Summary
holding that travel costs incurred by plaintiff's executives to investigate misappropriation of stored data did not qualify as losses under CFAA because they were unrelated to "any type of computer investigation or repair" or preventative security measures
Summary of this case from Dreni v. Printeron Am. Corp.Opinion
03 Civ. 2291 (MGC)
May 25, 2004
Michael R. Gordon, Joanna A. Diakos, Kirkpatrick Lockhart LLP, New York, NY, for Plaintiffs Nexans Wires S.A. and Lacroix Kress GmbH
Adam C. Silverstein, Jamie A. Forman, Golenbock Eiseman Assor Bell Peskoe LLP, New York, NY, for Defendants Sark-USA and Sarkuysan Elektrolitik Bakir Sanayii Ve Ticaret A.S.
OPINION
Defendants Sark-USA, Inc. ("Sark-USA") and Sarkuysan Elektrolitik Bakir Sanayii Ve Ticaret A.S. ("Sarkuysan") have moved to dismiss this action under Fed.R.Civ.P. 12(b)(6) and 12(b)(1). Specifically, defendants contend that plaintiffs Nexans Wires S.A. ("Nexans") and Lacroix Kress GmbH ("LK") lack standing to sue under the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030. By order of October 16, 2003, defendants' motion to dismiss was converted into a motion for summary judgment. Plaintiffs were directed to submit the facts upon which they rely for standing under the CFAA, 18 U.S.C. § 1030(g), and defendants were directed to submit a response. For the reasons that follow, defendants' motion for summary judgment dismissing the federal claims is granted.
BACKGROUND
Plaintiffs filed this action against their wire and cable industry competitors Sark-USA and Sarkuysan for unfair competition. Plaintiff L K, a German corporation, is wholly owned by plaintiff Nexans, a French corporation. Defendant Sark-USA is a Delaware corporation with its principal place of business in North Carolina and is the wholly owned subsidiary of defendant Sarkuysan, a Turkish corporation. The complaint asserts claims of misappropriation of trade secrets under New York and North Carolina law, unfair competition under New York, North Carolina and South Carolina law, tortious interference with prospective economic advantage and conversion under New York law, and five claims under the CFAA. Federal jurisdiction is based on the CFAA claims.
Plaintiffs submitted a proposed amended complaint with their opposition papers to defendants' motion to dismiss. That is the complaint under consideration.
All of plaintiffs' claims arise out of the subject of a related action,A.E.B. International, Inc. and Atlantic Specialty Wire, Inc. v. Myron Daniel Schatzberg, Sark-USA, Inc., Brigit Skeet Finley, and Sarkuysan Elektrolitik Bakir Sanayii Ve Ticaret A.S., 02 Civ. 6312 (MGC). In that action, the plaintiffs, A.E.B. International, Inc. ("AEB") and its sister company, Atlantic Specialty Wire, Inc. ("ASW"), sue defendants Sarkuysan and Sark-USA and two former employees, Myron Daniel Schatzberg ("Schatzberg") and Brigit Skeet Finley ("Finley") for misappropriation of trade secrets, tortious interference with prospective economic advantage, unfair competition and violations of the CFAA.
According to the complaint in this action, plaintiffs Nexans and L K manufacture and supply "advanced copper and optical fiber wire and cable solutions to the infrastructure, industry and building markets." Compl. ¶ 13. Plaintiffs are a major supplier of AEB and produce products which AEB then distributes throughout the United States. Plaintiffs assert that in order to maintain this relationship with AEB, it was necessary for plaintiffs to store much of their "confidential proprietary information" on the computers of AEB and ASW. This information consisted of plaintiffs' pricing schedules as well as manufacturing information. The information was stored in AEB's secure centralized computer system in New York and in ASW's computer system in South Carolina. Plaintiffs' information was segregated from other files and password protected to insure confidentiality.
Sarkuysan manufactures wire and cable products to be sold in the United States in direct competition with plaintiffs and AEB. Plaintiffs allege that at sometime prior to the departure of Schatzberg and Finley from AEB and ASW, Schatzberg, Finley and Sarkuysan, agreed to establish a new company, Sark-USA. The organization of Sark-USA enabled Sarkuysan to operate directly in the United States and to serve as the "repository" of plaintiffs' "stolen and misappropriated confidential, proprietary information." Compl. ¶ 28.
The essence of plaintiffs' complaint is that defendants induced Finley and Schatzberg to steal plaintiffs' proprietary information from AEB and ASW. Specifically, the complaint alleges that Finley had full access to AEB's computer system, including the information plaintiffs provided to AEB. Plaintiffs allege that beginning in March 2002, under instructions from defendants, Finley used her personal Yahoo e-mail account to download plaintiffs' proprietary information, without AEB's approval, and then sent the information to defendants. The complaint alleges that on April 15, 2002, Schatzberg, acting at the request of defendants, unlawfully obtained access to ASW's computer systems, created a "back-up" tape of the files and deleted confidential business information, including certain of plaintiffs' proprietary information. From April 2002 through May 21, 2002, Schatzberg, without the authorization of his employer, allegedly photocopied or downloaded plaintiffs' information from AEB's computer system, for the benefit of defendants.
In addition to the alleged misappropriation of plaintiffs' information from the computers of AEB and ASW, plaintiffs assert that Schatzberg misappropriated information gleaned from a visit to LK's factory. In March 2002, Schatzberg traveled to LK's factory in Germany with the Chairman of AEB, A. Erkan Buyuksoy ("Buyuksoy") where the two toured the LK factories and learned detailed information about the manufacturing process, which each agreed to keep confidential. However, Schatzberg allegedly violated this agreement and divulged all that he had learned from the trip to defendants.
DISCUSSION I.
Basis for Jurisdiction
Defendants moved under both Fed.R.Civ.P. 12(b)(1) and Fed.R.Civ.P. 12 (b)(6) to dismiss the complaint. "A case is properly dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) when the court lacks the statutory or constitutional power to adjudicate the case. In contrast, a dismissal under Rule 12(b)(6) is a dismissal on the merits of the action-a determination that the facts alleged in the complaint fail to state a claim upon which relief can be granted." Nowak v. Ironworkers Local 6 Pension Fund, 81 F.3d 1182, 1187 (2d Cir. 1996) (noting the difficulties of distinguishing between the two). Therefore, the court must first have assumed jurisdiction over the matter before a 12(b)(6) motion can be decided.Id. (citing Bell v. Hood, 327 U.S. 678, 682-83 (1946)). As the Second Circuit has noted, "Bell v. Hood, instructs us that, when the contested basis of federal jurisdiction is also an element of plaintiff's asserted federal claim, the claim should not be dismissed for want of jurisdiction except when it `appears to be immaterial and made solely for the purpose of obtaining jurisdiction or where such a claim is wholly insubstantial and frivolous.'" AVC Nederland B.V. v. Atrium Inv. Partnership, 740 F.2d 148 (2d Cir. 1984) (internal citations omitted). Plaintiffs' assertion of jurisdiction under the CFAA is not wholly insubstantial and frivolous. Therefore, this court has jurisdiction, and an examination under 12(b)(6), rather than under 12(b)(1) is appropriate.
This also resolves the parties' dispute concerning the appropriateness of a 12(b)(1) evidentiary hearing.
II. Conversion of Defendants' Motion to Dismiss into a Motion for Summary Judgment
"If, on a motion . . . to dismiss for failure of the pleading to state a claim upon which relief can be granted, matters outside the pleading are presented to and not excluded by the court, the motion shall be treated as one for summary judgment and disposed of as provided in Rule 56, and all parties shall be given reasonable opportunity to present all material made pertinent to such a motion by Rule 56." Fed.R.Civ.P. 12 (b). As noted above, defendants' motion to dismiss was converted into a motion for summary judgment by order of October 16, 2003. It became clear at oral argument that the real issue is whether plaintiffs can present sufficient evidence of "loss" to have standing to sue under the CFAA's civil provision, 18 U.S.C. § 1030 (g). In order to have standing, plaintiffs must have suffered a "loss" of at least $5,000. 18 U.S.C. § 1030 (g), (a)(5)(B)(i). The parties were given a full opportunity to present all relevant materials.
Pursuant to the order of October 16, 2003, plaintiffs made their first submission regarding the facts which they rely on for standing on October 30, 2003 and defendants made their initial response on November 13, 2003. Plaintiffs replied on November 18, 2003, which prompted a November 21, 2003 rebuttal from defendants. Plaintiffs submitted a Supplemental Affidavit on December 12, 2003 and defendants responded on December 19, 2003.
III. Standard for Summary Judgment
Where there are no material facts in dispute, a motion for summary judgment should be granted. Fed.R.Civ.P. 56(c). "Rule 56(c) mandates the entry of summary judgment . . . against a party who fails to make a showing sufficient to establish the existence of an element essential to that party's case, and on which that party will bear the burden of proof at trial." Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986'). "In such a situation, there can be `no genuine issue as to any material fact,' since a complete failure of proof concerning an essential element of the nonmoving party's case necessarily renders all other facts immaterial." Id. at 322-23. In deciding whether a genuine issue exists, a court must "examine the evidence in the light most favorable to the party opposing the motion, and resolve ambiguities and draw reasonable inferences against the moving party." In re Chateaugay Corp., 10 F.3d 944, 957 (2d Cir. 1993).
The issue in dispute is whether plaintiffs can prove an essential element of their CFAA claims, i.e. a "loss . . . aggregating at least $5,000 in value." 18 U.S.C. § 1030(g), (a)(5)(B)(i).
IV. The Computer Fraud and Abuse Act Claims
Plaintiffs allege that defendants Sark-USA and Sarkuysan violated the CFAA by inducing Schatzberg and Finley to copy and delete the computer files of AEB and ASW, files which contained plaintiffs' "confidential proprietary information."
The CFAA is a criminal statute, but it also provides for a civil right of action. 18 U.S.C. § 1030(g). Plaintiffs have alleged that the acts of defendants violated § 1030(a)(2)(C), (a)(4), (a)(5)(i), (a) (5) (ii), and (a)(5) (iii). Under § 1030(a)(2)(C), "[w]hoever . . . intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer if the conduct involved an interstate or foreign communication" may be punished. Section 1030(a)(4) prohibits accessing a protected computer without authorization "knowingly and with intent to defraud" and thereby "obtain[ing] anything of value." Section 1030(5) (A)(i) prohibits knowingly transmitting "a program, information, code, or command" and intentionally causing unauthorized damage, to a protected computer. Under § 1030(5)(A) (ii) and (iii), respectively, it is a violation to "recklessly cause damage" or to simply "cause damage" through the unauthorized access of a protected computer.
Plaintiffs' complaint actually alleges violations of 18 U.S.C. § 1030 (a)(5)(A) , (a)(5)(B) and (a)(5)(C). Pursuant to the 2001 amendments to the CFAA, these subsections are now (a)(5)(i), (a)(5) (ii), and (a) (5) (iii).
Section 1030(g) provides that a civil action may only be brought if the conduct involves one of the factors set forth in clause (i), (ii), (iii), (iv) or (v) of subsection (a)(5)(B). 18 U.S.C. § 1030(g). Here, the only applicable section of (a)(5)(B) is (a)(5)(B)(i): "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." Section 1030(e)(11) defines "loss" as:
any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.
Plaintiffs must meet this jurisdictional threshold in order to sue on any of the five CFAA claims they assert. Theofel v. Farey-Jones, 341 F.3d 978, 986 n. 5 (9th Cir. 2003) amended by 2004 WL 292101 (9th Cir. Feb. 17, 2004). "Damage" is defined as "any impairment to the integrity or availability of data, a program, a system, or information." § 1030(e)(8).
It is clear from the complaint that AEB and ASW, not plaintiffs, own the computers which were allegedly unlawfully accessed. This raises the question of whether a third-party who does not own or control the unlawfully accessed computer has standing to bring suit under the Act. At least one court has specifically held that there is no ownership or control requirement in the CFAA. Theofel, 341 F.3d at 986 ("Individuals other than the computer's owner may be proximately harmed by unauthorized access, particularly if they have rights to data stored on it."). Because plaintiffs store their information on AEB and ASW computers they may suffer the type of harm contemplated by the statute if those computers are damaged. Notably, the Theofal court found it premature to consider whether the damages or losses suffered by the non-owner plaintiff fell within the ambit of the Act because the plaintiff had not yet alleged its "loss." Theofal, 341 F.3d at 986. Therefore, it is unclear from Theofal what "loss" the non-owner must incur to have standing under § 1030(g).
The case defendants cite to support their argument that a corporation cannot be found liable under the CFAA for the actions of its employees is inapposite. In Doe v. Dartmouth-Hitchcock Medical Center, No. Civ. 00-100-M, 2001 WL 873063 (D. N.H. July 19, 2001), the court declined to find a hospital liable for the unlawful acts of one of its doctors because the doctor's violation of the CFAA was contrary to hospital policy and actually harmed the hospital. Here, Schatzberg and Finley are alleged to have acted at the direction of Sark-USA and Sarkuysan.
A. Plaintiffs' Alleged "Loss"
1. Travel Expenses
Plaintiffs' allegation of "loss" in their complaint simply tracks the language of the statute, and states that they have suffered a "loss" of at least $5,000 in value. In response to the order directing plaintiffs to submit the facts upon which the alleged loss is based, plaintiffs submitted two affidavits of Wolfgang Placke, the General Manager of LK. The "loss" asserted in the affidavits is the cost of two business trips that Placke and LK's Sales Director, Gerhard Maerker, took from their LK offices in Germany to AEB's New York offices. Placke states that they flew to New York in June of 2002 for the sole purpose of responding to the news that Schatzberg had abruptly resigned. Buyuksoy had apparently informed Placke that in an investigation after Schatzberg's abrupt departure, AEB had discovered that the system had been unlawfully accessed and certain files deleted. Plaintiffs were told that some of their information might have been taken. Tracking the statutory definition of "loss," Placke states that he and Maerker "met with representatives of AEB to discuss the theft of [their] proprietary information" and that the trip was to "respond to the AEB computer offense" and to "conduct an assessment of the damage caused by the impact of the computer theft on the integrity of the proprietary information, that [p]laintiffs had stored on AEB's computer system." Aff. Oct. 29, 2003, ¶ 7.
Placke asserts that the second trip, made by Maerker in February 2003, was prompted by the resignation of Finley. The affidavit does not state when Placke received this information. But, according to the complaint, Finley resigned in June 2002, seven months before the February trip. The total cost of these two trips was $8,007.14, which plaintiffs argue meets the jurisdictional threshold of a "loss" of at least $5,000.
Defendants make several arguments as to why the cost of these business trips does not constitute "loss" within the meaning of the CFAA. The most compelling argument is that neither trip's cost constitutes "loss" because the cost was unrelated to investigating or remedying damage to a computer. Placke's affidavit does not assert that he or Maerker or even Buyuksoy ever examined a computer or made a computer assessment. Moreover, Placke clarifies in his second affidavit that when he stated in his first affidavit that Buyuksoy checked the AEB computer system after Schatzberg's departure, he is not actually sure who checked the computer nor is he sure whether it was an AEB or ASW computer. In sum, defendants argue that plaintiffs' executives did not engage in any activity on their trips that could not have just as easily taken place over the telephone.
Defendants submitted deposition testimony and affidavits of Buyuksoy and Finley which contradict plaintiffs' assertion of the purpose of the two trips. However, credibility may not be determined on a motion for summary judgment.
In response, plaintiffs assert that they have established a prima facie case of standing by alleging that they incurred $8,007.14 in costs in responding to CFAA violations. Placke's affidavits describe the meetings which took place, including one at Le Cirque restaurant, as well as a confidential meeting between Placke, Maerker, and Buyuksoy where they "discussed what proprietary and confidential information was believed to have been stolen, how that proprietary and confidential information had been stolen, and what steps we could take in the future to prevent such computer-based theft." Aff. Dec. 8, 2003, ¶ 9.
Placke also states that his belief in having meetings such-as this conducted in person, made it impossible for these conversations to have taken place over the telephone. In sum, plaintiffs state that the expenses incurred by their senior executives in traveling to a meeting to discuss confidential information stolen by a customer's faithless employees constitutes "loss" within the meaning of the CFAA.
a. Definition of "Loss"
Prior to the clarifying amendment of 2001, "loss" was not defined. "Damage" was defined as "any impairment to the integrity or availability of data, a program, a system, or information that (A) causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals . . ." Since the first sentence of § 1030(g) provides a right of action for anyone who suffers "damage or loss," Judge Buchwald considered whether "loss," as well as "damage," was subject to the $5,000 statutory minimum. See In re Doubleclick Inc. Privacy Litigation, 154 F. Supp.2d 497 (S.D.N.Y. 2001)(concluding-that "loss" as well as "damage" was subject to the $5,000 threshold).
The In re Doubleclick court examined the legislative history of the statute in order to understand the meaning of the then undefined term "loss":
The 1994 amendment [to § 1030(g)] required both "damage" and "loss," but it is not always clear what constitutes "damage." For example, intruders often alter existing log-on programs so that user passwords are copied to a file which the hackers can retrieve later. After retrieving the newly created password file, the intruder restores the altered log-on file to its original condition. Arguably, in such a situation, neither the computer nor its information is damaged. Nonetheless, this conduct allows the intruder to accumulate valid user passwords to the system, requires all system users to change their passwords, and requires the system administrator to devote resources to resecuring the system. Thus, although there is arguably no "damage," the victim does suffer "loss." In re Doubleclick 154 F. Supp.2d at 521 (quoting S. Rep. No. 104-357, at 11 (1996) (emphasis added)).
From this, the court concluded that: "Congress intended the term `loss' to target remedial expenses borne by victims that could not properly be considered direct damage caused by a computer hacker."Id. at 521.
It is also clear that the remedial costs contemplated by "loss" are not limited to the cost of actual repairs themselves, but incurred "because of interruption of service." Id. at 522, n. 29 (citing 132 Cong. Rec. S14453 (daily ed. Oct. 1, 1986) (statement of co-sponsor Sen. Trible): "[i]n addition; the concept of `loss' embodied in this paragraph will not be limited solely to the cost of actual repairs. The Justice Department has suggested that other costs, including the cost of lost computer time necessitated while repairs are being made, be permitted to count toward the [then] $1,000 valuation. I and the other sponsors of this bill agree."). Therefore, it seems that "loss" means any remedial costs of investigating the computer for damage, remedying the damage and any costs incurred because the computer cannot function while or until repairs are made. However, there is nothing to suggest that the "loss" or costs alleged can be unrelated to the computer.
Although the court was examining a slightly different issue, theIn re Doubleclick court's analysis is especially helpful because it examined a proposed definition of "loss" which is virtually identical to the current definition. Id. at 522, n. 29. The court noted that this amendment "expressly seeks to clarify (1) what constitutes "loss," and (2) that "loss" is subject to the $5,000 monetary threshold." Id. The court was not persuaded that plaintiffs had alleged facts to support a finding of "loss" or "damage" of at least $5,000 from any single act.Id. at 525 (rejecting the argument that there were any remedial costs and expressing doubt that the economic value of the demographic information on plaintiffs' website or the value of the plaintiffs' attention span could help satisfy the jurisdictional threshold). In doing so, the court explained that some damage is too far outside the scope of what the statute is to protect against, "namely, damage to computer systems and electronic information by hackers." 154 F. Supp.2d at 525, n. 34 (criticizing America Online, Inc. v. LCGM, 46 F. Supp.2d 444, 451 (E.D. Va. 1998) ("AOL") which held that damage to "reputation or goodwill" could count toward the [then] "damage" threshold). The court dismissed the CFAA claim citing the plaintiffs' inability to meet the jurisdictional threshold of at least $5,000 of "loss" or, then, "damage." Id. at 526.
The court examined the "Enhancement of Privacy and Public Safety Act, S. 3083, 106th Cong (Sept. 20, 2000) which stated: " (10) the term `loss' includes — `(A) the reasonable costs to any victim of —' (i) responding to the offense; `(ii) conducting a damage assessment; and `(iii) restoring the system and data to their condition prior to the offense; and `(B) any lost revenue or costs incurred by the victim as a result of interruption of service.'" In re Doubleclick, 154 F. Supp.2d at 522, n. 29.
In 2001, 1030(g) and the definition of "damage" were amended, and a definition of "loss" was added. Nothing in the legislative history of the 2001 amendment suggests that the costs incurred in "responding to an offense" or in "conducting a damage assessment" can be unrelated to a computer. See Cong. Rec. S 10913, 106th Cong (Oct. 24, 2000) (noting the inclusion of the definition of "loss" and the intent to incorporate the $5,000 jurisdictional threshold into a description of the offense). Therefore, the meaning of "loss," both before and after the term was defined by statute, has consistently meant a cost of investigating or remedying damage to a computer, or a cost incurred because the computer's service was interrupted.
Another decision sheds additional light on the types of harm the statute contemplates. In Tyco Int'l Inc. v. John Does, No. 01 Civ. 3856, 2003 WL 21638205 (S.D.N.Y. July 11, 2003), Magistrate Judge Freeman considered whether the cost of investigating the identity of a computer hacker could constitute compensatory damages under the CFAA. Although the court was clearly calculating damages, rather than determining "loss" for purposes of standing, the court makes clear that the types of costs which the CFAA allows recovery for are related to fixing a computer. The court stated:
[w]hile it is true, . . . that the CFAA allows recovery for losses beyond mere physical damage to property, the additional types of damages awarded by courts under the Act have generally been limited to those costs necessary to assess the damage caused to the plaintiff's computer system or to resecure the system in the wake of a hacking attack. See EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 584-85 (1st Cir. 2001) (awarding costs of assessing damage); United States v. Middleton, 231 F.3d 1207, 1213-14 (9th Cir. 2000) (awarding costs of "investigating and repairing the damage" FN3); In re Doubleclick Inc. Privacy Litigation, 154 F. Supp.2d 497, 524-25 (S.D.N.Y. 2001) (recognizing only costs in remedying damage as recoverable under CFAA).
3. Although the court in Middleton uses the word "investigating," it is clear from both the court's language ("investigating . . . the damage") and the facts of the case that this investigation involved only assessing the damage to the system — not locating and collecting information about the hacker.
Therefore, Tyco is instructive in that the costs the court found to be recoverable were the costs of remedying damage to thecomputer. General non-computer costs incurred in investigating the violation were deemed too far outside the scope of the Act.
Even cases which have taken an expansive view of the CFAA jurisdictional threshold have not suggested that "loss" can include a cost unrelated to the computer. In Pacific Aerospace Electronics, Inc. v. Taylor, No. CS-02-0412-AAM, 2003 WL 23100804 (E.D. Wash. June 20, 2003), the court denied a motion to dismiss an employer's CFAA suit against a faithless employee. Id. (citingEF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001) for the proposition that the $5,000 threshold can be easily satisfied). However, in Explorica the First Circuit did not endorse the district court's reasoning that "loss" encompasses a loss of business or goodwill. Id. at 584. The Court of Appeals found that the $20,944.92 plaintiff paid "to assess whether their website had been compromised" was the only necessary consideration, as it was clear that this cost satisfied the statutory threshold. Id. Thus, the "loss" inExplorica was the cost of hiring a consultant to assess the computer damage, not a general expense.
b. Plaintiffs' Travel Expenses Do Not Constitute "Loss"
Quoting the language of the statute, Placke's affidavits assert that the two trips were for the purpose of "conducting a damage assessment" and "responding to the offense." 18 U.S.C. § 1030 (e) (11). However, the affidavits do not allege any facts showing that this assessment or response was in any way related to a computer. It was undoubtedly necessary for plaintiffs to speak with AEB and ASW about the business repercussions of the alleged actions of Schatzberg and Finley. Plaintiffs have a close working relationship with AEB and ASW and the activities of faithless employees would be cause for alarm and discussion. These employees had substantial non-computer information, which had been gleaned from Schatzberg's trip to LK and his photocopying of AEB and ASW files. However, nothing in the two affidavits indicates that during these meetings computers were being investigated or repaired. In fact, one of the meetings took place at an expensive restaurant and another was strictly between Maerker, Placke and Buyuksoy, which eliminates the possibility that they were working with a computer technician or consultant. It is clear that these meetings were held to discuss the problem of the information of AEB and ASW getting into the hands of competitors. However, nothing suggests that the trips were taken to engage in any type of computer investigation or repair. Furthermore, no facts are alleged showing that preventive measures were added to the computers or that the system was augmented to tighten security — after all, these were discussions between senior executives — not computer experts. Placke states that the meeting was held at AEB's offices because of his belief in having meetings conducted in person. He does not suggest that the meetings were held at AEB so that he and Maerker could inspect or repair the computers.
In the related action, AEB has asserted that it incurred costs in investigating the unauthorized access and in making repairs, and has also asserted claims under the CFAA. However, Nexans LK do not allege that they were required to contribute to any such costs incurred by AEB, nor do they state that they paid technicians to conduct a computer investigation or make repairs to AEB's computers.
Plaintiffs do not cite any case which holds that the travel expenses of these senior executives constitutes "loss," and although there are very few opinions on the meaning of "loss" as ! used in § 1030(g), no case relies on costs so unrelated to the computer itself. Nothing in either case law or legislative history suggests that something as far removed from a computer as the travel expenses of senior executives constitutes "loss." Therefore, the international travel expenses that plaintiffs' senior executives incurred to attend a meeting with their customer's senior executive, in which no computers are said to have been examined, and no computer consultant said to have been present cannot satisfy the $5,000 "loss" requirement of the statute.
2. Lost Revenue
Finally, at oral argument, plaintiffs contended that the revenue they lost as a result of defendants' use of their information to unfairly compete for business constitutes "loss" within the meaning of § 1030(e)(11) and gives them standing under § 1030(g). Placke asserts that at trial, plaintiffs will be able to prove the loss of two specific business opportunities. However, plaintiffs state in a later submission, that they are not arguing that the revenue they lost as a result of the alleged unfair competition alone satisfies the CFAA's "loss" requirement. It is not clear whether plaintiffs continue to press their argument that revenue lost as a result of lost business opportunities may be counted toward the $5,000 threshold. Nevertheless, their argument is unpersuasive.
First, the "revenue lost" which constitutes "loss" under § 1030(e)(11) appears from the plain language of the statute to be revenue lost "because of [an] interruption of service." § 1030(e)(11). Therefore, if Nexans and LK had lost revenue because the computer systems of AEB and ASW were down, that would seem to be the type of lost revenue contemplated by the statute. However, plaintiffs are not claiming to have lost money because the computers of AEB or ASW were inoperable, but rather because of the way the information was later used by defendants.
Second, persuasive authority suggests that plaintiffs' lost revenue due to lost business opportunity does not constitute "loss" under the statute. In Register.com, Inc. v. Verio, Inc., 126 F. Supp.2d 238, 252 n. 12 (S.D.N.Y. 2000), aff'd 2004 WL 103400 (2d Cir. 2004) the court examined a similar issue. The plaintiff claimed that the defendant's "end use" of information retrieved from its website allowed it to compete unfairly and that as a result plaintiffs lost business and goodwill. The plaintiff argued that this lost revenue should count toward the $5,000 threshold (then "damages"). The court found that if:
lost good will [sic] or business could provide the [$5,000 amount, however,] it could only do so if it resulted from the impairment or unavailability of data or systems. The good will losses cited by [the plaintiff] are not the result of harm addressed by 1030(a)(5)[(iii)]. How [the defendant] uses the data, once extracted, has no bearing on whether [defendant] has impaired the availability or integrity of [plaintiff's] data or computer systems in extracting it.
Thus, the court found that the loss of business due to defendants' eventual use of the information, rather than a loss of business because of computer impairment, was too far removed from computer damage to count toward the jurisdictional threshold.
Lastly, the cases on which plaintiffs rely are not persuasive. InFour Seasons Hotels and Resorts BV v. Consorcio Barr, S.A., 267 F. Supp.2d 1268 (S.D. Fla. 2003), the court made an explicit finding that the hotel: "suffered `loss' under the statute of $28,000 in expenses incurred in investigating and responding to these offenses, which occurred within a one-year period." Id. at 1324. Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc., 119 F. Supp.2d 1121 (W.D. Wash. 2000), stands only for the proposition that an employer can state a claim against a faithless former employee even where the computer data was not physically impaired. The Shurgard court was not considering whether the $5,000 threshold had been met.Id. In sum, revenue lost because the information was used by the defendant to unfairly compete after extraction from a computer does not appear to be the type of "loss" contemplated by the statute.
Plaintiffs do not cite any case which lends support to finding a "loss" of $5,000 based on (1) travel costs of senior executives or (2) loss of revenue unrelated to interruption of computer service. Therefore, defendants' motion for summary judgment dismissing plaintiffs' five claims under the CFAA is granted.
V. Plaintiffs' State Law Claims
Plaintiffs also assert state law claims for misappropriation of trade secrets under New York and North Carolina law, unfair competition under New York, North Carolina and South Carolina law, and tortious interference with prospective economic advantage and conversion under New York law. Supplemental jurisdiction over these claims is appropriate since they arise out of the same nucleus of operative facts as the federal claims. United Mine Workers v. Gibbs, 383 U.S. 715, 725 (1966). Now that the federal claims have been dismissed, the exercise of supplemental jurisdiction over the state law claims is discretionary. 28 U.S.C. § 1367(c)(3); Gibbs, 383 U.S. at 726 (noting that judicial economy, convenience, and fairness are the factors to be balanced in deciding whether to exercise supplemental jurisdiction). Given the substantial overlap of issues, claims, and parties in this action and the closely related case, A.E.B. International, Inc. v. Schatzberg et al., 02 Civ. 6312 (MGC), it would be wasteful and inefficient to dismiss the state law claims in this action. Therefore, I exercise my discretion to retain jurisdiction over plaintiffs' state law claims.