Summary
holding that subsection (g) affords a civil action for any CFAA violation, but requires an allegation of one of the five enumerated factors in § 1030(B)
Summary of this case from P.C. Yonkers v. Celebrations, SuperstoreOpinion
No. 03 Civ. 2183(NRB).
February 23, 2004.
Robert W. Clarida, Cowan, Liebowitz Latman, P.C., New York City, for Plaintiff.
Patrick T. Perkins, Fross Zelnick Lehrman Zissu, P.C., New York City, for Defendant.
MEMORANDUM AND ORDER
Plaintiff I.M.S. Inquiry Management Systems, Ltd., ("plaintiff" or "I.M.S.") commenced this action on March 28, 2003, against defendant Berkshire Information Systems, Inc., ("defendant" or "Berkshire") seeking damages and injunctive relief for defendant's alleged unauthorized use of plaintiff's computer system and the content thereof. In Plaintiff's First Amended Complaint ("Amended Complaint" or "Am. Compl."), filed on May 6, 2003, plaintiff claims that: (1) defendant committed three violations of the Computer Fraud and Abuse Act; (2) defendant infringed plaintiff's copyright; (3) defendant violated the Digital Millennium Copyright Act; and (4) defendant tortiously interfered with plaintiff's contractual relations.
Pursuant to Fed.R.Civ.P. 12(b)(6), defendant moves to dismiss these claims, asserting that plaintiff fails to state a claim under which relief may be granted. Defendant moves to dismiss plaintiff's copyright infringement claim for the additional reason that this Court lacks subject matter jurisdiction. Defendant also urges that upon dismissal of plaintiff's federal law claims, the Court should decline to exercise supplemental jurisdiction over plaintiff's New York state claim of tortious interference with contractual relations. Defendant further argues that upon the dismissal of plaintiff's Amended Complaint, plaintiff should be denied leave to replead. Lastly and alternatively, in the event plaintiff's claims are not dismissed, plaintiff should be required to provide a more definite statement of its claims under Fed.R.Civ.P. 12(e).
For the following reasons, defendant's motion is denied in part and granted in part.
I. BACKGROUND
The following factual background and allegations are derived from plaintiff's amended complaint and are taken as true for purposes of this motion.
I.M.S., a Canadian Corporation, is engaged in the service of providing advertising tracking information to publishers, advertisers, and others. I.M.S. operates a web-based service known as "e-Basket", which is used by I.M.S.'s clients to track magazine advertising. e-Basket is available exclusively to I.M.S. clients. Each I.M.S. client is issued a unique user identification and password which allows the client to access the e-Basket service and information in I.M.S.'s computers through an I.M.S. website. The e-Basket content is selected by I.M.S. and arranged into categories and sub-categories, a process which involves substantial creativity, time and effort. According to I.M.S., the e-Basket service contains copyrightable subject matter.
Berkshire has introduced and operates a competing tracking service called "Marketshareinfo.com". I.M.S. alleges that in or around March of 2002, Berkshire, or an agent thereof, intentionally and without authorization accessed I.M.S.'s e-Basket service, and gathered and copied content therefrom for use in Marketshareinfo.com. Specifically, Berkshire's unauthorized access spanned eight different webpages of e-Basket content, including that which would ordinarily be used by I.M.S. clients. Through its unauthorized access, I.M.S. contends that Berkshire copied roughly eighty-five percent of I.M.S.'s report formats. Marketshareinfo.com was launched after Berkshire accessed e-Basket, and I.M.S. alleges that Marketshareinfo.com incorporates original copyrightable elements of e-Basket, including the selection and arrangement of informational category headings and I.M.S.-compiled market data.
To gain access to e-Basket, I.M.S. alleges that Berkshire obtained a user identification and password issued to a third party, thereby knowingly inducing that third party to breach an agreement it had with I.M.S.
According to I.M.S., Berkshire's unauthorized access of I.M.S.'s computers is causing I.M.S. irreparable harm, has impaired the integrity and availability of I.M.S.'s data, and has caused I.M.S. to incur costs of more than $5,000 in damage assessment and remedial measures.
II. STANDARD OF REVIEW FOR A MOTION TO DISMISS
Defendant argues that we should dismiss all of plaintiff's federal claims for failure to state a claim. In assessing a motion to dismiss under Fed.R.Civ.P. 12(b)(6), the Court is obligated to accept as true all well-pleaded factual allegations in the Amended Complaint, and view them in the light most favorable to plaintiff. See Scheuer v. Rhodes, 416 U.S. 232, 236, 94 S.Ct. 1683, 40 L.Ed.2d 90; Hertz Corp. v. City of New York, 1 F.3d 121, 125 (2d Cir. 1993). Defendant's motion is to be granted only where "it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief." Still v. DeBuono, 101 F.3d 888, 891 (2d Cir. 1996) ( citing Conley v. Gibson, 355 U.S. 41, 48, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957)).
Additionally, as portions of defendant's motion appear to attack the sufficiency of plaintiff's amended complaint strictly in regard to Fed.R.Civ.P. 8(a), we will note that "the Federal Rules of Civil Procedure do not require a claimant to set out in detail the facts upon which he bases his claim." Conley, 355 U.S. 41, 47, 78 S.Ct. 99, 2 L.Ed.2d 80. Instead, all the Rules require is a "short and plain statement of the claim showing that the pleader is entitled to relief." Fed.R.Civ.P. 8(a). This liberal standard governs because the "principal function of pleadings under the Federal Rules is to give the adverse party fair notice of the claim asserted so as to enable him to answer and prepare for trial." Salahuddin v. Cuomo, 861 F.2d 40, 42 (2d Cir. 1988).
III. THE COMPUTER FRAUD AND ABUSE ACT
A. Overview Of The Computer Fraud And Abuse Act.
Plaintiff's First Amended Complaint recites three separate claims for relief under the Computer Fraud and Abuse Act ("CFAA"). 18 U.S.C. § 1030 et seq ("§ 1030"). Both parties devote a considerable portion of their briefing papers to their respective interpretations of the CFAA's modestly complex statutory scheme. In short, the parties disagree over what must be pled under certain CFAA subsections and what civil rights of action are made available by the CFAA. It is thus useful at the outset to review a few aspects of the CFAA.
Subsection (a) of the CFAA criminalizes several different kinds of unauthorized access to a computer, providing in relevant part:
(a) Whoever . . .
(5)(A)(ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damages; or (iii) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damages; and
(B) by conduct described in [either (5)(A)(ii) or (5)(A)(iii)] caused . . . (i) loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value . . . shall be punished as provided in subsection (c) of this section.
The referenced subsection (c) sets out a series of fines and possible terms of imprisonment for violations or attempted violations of subsection (a) of the CFAA.
See § 1030(b).
Subsection (e) of the CFAA supplies definitions for terms used in the CFAA.
Subsection (g) provides a civil right of action and reads in relevant part:
Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B). Damages for a violation involving only conduct described in subsection (a)(5)(B)(i) are limited to economic damages.
B. Discussion of Plaintiff's CFAA Claims.
Plaintiff avers that defendant's conduct violated §§ 1030(a)(2)(c), 1030(a)(5)(A)(iii) and 1030(a)(5)(B)(i) of the CFAA.
§ 1030(a)(2)(c) reads: "Whoever . . . intentionally accesses a computer without authorization or exceeds authorized accesses, and thereby obtains . . . information from any protected computer if the conduct involved an interstate or foreign communication . . . shall be punished as provided in subsection (c) of this section."
Defendant advances its motion against the CFAA claims on three grounds: First, plaintiff's pleading fails to allege the suffering of "damage" as required and defined by the CFAA. Second, plaintiff's pleading fails to allege the suffering of "loss" as required and defined by the CFAA. Third, § 1030(a)(2)(c) does not provide a civil cause of action, and therefore plaintiff has failed to state a claim under that subsection.
Defendant argues that, under the CFAA, plaintiff must adequately plead both "loss" and "damages" as defined by the CFAA.
1. Plaintiff Adequately Pleads Damage Under the CFAA.
Defendant argues that plaintiff fails to alleged "damage" as required by the CFAA. The CFAA defines damage as "any impairment to the integrity or availability of data, a system, or information." 18 U.S.C. § 1030(e)(8). Plaintiff alleges that "defendant's acts . . . have impaired the integrity and availability of plaintiff's data, programs, systems and/or information." Am. Compl., at ¶ 37. Defendant urges that this recitation of the CFAA's language is not enough to evade dismissal.
We disagree with defendant's characterization of plaintiff's complaint. In addition to referencing damages as defined by the CFAA, plaintiff has set forth facts in its complaint explaining that the data offered through the e-Basket program is for the exclusive use of its customers, and not for competitor appropriation. See Compl. at ¶¶ 8, 12. Defendant is alleged to have accessed e-Basket in or around March 2002, copying approximately 85% of the report formats contained on the system to assist in the creation of its own competing system. See id. at ¶¶ 18-20, 24. In so doing, plaintiff maintains that it suffered irreparable harm as the integrity of its data and system was impaired. See id. at ¶¶ 25-26. These allegations are sufficient to sustain this claim.
2. Plaintiff Adequately Pleads Loss Under the CFAA.
Loss, treated separate from damage under the CFAA, is defined as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11). Because plaintiff's claim relies on clause (i) of subsection (a)(5)(B), see 18 U.S.C. § 1030(g), its complained of loss must aggregate to at least $5,000 in value.
In the Amended Complaint, plaintiff alleges that defendant's unauthorized activity with respect to the e-Basket system (described in competent detail in the Amended Complaint) forced plaintiff to incur costs of more than $5,000 in damage assessment and remedial measures. See Compl. at ¶ 27. These allegations adequately state a claim under the CFAA and are sufficient to withstand defendant's motion to dismiss in this regard.
We need not reach the question of whether the CFAA allows a plaintiff to allege damage but not loss, or loss but not damage, because we find that plaintiff has adequately pled both.
3. Plaintiff States a Valid Claim Under § 1030(a)(2)(c).
Section 1030(a)(2)(c) forbids obtaining information from a protected computer involved in interstate or foreign communication through intentional and unauthorized access. Defendant asserts that plaintiff cannot maintain a claim under § 1030(a)(2)(c), contending that § 1030(g) does not provide a civil action for violations of this subsection.
The plain text of § 1030(g) does not provide or imply, and defendant offers no supporting case law for, such a restriction. Section 1030(g) affords a civil action for any CFAA violation, but requires an allegation of one of five enumerated factors in § 1030(a)(5)(B). Plaintiff's Amended Complaint satisfies § 1030(g) by elsewhere alleging the consequence described in § 1030(a)(5)(B)(i) (loss aggregating to at least $5,000). Additionally, there is ample authority permitting civil actions to proceed on alleged violations of this subsection. See, e.g., Theofel v. Farey-Jones, 341 F.3d 978, 986 (9th Cir. 2003) (finding a civil cause of action under § 1030(a)(2)(c) in conjunction with § 1030(g)); Chance v. Avenue A, Inc., 165 F.Supp.2d 1153, 1158 (W.D.Wash. 2001) (same); In re Intuit Privacy Litig., 138 F.Supp.2d 1272, 1279 (C.D.Cal. 2001) (same).
IV. COPYRIGHT INFRINGEMENT
Plaintiff claims defendant has infringed his copyright in e-Basket. Defendant challenges this Court's authority to consider this claim because of an asserted lack of subject matter jurisdiction.
Under the Copyright Act, "no action for infringement . . . shall be instituted until a registration of the copyright claim has been made in accordance with this title." 17 U.S.C. § 411(a). The registration requirement is jurisdictional; a lack of registration bars an infringement claim. See, e.g., Morris v. Business Concepts, Inc., 283 F.3d 502, 505 (2d Cir. 2002); see also City Merchandise, Inc. v. Kings Overseas Corp., 99 Civ. 10456(RCC), 2001 WL 286724, at *3 (S.D.N.Y. Mar. 23, 2001) (stating "the statute and Second Circuit precedent explicitly require registration as a prerequisite to an infringement claim.")
As evidence of registration, plaintiff attaches a Certificate of Registration issued by the Copyright Office on March 7, 2003, for plaintiff's "e-Basket." See Am. Compl., Ex. A (copyright registration for No. TX-5-656-679) (the "Registration Certificate"). Plaintiff additionally attests that this registration is for the same work that defendant has infringed. See Opp. Mem. at 10-12; Am. Compl., at ¶¶ 45-47. For its part, defendant urges that this registration certificate pertains to a different work, one that defendant is not accused of violating and that is not the matter in suit.
Oral argument was heard on this issue on January 28, 2004. For the following reasons, we agree with defendant and find that we do not possess subject matter jurisdiction to entertain plaintiff's copyright infringement claims.
A. Plaintiff's Registration Certificate.
Plaintiff's Registration Certificate discloses the following pertinent information: (1) the registered work was completed in the year 2003; (2) the date of first publication of the registered work was January 14, 2003; (3) neither the registered work nor an earlier version of the registered work was previously registered with the Copyright Office; (4) the registered work, if characterized as a derivative work or a compilation, is not based on and has not incorporated any preexisting work or works; (5) the registered work, if characterized as a derivative work or a compilation, consists of text, artwork and compilation that is new to the work; and (6) the effective date of registration is March 7, 2003. We here recall that defendant is alleged to have accessed and copied plaintiff's work in or around March of 2002. See Am. Compl., at ¶¶ 13-15, 19.
B. The Registered Work Is Not The "Same Work" That Was Infringed.
Plaintiff has primarily taken the position that the work it registered is the same work it claims defendant infringed. In its Amended Complaint, plaintiff avers that its database is "prepared over a period of time" Am. Compl., at ¶ 12, and in its briefing cites to statutory language stating "where a work is prepared over a period of time, the portion of it that has been fixed at any particular time constitutes the work as of that time." Opp. Mem. at 11 (quoting 17 U.S.C. § 101). In its most recent defense of its position that the registered work and the infringed work are one in the same, plaintiff analogizes itself to a "painter who begins a mural on Monday and finished on Friday." Plaintiff's Letter of January 15, 2004, at 3 ("Plaintiff's Letter"). According to plaintiff, this argument must prevail as otherwise its hypothetical painter "would have no recourse against someone who photographed the emerging work on Tuesday and sold posters of it." Id.
We find plaintiff's argument unpersuasive and are compelled to conclude that the registered work is not the same as the work which was supposedly infringed.
The Registration Certificate before the Court identifies a work that was created in 2003 and first published on January 14, 2003. "Publication" is statutorily defined as "the distribution of copies or phonorecords of a work to the public by sale or other transfer of ownership, or by rental, lease, or lending." 17 U.S.C. § 101. Although plaintiff claims defendant had no license or privilege to access and use (and copy from) its website, the e-Basket service was necessarily available to some segment of the public in March of 2002 based on the allegations in the complaint. See, e.g., Am. Compl, at ¶ 17 (accusing defendant of obtaining a password to plaintiff's website from a third party who, ostensibly, was in legitimate possession of the password). If, as plaintiff claims, its website qualifies as a "work . . . prepared over a period of time," 17 U.S.C. § 101, the same statutory definition directs that the portion of the work fixed in March of 2002 was the work as of that time. As such, the work as it existed in March of 2002 was also a published work as of March of 2002. Because its Registration Certificate speaks of a work first published in January of 2003, it covers something other than a work that was published (and allegedly infringed) in March of 2002.
"A work is 'fixed' in a tangible medium of expression when its embodiment in a copy or phonorecord, by or under the authority of the author, is sufficiently permanent or stable to permit it to be perceived, reproduced, or otherwise communicated for a period of more than a transitory duration." 17 U.S.C. § 101.
In addition, we stress that this is not a situation where the defendant copied an unpublished work, such as one merely visible to the public in a noncommercial medium during its preparation. On the contrary, plaintiff's website was "visible to the public" in March of 2002 because its content was simultaneously being sold to clients. See Am. Compl., at ¶¶ 9, 17. The sale of this content to certain members of the public predated defendant's alleged infringement. The mural painter comparison is thus faulty. There, the painter has not yet published the mural when it is infringed. To protect the work and reserve recourse against infringement, the painter would list the date of first publication on its registration certificate (according to plaintiff's hypothetical, presumably Friday or some point thereafter). Having not actually published the work prior to the publication date claimed on the certificate, there is no danger that daily stages of the mural would be viewed as separate works needing separate registrations.
C. The Registered Work Is Not Derivative Of And Does Not Otherwise Cover The Work That Was Infringed.
We understand plaintiff to advance the nuanced or alternative argument that the infringed upon work was "pre-existing underlying matter" to the registered work. See Plaintiff's Letter, at 2. Plaintiff asserts that "[b]ecause I.M.S. [a] owns copyright in this [pre-existing underlying matter], as well as the new matter first published on Jan. 14, 2003, its registration of the latter work extends to the earlier work." Id. This argument is also unpersuasive.
1. Relevant Case Law.
Subsequent to this motion's full briefing, the Second Circuit decided Well-Made Toy Mfg. Corp. v. Goffa Int'l Corp., 354 F.3d 112 (2d Cir. 2003). This Court found Well-Made Toy' s section on copyright registration particularly instructive and relevant to the instant matter, and therefore requested letters from each party assessing their positions on the registration issue in light of the new decision.
In Well-Made Toy, the plaintiff Well-Made was a manufacturer of "Sweetie Mine" rag dolls. The first Sweetie Mine was a 20-inch doll, the copyright for which plaintiff registered in 1996. Plaintiff designed a 48-inch doll two years later that retained the same proportions as the 20-inch doll. Plaintiff never registered its copyright for the 48-inch doll. That same year, defendant Goffa began manufacturing a 48-inch rag doll known as "Huggable Lovable". Well-Made sued Goffa in the United States District Court for the Eastern District of New York in 1999. In resolving the matter, the district court most notably refused to consider whether the 48-inch Huggable Lovable doll infringed the 48-inch Sweetie Mine doll because plaintiff never sought a separate registration for its bigger doll. Thus, the district court concluded it lacked subject matter jurisdiction over that claim, a decision which plaintiff appealed. See id., 354 F.3d 112, 114.
The Second Circuit denied plaintiff's appeal holding that "registration of a claim on an original work does not create subject matter jurisdiction with respect to a suit for infringement of the original's unregistered derivative." Id., 354 F.3d 112, 114. While this holding is not necessarily on point (as plaintiff relies on a registration certificate to include underlying unregistered work), the Second Circuit's review in Well-Made of Streetwise Maps, Inc. v. VanDam, Inc., 159 F.3d 739 (2d Cir. 1998) is highly informative.
In Streetwise Maps, plaintiff Streetwise brought a copyright infringement claim against defendant VanDam. Streetwise relied upon a 1989 registration certificate that stated the work it protected was derivative of a "Streetwise Manhattan map carrying a copyright notice date of 1984, 1985." Id., at 746 (quoting the registration certificate). The derivative map included previously unused depictions of the subway and bus systems. Id. Defendants had argued that only those additions — the subway and bus lines — were covered by the registration, and no claim could be brought for the earlier map without plaintiff producing a separate registration therefor. Id., at 747. The Second Circuit disagreed, maintaining that "because Streetwise is the owner of the copyright of both the derivative and pre-existing works, the registration certificate relating to the derivative work in this circumstance will suffice to permit it to maintain an action for infringement based on defendants' infringement of the pre-existing work." Id.
In comparing Streetwise Maps to the facts before the court in Well-Made, the Second Circuit observed:
In Streetwise Maps, the registration statement listed the pre-existing work, the plaintiff was the copyright owner of both works, and the pre-existing work was wholly subsumed within the registered derivative work. By contrast, the copied work here is not listed in any copyright registration and the only copied expressive elements . . . do not appear in any work whose copyright has been registered.Well-Made, 354 F.3d 112, 115-16 (emphasis added).
Another relevant case is Mattel, Inc. v. Robarb's, Inc., 139 F.Supp.2d 487 (S.D.N.Y. 2001). Plaintiff Mattel held a registered copyright in its Hot Wheels T-Bird Stocker's packaging, which included the Hot Wheels flame design. Defendant Robarb's designed a toy vehicle display case that, to convey its compatibility with Mattel's miniature car packages, employed the Hot Wheels flame design. Seeking judgment on the pleadings against Mattel's copyright infringement claim, defendant argued that its product did not depict the T-Bird Stocker, but instead other cars not registered by Mattel. Notwithstanding this fact, the court held that "Robarb's use of the Mattel flame, a distinctive and recognizable element of Mattel's registered copyright, in a substantially similar derivative work, gives Mattel a cause of action pursuant to 17 U.S.C. §§ 411, 506(b)." Id., 496-98. According to the Mattel court, it was persuaded by the proposition in Streetwise Maps that said "[a]lthough unregistered, the preexisting work was deemed worthy of protection because elements of it were incorporated into the registered derivative work." Id., 497.
2. Application.
Whether the Registration Certificate is viewed as one for a derivative work, a compilation of other works, or a work that contains "pre-existing underlying matter" (Plaintiff's Letter, at 2), it does not cover the content and matter that was allegedly infringed in March of 2002. Under the authority of Well-Made and Streetwise Maps, we find that the portion of the Registration Certificate requiring the identification of "Preexisting Material" would have to refer to the preexisting matter that is the basis of this infringement action. Unlike the plaintiff in Streetwise Maps, the plaintiff here does not identify the preexisting work that is the foundation of this action. See Well-Made, 354 F.3d 112, 115-16. And like in Well-Made,"the copied work here is not listed in any copyright registration." Id. The only indication that the Registration Certificate protects work that existed in March of 2002 are plaintiff's current protestations to this effect. This is not sufficient to confer subject matter jurisdiction on this Court. Able counsel (indeed, the same counsel currently representing plaintiff in this action) drew up and submitted the registration on behalf of plaintiff after the alleged acts of infringement commenced. If in drafting the Registration Certificate plaintiff meant to secure pre-January 2003 matter that was preexisting to or underlying the actual subject of the registration, it should have said so, and it had opportunity to say so.
Plaintiff is correct that the registration certificate in Mattel did not list any preexisting work. However, in Mattel, the defendant's product infringed an actual element of the registered work itself (the flame design on the package for the toy, see Copyright Registration Number VA 445-024), an argument here that had already been rejected. And furthermore there was no claim in Mattel that the publication date of the registered packaging antedated the infringement, which may have necessitated identification of preexisting matter. See Mattel, 139 F.Supp.2d at 496-98.
The inclusion of the response "Text and artwork; compilation" under the subheading "Material Added to This Work" likewise does not sufficiently advance plaintiff's position. This information gives no indication of what precise underlying or preexisting work was supplemented as the previous section calling for the designation of any preexisting work on which the registered work is based is left blank.
Plaintiff is mistaken if it argues that it did not have to complete this portion of the section because it pertains only to derivative works. The Form TX Line-By-Line Instructions (viewable at http://www.copyright.gov/forms/formtx.pdf) state: "Complete space 6 if this work is a 'changed version,' 'compilation,' or 'derivative work' and if it incorporates one or more earlier works that have already been published or registered for copyright." While the instructions do specifically read "[f]or derivative works, complete [space a] and space b", nowhere do the instructions direct that only parties claiming a derivative work need identify preexisting work in space a. Indeed, the lead instructions (recited above) belie any such restriction. Moreover, and more importantly, 17 U.S.C. § 409(9), in outlining the copyright registration requirements states that "[t]he application . . . shall include . . . in the case of a compilation or derivative work, an identification of any preexisting work or works that it is based on or incorporates." Id. For some reason, plaintiff felt compelled to complete space.b. If that is because it thought it was registering a compilation, it was required to fill in space a. If plaintiff's work fell into some unclassifiable dimension that required the completion of space b but not space a, it has failed to lucidly explain in its pleading and to the Court precisely how that is the case.
Plaintiff's copyright infringement claim is therefore dismissed, an outcome entirely consonant with the results in Streetwise Maps and Well-Made.
Plaintiff states that it "asserts infringement of pre-existing underlying matter, contained in the deposit copy submitted with the registration." Any suggestion that the deposit by itself was adequate to satisfy the 17 U.S.C. § 411 registration requirement is rejected.
V. DIGITAL MILLENNIUM COPYRIGHT ACT
Congress enacted the Digital Millennium Copyright Act ("DMCA") in 1998 to "strengthen copyright protection in the digital age." Universal City Studios, Inc. v. Corley, 273 F.3d 429, 435 (2d Cir. 2001). Plaintiff claims that defendant, by accessing I.M.S.'s computer system through the unauthorized use of a password issued to a party other than defendant, violated the DMCA's bar on circumventing a technological measure that effectively controls access to protected work. See Am. Compl. at ¶ 49. The DMCA's "anti-circumvention" provisions, as they are commonly known, read in pertinent part:
17 U.S.C. § 1201 et seq.
As a preliminary matter, we note that there is no inconsistency in addressing plaintiff's DMCA claim on the merits and finding that this Court does not possess subject matter jurisdiction over plaintiff's copyright infringement action. An owner's copyrighted work can be unregistered. Unlike its effect on its infringement claim, plaintiff's failure to register its copyrighted work is not a bar to a DMCA action. See Medical Broadcasting Co. v. Flaiz, 2003 WL 22838094, at * 3 (E.D.Pa. Nov. 25, 2003) (stating "[w]hile a copyright registration is a prerequisite under 17 U.S.C. § 411(a) for an action for copyright infringement, claims under the DMCA, however, are simply not copyright infringement claims and are separate and distinct from the latter"); see also See 3 M. D. Nimmer, NIMMER ON COPYRIGHT, § 12A.18[B] (2003) (noting that §§ 1201 and 1202 of the DMCA "occupy a niche distinct from copyright infringement, albeit codified in the same title of the United States Code").
See id. at § 1201(a)(1). A companion to the DMCA's anti-circumvention measures are its anti-trafficking prohibitions, (located in 17 U.S.C. § 1201(a)(2), (b)(1)) which target "anyone who would traffic in a technology primarily designed to circumvent" a technological measure protecting copyrighted work. Universal Studios, Inc., 273 F.3d at 435 (emphasis in original).
See, e.g., Universal Studios, Inc., 273 F.3d at 435.
No person shall circumvent a technological measure that effectively controls access to a work protected under this title. 17 U.S.C. § 1201(a)(1)(A).
. . . . .
As used in this subsection . . . to 'circumvent a technological measure' means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner; and . . . a technological measure 'effectively controls access to a work' if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.17 U.S.C. § 1201(a)(3).
Defendant challenges whether the facts as alleged manifest a "circumvention" as that term is defined in the subsection. According to defendant, the DMCA was passed to combat unauthorized disabling of digital walls which otherwise safeguard copyrighted materials available on the Internet and the decryption of encrypted content, such as that found on a DVD. See Mem. at 13 (citing Universal City Studios, Inc., 273 F.3d 429). Defendant argues that it is not accused of having "hacked" into plaintiff's website, and that "[t]he disconnect between the harm the statute is designed to address and the acts of which [p]laintiff complains" warrants dismissal of this claim. Mem. at 13.
Whether accessing copyrighted work by unauthorized use of an otherwise legitimate, owner-issued password qualifies as circumvention under the DMCA appears to be a question of first impression in this Circuit and in all others.
A. Was An Effective Technological Measure In Place?
An action under the DMCA requires "circumvent[ion of] a technological measure that effectively controls access to a work protected under this title." 17 U.S.C. § 1201(a). A "technological measure that effectively controls access" is defined as one that "in the ordinary course of its operation . . . requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work." Id., at § 1201(a)(3).
I.M.S.'s password protection fits within this definition. In order to gain access to the e-Basket service, a user in the ordinary course of operation needs to enter a password, which is the application of information. Indeed, the Second Circuit in Universal Studios confirmed that "[t]he DMCA . . . backed with legal sanctions the efforts of copyright owners to protect their works from piracy behind digital walls such as encryption codes or password protections." Universal Studios, 273 F.3d at 435 (emphasis added).
B. Was The Technological Measure Circumvented?
It is of course the case, as defendant propounds, that the DMCA addresses activity such as decryption, descrambling, deactivation and impairment, and that these are all forms of circumvention under the subsection commonly involving technologically-sophisticated maneuvers. One might associate these activities with the breaking and entering (or hacking) into computer systems.
On the other hand, other actions proscribed by the DMCA, connote broader application of the anti-circumvention prohibition, such as the terms "avoid" and "bypass". These actions are far more open-ended and mundane, and do not necessarily involve some kind of tech-based execution. Notwithstanding this, defendant argues that it has not even committed any act of avoidance or bypass, as it is accused of confronting IMS's password-controlled access in the way precisely intended: "[A]ll [I.M.S.] accuses Berkshire of doing is using IMS's own customer's valid password and user [identification] to view IMS's e-Basket system exactly as the customer itself might have done." Rep. Mem. at 10.
We agree that plaintiff's allegations do not evince circumvention as that term is used in the DMCA. Circumvention requires either descrambling, decrypting, avoiding, bypassing, removing, deactivating or impairing a technological measure qua technological measure. In the instant matter, defendant is not said to have avoided or bypassed the deployed technological measure in the measure's gatekeeping capacity. The Amended Complaint never accuses defendant of accessing the e-Basket system without first entering a plaintiff-generated password.
More precisely and accurately, what defendant avoided and bypassed was permission to engage and move through the technological measure from the measure's author. Unlike the CFAA, a cause of action under the DMCA does not accrue upon unauthorized and injurious access alone; rather, the DMCA "targets the circumvention of digital walls guarding copyrighted material." Universal Studios, 273 F.3d 429, 443 (emphasis in original).
Compare 17 U.S.C. § 1201(a)(3)(A) with 18 U.S.C. § 1030(a).
Although whether an activity qualified as circumvention was not the question posed to the court, Universal Studios is instructive as a matter of reference. There, the offending circumvention was a DVD decryption program, DeCSS, which enabled the viewing of movies without using a DVD player. See Universal Studios, 273 F.3d at 452. The security device that prevented access to DVD movies without a DVD player, CSS, was described "[i]n its basic function . . . [as] a lock on a homeowner's door, a combination of a safe, or a security device attached to a store's products." Id., at 452-53. Likewise, "[i]n its basic function, [DeCSS, the decryption program] is like a skeleton key that can open a locked door, a combination that can open a safe, or a device that can neutralize the security device attached to a store's products. DeCSS enables anyone to gain access to a DVD movie without using a DVD player." Universal Studios, 273 F.3d at 453.
Defendant is alleged to have accessed plaintiff's protected website without plaintiff's authorization. Defendant did not surmount or puncture or evade any technological measure to do so; instead, it used a password intentionally issued by plaintiff to another entity. As an analogy to Universal Studios, the password defendant used to enter plaintiff's webservice was the DVD player, not the DeCSS decryption code, or some alternate avenue of access not sponsored by the copyright owner (like a skeleton key, or neutralizing device). Plaintiff, however, did not authorize defendant to utilize the DVD player. Plaintiff authorized someone else to use the DVD player, and defendant borrowed it without plaintiff's permission. Whatever the impropriety of defendant's conduct, the DMCA and the anti-circumvention provision at issue do not target this sort of activity.
VI. TORTIOUS INTERFERENCE WITH CONTRACTUAL RELATIONS
Having upheld plaintiff's claims under the CFAA, we will exercise supplemental jurisdiction over plaintiff's claim of tortious interference with contractual relations pursuant to 28 U.S.C. § 1367(a).
VII. LEAVE TO REPLEAD
In its opposition memorandum, plaintiff asks for leave to replead to remedy any insufficiency identified by the Court. Defendant opposes this request, arguing that plaintiff has already had the opportunity to replead, and indeed did so following a round of letters, pursuant to this Court's Individual Practices, debating the propriety of a motion to dismiss plaintiff's initial complaint.
Fed.R.Civ.P. 15(a) provides that "leave [to replead] shall be freely given when justice so requires." However, leave to amend can be denied where it appears that granting leave to amend would be unproductive or futile. See Foman v. Davis, 371 U.S. 178, 182, 83 S.Ct. 227, 9 L.Ed.2d 222 (1962). As it now stands, any amendment would be futile as repleading alone will not cure the deficiencies in plaintiff's copyright infringement and DMCA claims. The only potentially valid amendment the Court foresees would require plaintiff to register the copyright upon which it bases its infringement action. Whether a copyright registration contradicted by a previous registration (and complaint) can confer subject matter jurisdiction on this Court is an open question.
VIII. MOTION FOR A MORE DEFINITE STATEMENT
Having concluded that plaintiff's claims under the CFAA survive Rule 12(b)(6) and satisfy Rule 8(a), defendant's motion for a more definite statement pursuant to Rule 12(e) is denied. See Tom Kelly Studios Inc. v. Int'l Collectors Society Inc., No. 97 Civ. 0056(WK), 1997 WL 598461, at *1 (S.D.N.Y. Sept. 25, 1997) (stating "if a complaint complies with the liberal pleading requirements of Fed.R. of Civ. P. 8(a), then the Rule 12(e) motion should be denied"). The Amended Complaint's allegations adequately enable defendant to form a responsive pleading.
CONCLUSION
For the foregoing reasons, defendant's motion is denied with respect to plaintiff's CFAA claims, and granted for plaintiff's copyright infringement and DMCA claims. Defendant's motion for a more definite statement is denied. Additionally, this Court will exercise supplemental jurisdiction over plaintiff's state law claim. A pretrial conference in this matter is scheduled for March 19, 2004, at 12:00 p.m. in Courtroom 21A, 500 Pearl Street.
IT IS SO ORDERED.