Opinion
CIVIL NO. 15-1082 (GAG)
03-10-2016
SUN WEST MORTGAGE COMPANY, INC., Plaintiff v. MIGUEL M. MATOS FLORES, Defendant.
OPINION AND ORDER
In this action, Plaintiff Sun West Mortgage Company ("Sun West") contends that its former employee, Defendant Miguel Matos Flores ("Matos") breached his employment agreement and made unauthorized disclosures regarding company trade secrets in violation of The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, et seq. ("CFAA"), the Stored Wire and Electronic Communications and Transactional Records Access Act, 18 U.S.C. §§ 2071-2712 et seq. (the "Stored Communications Act" or the "SCA"), and the Wire and Electronic Communication and Interception of Oral Communications Act, 18 U.S.C. §§ 2510-2522 et seq. (the "Wiretap Act"). (Docket No. 1 ¶¶ 36-58.) In addition to these federal claims, Sun West also contends that Matos violated various Puerto Rico laws, invoking diversity jurisdiction. Id. ¶¶ 1, 59-93.
Sun West asserts the following claims under Puerto Rico state law without providing citation to any specific statute or provision of the Civil Code: misappropriation of confidential information and trade secrets under the Puerto Rico Commercial and Industrial Secrets Protection Act; conversion; breach of employment agreements; breach of duty of loyalty; breach of implied contractual and legal duty. (Docket No. 1 at 13, 15-18.) These claims are not the subject of the instant motion to dismiss.
Presently before the Court is Matos' motion to dismiss the federal claims pursuant to FED. R. CIV. P. 12(b)(6) for failure to state a claim upon which relief can be granted. (Docket No. 25). Additionally, Matos requests jurisdictional discovery in order to ascertain whether the parties are completely diverse and Sun West's state law claims are properly before the Court. Id. at 17-18. I. Relevant Factual and Procedural Background
In the Complaint, Sun West also describes an incident in which Matos allegedly improperly interfered with a business transaction involving a Sun West client. (Docket No. 1 ¶¶ 25-35.) Because this alleged incident is immaterial to the motion to dismiss, the Court omits it from its recitation of the facts.
Sun West hired Matos as a loan officer on April 11, 2011. (Docket No. 1 ¶ 5.) He was responsible for "sourc[ing] prospective consumer borrowers" and signing them up for single-family loan mortgage packages. Id. ¶ 6. As a result of his position, Matos had access to Sun West's borrower, broker, customer and investors lists, contractual arrangements, lists of real estate agents, vendors, suppliers, and service providers that had contractual arrangements with Sun West, Sun West's pricing and financial structures, marketing programs and plans, operational methods and cost information, accounting procedures, and research and development. Id. ¶ 7. Pursuant to the Employment Agreement (the "Agreement"), Matos agreed not to "publish, disclose or allow to be published or disclosed, Trade Secrets to any person who is not an employee of Sun West unless such disclosure is necessary for the performance of Loan Officer's obligation under the Agreement." Id. ¶ 8.
Carlos Gaztambide is the Executive President of Multiples Mortgage Corp, a competitor of Sun West in Puerto Rico. (Docket No. 1 ¶¶ 14-15.) Sun West alleges that on December 5, 2014, Matos told Gaztambide that he wanted to refer a client to Multiples Mortgage and that he was unhappy at Sun West. Id. ¶¶ 15-16. Sun West also contends that Matos indicated he could set up a team of Sun West employees who would leave to join Multiples Mortgage. Id. ¶ 17. In an affidavit appended to the Complaint, Gaztambide states that he notified Matos that he would not hire anyone from Sun West without first speaking with Sun West's Executive Vice President Raul Padilla, and that Multiples Mortgage could not compensate any Sun West loan officers for referrals. (Docket No. 1-5 ¶¶ 5, 8.) Gaztambide also stated that after Matos complained that Sun West was not properly compensating loan originators, Gaztambide asked to see Sun West's pricing. Id. ¶ 10. Gaztambide states that Matos accessed this information on his telephone and showed it to him. Id. Gaztambide states that later that day, Matos contacted him again to request that he keep their conversation confidential. Id. ¶ 11.
Sun West alleges that Matos sent and downloaded to his personal e-mail account 270 transmissions containing Sun West's confidential information and trade secrets without authorization, though it has not determined if Matos reproduced or revealed any of this information. (Docket No. 1 ¶¶ 22-23.)
II. Standard of Review
When considering a motion to dismiss for failure to state a claim upon which relief can be granted, see FED. R. CIV. P. 12(b)(6), the court analyzes the complaint in a two-step process under the current context-based "plausibility" standard established by the Supreme Court. See Schatz v. Republican State Leadership Comm., 669 F.3d 50, 55 (1st Cir. 2012) (citing Ocasio-Hernández v. Fortuño-Burset, 640 F.3d 1, 12 (1st Cir. 2011) which discusses Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007)). First, the court must "isolate and ignore statements in the complaint that simply offer legal labels and conclusions or merely rehash cause-of-action elements." Id. A complaint does not need detailed factual allegations, but "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Iqbal, 556 U.S. at 678-79. Second, the court must then "take the complaint's well-[pleaded] (i.e., non-conclusory, non-speculative) facts as true, drawing all reasonable inferences in the pleader's favor, and see if they plausibly narrate a claim for relief." Schatz, 669 F.3d at 55. Plausible, means something more than merely possible, and gauging a pleaded situation's plausibility is a context-specific job that compels the court to draw on its judicial experience and common sense. Id. (citing Iqbal, 556 U.S. at 678-79). This "simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence of" the necessary element. Twombly, 550 U.S. at 556.
"[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged—but it has not 'show[n]'—'that the pleader is entitled to relief.'" Iqbal, 556 U.S. at 679 (quoting FED. R. CIV. P. 8(a)(2)). If, however, the "factual content, so taken, 'allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged,' the claim has facial plausibility." Ocasio-Hernández, 640 F.3d at 12 (quoting Iqbal, 556 U.S. at 678).
III. Legal Analysis
In the motion to dismiss, Matos argues that "the bare assertion that the[ ] 270 emails sent to his personal email were trade secrets is insufficient to state a claim under CFAA, SECA or the Wire Tap Act." (Docket No. 25 ¶ 4.3.) The Court will address each in turn.
A. The Computer Fraud and Abuse Act
The CFAA provides a civil remedy for victims who suffer damages in excess of $5,000 as a result of an individual who "knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access" in furtherance of fraud. 18 U.S.C. § 1030(a)(4). Accordingly, to state a claim under the CFAA, Sun West must demonstrate that Matos accessed a protected computer "without authorization" or that he "exceeded" his "authorized access" in order to commit a fraud. Id. Despite the CFAA's expansive language, the statute was not intended to criminalize "benign activities such as workplace procrastination." Advanced Micro Devices, Inc. v. Feldstein, 951 F. Supp. 2d 212, 218 (D. Mass. 2013) (citing United States v. Nosal, 676 F.3d 854, 866 (9th Cir. 2012)).
The term "without authorization" is not defined by the statute and courts have split on whether to take a broad or narrow view of the language. Advanced Micro Devices, Inc, 951 F. Supp. 2d at 217-18 (describing CFAA interpretations). The narrow interpretation of the CFAA holds that the term "without authorization" only reaches conduct by outsiders who did not have permission to access the plaintiff's computer. E.g., Shamrock Foods v. Gast, 535 F. Supp. 2d 962, 967 (D. Ariz. 2008). This interpretation of the statute would preclude a claim under the CFAA by an employer against its employee. Conversely, the broad view allows for an employer's CFAA claim against an employee who accesses a computer whenever he, without the employer's knowledge, "acquires an interest that is adverse to that of his employer or is guilty of a serious breach of loyalty." Guest-Tek Interactive Entm't, Inc. v. Pullen, 665 F. Supp. 2d 42, 45 (D. Mass. 2009) (analyzing CFAA interpretations). Although the First Circuit has not specifically addressed the meaning of "without authorization" or "exceeded authorization," it has favored a broader reading of the statute. Id. at 45 (citing EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 582-84 (1st Cir. 2001)).
In EF Cultural, the First Circuit permitted an employer's claim pursuant to the CFAA against employees who collected pricing information from the employer's website in order to develop a competing business with lower prices. In Guest-Tek, the court found that the EF Cultural court held that the employees' reliance on the pricing information "reeked of use - and indeed, abuse - of proprietary information that goes beyond any authorized use of EF's website." Guest-Tek Interactive Entm't, Inc., 665 F. Supp. 2d at 45
Even under a broad interpretation of the statute, Sun West failed to satisfy the Twombly and Iqbal pleading requirements as to the CFAA claim. Sun West's allegation that Matos forwarded information to his personal e-mail account, sending 270 transmissions, is insufficient to state a claim. Sun West specifically does not allege that he copied, revealed to third parties, or reproduced any information, proprietary or otherwise. (Docket No. 1 ¶ 23.) Sun West also does not allege that Matos sent such emails with "intent to defraud," in furtherance of a fraud, or that he obtained anything of value. 18 U.S.C. § 1030(a). Similarly, Sun West's allegation that Matos showed confidential pricing information to Gaztambide on his telephone is insufficient to support an inference that he accessed a Sun West computer without authorization, or in excess of his authorization, absent allegations he did so in furtherance of a fraud. At most, the Court interprets this alleged incident as an attempt to justify his desire to leave Sun West to Gaztambide, who expressed skepticism that Matos was being mistreated by Sun West. (Docket No. 1-5 ¶ 10.)
Sun West's claim under the CFAA also fails to satisfy the damages requirement. The CFAA defines damage as "any impairment to the integrity or availability of data, a program, a system or information . . . ." 18 U.S.C. § 1030(e)(8). This language does not encompass any harm resulting from the disclosure to a competitor of trade secrets or other confidential information. Courts have interpreted this to include "the destruction, corruption, or deletion of electronic files, the physical destruction of a hard drive, or any diminution in the completeness or usability of the data on a computer system." E.g., New South Equip. Mats, LLC v. Keener, 989 F. Supp. 2d 522, 529 (S.D. Miss. 2013) (finding that mere copying of electronic information is not enough to satisfy the CFAA's damage requirement). Although the First Circuit has not limited "loss" under the statute to purely physical damages, the statute does not permit claims for matters unrelated to the computer. See Shirkov v. Dunlap, Grubb & Weaver, PLLC, No. 10-12043, 2012 WL 1065578, at *24 (D. Mass. Mar. 27, 2012).
Sun West asserts that its damages include "the hiring of a forensic computer examiner to determine the scope of Matos' breach and a damages assessment; the hiring of counsel to bring this legal action; the management's time necessary for addressing, responding to and remediating Matos' wrongdoings; and the value of the information Matos retrieved from the Sun West premises." (Docket No. 1 ¶ 41.) These damages are not sufficient to trigger the CFAA. Courts have held that legal fees do not constitute a loss under the CFAA. Wilson v. Moreau, 440 F. Supp. 2d 81, 109-10 (D.R.I. 2006). Similarly, management's time spent evaluating whether Matos' conduct is actionable is not recoverable under the CFAA. Id. The value of information Matos may have retrieved from Sun West is speculative at best because Sun West concedes it has no basis to believe Matos "copied, revealed to third parties [or] reproduced" any of this information. (Docket No. 1 ¶ 23.) Sun West does not allege that its computers or network were out of commission or damaged in any way. Neither does Sun West contend that it incurred costs repairing its computers. Thus, the motion to dismiss Sun West's claim pursuant to the CFAA is hereby GRANTED.
B. The Stored Communications Act
The SCA prohibits an individual from intentionally accessing, without authorization, a facility that provides an electronic communication service or exceeding an authorization to access that facility, and thereby obtaining, altering or preventing authorized access to a wire or electronic communication while it is in electronic storage in such system. 18 U.S.C. § 2701(a). Under the statute, "any person aggrieved" by knowing and intentional conduct that violates the SCA has a private right of action. 18 U.S.C. § 2707(a). An aggrieved person is one who was a party to an intercepted electronic communication, or against whom the interception was directed. Padmanabhan v. Healey, No. 15-13297, 2016 WL 409673, at *3 (D. Mass. Feb. 2, 2016).
Since the SCA was established in 1986, courts have struggled with the same language at issue under the CFAA, namely "access without authorization" and "exceed [ ] an authorization to access" a facility. Cheng v. Romo, No. 11-10007, 2012 WL 6021369, at *3 (D. Mass. Nov. 28, 2012). As with the CFAA, the First Circuit has not directly addressed the meaning of these terms under the SCA; however, courts in the First Circuit have consistently applied CFAA caselaw in analyzing the SCA. Id. at *4 (citing Guest-Tek Interactive Entm't, Inc. v. Pullen, 665 F. Supp. 2d 42 (D. Mass. 2009)). Thus, the Court's analysis under this statute is the same as under the CFAA. The Complaint fails to allege sufficient facts to support an inference that Matos obtained, altered, or prevented authorized access to a wire or electronic communication. The mere assertion that he sent Sun West's confidential information and trade secrets to his personal e-mail account, without more, does not satisfy the Plaintiff's pleading requirements under Twombly and Iqbal. The motion to dismiss Sun West's claim pursuant to the SCA is GRANTED.
C. The Wire and Electronic Communication and Interception of Oral Communications Act
Without providing citation to a specific chapter or provision of the U.S. Code, Sun West claims that "Matos' actions were in violation of the Wiretap Act, which entitles Sun West to recover damages (compensatory and punitive) costs and attorneys' fees against Matos and injunctive relief to enjoin Matos from further violating the Wiretap Act." (Docket No. 1 ¶ 58.) 18 U.S.C. § 2511 prohibits any person from intentionally intercepting, endeavoring to intercept, or procuring any other person to intercept any wire, oral or electronic communication. It also prohibits disclosure and intentional use of information or the contents of such communications. Id. Under the statute, "intercept" is the "acquisition of the contents of any . . . electronic communication . . . through the use of any electronic, mechanical or other device." 18 U.S.C. § 2510(4).
To prevail under this statute, a plaintiff must demonstrate that the defendant "acted with the purpose of committing a criminal or tortious act other than the recording of the communication itself." Vazquez-Santos v. El Mundo Broad. Corp., 283 F. Supp. 2d 561, 566-67 (D.P.R. 2003) Similarly, "a disclosure or use of the contents of any intercepted communication is only unlawful if the person knows or has reason to know that the interception was illegal." Id. at 566-67. Importantly, the Wiretap Act permits interception of electronic communications if consent is given by at least one of the parties to the communications. United States v. Bennett, 538 F. Supp. 1045, 1047-48 (D.P.R. 1982).
In this case, Sun West has not specified which factual allegations in its Complaint support this claim. To the extent Sun West bases this claim on its allegations regarding the "270 transmissions to [Matos'] personal email from Sun West's information computer system," Sun West offers nothing to support its claim under the Wiretap Act that Matos acted with a criminal or tortious intent. (Docket No. 1 ¶ 22.) Sun West presents exclusively conclusory statements that support only a threadbare recitation of the elements of a claim. Allegations that Matos "intercepted the confidential information with a tortious intent" and that he "intends to benefit economically from the confidential information he intercepted" are insufficient to satisfy the pleading requirements. These allegations do not allow the Court to infer more than a mere possibility of misconduct, and thus, do not support a reasonable inference that Sun West is entitled to relief under the Wiretap Act. The motion to dismiss this claim is GRANTED.
IV. Conclusion
In sum, the Court GRANTS Defendant's motion to dismiss the federal claims under CFAA, the Stored Communications Act, and the Wiretap Act. These claims are DISMISSED with prejudice. Judgment shall be entered accordingly.
Additionally, because the only remaining claims are based on Puerto Rico state law, the Court GRANTS Defendant's motion for jurisdictional discovery. In order to remain in this Court, Plaintiff has the burden to establish diversity jurisdiction pursuant to 28 U.S.C. § 1332 by demonstrating that the parties are completely diverse and the amount in controversy of the remaining state law claims exceeds $75,000. The parties shall conduct jurisdictional discovery which shall conclude on or before May 1, 2016. No extensions will be allowed. The parties, on or before March 18, 2016 shall agree to a jurisdictional discovery timetable and file a joint informative motion. A renewed motion to dismiss for lack of subject matter jurisdiction shall be filed on or before May 20, 2016, and, if the same is not filed an answer to the complaint shall be filed within the same date.
The Court notes that, according to the Complaint, Sun West is a California corporation authorized to do business in Puerto Rico and Matos is a "resident" of Puerto Rico. (Docket No. 1 ¶ 3.) Thus, Plaintiff must inform the Court of its principal place of business so that the Court can determine its citizenship. Similarly, Defendant shall inform the Court whether he is a citizen of Puerto Rico. Finally, Plaintiff must demonstrate that the remaining claims meet the amount in controversy.
SO ORDERED.
In San Juan, Puerto Rico this 10th day of March, 2016.
s/ Gustavo A. Gelpí
GUSTAVO A. GELPI
United States District Judge