November 6, 2015 and file a certificate of service on the Court's docket.
It is further ORDERED that a hearing on Plaintiff Dow Corning Corporation's Motion for a Preliminary Injunction, ECF No. 7, is SCHEDULED for November 17, 2015 at 3:00 p.m.
It is further ORDERED that the parties are DIRECTED to appear for the motion hearing.
It is further ORDERED that Defendants are DIRECTED to file any response to Plaintiff's motion for a preliminary injunction that they wish to be considered on or before November 16, 2015. Dated: November 4, 2015
s/Thomas L. Ludington
THOMAS L. LUDINGTON
United States District Judge
PROOF OF SERVICE
The undersigned certifies that a copy of the foregoing order was served upon each attorney or party of record herein by electronic means or first class U.S. mail on November 4, 2015.
s/Michael A. Sian
MICHAEL A. SIAN, Case Manager