Summary
holding that in order to state a claim under the CFAA the information must be of value, which the court defined as "relative to one's needs and objectives."
Summary of this case from Satcom Solution & Res. LLC v. PopeOpinion
No. 07-1007.
September 17, 2007.
Appeal from the United States District Court for the District of Colorado.
John K. Shunk and David Warren Feeder, II, Messner Reeves, Denver, CO, for Plaintiff-Appellant.
Thomas Joseph Arckey, Arckey Reha, LLC, Littleton, CO, for Defendant-Appellee.
Before PORFILIO, ANDERSON, and BALDOCK, Circuit Judges.
ORDER AND JUDGMENT
After examining the briefs and appellate record, this panel has determined unanimously to grant the parties' request for a decision on the briefs without oral argument. See Fed.R.App.P. 34(f); 10th Cir. R. 34.1(G). The case is therefore ordered submitted without oral argument. This order and judgment is not binding precedent, except under the doctrines of law of the case, res judicata, and collateral estoppel. It may be cited, however, for its persuasive value consistent with Fed.R.App.P. 32.1 and 10th Cir. R. 32.1.
Triad Consultants, Inc., appeals from the district court's judgment in favor of Triad's former employee, defendant Jeffrey Wiggins. The district court dismissed with prejudice Triad's Computer Fraud and Abuse Act (CFAA) claim, see 18 U.S.C. § 1030, first under Fed.R.Civ.P. 12(b)(6) and, alternately, under Fed.R.Civ.P. 56. The court declined to exercise supplemental jurisdiction over Triad's state-law claims and denied its motion for a preliminary injunction. Triad appeals only the dismissal of the CFAA claim. We have jurisdiction under 28 U.S.C. § 1291 and affirm the district court's dismissal of the CFAA claim under Rule 12(b)(6).
Backgrotind
Because the parties are familiar with the facts, we summarize only the pertinent allegations of the complaint, which we must take as true for purposes of deciding this appeal under Rule 12(b)(6). Triad provides computer programming and information technology services as well as recruiting and placement services for computer, data processing, and communications professionals. Wiggins was President and Chief Operating Officer of Triad at the time of his discharge. Part of his responsibilities included creating and safe-guarding backup tapes of Triad's computer system, which involved removing a backup tape from the premises each day. Each backup tape contained all of Triad's electronically stored trade secrets and proprietary and confidential information.
On July 28, 2006, Triad terminated Wiggins's employment, escorted him out of the office, and reminded him that he was obligated to return any Triad property in his possession. On August 18, a former Triad network administrator, Jeff Martin, informed the company that Wiggins asked him to break into Triad's network server and copy or download computer files, which he refused to do. On August 29, Martin informed Triad that Wiggins asked him to restore a backup tape that Wiggins had in his possession. Restoration would convert the data into a usable format. Martin agreed with Triad to accept the tape from Wiggins and return it to Triad. Wiggins, however, informed Martin that he found someone else to restore the tape, one of Triad's consulting partners. Martin passed this information along to Triad, which then contacted its consulting partner and recovered the tape on September 1.
Triad then filed this action on September 7, 2006. In addition to the foregoing allegations, Triad also alleged that it believed that other backup tapes might be missing. In its CFAA claim, Triad asserted that Wiggins, knowingly and with intent to defraud, and without authorization or in excess of his authorization, accessed Triad's computers and appropriated confidential and proprietary business information, and attempted to use the information for his personal benefit, all of which led to losses of at least $5,000. Triad also asserted state-law claims and moved for a preliminary injunction. Wiggins answered the complaint and asserted state-law counterclaims relating to compensation he alleged Triad owed him. He also moved to dismiss the CFAA claim for failure to state a claim on which relief can be granted and asked the district court to decline to exercise supplemental jurisdiction over Triad's state-law claims. Attached to his motion was a copy of an affidavit dated September 21, 2006, that he had sent to Triad along with a second backup tape and two other items.
The district court held two hearings on the motions, heard testimony, and received evidence. At the conclusion of the second hearing, the court issued an oral ruling. As to the CFAA claim, the court first applied Rule 12(b)(6)'s standard and concluded that the complaint failed to allege two essential elements of a CFAA violation under 18 U.S.C. § 1030(a)(4): that Wiggins exceeded his authorized access and that he obtained something of value. Regarding access, the court noted that the complaint alleged that Wiggins was authorized to possess the backup tapes. As to whether or not Wiggins obtained anything of value, the court noted that the complaint set forth a sequence of facts showing that he never obtained any information from the tapes.
The CFAA is a criminal statute, but under the portions of 18 U.S.C. § 1030 relevant to Triad's CFAA claim, whoever "knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value" may be liable in a civil action to any person who as a result suffers "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." 18 U.S.C. § 1030(a)(4), (a)(5)(B)(I), (g).
In the alternative the court treated the motion to dismiss as one seeking summary judgment under Rule 56, as it had earlier advised the parties it might do, and granted the motion as to the CFAA claim on the grounds that Triad had not incurred any damage or loss by reason of a violation of the statute, see 18 U.S.C. § 1030(g), and that in any event Triad's expenditure of more than $22,000 investigating the matter was not a loss arising from a course of conduct related to Wiggins's actions, as required by 18 U.S.C. § 1030(a)(5). The court declined to exercise supplemental jurisdiction over Triad's state-law claims, denied its motion for a preliminary injunction, and dismissed Wiggins's counterclaims without prejudice. Triad appealed.
Discussion
On appeal, Triad takes issue only with the district court's dismissal of its CFAA claim. We affirm on the basis of the district court's dismissal under Rule 12(b)(6) and need not reach its alternate dismissal under Rule 56. We review de novo a district court's dismissal under Rule 12(b)(6). See Ridge at Red Hawk, L.L.C. v. Schneider, 493 F.3d 1174, 1177 (10th Cir. 2007). In doing so, "we assume the truth of the plaintiffs well-pleaded factual allegations and view them in the light most favorable to the plaintiff." Id. (quotation omitted). We must determine "whether the complaint contains `enough facts to state a claim to relief that is plausible on its face.'" Id. (quoting Bell Atl. Corp. v. Twombly, ___ U.S. ___, 127 S.Ct. 1955, 1974, 167 L.Ed.2d 929 (2007)). Thus, "the complaint must give the court reason to believe that [Triad] has a reasonable likelihood of mustering factual support for [its] claims." Ridge at Red Hawk, L.L.C., 493 F.3d at 1177.
We need not decide whether Wiggins "accesse[d] a protected computer without authorization, or exceed[ed] authorized access," or furthered a fraudulent intent by doing so. 18 U.S.C. § 1030(a)(4). Nor need we determine whether the backup tapes fall within the statutory definition of a computer. Instead, we will assume these elements of the claim and focus on the district court's determination that Triad failed to allege sufficient facts to show that Wiggins "obtain[ed] anything of value." Id.
The statute defines "computer" as "an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device." 18 U.S.C. § 1030(e)(1).
We are not persuaded by Triad's argument that the tapes themselves, without access to the information they contained, were "anything of value." Triad has pointed to no case, and we have found none, where obtaining that sort of value — the value of a storage medium apart from the value of any information it contains — was sufficient to state a claim under the CFAA. To the contrary, in each of the CFAA cases discussed in Triad's briefs, access to information was central to the claimed violation — the information was either deleted, used to compete, or given to a competitor. See Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418, 419 (7th Cir. 2006) (employee deleted information prior to quitting); Vi-Chip Corp. v. Lee, 438 F.Supp.2d 1087, 1092 (N.D.Cal. 2006) (same); Nexans Wires S.A. v. Sark-USA, Inc., 319 F.Supp.2d 468, 469-70, 471 (S.D.N.Y. 2004) (competitor induced copying and deletion of information by plaintiffs former employees, then used copied information); Pac. Aerospace Elecs., Inc. v. Taylor, 295 F.Supp.2d 1188, 1193, 1196 (E.D.Wash. 2003) (former employees used information gleaned from employer's computer to compete); Shurgard Storage Ctrs., Inc. v. Safeguard Self Storage, Inc., 119 F.Supp.2d 1121, 1123, 1127 (W.D.Wash. 2000) (plaintiffs former employee gave information to competitor); C.H. Robinson Worldwide, Inc. v. Command Transp., LLC, No. 05-C-3401, 2005 WL 3077998, at *2-4 (N.D.Ill. Nov. 16, 2005) (unpublished) (former employees used information to compete).
Instead, we find persuasive the reasoning of the First Circuit, that CFAA "value is relative to one's needs and objectives." United States v. Czubinski, 106 F.3d 1069, 1078 (1st Cir. 1997). In Czubinski, the court required the government to show that the information was valuable to the defendant. Id.; see also id. at 1078-79 (discussing CFAA's legislative history supporting view that the statute was meant to protect information as opposed to mere unauthorized access). Similarly here, the value of the tapes to Wiggins (and to Triad, for that matter) lay in the information the tapes contained, not in the physical objects themselves. Because Triad alleged no facts showing that Wiggins accessed the information on either tape, it cannot establish one of the elements of a claim under § 1030(a)(4), that Wiggins obtained "anything of value." See P.C. Yonkers, Inc. v. Celebrations the Party Seasonal Superstore, LLC, 428 F.3d 504, 509 (3d Cir. 2005) (affirming denial of preliminary injunctive relief under CFAA where plaintiffs did not know, had not shown, and could not show "what information, if any, was taken" by former employee who accessed computer without authorization).
In a footnote to its appellate brief, Triad notes that no discovery had occurred in this case when the district court issued its oral ruling, and contends that it has not conceded that Wiggins failed to obtain any information from the tapes. See Aplt. Opening Br. at 16, n. 13. But Triad's reluctance to concede the point is based on nothing more than pure speculation and runs contrary to (1) Triad's allegations regarding the first tape, which showed that Triad recovered the tape before Wiggins could get someone to restore the data; and (2) Triad's own testimony at the motions hearing, namely, that it had examined the tapes but could not show that any information had been accessed, see Aplt. App., Vol. II at 299. Although we, like the district court, do not consider matters outside the complaint under Rule 12(b)(6), the district court stated that it could not "find that discovery is going to change [the] determination as to [Triad's CFAA claim]." Id. at 245. Thus, we conclude that the district court properly based its dismissal on Rule 12(b)(6) without providing an opportunity for discovery or amendment of the complaint regarding either tape. Moreover, the district court noted that at the time of its oral ruling, the case had been pending for three months and Triad had not served any discovery requests on Wiggins. Id., Vol. I at 234.
Triad's reliance on United States v. Willis, 476 F.3d 1121 (10th Cir. 2007), is misplaced. In Willis, decided two months after the district court's oral ruling in this case, we addressed an argument by a criminal defendant that the offense with which he was charged under a different subsection of the CFAA, § 1030(a)(2)(C), required proof of an intent to defraud under § 1030(a)(4). We pointed out several differences between the elements of the two subsections, among them that (a)(4) requires only that a person "obtain anything of value," but that (a)(2)(C) requires a person to obtain "information." Id. at 1126. But this distinction was not necessary to our disposition of the case; rather, what mattered for our purposes in Willis was that the government was not required to prove fraudulent intent in order to obtain a conviction under subsection (a)(2)(C). Id. And as we explained above, the backup tapes themselves do not constitute "anything of value" for purposes of a claim under subsection (a)(4) in this case absent access to the information they contain.
Conclusion
We conclude that Triad failed to allege sufficient facts to state a CFAA claim that is plausible on its face. See Twombly, 127 S.Ct. at 1969; Ridge at Red Hawk, L.L.C., 493 F.3d at 1177. The judgment of the district court is AFFIRMED.