Summary
denying injunction where plaintiff failed to show sufficient risk of irreparable harm, given (among other things) absence of evidence of actual harm in preceding two years
Summary of this case from Yazam, Inc. v. D.C. Dep't of for-Hire VehiclesOpinion
Case No. 6:13-cv-01392-JTM
02-05-2016
Tank Connection, LLC, Plaintiff, v. John R. Haight, Defendant.
Holly M. Perkins, Joseph, Hollander & Craft, LLC, Topeka, KS, Stephen M. Joseph, Ross A. Hollander, Joseph, Hollander & Craft, LLC, Wichita, KS, for Plaintiff. Christopher F. Burger, Jeffrey L. Heiman, Stevens & Brand, LLP, Lawrence, KS, Thomas D. Haney, Stevens & Brand, LLP, Topeka, KS, for Defendant.
Holly M. Perkins, Joseph, Hollander & Craft, LLC, Topeka, KS, Stephen M. Joseph, Ross A. Hollander, Joseph, Hollander & Craft, LLC, Wichita, KS, for Plaintiff.
Christopher F. Burger, Jeffrey L. Heiman, Stevens & Brand, LLP, Lawrence, KS, Thomas D. Haney, Stevens & Brand, LLP, Topeka, KS, for Defendant.
MEMORANDUM AND ORDER
J. THOMAS MARTEN, JUDGE
Plaintiff Tank Connection, LLC, brought this action against a former employee, John Haight, claiming that when Haight left its employment and went to work for a competitor he improperly took confidential information from Tank Connection's computer files. Plaintiff asserts claims for breach of contract, violation of the Kansas Uniform Trade Secrets Act, breach of a common law duty of loyalty, and violation of the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030. Haight denies the allegations. The matter is now before the court on Haight's motion for summary judgment, which argues there is no genuine issue as to any material fact and that Haight is entitled to judgment as a matter of law on all claims. (Dkt. 152).
I. Uncontroverted Facts
The court finds the following facts to be uncontroverted for purposes of the motion for summary judgment.
Tank Connection designs, manufactures, installs and services above-ground storage tanks. John Haight began working for Tank Connection in 2008. He had no prior experience in the industry. Haight signed a “Non-Disclosure Agreement” on July 28, 2008, pursuant to which he promised: “That I personally shall observe the strictest secrecy with respect to all proprietary information that I have been exposed to,” and “[t]hat I personally will not disclose to third parties the materials mentioned above unless prior written consent is given by TANK Connection.” He was also given an employee handbook. The parties did not have a non-compete agreement.
In the normal course of employment at Tank Connection, employees (including Haight) regularly accessed the company's servers both through on-site computers and remotely through secured connections. Employees' access normally and regularly included reading information in the public shared folders on the servers and copying documents to computer hard drives and portable flash drives (also referred to as thumb drives or USB devices). Tank Connection knew of such conduct and consented to it. Some of the flash drives used by Haight belonged to Tank Connection and some belonged to Haight. Haight's job involved frequent travel with a laptop computer and flash drives and he often took these items home at night.
Tank Connection had about 300 employees. Each employee's computer was password protected. Access to data on the server was controlled by user-account privileges (Microsoft Active Directory). The user accounts were set up with standard authentication practices including user name and password.
Haight's position with Tank Connection was International Sales Manager. Throughout his employment, Haight and other employees accessed Tank Connection's server on a regular basis and downloaded information on flash drives as was necessary in the performance of their duties.
Tank Connection shared some information with its customers without having them sign a non-disclosure agreement. Some of the information that Tank Connection now claims as confidential would have been known to its customers, such as pending jobs, pricing information, and customer purchasing history. The information shared with customers did not include Tank Connection's pricing margins, equity partner information, employee bonus information, corporate strategy, staff meeting notes, personnel files, and business plans with detailed financial information.
Haight testified that a “head hunter” contacted him about a month before he left Tank Connection and, as a result, he began discussions with a competitor, USA Tank Sales & Erection Company (“USA Tank”), about working for that company. On August 22, 2013, Haight received several emailed documents from USA Tank, including that company's vision statement, dental plan summary, employee benefits brochure, and non-disclosure and non-compete agreements. On August 23, 2013, Haight received an email from USA Tank setting forth its compensation package. On or about September 6, 2013, USA Tank emailed Haight a conditional offer for employment as Director of International Sales & Business Development. The offer was effective up until September 23, 2013.
By September 11, 2013, USA Tank had established a company email address and cell phone number for Haight. That information was emailed to Haight on September 12, 2013, at 7:55 a.m.
On the morning of September 12, 2013, Haight attempted to renegotiate his compensation and terms of employment with Tank Connection. After those negotiations failed, Haight submitted his resignation around 8:30 a.m. Haight testified that he had drafted his resignation letter on his home computer a day or two earlier. Haight left his Tank Connection laptop computer in his office along with several flash drives. (Dkt. 151 at 3). These items have been in the possession of Tank Connection or its expert since Haight left Tank Connection's employment.
Tank Connection attempts to controvert this fact although it stipulated to it in the pretrial order.
Tank Connection contacted Haight several days after his resignation and told him that all company property should be returned. In response, Haight deleted any and all remaining Tank Connection information from his personal flash drives, collected any items in his possession that could be considered property of Tank Connection, including promotional materials and three company flash drives, and placed those items in a paper bag. He gave the bag to a Tank Connection employee to return to the company. Haight had also previously returned another company flash drive, making a total of at least four that he returned within a few days of his resignation.
Tank Connection searched the laptop and the four flash drives returned by Haight prior to sending these items to a forensic expert. Tank Connection hired forensic expert Lanny Morrow, of BKD, LLP, to examine the laptop used by Haight during his employment with Tank Connection to see if it contained “evidence of data harvesting.” In the course of that examination Morrow also reviewed the four flash drives that Haight turned in after his resignation.
Haight brought four additional flash drives to his deposition on November 21, 2013. Two of these drives were Haight's personal property and two were given to Haight by his new employer, USA Tank. These four flash drives were subsequently examined by John Mallery, a computer forensic specialist agreed upon by the parties. Mallery also examined the hard drive of the computer that Haight used in his new employment with USA Tank. The examination of the hard drive showed no evidence of any Tank Connection proprietary information.
Early on in the case, the court granted a temporary restraining order and appointed a receiver for the purpose of preventing the loss or spoliation of data. Dkt. 8. Mallery was retained by the receiver as a forensic expert. In both that order and in a subsequent preliminary injunction, which was agreed to by the parties, the court ordered Haight and USA Tank to refrain from using and to turn over to the receiver any property of Tank Connection, to turn over an image of any USA Tank hard drives accessed by Haight, and for Haight to turn over any storage media in his possession. Dkt. 42.
Tank Connection generally attempted to keep the following information confidential: pending major projects (“Hot Lists”); pricing margins and goals; equity partner information; detailed customer lists with purchasing history and other information; employee bonus information; corporate strategy; staff meeting notes; and personnel files. This information helps Tank Connection to compete and could potentially be used by competitors to Tank Connection's detriment.
The “Hot List” contains a list of potential projects that are expected to close within thirty days. Information in the list may include customer names, projected cost of materials, installation and equipment, and the projected close date.
Tank Connection also used computer programs for design and pricing. The programs are not well explained in the briefs, but as their names suggest they were apparently used by Tank Connection to design and price tank systems. Tank Connection asserts that the programs are “uniquely detailed and complex,” and that the design program was developed solely by Tank Connection and contains “unique design methods, techniques, and information.” These amorphous descriptions do little to show the nature of these programs or whether they are truly unique in the industry, and the company's further assertion that these programs have a value of $1.2 million—which Tank Connection seeks as damages—is not supported by any meaningful explanation. See Dkt. 154 at 9 (“This information is valued at $1.2 million because both the pricing and design programs were created, developed, and continuously updated by Tank Connection.”).
Laptop examination. Forensic expert Lanny Morrow examined the laptop that Haight used at Tank Connection. The following is a summary of his findings, which the court accepts as true for purposes of the motion for summary judgment. A laptop user—one may reasonably infer it was Haight—accessed numerous directories and files on September 11, 2013. Some of these files were on the laptop and some were on the Tank Connection server. This activity occurred between the times of 1:07 p.m to 5:29 p.m., and 8:40 p.m. to 10:58 p.m.
A removable USB device with a serial number ending in 1050 was attached to the laptop at 5:29 p.m. and again at 10:06 p.m. After the connection of the USB at 10:06 p.m., Haight accessed various files and directories from the device after they were copied from the laptop. The accessed files included a “Resignation.docx” file created on the USB at 10:06 p.m. A directory entitled “Business Plans, Budgets, Ect” was created on the USB at 10:41 p.m. A directory by that same name also exists on the laptop. The latter directory had been created on August 21, 2012. A file within the “Business Plans” directory entitled “2013 TC International Business Plan.docx” was also created on the USB at 10:44 p.m. A file by that same name exists on the laptop. The latter file had been created on March 28, 2013.
In addition to the foregoing files and directories accessed from the laptop, Haight also accessed various directories or files on the Tank Connection server. Among the latter was a directory titled “Sales Stuff” and a file titled “contacts.pst,” which contained information on 276 contacts.
Morrow determined that the serial number of the USB used on the evening of September 11, 2013, does not match any of the four USB devices that Haight returned to the company after his resignation. The USB device used that evening remains unaccounted for. Tank Connection does not maintain an inventory of its flash drives, nor has it attempted to determine if the USB used on the evening of September 11, 2013, is among the other flash drives in its possession.
Morrow's opinion is that the connection of the USB device on Haight's final day of employment, in tandem with “mass accessing” of directories and files that are represented as proprietary by Tank Connection, “is indicative of the harvesting of data from Tank Connection by the user of the Haight hard drive.”
Tank Connection's president, Vince Horton, had a personal “Home” folder set up on the company's file server. It contained directories or folders named “Business Plans, Budgets, Ect,” “Sales Stuff,” and “2013 TC International Business Plan.docx,” all of which contained confidential information. Horton's folder was supposedly set up so that it was accessible only to Horton and a network administrator. But when the company changed servers on March 9, 2013, the security settings were incorrectly set, with the result that, unbeknownst to Horton, his Home folder could be accessed by other Tank Connection employees, including Haight.
Haight testified in his deposition that, a few days before his resignation, a coworker told him there was “some interesting stuff on the server.” He was referring to the information in Horton's Home folder, which was in a directory or folder named “User Shared Documents.” Haight admits that he looked at the files in the folder, which included information on possible “strategic partners” [i.e. other companies who might invest in, work with, or buy out Tank Connection ] and details on employee salaries and bonuses.
Tank Connection paid BKD $33,386.25 for Lanny Morrow's forensic examination of the laptop. It paid Mallery Technical Training and Consulting $5,187.50 for John Mallery's forensic examination of the flash drives produced by Haight at his deposition.
II. Summary of Arguments
Haight's motion for summary judgment asserts a number of arguments. First, Haight contends that the opinions of Tank Connection's forensics expert (Morrow) are conclusory and based on nothing more than ipse dixit. Moreover, Haight claims that Tank Connection refused in discovery to provide him with “the source data” underlying Morrow's conclusions. Haight argues that this “refusal to participate” in discovery, as he puts it, warrants the drawing of an adverse interest against Tank Connection and that, when considered with the lack of support for Morrow's opinions, warrants summary judgment in his favor. Dkt. 153 at 11.
Haight's second argument claims that Tank Connection has produced no evidence that he has or likely will disclose any confidential information. He argues judgment must be entered in his favor to the extent the claims are based on an allegation that he has disclosed or will disclose proprietary information. Id. at 12.
Haight next claims that Tank Connection has produced no evidence that its design and pricing programs have any economic value, or that Haight has disclosed or damaged the programs in any way. Haight argues that Tank Connection's claim for damages is based on pure speculation. Id. at 13.
Fourth, Haight argues that the breach of contract claim fails because Tank Connection cites no evidence that Haight violated the parties' non-disclosure agreement. He argues there is no evidence that he accessed any proprietary information beyond the needs of his employment and that, even if he did access or “harvest” such information, doing so did not violate the non-disclosure agreement and caused Tank Connection no damages. Additionally, Haight argues that the non-disclosure agreement terminated when his employment relationship ended.
Fifth, Haight argues that the claim under the Kansas Uniform Trade Secrets Act (KUTSA) fails, because the record contains no evidence that the information he allegedly misappropriated had independent economic value; because there is no evidence that the information was not generally known by third parties; because Tank Connection failed to take reasonable steps to maintain the secrecy of the information; and because there is no evidence that Haight “misappropriated” any information within the meaning of the Act.
Sixth, Haight contends the claim under the Computer Fraud and Abuse Act (CFAA) fails because there is no evidence that he took information without permission from the server; there is no evidence that he exceeded his authorization to access the server; and no evidence that Tank Connection reasonably incurred any loss as a result of a violation by Haight. As for Tank Connection's argument that its payment to forensic expert Morrow constituted loss, Haight argues that Morrow was hired for purposes of litigation and not to determine how Haight obtained proprietary information or to mitigate damage or risk associated with a potential breach.
Finally, Haight's seventh argument challenges Tank Connection's claim for breach of a duty of loyalty. Haight argues any such claim is duplicative of and preempted by the Kansas Uniform Trade Secrets Act (KUTSA). He also argues the claim fails for reasons previously stated, i.e., due to an absence of evidence that he wrongfully accessed information or that Tank Connection was damaged as a result.
III. Summary Judgment Standards
“A party may move for summary judgment, identifying each claim or defense—or the part of each claim or defense—on which summary judgment is sought.” Fed.R.Civ.P. 56(a). Summary judgment is proper if “the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed.R.Civ.P. 56(a). The court must view the evidence and all reasonable inferences in the light most favorable to the nonmoving party. LifeWise Master Funding v. Telebank, 374 F.3d 917, 927 (10th Cir.2004). “The movant bears the initial burden of making a prima facie demonstration of the absence of a genuine issue of material fact and entitlement to judgment as a matter of law.” Thom v. Bristol–Myers Squibb Co., 353 F.3d 848, 851 (10th Cir.2003) (citing Celotex Corp. v. Catrett, 477 U.S. 317, 322–23, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986) ). An issue of material fact is genuine “if the evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986).
The party resisting summary judgment may not rely upon mere allegations or denials contained in its pleadings or briefs. Id. at 256, 106 S.Ct. 2505. Rather, it must come forward with specific facts showing the presence of a genuine issue of material fact for trial and significant probative evidence supporting the allegation. Id. Summary judgment may be granted if the nonmoving party's evidence is merely colorable or is not significantly probative. Id. at 249–50, 106 S.Ct. 2505. Once the moving party has carried its burden under Rule 56, the party opposing summary judgment must do more than simply show that there is some metaphysical doubt as to the material facts. Matsushita Elec. Indus. Co., Ltd. v. Zenith Radio Corp., 475 U.S. 574, 586, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986). “In the language of the Rule, the nonmoving party must come forward with ‘specific facts showing that there is a genuine issue for trial. ’ ” Id. at 587, 106 S.Ct. 1348 (quoting Fed.R.Civ.P. 56(e) ) (emphasis in Matsushita ). One of the principal purposes of the summary judgment rule is to isolate and dispose of factually unsupported claims or defenses, and the rule should be interpreted in a way that allows it to accomplish this purpose. Celotex Corp. v. Catrett , 477 U.S. 317, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). IV. Analysis
1. Breach of contract . In the parties' non-disclosure agreement, Haight promised to “observe the strictest secrecy” with respect to all proprietary information he has been exposed to and that he will “not disclose [it] to third parties” without consent. The court finds that Tank Connection has failed to cite evidence from which a reasonable jury could conclude that Haight breached these promises. Insofar as Tank Connection's contract claim is based upon an allegation that Haight disclosed its proprietary information to USA Tank, there is no basis in this record other than speculation for a jury to make such a finding. There is clearly no direct evidence that Haight disclosed the information. Nor do the circumstances reasonably warrant such an inference. Tank Connection cites no evidence that USA Tank was able to poach Tank Connection's customers or employees after Haight began working there, that it was able to use inside knowledge to underbid Tank Connection on projects, that it began using methods formerly unique to Tank Connection, or that it otherwise did anything to suggest that it was in possession of Tank Connection's proprietary information. While it might be reasonable to infer that Haight likely copied some proprietary information just prior to his departure, and further that he did so with a possible view of improperly using this information in his work at USA Tank, the record is simply void of any evidence that he actually disclosed such information to USA Tank or that he (or USA Tank) used it to Tank Connection's disadvantage. The mere possibility that Haight might have done so is not enough to permit a judgment against him for breaching a promise not to disclose the information. Tank Connection must cite some evidence reasonably tending to suggest that he disclosed the information.
Tank Connection argues that Haight breached the agreement by “accessing and harvesting” proprietary information. Dkt. 154 at 36 (citing Atchison Casting Corp. v. Dofasco, Inc. , 889 F.Supp. 1445 (D.Kan.1995) ). But the parties' agreement (entitled “NON-DISCLOSURE AGREEMENT”) only prohibited Haight from disclosing proprietary information to third parties; it did not prohibit him from accessing it. And there is simply no evidence that he disclosed it. The Atchison case cited by Tank Connection only highlights the need for such evidence. In Atchison, evidence of improper disclosure arose from the fact that a purchaser of some of the defendant's assets was able to begin manufacturing a complex product in far less time than normal, suggesting it had been given access to defendant's trade secrets. The circumstances reasonably implied that the defendant had breached a promise to the plaintiff (a prospective purchaser of defendant's remaining assets) to preserve those trade secrets. Atchison , 889 F.Supp. at 1460. Cf. Musket Corp. v. Star Fuel of Okla . , LLC , 606 Fed.Appx. 439, 452 (10th Cir.2015) (“By bringing [plaintiff's] documents to [defendant], [employee] breached a non-disclosure agreement.”). The absence of any such evidence in this case precludes Tank Connection's claim for breach of the non-disclosure agreement.
2. Misappropriation of Trade Secrets . Haight challenges the trade secret claim on a number of grounds, but the court concludes that only his argument concerning damages need be addressed, because the lack of evidence that Tank Connection suffered actual or other compensable damages from the alleged misappropriation is dispositive of this claim.
The KUTSA provides that the damages which a complainant is entitled to recover for misappropriation of a trade secret “can include both the actual loss caused by misappropriation and the unjust enrichment caused by misappropriation that is not taken into account in computing actual loss.” K.S.A. § 60–3322(a). In lieu of those two methods, damages may alternatively be measured by imposition of a reasonable royalty “for a misappropriator's unauthorized disclosure or use of a trade secret.” Id.
Tank Connection claims three items of actual damage were caused by Haight's alleged misappropriation: a loss of $1.2 million, representing the value of the pricing and design programs allegedly copied by Haight; and the $33,386.25 and $5,187.50 payments made to BKD and Mallery Technical Consulting. The court concludes as a matter of law, however, that none of these items constitute actual loss from the claimed misappropriation.
As an initial matter, the court will assume that Tank Connection's price and design programs have some monetary value, even though the briefs offer no real explanation of what these programs contain or consist of, and even though the claimed value of $1.2 million is not substantiated by the record. But what actual loss resulted from the fact that Haight may have copied these items onto a flash drive shortly before he resigned or from the fact that he allegedly retained them? Tank Connection was not deprived of the programs and they were not damaged in any way. There is no evidence that the programs were actually given to USA Tank or that Haight or USA Tank have used them in any way to unfairly compete against Tank Connection. This is not a question, as Tank Connection intimates, of allowing recovery notwithstanding that “damages may be difficult to ascertain.” Dkt. 154 at 34. The problem is that there is no evidence of damages. What basis would a jury have for calculating a loss from Haight's access to the price and design programs? There is not the slightest evidence that Haight's alleged actions with respect to these programs (which, by the way, Haight apparently routinely copied and worked with in the course of his employment at Tank Connection) have caused any actual monetary loss to Tank Connection. Nor would a judgment for unjust enrichment be permissible under the evidence cited. Nothing is cited to suggest that Haight (or USA Tank) has been enriched in any way by his alleged acquisition and retention of the programs. Finally, the statutory alternative of damages in the form of a reasonable royalty is not appropriate, as that remedy is available only for unauthorized “disclosure or use of a trade secret,” and no evidence is cited that Haight disclosed or used the price and design programs. See InnoSys, Inc. v. Mercer , 364 P.3d 1013, 1028–30, 2015 WL 5090452, *13–14 (Utah, Aug. 28, 2015) (summary judgment on damages properly granted where there was no evidence that defendant suffered loss from employee's retention of proprietary material).
Tank Connection does not address Haight's allegation that these programs cannot be used without ongoing access to the Tank Connection server.
The payments by Tank Connection to BKD and Mallery Consulting stand on a somewhat different footing, because these expenses were incurred by Tank Connection for reasons that were related to Haight's conduct. But the question is whether they constitute “actual loss caused by misappropriation ” under K.S.A. § 60–3322. The court finds no Kansas authority on this question, while other jurisdictions interpreting the Uniform Trade Secrets Act have adopted differing treatment of such costs, as shown by News Am. Mktg. In – Store, Inc. v. Marquis , 86 Conn.App. 527, 535–36, 862 A.2d 837, 843 (2004) aff'd, 276 Conn. 310, 885 A.2d 758 (2005), and 21st Century Sys., Inc. v. Perot Sys. Gov't Servs., Inc. , 284 Va. 32, 48–49, 726 S.E.2d 236, 245 (2012).
In News Am. Mktg., an appellate court affirmed a trial ruling that the expense of examining a former employee's computer, when the employee was suspected of taking trade secrets, was essentially a litigation expense and was not compensable:
It is a settled principle of our common law that parties are required to bear their own litigation expenses, except as otherwise provided by statute. [quotation marks and cite omitted] Actual damage is a necessary element that must be proven by the plaintiff to prevail on its trade secrets claim. To allow the plaintiff to characterize the cost of its own investigation of suspected wrongdoing as actual damages would effectively eliminate the plaintiff's burden of proving actual harm resulting from [defendant's] alleged violation of the trade secrets act. The [trial] court properly concluded that the plaintiff had failed to adduce evidence of actual loss as a result of [defendant's] conduct.
News Am. Mktg. , 862 A.2d at 846–47. By contrast, in 21st Century Systems the court affirmed a damage award for the cost of a computer forensic analysis. 21st Century Systems , 726 S.E.2d at 244. Among other things, the court cited testimony that the computer examination was undertaken shortly after the unexpected departure of several executives from a company and also after the company had learned that the executives were copying large amounts of company data and were continuing to coordinate with current company employees. Id. The court also noted that the invoices of the forensic expert were not objected to at trial and the defense offered no evidence from which the jury could have discounted or apportioned the damages. As such, the “evidence at trial was sufficient to demonstrate that the Defendant's actions caused [the company] to initiate the computer forensics examination and that the trial court did not err when it refused to set aside the jury's award....” Id. at 245.
In this case, the court concludes that the payments to BKD and Mallery resemble the expenses in News Am. Mktg. and are not properly considered an “actual loss caused by misappropriation.” These were investigative expenses incurred by Tank Connection based on its suspicions that Haight might have taken data. Tank Connection does not deny that it undertook the forensic investigation to ascertain if there had been any theft of its proprietary information and, if so, to demonstrate a basis for legal action against Haight. The court notes that plaintiff would have incurred the expenses regardless of the outcome of the examination—i.e., regardless of whether any misappropriation had occurred. Such expenses are not within the traditional realm of tort damages. As in News Am. Mktg., permitting the plaintiff to claim the cost of its own investigation as compensable damages would effectively eliminate the statutory requirement of “actual loss” for an actionable misappropriation. This was an attempt to find proof of data misappropriation, not a loss resulting from the misappropriation. The 21st Century Systems case is distinguishable both because the expenses in that case were not objected to and because they were incurred as part of a remedial effort to staunch what was known to be ongoing misappropriation of company data. In sum, because Tank Connection has failed to cite evidence of actual loss or other compensable damages resulting from Haight's alleged misappropriation, the court finds Haight is entitled to summary judgment insofar as Tank Connection seeks damages under the KUTSA.
In addition to damages, the KUTSA authorizes a court to enjoin “actual or threatened misappropriation.” K.S.A. § 60–3321(a). In the pretrial order Tank Connection requested “[i]njunctive relief barring Mr. Haight from further work in the above ground tank industry for a period of time appropriate to prevent further disclosure of information.” Dkt. 151 at 10. The evidence cited, however, will not support this requested relief. First, Tank Connection has cited no evidence of any prior disclosure or use of Tank Connection trade secrets by Haight. Second, the requested injunction is overly broad, as it would go beyond preventing improper disclosure of confidential trade secrets and would deprive Haight of his livelihood in the absence of any non-compete agreement between the parties. Third, Tank Connection fails to cite evidence showing a risk of current disclosure and/or harm sufficient to justify the requested injunction. It is has now been over two years since Haight left Tank Connection's employment. As noted above, no evidence of disclosure or actual harm from any improper use of proprietary information has been produced. A prior court-ordered examination of Haight's computer from USA Tank revealed no evidence of improper disclosure or use of trade secrets. Significantly, Tank Connection cites no evidence to show that a disclosure of information obtained by Haight over two years ago would still result in a commercial disadvantage to Tank Connection. It appears that all of the claimed trade secret materials were time-sensitive to one degree or another, such that any future disclosure of the materials would be unlikely to cause actual loss. For example, the court does not see how disclosure of Tank Connection's projects, customers, price margins, or strategic plans/partners from more than two years ago would allow a current competitor to gain an unfair advantage. As for Tank Connection's price and design programs, Tank Connection repeatedly claims these programs are “unique” but does not explain how that is so or how a competitor could exploit them. And as Tank Connection itself noted, these programs need to be “continuously updated,” suggesting that disclosure of a two-year old version of these programs would be unlikely to cause irreparable harm.
Although the request for an injunction is included in the pretrial order, the issue is not specifically raised in Tank Connection's summary judgment response.
For the foregoing reasons, the court concludes that Haight's motion for summary judgment on the claim for misappropriation of trade secrets should be granted.
3. Breach of the duty of loyalty . Due to the lack of evidence of actual loss, as discussed above, the court concludes that Haight is also entitled to summary judgment on Tank Connection's claim for breach of a duty of loyalty. In arguing otherwise, Tank Connection again cites its payments to forensic experts for computer examinations and Haight's alleged retention of its price and design programs. For reasons previously indicated, the court finds that none of these items show actual loss compensable as damages for Haight's alleged breach of the duty of loyalty. Tank Connection has not argued or shown grounds for other possible remedial measures, such as forfeiture of any monies paid to Haight, so the court need not address those issues. Cf. Bessman v. Bessman , 214 Kan. 510, 520 P.2d 1210 (1974) (agent is entitled to no compensation for conduct which is disobedient).
4. Computer Fraud and Abuse Act (CFAA) . Tank Connection contends Haight violated 18 U.S.C. § 1030(a)(2)(C) and (a)(4) by knowingly and intentionally accessing a protected computer without authorization or exceeding authorization and taking trade secret and confidential information. Dkt. 151 at 8. It seeks damages in the amount of the payments it made to BKD ($33,386.25) and Mallery Consulting ($5,187.50) for forensic computer examinations.
Section 1030(a)(2)(C) of Title 18 makes it a criminal offense to intentionally access a computer without authorization, or to exceed authorized access, and to thereby obtain information from any protected computer. A “protected computer” includes one which “is used in or affecting interstate or foreign commerce.” § 1030(e)(2)(B). The term “exceeds authorized access” means “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser [sic] is not entitled so to obtain or alter.” § 1030(e)(6).
Section 1030 allows a person who suffers damage or loss to maintain a civil action for compensatory damages against the violator if the offense caused loss to the victim of at least $5,000. See § 1030(g), (c)(4)(A)(i)(I). The statute defines “loss” to include “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the ... system ... to its condition prior to the offense, ...” § 1030(e)(11). “Damage” means “any impairment to the integrity or availability of data, a program, a system, or information.” § 1030(e)(8).
The foregoing provisions, as applied to this case, indicate that Tank Connection must prove each of the following elements to prevail on its CFAA claim. It must show: 1) that Haight exceeded his authorized access to a Tank Connection computer; 2) that he did so intentionally; 3) that by doing so he obtained information from the computer that he was not entitled to obtain; 4) that the computer was used in or affecting interstate or foreign commerce; and 5) that by doing so, Haight caused Tank Connection a loss of at least $5,000.
Among other things, Haight argues there is no evidence that he acted without authorization or that he exceeded his authorized access to Tank Connection's computer or server. Dkt. 153 at 20. Haight argues that his subjective intent is irrelevant to this inquiry (citing, inter alia, US Bioservices Corp. v. Lugo , 595 F.Supp.2d 1189 (D.Kan.2009) ), and that “the only question is whether [he] had authority to access Plaintiff's information.” Dkt. 153 at 20. He argues that Tank Connection simply sets forth an unsupported conclusion that he was not authorized to access certain information. Haight says he only accessed information that was on the server in public shared folders and that doing so was a regular part of his job.
The server would also be within the scope of the CFAA because the statute defines a “computer” to include “any data storage facility or communications facility directly related to or operating in conjunction with such [computer] device....” 18 U.S.C. § 1030(e)(1).
Tank Connection agrees that Haight's intent is irrelevant, Dkt. 154 at 49, but says “access to data on Tank Connection's servers is controlled by user account privileges (Microsoft Active Directory)” and that “there are areas on the servers that have restricted access based upon the privileges attached to a user account.” It contends that the folders of Vince Horton, which Haight allegedly accessed, “were not accessible to Mr. Haight or anyone else except upper management.” However, “during a server migration there was a security breach,” and Haight “apparently accessed those folders and files when he learned of the breach.” Dkt. 154 at 50.
The court first concludes that Haight is entitled to summary judgment on any claim that he accessed a computer “without authorization.” Although the statute does not define this particular term, courts have construed it to mean “without permission.” See Lugo , 595 F.Supp.2d at 1192 ; University Sports Publications Co. v. Playmakers Media Co. , 725 F.Supp.2d 378, 383 (S.D.N.Y.2010). The uncontroverted facts show that Tank Connection gave permission to Haight to access both the Tank Connection laptop and the server in connection with his employment.
The more difficult question is whether Haight “exceed[ed] authorized access.” Although some courts have held that this inquiry turns on a defendant's intent—such that an employee who accesses information for an improper purpose exceeds his authorized access—judges in this district have adopted the narrower and more prevalent view that the inquiry focuses on the objective grant of access by the employer, not on the defendant's intent. See Lugo , 595 F.Supp.2d at 1194–95 (“the court follows the line of cases that have rejected a reading of the CFAA by which the defendant's intent may determine whether he has acted without authorization or has exceeded his authorized access.”); Farmers Bank & Trust, N.A. v. Witthuhn , 2011 WL 4857926, *4 (D.Kan., Oct. 13, 2011) (the view that courts determine authorization based on the employer's decision to allow or terminate an employee's authorization has “recently gained critical mass”). For the reasons expressed in Lugo and Farmers Bank, the court finds the latter decisions to be the more persuasive interpretation.
The problem with Tank Connection's argument that Haight exceeded his authorized access is that it is premised upon a restriction that was supposed to be incorporated into its network settings, but which in fact was not. See Dkt. 154 at 50 (noting that but for the error “Mr. Horton's folder would have been restricted to Mr. Horton and the Network Admin account.”) [emphasis added]. Tank Connection intended for access to Horton's home folder to be restricted, but due to an apparent error by the network administrator or someone else, a number of employees, including Haight, were given access to the folder. Horton's folder was located in a directory that was labeled as public or shared and was in fact accessible to company account holders such as Haight for at least five months, according to the uncontroverted facts. Haight cites evidence that he and others, with Tank Connection's approval, regularly accessed the shared folders of other employees in the course of their work.
When an employee has been granted general authority to access a particular area of a computer or server, as was Haight, the fact that his employer had an unexpressed desire or intent to limit his access to a portion of that area does not establish unauthorized access within the meaning of § 1030. Tank Connection authorized Haight to access information in the shared folders. It cites no evidence that it ever conveyed to Haight or to others that they were restricted from accessing any information in the shared folders generally or from Horton's folder in particular. The fact that Tank Connection inadvertently provided Haight with access to the folder did not restrict or limit his authority. Cf. United States v. Valle , 807 F.3d 508, 525 (2nd Cir.2015) (invoking the rule of lenity and observing that “the legislative history consistently characterizes the evil to be remedied—computer crime—as ‘trespass' into computer systems or data, and correspondingly describes ‘authorization’ in terms of the portion of the computer's data to which one's access rights extend.”). Nor does the fact that Haight apparently accessed these folders for purposes contrary to Tank Connection's interests amount to evidence that he exceeded “authorized access.” Case law makes clear that the relevant question is whether he was authorized to access the area or the information, not whether he did so with an improper purpose in mind. Cf. Valle , 807 F.3d at 527. See also Lugo , 595 F.Supp.2d at 1194 (“The court follows the line of cases that have rejected a reading of the CFAA by which the defendant's intent may determine whether he has acted without authorization or has exceeded his authorized access.”). Under the uncontroverted facts, Tank Connection has failed to show a genuine issue as to whether Haight “exceed[ed] authorized access” within the meaning of § 1030(a)(2).
Valle invoked the rule of lenity in construing what is, after all, a criminal statute. It quoted the observations of the Ninth Circuit about the dangers of relying on a purpose-based definition of “authorized access”:
“[T]he government's proposed interpretation of the CFAA allows private parties to manipulate their computer-use and personnel policies so as to turn these relationships into ones policed by the criminal law. Significant notice problems arise if we allow criminal liability to turn on the vagaries of private policies that are lengthy, opaque, subject to change and seldom read. Consider the typical corporate policy that computers can be used only for business purposes. What exactly is a ‘nonbusiness purpose’? If you use the computer to check the weather report for a business trip? For the company softball game? For your vacation in Hawaii? And if minor personal uses are tolerated, how can an employee be on notice of what constitutes a violation sufficient to trigger criminal liability?”
Valle , 807 F.3d at 527 (quoting United States v. Nosal , 676 F.3d 854, (9th Cir.2012) ).
--------
IT IS THEREFORE ORDERED this 5th day of February, 2016, that defendant Haight's Motion for Summary Judgment (Dkt. 152) is GRANTED.