Opinion
Civil Action No. 10 - 1685
08-30-2011
GABRIEL FONTANA, an adult individual, and BAR1713, LLC, a Pennsylvania Limited Liability Corporation, Plaintiffs, v. WILLIAM P. CORRY, Defendant.
Judge David Steward Cercone
Chief Magistrate Judge Lenihan
ECF No. 3
MAGISTRATE JUDGE'S REPORT AND RECOMMENDATION
I. RECOMMENDATION
It is respectfully recommended that the Motion to Dismiss filed by Defendant William P. Corry (ECF No. 3) be granted without prejudice.
II. REPORT
Plaintiffs, Gabriel Fontana and Bar 1713, instituted this proceeding against Defendant, William P. Corry, alleging a violation of the Computer Fraud and Abuse Act, 18 U.S.C. §1030 et seq. ("CFAA"). Plaintiffs contend that as a result of Corry's violations of the CFAA, they suffered harm individually and to their business ventures in an amount in excess of $5,000.00. (Compl. ¶23.) This Court's subject jurisdiction is predicated upon federal question jurisdiction pursuant to 28 U.S.C. §1331, as well as 18 U.S.C. §1030(g), and venue in this district is proper under 28 U.S.C. §1391. Corry has moved to dismiss the Complaint with prejudice on the basis that it fails to allege even a modest factual basis for the CFAA claim as required by the Supreme Court's decisions in Twombly and Iqbal. For the reasons set forth below, the Court agrees with Corry, but recommends dismissal without prejudice.
A. Factual Background and Procedural History
The following factual allegations are accepted as true for purposes of a motion to dismiss. Plaintiffs are Bar 1713, LLC, which owns and conducts business under the fictitious name of S Bar ("S Bar"), a nightclub/restaurant in Pittsburgh, Pennsylvania, and Gabriel Fontana ("Fontana"), an individual who resides in Pittsburgh, Pennsylvania, and is an alleged agent and manager of S Bar. (Compl. ¶4.) Plaintiffs aver that Defendant William P. Corry, ("Corry"), resides in Florida and is the principal owner and operator of Whim Nightclub ("Whim"), located in Pittsburgh, PA. (Compl. ¶5, ¶10.) According to Plaintiffs, at the time Corry sought to establish Whim, he hired Fontana as the manager and individual responsible for overseeing the ongoing construction and renovation of Whim. (Compl.¶11.)
At all relevant times, S Bar is alleged to have operated an electric point of sale ("POS") computer database system, in which all funds and transactions were recorded regarding the business activities of S Bar. (Compl. ¶12.) Plaintiffs further allege that this POS System enabled users to access commercial records, balance sheets, and other privileged matters, via computer access. (Compl. ¶13.) While acting as manager of Whim, Fontana alleges that he created a separate POS account for Whim which Corry was authorized to access in his position as owner of Whim. (Compl. ¶14.)
Beginning on or about November 14, 2009 and continuing through January 24, 2010, Corry is alleged to have intentionally accessed the POS System for S Bar on numerous occasions. (Compl. ¶15.) In particular, the "Audit Report for WHIM Pittsburg - Gabe Fontana," attached to the Complaint as Exhibit A, shows that Corry accessed the POS system, and specifically the S Bar account, on 11/14/09, 11/28/09, 12/18/09, 12/19/09, 12/20/09, 12/24/09, 1/03/10, 1/17/10, 1/23/10, and 1/24/10; in some instances, the Audit Report shows that Corry accessed the S Bar account on multiple occasions on the same date. (Ex. A to Compl., at 4-10, ECF No. 1-2.) Plaintiffs contend that Corry was neither authorized nor permitted to access the POS system that was operated for the benefit of S Bar. (Compl., ¶16.)
Subsequently, on December 16, 2010, Plaintiffs filed this lawsuit against Defendant Corry, alleging that he violated the CFAA "by intentionally accessing a computer used for interstate commerce or communication, without authorization or by exceeding authorized access to such a computer, and by obtaining information from such a protected computer." (Compl., ¶18.) Plaintiffs further contend that Corry intentionally accessed the protected computer without authorization, causing damage to Plaintiffs, recklessly or without due regard for his actions. (Compl., ¶19.) It is further alleged that the numerous and continuous access breaches of the computer database system by Corry show that his conduct was knowing and intentional. (Compl. ¶20.) In addition, Plaintiffs assert that the computer system(s) accessed by Corry constitute a "protected computer" within the meaning of 18 U.S.C. §1030(e)(2). (Compl., ¶22.) As a result of Corry's alleged unauthorized access to the computer, Plaintiffs contend that they have suffered "damage and loss . . . , including, without limitation, harm to Fontana and Bar 1713, LLC's business ventures, and other damage in an amount to be proven at trial, but, in any event, in an amount in excess of five thousand dollars ($5,000)." (Compl., ¶23.)
In response, Corry filed a Motion to Dismiss the Complaint pursuant to Rule 12(b)(6) (ECF No. 3) on January 4, 2011, despite not having been formally served with the Complaint. Plaintiffs filed a Response in Opposition to Defendant's Memorandum in Support of Motion to Dismiss on February 14, 2011 (ECF No. 8). Corry filed a Reply Memorandum (ECF No. 9) on March 1, 2011. As the motion to dismiss has been fully briefed, it is now ripe for disposition.
B. Standard of Review under Rule 12(b)(6)
A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the legal sufficiency of a complaint. Kost v. Kozakiewicz, 1 F.3d 176, 183 (3d Cir. 1993). A complaint must be dismissed for failure to state a claim if it does not allege "enough facts to state a claim to relief that is plausible on its face." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 556 (2007) (rejecting the traditional 12(b)(6) standard set forth in Conley v. Gibson, 355 U.S. 41, 4546 (1957)); Ashcroft v. Iqbal, 129 S.Ct. 1937, 1960 (May 18, 2009) (citing Twombly). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal at 1949 (citing Twombly at 556). The Supreme Court further explained:
The plausibility standard is not akin to a "probability requirement," but it asks for more than a sheer possibility that a defendant has acted unlawfully. Where a complaint pleads facts that are "merely consistent with" a defendant's liability, it "stops short of the line between possibility and plausibility of 'entitlement to relief.'"Id. (citing Twombly at 556-57). The court of appeals has expounded on this standard in light of its decision in P hillips v. County of Allegheny, 515 F.3d 224 (3d Cir. 2008) (construing Twombly in a civil rights context), and the Supreme Court's recent decision in Iqbal:
After Iqbal, it is clear that conclusory or "bare-bones" allegations will no longer survive a motion to dismiss: "threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Iqbal, 129 S.Ct. at 1949. To prevent dismissal, all civil complaints must now set out "sufficient factual matter" to show that the claim is facially plausible. This then "allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. at 1948. The Supreme Court's ruling in Iqbal emphasizes that a plaintiff must show that the allegations of his or her complaints are plausible. See Id. at 1949-50; see also Twombly, 505 U.S. at 555, & n. 3.Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009). In light of Iqbal, the Fowler court then set forth a two-prong test to be applied by the district courts in deciding motions to dismiss for failure to state a claim. First, the district court must accept all well-pleaded facts as true and discard any legal conclusions contained in the complaint. Fowler, 578 F.3d at 210-11. Next, the court must consider whether the facts alleged in the Complaint sufficiently demonstrate that the plaintiff has a "plausible claim for relief." Id. at 211. To survive a motion to dismiss, a complaint must show an entitlement to relief through its facts. Id. (citing Phillips at 234-35).
Courts generally consider only the allegations of the complaint, its attached exhibits, and matters of public record in deciding motions to dismiss. Pension Benefit Guar. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993). Factual allegations within documents described or identified in the complaint may also be weighed if the plaintiff's claims are based upon those documents. Id. (citations omitted). A district court may consult those documents without converting a motion to dismiss into a motion for summary judgment. In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997).
C. Discussion
This cause of action has its genesis in a state court matter arising out of the same dispute between Corry and Fontana over the operation and management of Whim, which culminated in the filing of a lawsuit against Fontana and S Bar in the Allegheny County Court of Common Pleas on May 26, 2010, by the owner of Whim, Moe G. Enterprises LLC ("Moe G"), of which Corry is the sole member. In response to Moe G's complaint in the court of common pleas, Fontana and S Bar filed a counterclaim asserting, inter alia, a violation of the CFAA based on the same facts asserted in the present matter. Thereafter, in the Moe G. state court matter, Fontana and S Bar filed a Notice of Removal to the United States District Court for the Western
See ECF No. 1-2, Docket No. 2:10-cv-1538, U.S. Dist. Ct., W.D.Pa., Moe G. Enterprises LLC v. Fontana, et al. Because this information is a matter of public record, the Court may consider it without converting Defendant's motion to dismiss to a motion for summary judgment. In re Burlington Coat Factory Sec. Litig., 114 F.3d at 1426.
See ECF No. 1-5, Docket No. 2:10-cv-1538.
District of Pennsylvania, based on the federal question raised in their counterclaim. Moe G. promptly filed a Motion to Remand. In opposing the motion to remand, Fontana and S Bar instituted the present federal action alleging a violation of the CFAA, thus invoking this Court's subject matter jurisdiction pursuant to 28 U.S.C. §1331, and then moved to consolidate the two proceedings in an unsuccessful attempt to withstand remand of the Moe G. matter for lack of subject matter jurisdiction. This Court declined to consolidate the two cases and ordered that the Moe G. matter be remanded to state court. Subsequently, Corry has moved to dismiss the CFAA claim against him in the case at bar. It is in this context that the Court turns now to the merits of Corry's motion to dismiss.
ECF No. 1, Docket No. 2:10-cv-1538.
ECF No. 2, Docket No. 2:10-cv-1538.
ECF Nos. 9-11, Docket No. 2:10-cv-1538.
ECF No. 18, Docket No. 2:10-cv-1538.
Corry moves to dismiss the Complaint pursuant to Rule 12(b)(6) for failure to state a claim under the CFAA upon which relief can be granted, on the basis that Plaintiffs' Complaint contains nothing more than bald assertions and legal conclusions unsupported by any factual allegations demonstrating a plausible claim for relief under the CFAA.
1. Computer Fraud & Abuse Act
The Computer Fraud and Abuse Act, although initially a criminal statute that penalized computer hacking activities, also authorizes private civil actions in certain situations. P.C. Yonkers, Inc. v. Celebrations the Party & Seasonal Superstore, LLC, 428 F.3d 504, 510 (3d Cir. 2005) (citation omitted); see also 18 U.S.C. §1030(g). In particular, the CFAA proscribes seven actions that will result in civil and criminal liability. 18 U.S.C. §1030(a)(1)-(7). Plaintiffs have indicated that their CFAA claim is predicated on §1030(a)(2)(C), which provides in relevant part: "Whoever . . . intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer . . . shall be punished as provided in subsection (c) of this section." 18 U.S.C. §1030(a)(2)(C). In addition to proving that Corry's alleged conduct satisfies the requirements of §1030(a)(2)(C), Plaintiffs must also meet the requirements of §1030(g), which states in relevant part:
Although the Complaint does not identify which subsection of Section 1030(a) Corry allegedly violated, Plaintiffs clarify in their Response to the motion to dismiss that their claim is predicated on Section 1030(a)(2)(C).
Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages.18 U.S.C. §1030(g). "In other words, a violation of the offenses described in subsection (a) gives rise to civil liability under subsection (g) only if the alleged conduct violates one of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i) . . .. " Consulting Professional Resources, Inc. v. Concise Techs. LLC, No. 09-1201, 2010 WL 1337723, *3 (W.D.Pa. Mar. 9, 2010).
Plaintiffs have indicated in their Response to the motion to dismiss that they are proceeding under subsection (c)(4)(A)(i)(I), which provides:
(c) The punishment for an offense under subsection (a) or (b) of this section is—18 U.S.C. §1030(c)(4)(A)(i)(I).
. . .
(4)(A) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 5 years, or both, in the case of—
(i) an offense under subsection (a)(5)(B), which does not occur after a conviction for another offense under this section, if the offense caused (or, in the case of an attempted offense, would, if completed, have caused)—
(I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value[.]
2. Motion to Dismiss
Initially, Corry advanced several arguments in support of dismissal of Plaintiffs' CFAA claim, without the benefit of knowing under which subsection of §1030(a) Plaintiffs were pursing their CFAA claim. After having received Plaintiffs' Response in Opposition to Defendant's Memorandum in Support of Motion to Dismiss ("Plaintiffs' Response in Opposition") (ECF No. 8), Corry has focused his argument in support of dismissal on three deficiencies: The Complaint (1) fails to establish the POS System as a "protected computer"; (2) fails to adequately allege a statutorily-defined loss as required under the CFAA; and (3) fails to allege a "loss" of sufficient magnitude. Each of these arguments will be addressed in turn.
a. "Without Authorization " or "Exceeds Authorized Access"
As a preliminary matter, the Court wishes to address an argument raised by Corry in his opening memorandum, but not addressed in his reply brief. Initially, in his Memorandum in Support of the Motion to Dismiss (ECF No. 4) ("Supporting Memorandum"), Corry challenged whether Plaintiffs have adequately pled facts to show or suggest that he accessed the POS System without authorization. In order to prove a violation of §1030(a)(2)(C), Plaintiffs must show, among other things, that Corry accessed the POS System either "without authorization" or that he "exceeded authorized access." The statute defines "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled to so obtain or alter[.]" 18 U.S.C. §1030(e)(6). However, the statute does not provide a definition for "without authorization" or "authorization." Most courts have applied the ordinary, common meaning of the word "authorization," which is permission. LVRC Holding LLC v. Brekka, 581 F.3d 1126, 1132-33 (9th Cir. 2009); United States v. Aleynikov, 737 F.Supp. 2d 173, 191 (S.D.N.Y. 2010). The court of appeals in LVRC Holding explained the difference between "unauthorized access" and "exceeds authorized access" as follows: "a person who 'intentionally accesses a computer without authorization,' §§ 1030(a)(2) and (4), accesses a computer without any permission at all, while a person who 'exceeds authorized access,' id., has permission to access the computer, but accesses information on the computer that the person is not entitled to access." 581 F.3d at 1133.
Here the factual allegations in the Complaint show that Corry had permission to access the POS System to view the Whim data. (Compl. ¶14.) However, the Complaint further asserts that he did not have authority to access the S Bar data. (Compl. ¶16.) Indeed, Corry admits in his Supporting Memorandum that it is conceivable that he could have exceeded authorized access by viewing the S Bar data as alleged by Plaintiffs, but he did not access the computer hosting the POS System without authorization. (Def.'s Supp. Mem. at 9, ECF No. 4.) Moreover, in his Reply Brief, Corry does not attempt to dispute Plaintiffs' argument that the Complaint sufficiently establishes that he did not have authority to access the S Bar data in the POS System. Thus, these allegations are sufficient under Twombly to show or suggest the presence of the "exceeds authorized access" element of the CFAA at the motion to dismiss stage.
b. "Protected Computer"
Corry submits that in order to allege a plausible claim under the CFAA, Plaintiffs must show that he accessed or obtained information from a "protected computer." Under the CFAA, a "protected computer" means "a computer . . . which is used in or affecting interstate or foreign commerce or communication . . .. 18 U.S.C. §1030(e)(2)(B). Corry contends that other than asserting in the Complaint that the computer housing the POS System is a protected computer, Plaintiffs do not allege any facts that show or suggest that the computer was used in or affecting interstate or foreign commerce or communication, and thus, are insufficient to meet the requirements of Twombly and Iqbal.
In response, Plaintiffs submit that the Complaint provides that S Bar owned and operated a POS computer database system, which retained all information regarding S Bar's funds and transactions relating to the operation of the business, citing paragraph 12 of the Complaint. Plaintiffs then submit that the POS System tracked and recorded all sales, inventories, and supplies for the maintenance and operation of S Bar, and that many of the suppliers that are utilized by S Bar are located outside of the Commonwealth of Pennsylvania, and therefore, records and communications are transacted across state borders. Plaintiffs argue that due to the broad definition of a "protected computer," any computer that is connected to the internet would appropriately fall within the definition of affecting interstate commerce or communication, as such computer would be utilized to send electronic mail or purchase inventory from an out-of-state supplier.
The Court finds the Complaint fails to adequately plead facts to show or suggest that the POS System is a "protected computer" within the meaning of the CFAA. To withstand dismissal, Plaintiff must assert facts to show or suggest that the POS System was used or affected interstate commerce or communication. See e.g., Atlantic Recording Corp. v. Raleigh, No. 4:06-CV-1708, 2009 U.S. Dist. LEXIS 45938, *9-10 (E.D.Mo. June 2, 2009)(finding allegation in counterclaim that "'computer[] and computer systems . . . were used in interstate commerce and/or communication[,]'" without any specific facts to explain how computer was used in or affected interstate commerce, was merely conclusory); Advantage Ambulance Group, Inc. v. Lugo, Civ. A. No. 08-3300, 2009 U.S. Dist. LEXIS 26465, *5-7 (E.D.Pa. Mar. 30, 2009) (finding that alleging simply that the accessed computer "was used in interstate commerce" was nothing more than a formulaic recitation of the elements of a CFAA claim, and thus, insufficient under Twombly).The allegations set forth in paragraphs 12 and 13 of the Complaint do not show or suggest in any way that the computer was used in or affected interstate commerce or communication. Paragraphs 12 and 13 merely suggest that all funds and transactions were recorded in the POS System, but no information regarding the nature of the transactions or source of the funds is given. Likewise, the fact that authorized users could access commercial records, balance sheets, and other privileged records does not suggest an interstate component.
Although Plaintiffs' argument in their Response in Opposition raises facts that appear to show or suggest ways in which a computer could be used in or affect interstate commerce or communication, none of these facts appears in the Complaint. Moreover, the statement in paragraph 22 of the Complaint, that the computer system accessed by Corry is a "protected computer," is nothing more than a "threadbare recital" of one of the elements of a [CFAA claim], supported by merely conclusory statements," and thus, is insufficient under Twombly and Iqbal. Fowler, 578 F.3d at 210. Therefore, the Court finds Plaintiffs' Complaint is insufficient to meet the pleading requirement under Twombly and Iqbal with regard to whether the POS System is a "protected computer" under the CFAA.
c. Pleading "Loss" Under CFAA
Corry's next argument challenges whether Plaintiffs have sufficiently pled a "loss" under the CFAA. Corry submits that the Complaint is deficient as Plaintiffs have failed to assert any cognizable loss under the CFAA, and instead have merely asserted, in a conclusory fashion, that Corry's violation "has caused damage and loss . . . including, without limitation, harm to Fontana and Bar 1713, LLC's business ventures, . . .." (Compl. ¶23.) While Corry acknowledges that Plaintiffs have identified, in their Response in Opposition, a number of losses that may be sufficient to support a CFAA claim if these losses were actually incurred, Corry maintains that none of these losses are alleged in the Complaint. Therefore, Corry submits that Plaintiffs' conclusory allegation is wholly insufficient and the Complaint must be dismissed.
The CFAA provides that "[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator . . .." 18 U.S.C. §1030(g). Corry argues that Plaintiffs do not appear to be claiming that they suffered "damage" cognizable under the CFAA, but rather, are claiming only that they suffered a "loss" as that term is defined under the CFAA. The Court agrees with Corry in this regard. See Pls.' Resp. in Opp'n at 8.
Under the CFAA, "loss" is defined as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service[.]" 18 U.S.C. §1030(e)(11). Courts have held that to fall within this definition, the alleged "loss" must be related to the impairment or damage to a computer or computer system. See e.g., Cassetica Sotfware, Inc. v. Computer Sciences Corp., No. 09 C 0003, 2009 U.S. Dist. LEXIS 51589, *11 (N.D. Ill. June 18, 2009) (noting courts have uniformly held that economic costs unrelated to computer systems do not fall within the statutory definition of "loss"); Clinton Plumbing & Heating of Trenton, Inc. v. Ciaccio, Civ. No. 09-2751, 2010 WL 4224473, *6 (E.D.Pa. Oct. 22, 2010) ("Various courts have interpreted 'loss' to mean the remedial costs of investigating a computer for damage, remedying damage done, and costs incurred while the computer is inoperable.") (citations omitted).
Courts have also found that lost revenue incurred because of an interruption of service falls within the statutory definition of "loss." Id. (citing Crown Coal & Coke Co. v. Compass Point Resources, LLC, Civ. A. No. 07-1208, 2009 WL 1806659, at *8 (W.D.Pa. June 23, 2009). As Chief Judge Lancaster from this District explained in Crown Coal and Coke Company:
According to the CFAA, lost "revenue" constitutes "loss" if it is incurred "because of interruption of service." 18 U.S.C. § 1030(e)(11). Therefore, if defendants had lost revenue because their computers were inoperable, that would be the type of lost revenue contemplated by the statute. Defendants, however, are not claiming to have lost money because their computers were inoperable. Rather, they are claiming to have been denied potential business opportunities as a result of Crown Coal's unauthorized access. This alleged loss of business opportunities is simply not compensable under the CFAA. See Nexans Wires S.A. v. Sark-USA, Inc., 319 F.Supp.3d 468, 477 (S.D.N.Y.2004), aff'd, 166 Fed.App. 559 (2nd Cir.2006) (holding that lost revenue due to lost business opportunity does not constitute "loss" under the CFAA); Chas S. Winner, Inc., v. Polistina, No. 06-4865, 2007 WL 1652292, * 4 (D.N.J. June 4, 2007) (holding that loss under the CFAA must pertain to a cost of investigating or remedying damage to a computer, or a cost incurred because the computer's service was interrupted).2009 WL 1806659, at *8. Thus, while a loss resulting from lost access to data and an inability to reproduce the operational system would fall within the purview of the CFAA, see B & B Microscopes v. Armogida, 532 F.Supp. 2d 744, 758-59 (W.D.Pa. 2007), a claim for future lost revenue due to the dissemination of trade secrets was not a "loss" under the CFAA, see Advantage Ambulance Group, 2009 WL 839085, at *4. Clinton Plumbing, 2010 WL 4224473, at *6. Moreover, in Clinton Plumbing, the plaintiffs claimed a "loss of assets, overdraft fees, returned check fees, late fees, reputational damages arising from a damaged credit score, and termination of certain contracts due to insufficient funds for payment." Id. at *7. The district court in that case found that none of these allegations was sufficient to show a "loss" under the CFAA, because none of these claims alleged a loss related to computer impairment or interruption of service. Id.
In the case at bar, Plaintiffs' sole allegation of loss in the Complaint is contained in paragraph 23 and states, in essence, that Corry's unauthorized access to the protected computer caused damage to Fontana and Bar 1713, including harm to their ongoing business ventures, all of which exceeded $5,000.00. Nowhere in the Complaint do Plaintiffs allege that the loss was related to the impairment or damage to their computer or the POS System, or to the interruption of service. Rather, Plaintiffs merely assert harm to their ongoing business ventures, which is similar to the harm alleged in Crown Coal, i.e., an alleged loss of business opportunities, which Judge Lancaster found to be insufficient to plead a cognizable "loss" under CFAA. Crown Coal, 2009 WL 1806659, at *8.
Plaintiffs argue that the meaning of "loss" under the CFAA has been interpreted to mean "any remedial costs of investigating the computer for damage, remedying the damage and any costs incurred because the computer cannot function while or until repairs are made[,]" citing in support Nexans Wires S.A. v. Sark-USA Inc., 319 F.Supp. 2d 468, 474 (S.D.N.Y. 2004). According to Plaintiffs, such losses can include any resources expended in hiring a consulting firm or costs associated with having the POS provider assess and determine the party who accessed the database without authorization, and determining the extent to which a protected computer has been compromised and the amounts utilized to repair any damages incurred, citing in support EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 584 (1st Cir. 2001). Although Plaintiffs correctly identify a number of losses that have been found sufficient to support a CFAA claim, none of these losses are alleged in the Complaint, nor can they reasonably be inferred from the bare, conclusory statement appearing in the Complaint. Plaintiffs would certainly have knowledge, at this juncture, as to whether or not they had undertaken any measures to remedy any damage done to their POS System or whether it would be necessary to hire a consultant to determine what damage or impairment, if any, had resulted to their POS System. Yet the Complaint is devoid of any such allegations. In addition, Plaintiffs would also be in a position to know if there was an interruption in service of the POS System due to Corry's alleged unauthorized access. Having failed to plead such facts, Plaintiffs' Complaint fails to sufficiently plead a loss under the CFAA. Integrated Waste Solutions, Inc. v. Goverdhanam, Civ. A. No. 10-2155, 2010 U.S. Dist. LEXIS 127192, *27 (E.D.Pa. Nov. 30, 2010) (where plaintiff listed the increasing costs of steps it had already begun taking to remedy the alleged harm caused by cyber-attacks, these allegations were sufficient to plead damages under the CFAA); Advantage Ambulance Group, 2009 U.S. Dist. LEXIS 26465, *4 (alleging only lost revenue due to former employees transfer of trade secrets, without any indication of steps taken to remedy any damage done to their computer system or to protect it from future attacks, was too speculative to constitute loss contemplated by the CFAA).
d. Loss "Aggregating at Least $5,000 in Value"
For his final argument, Corry submits that Plaintiffs have failed to properly allege the financial prerequisite to maintaining a civil lawsuit under the CFAA. It is now clear from Plaintiffs' Response in Opposition that their claim is predicated on 18 U.S.C. §1030(c)(4)(A)(i)(I). Pursuant to this subclause, Plaintiffs must allege a "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." Id. In their Complaint, Plaintiffs have alleged "damage and loss by reason of these violations, including, without limitation, harm to Fontana and Bar 1713 LLC's business ventures, and other damage in an amount to be proven at trial, but in any event, in an amount in excess of five thousand dollars ($5,000)." Compl. ¶23. Corry submits that this allegation is deficient in three respects: (1) it fails to specify the allocation between damage, loss and "other damage"; (2) it fails to state that loss alone meets the $5,000 jurisdictional prerequisite; and (3) it fails to state that the amounts were incurred within a one-year period. Corry therefore contends that because the Complaint fails to properly plead the jurisdictional amount, it must be dismissed. In support, Corry cites DocMagic, Inc. v. Ellie Mae, Inc., 745 F.Supp. 2d 1119 (N.D.Cal. 2010); Oce North America, Inc. v. MCS Services, Inc., 748 F.Supp. 2d 481 (D.Md. 2010).
Plaintiffs erroneously cite § 1030(a)(4)(A)(i)(I); however, it is clear from their argument that they meant to cite to §1030(c)(4)(A)(i)(I).
In response, Plaintiffs do not address in any way the deficiencies raised by Corry. Instead, Plaintiffs argue, in essence, that their allegation in the Complaint that Corry's unauthorized access to the protected computer caused damage to Fontana and Bar 1713, including harm to their ongoing business ventures, all of which exceeded $5,000.00, and all reasonable inferences that are to be drawn from such averments, are sufficient to state a claim under the CFAA. In addition, Plaintiffs submit that they "will be unable to determine the full amount of [their] loss until [they are] able to understand (1) what information was accessed, (2) how said information was used and (3) to whom the same was disseminated." Pls.' Resp. in Opp'n at 9, ECF No. 8. Plaintiffs' arguments are completely unavailing.
Plaintiffs' first argument is simply a restatement of the conclusory allegation contained in paragraph 23 of their Complaint, without any factual support. Moreover, Plaintiffs claim they are entitled to all reasonable inferences from their allegation but do not indicate what reasonable inferences they wish the Court to draw. On the other hand, Corry's argument finds support in the case law. In particular, the district court's decision in DocMagic is directly on point, and demonstrates the Complaint's deficiency in pleading the financial prerequisite:
Ellie Mae's counterclaim contains only a single, generalized allegation related to loss from conduct that violated the CFAA: that "Ellie Mae has suffered damages and loss . . . including, without limitation, harm to Ellie Mae's data and/or computer(s) and other losses and damages in an amount to be proven at trial, but in any event, over $5000 aggregated over a one-year period."745 F.Supp. 2d at 1150 (internal citations omitted). Other courts have similarly concluded that a generalized allegation of damage and loss in excess of $5,000 during a one-year period is insufficient to plead the requisite jurisdictional amount under the CFAA. See e.g., Oce North America, 748 F.Supp. 2d at 488 (finding "Plaintiff's allegation that it 'has suffered impairment to the integrity or availability of its data, programs, systems and information resulting in losses or damages in excess of $5000 during a one year period' is merely a conclusory statement and thus does not sufficiently plead the $5000 minimum damages requirement to bring suit under the CFAA.") (citations omitted).
Such an allegation is insufficient to satisfy the CFAA's loss requirement for at least two reasons. To begin with, the averment verges on the type of conclusory, "formulaic recitation of the elements of a cause of action," that Iqbal and Twombly require a court to disregard. Iqbal, 129 S. Ct. at 1949-50 (quoting Twombly, 550 U.S. at 555). More importantly, even if the court were to consider the allegation, paragraph 59 fails to plead facts sufficient to meet the CFAA's requirement for a private cause of action. In the counterclaim, Ellie Mae alleges that it suffered "damages and loss . . . over $5000 aggregated over a one-year period." The statute, however, requires that an entity suffer a "loss . . . during any 1-year period . . . aggregating at least $5,000 in value." 18 U.S.C § 1030(c)(4)(A)(i)(I). Because it is impossible to determine from Ellie Mae's counterclaim whether its loss, as loss is defined by the CFAA, standing alone and excluding damages, would aggregate to more than $5000 in a given year, Ellie Mae's counterclaim fails to adequately plead facts necessary to support a cause of action under the CFAA. Accordingly, DocMagic's motion to dismiss the second counterclaim for relief is granted, and the counterclaim is dismissed with leave to amend.
The Court finds the reasoning of DocMagic persuasive and adopts it here. Because it is impossible to ascertain from Plaintiffs' Complaint whether their loss, as defined by the CFAA, exclusive of damages, would exceed $5,000 in any one-year period, the Court concludes that Plaintiffs' Complaint fails to adequately plead facts necessary to establish the minimum dollar value required to bring a claim under the CFAA.
Plaintiffs' other argument warrants only brief consideration. Plaintiffs submit they will be unable to determine the full amount of their loss until they are able to understand three things: (1) what information was accessed, (2) how said information was used, and (3) to whom this information was disseminated. Plaintiffs' argument completely misses the mark. First, Plaintiffs would have to already possess some knowledge of what information was accessed by Corry, otherwise they would not have been able to file the present lawsuit. Indeed, Plaintiffs attached the Audit Report to their Complaint, showing that Corry accessed S Bar's account in the POS System on numerous occasions. Moreover, Plaintiffs are in the best position to know what information is contained in their own account. Second, even if Plaintiffs could discover this information, it would have no consequence here because "how the information was used" and "to whom it was disseminated" do not implicate a cognizable loss under the CFAA. See Shamrock Foods Co. v. Gast, 535 F. Supp. 2d 962, 965-66 (D. Ariz. 2008) ("[L]egislative history confirms that the CFAA was intended to prohibit electronic trespassing, not the subsequent use or misuse of information."). Rather, this information would likely be relevant to claims involving loss of potential business opportunities, misappropriation of trade secrets, loss of goodwill, breach of confidentiality agreements, or tortious interference with contractual relations, and the like, none of which involves a loss relating to impairment to the computer system or interruption of service. Consequently, this information is simply unnecessary to establishing that a cognizable loss was incurred under the CFAA, and thus, cannot be counted towards the $5,000 minimum damages requirement.
For all the above reasons, the Court finds that the Complaint fails to allege sufficient facts to show or suggest a loss in excess of $5,000 in a one-year period.
III. CONCLUSION
For the reasons set forth above, the Court recommends that the Motion to Dismiss filed by Defendant William P. Corry (ECF No. 3) be granted without prejudice, and Plaintiff be allowed to file an amended complaint to cure the deficiencies identified in this Report and Recommendation. However, if Plaintiff fails to file a curative amendment within the time allowed by the District Judge, then this Magistrate Judge recommends that the Complaint be dismissed with prejudice.
In accordance with the Magistrate Judges Act, 28 U.S.C. § 636(b)(1)(B) and (C), and rule 72.D.2 of the Local Rules of Court, the parties are allowed fourteen (14) days from the date of service of a copy of this Report and Recommendation to file objections. Any party opposing the objections shall have fourteen (14) days from the date of service of objections to respond thereto. Failure to file timely objections will constitute a waiver of any appellate rights.
By the Court:
LISA PUPO LENIHAN
Chief U.S. Magistrate Judge
cc: All Counsel of Record
Via Electronic Mail