Opinion
20-cr-00337-WHO-1
06-28-2022
UNITED STATES OF AMERICA, Plaintiff, v. JOSEPH SULLIVAN, Defendant.
ORDER DENYING MOTION TO DISMISS WIRE FRAUD COUNTS RE: DKT. NO. 107
William H. Orrick United States District Judge.
Defendant Joseph Sullivan moves to dismiss three wire fraud counts in the Superseding Indictment arising from his alleged efforts to cover up a 2016 data breach at Uber Technologies, Inc. (“Uber”), in which the personally identifiable information of Uber users and drivers was obtained. Looking to the four corners of the Superseding Indictment, the government has adequately stated that obtaining money from Uber drivers, in the form of service fees, was an object of Sullivan's alleged scheme. There may have been other objects of the alleged scheme, but the Superseding Indictment sufficiently asserts that this was one. Although the Superseding Indictment does not state that Sullivan made any misrepresentations directly to those drivers, it does allege that misrepresentations made to others were part of his scheme to defraud them. That is enough for the wire fraud counts to proceed. The motion is DENIED.
I agree with Sullivan, however, that the wire fraud changes cannot proceed on an omission theory. The Superseding Indictment fails to state that he owed an independent duty to disclose the data breach to the alleged defrauded party: Uber drivers. As his counsel conceded at oral argument, this can be addressed via jury instruction; the lack of such a duty alone does not warrant dismissing the wire fraud counts. And whether the government's theory as stated in the Superseding Indictment is plausible is another question that will be answered when it is presented to a jury.
BACKGROUND
On December 22, 2021, a grand jury charged Sullivan with five counts arising from a November 2016 data breach suffered by Uber, in which hackers obtained access to personally identifiable information of Uber users and drivers, including approximately 600,000 drivers' license numbers. Superseding Indictment (“SI”) [Dkt. No. 71] ¶¶ 4-5, 11-16. Three of those counts, at issue in this motion, allege violations of 18 U.S.C. § 1343 (wire fraud). See id. ¶¶ 1516; Mot. to Dismiss (“MTD”) [Dkt. No. 107] 2.
The Superseding Indictment characterizes Uber as a “provider of a ride-sharing platform.” Id. ¶ 7. Under its contracts with California drivers, drivers were not considered “employees” and were not promised traditional wages. Id. Rather, the drivers agreed to pay Uber service fees to use its ride-sharing platform, and Uber acted as the drivers' agent in collecting fares from riders via its payment processing platform. Id.
The Superseding Indictment alleges that on or about November 14 and 15, 2016, Sullivan learned that a group of at least two hackers had gained unauthorized access to Uber data. SI ¶ 4. At the time, Sullivan was Uber's Chief Security Officer. See Tr. of June 2, 2022, Hr'g (“Tr.”) [Dkt. No. 123] 9:9. Despite knowing that California law obligated Uber to notify the affected drivers, Sullivan purportedly “engaged in a scheme designed to ensure that the data breach did not become public knowledge, was concealed, and was not disclosed” to either the Federal Trade Commission (“FTC”) or impacted users and drivers. SI ¶¶ 5, 8. According to the Superseding Indictment, Sullivan arranged for the hackers to be paid a “substantial sum of money” in exchange for a written agreement not to disclose the breach. Id. He also allegedly withheld information from others at Uber who were in a position to disclose the breach to the FTC, and later misrepresented the circumstances of the breach to the company's new CEO. Id.
The Superseding Indictment alleges that Sullivan knowingly and intentionally schemed to obtain money or property: the service fees Uber drivers paid Uber. See id. ¶¶ 6-10. He purportedly did this by taking steps “to ensure that drivers did not receive the notification required by state law,” which the Superseding Indictment asserts “deprived those drivers of material information relevant to a driver's decision to continue driving for Uber and paying” the service fees. Id. ¶ 9. The Superseding Indictment also alleges that Sullivan “made, caused to made, and ratified material misrepresentations . . . to ensure that Uber's drivers and others did not learn the true nature of the breach.” Id. ¶ 10. Those alleged misrepresentations were: (1) executing a nondisclosure agreement between Uber and the hackers falsely stating the hackers did not take or store Uber's data; (2) sending an email to Uber's new CEO falsely stating when the hacker's bounty had been paid and misrepresenting the scope of the breach; and (3) “falsely suggesting” in another email that the data breach was not a data breach and downplaying its severity. Id.
Sullivan moved to dismiss the three wire fraud counts on April 11, 2022. Dkt. No. 107. I heard arguments from both parties on June 2, 2022.
LEGAL STANDARD
“The indictment or information must be a plain, concise, and definite written statement of the essential facts constituting the offense charged.” Fed. R. Crim. P. 7(c)(1). In judging the sufficiency of the indictment, the question is whether it “adequately alleges the elements of the offense and fairly informs the defendant of the charge, not whether the government can prove its case.” United States v. Buckley, 689 F.2d 893, 897 (9th Cir. 1982).
A defendant may move to dismiss an indictment for failure to state an offense under Federal Rule of Criminal Procedure 12(b)(3)(B)(v). In deciding such a motion, the court is “bound by the four corners of the indictment” and must accept the truth of the allegations within. United States v. Boren, 278 F.3d 911, 914 (9th Cir. 2002). It does not take evidence or make factual determinations. Id.; see also United States v. Jensen, 93 F.3d 667, 669 (9th Cir 1996) (“A motion to dismiss the indictment cannot be used as a device for a summary trial of the evidence. The court should not consider evidence not appearing on the face of the indictment.”) (internal citation and modifications omitted). To put it plainly: “The indictment either states an offense or it doesn't.” Boren, 278 F.3d at 914.
DISCUSSION
Wire fraud involves using wires to execute “any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises.” 18 U.S.C. § 1343. Sullivan challenges the sufficiency of these charges on three primary grounds.
I. An Object of the Alleged Scheme
Sullivan first argues that the wire fraud charges should be dismissed because they do not adequately allege that obtaining money or property (i.e., the service fees) from the alleged victims (the Uber drivers) was more than an incidental byproduct of his alleged efforts to conceal the data breach. MTD at 3:5-9. Relatedly, he asserts that the counts only allege that he sought to maintain those fees rather than obtain new or increased fees. Id. at 3:10-15. In making these arguments, Sullivan relies heavily on two recent decisions from the Supreme Court and Ninth Circuit. See id. at 6:1-9:20.
The first, Kelly v. United States, 140 S.Ct. 1565, 1569 (2020), arose from the highly publicized “Bridgegate” scandal, where public officials shut down lanes of the George Washington Bridge in retaliation against a New Jersey mayor who declined to support then-Governor Chris Christie. Two of the officials involved were convicted of wire fraud, among other charges. Id. at 1571. The Third Circuit affirmed those convictions, rejecting the officials' argument of insufficient evidence. Id. The Supreme Court reversed and remanded. Id. at 1574.
Central to the Court's decision was the government's burden to prove property fraud under section 1343, not just that the officials “engaged in deception.” Id. at 1571. As the Court stated:
The evidence the jury heard no doubt shows wrongdoing-deception, corruption, abuse of power. But the federal fraud statutes at issue do not criminalize all such conduct. Under settled precedent, the officials could violate those laws only if an object of their dishonesty was to obtain the Port Authority's money or property.Id. at 1568. The Court rejected the government's argument that the object of the fraud was to obtain money by diverting the time and labor of Port Authority employees assigned to carry out the lane closures, concluding that this time and labor were “just the implementation costs of the defendants' scheme”-“an incidental (even if foreseen) byproduct” of the officials' regulatory object: to retaliate against the mayor. Id. at 1573-74. The Court's holding was clear: “[A] property fraud conviction cannot stand when the loss to the victim is only an incidental byproduct of the scheme.” Id. at 1573. Rather, the property “must be an ‘object of the fraud.'” Id. (citation omitted).
The government characterizes Kelly as factually distinguishable and therefore inapplicable. Oppo. [Dkt. No. 112] 6:12-19. It notes that Sullivan was not a public official engaged in purportedly corrupt acts and argues that the Supreme Court's concern that regulatory or honest-services fraud was improperly recast as property fraud does not apply. See id. at 6:14-16, 7:2-9.
True, Sullivan is not a public official accused of regulatory or honest-services fraud. This is a property fraud case; that is not in dispute. But in Kelly, the Court expressly considered what was required of the government in proving property fraud. It described the type of fraud at issue at the outset, noting that the government “needed to prove property fraud.” Kelly, 140 S.Ct. at 1571. It described what could “undergird a property fraud prosecution” (a “government's right to its employees' time and labor”). Id at 1573. And it expressly articulated the rule upon which Sullivan relies: “[A] property fraud conviction cannot stand when the loss to the victim is only an incidental byproduct of the scheme.” Id. Despite the factual distinctions between Kelly and this case, the Court's decision and rationale applies.
The Superseding Indictment satisfies the rule articulated in Kelly by alleging that an object of the scheme was to “obtain money and property,” the drivers' service fees. See Oppo. at 7:228:5; see also SI at ¶¶ 6-7, 9. Sullivan argues that “[n]ot a scrap of evidence suggests that maintaining such fees was the ‘object' of Sullivan's activities,” and instead that the Superseding Indictment portrays the effort to downplay the data breach as an “attempt to conceal the indictment from the FTC and, later, from Uber's new management.” See MTD at 7:10-23. But a motion to dismiss the indictment is not a trial of the evidence. Jensen, 93 F.3d at 669. I may not make any factual determinations either. Boren, 278 F.3d at 914. Looking at the four corners of the Superseding Indictment and accepting the truth of the allegations within, I find that it sufficiently states that an object of Sullivan's scheme was to obtain the drivers' service fees. See id.
Kelly did not foreclose the possibility that a scheme may have more than one object. The Court repeatedly described the issue as whether obtaining money or property was “an object” of the scheme, not the object. See e.g., Kelly, 140 S.Ct. at 1568 (“Under settled precedent, the officials could violate those laws only if an object of their dishonesty was to obtain the Port Authority's money or property.”) (emphasis added). The Second Circuit adopted a similar interpretation of Kelly in United States v. Gatto, 986 F.3d 104, 116 (2d Cir. 2021), holding that “[d]efendants may have had multiple objectives, but property need only be ‘an object' of their scheme . . . not the sole or primary goal.”
In Gatto, the defendants, Adidas employees and affiliates, were convicted of engaging in a scheme to defraud three Adidas-sponsored universities by paying tens of thousands of dollars to the families of sought-after basketball recruits, then covering up those payments so the recruits could certify that they had complied with eligibility rules that barred them from being paid. See 986 F.3d at 109-10. Because the recruits' athletic-based financial aid was contingent upon that certification-and the universities would not have awarded the recruits that aid had they known the recruits were ineligible to compete-the Second Circuit held that depriving the universities of athletic-based aid was an object of the scheme. See id. at 116. In so holding, the court rejected the defendants' argument that they instead intended to “assist the universities' recruiting efforts by luring the best basketball players to Adidas-sponsored schools to better market their brand.” Id. The court held that a scheme could have multiple objectives, but so long as property was “an object,” Kelly was satisfied. See id.
There may have been other objectives to Sullivan's purported scheme, as the government acknowledged at oral argument. One might have been to protect Sullivan's own professional or personal reputation as a security officer. See Tr. at 9:5-11. Another might have been to protect Uber from further scrutiny from the FTC and to ensure that the company kept making money. See id. But, as alleged in the Superseding Indictment, an object of the scheme was to deprive Uber drivers of their service fees. See SI at ¶¶ 6-7, 9. Whether obtaining those fees was in fact an object of Sullivan's scheme or merely an incidental byproduct is a question for the jury to decide. At this point, the Superseding Indictment sufficiently alleges that an object of the scheme was to obtain property, satisfying the requirement set forth in Kelly.
United States v. Yates, 16 F.4th 256 (9th Cir. 2021) does not compel a different conclusion. In Yates, the Ninth Circuit vacated the bank fraud convictions of two bank employees, finding that the government's “salary maintenance” theory was “legally insufficient.” See 16 F.4th at 264. The government argued in part that the defendants misrepresented the bank's financial condition in order to keep receiving their salaries and bonuses-depriving the bank of that property was an object of their scheme. See Yates, 16 F.4th at 264, 266. The Ninth Circuit recognized that salaries and other financial employment benefits were “of course” considered money under the statutory language. See id. at 266. But it distinguished between “a scheme whose object is to obtain a new or higher salary and a scheme whose object is to deceive an employer while continuing to draw an existing salary-essentially, avoiding being fired.” Id. at 266. It was not enough that the bank employees intended to maintain their salaries or receive standard annual bonuses or raises. Id. at 268. Rather, the court held, the government needed to show that the defendants sought to obtain an increased salary or bonus. See id. at 266.
Sullivan argues that the Superseding Indictment suffers the same flaw. He contends that the indictment does not allege that the object of his scheme was to obtain new drivers (who would pay new service fees) or higher fees from existing drivers. See MTD at 9:9-18. Instead, he argues, it alleges that Sullivan withheld information from the drivers so that they would continue driving for Uber and paying the associated fees. Id. According to Sullivan, this is the same maintenance theory that the Ninth Circuit rejected in Yates. Id.
In response, the government points to Uber's contractual relationship with drivers in California as alleged in the Superseding Indictment. See Oppo. at 10:1-10. Paragraph 7 states that Uber drivers were not considered “employees,” nor were they promised a “traditional wage.” SI ¶ 7. Drivers paid Uber service fees to use its ride-sharing platform and Uber collected fares from its users, acting as the drivers' agent. Id. Given this structure, the government argues, drivers had no obligation to continue driving for Uber-so there were no fees that could be “maintained.” See Oppo. at 10:1-10.
Again, I am bound by the allegations within the four corners of the Superseding Indictment and must accept them as true. The unique relationship between Uber and Uber drivers, as described in the indictment, sufficiently shows that Uber was not entitled to the services fees in the same way that the bank employees were entitled to their standard salaries and bonuses in Yates. See SI ¶ 7. Further, the Superseding Indictment alleges that an object of Sullivan's scheme was to “obtain money and property.” Id. ¶ 6. This differs from another case that Sullivan relies upon, United States v. Guertin, --- F.Supp.3d ----, 2022 WL 203467, at *2 (D.D.C. Jan. 24, 2022), where the indictment expressly alleged that the defendant sought to “unlawfully enrich himself by maintaining his State Department employment and salary.” See MTD at 8:17-9:8.
It is also worth noting that the Superseding Indictment does not allege that an object of Sullivan's scheme was to maintain his own salary or avoid being fired. See generally SI. Yates makes clear that such allegations would not be enough to support a wire fraud charge. However, that is not an object of the scheme alleged in the Superseding Indictment. And even if it were, so long as obtaining the service fees from Uber drivers was also an object of the alleged scheme, under Kelly, the charges would survive the motion to dismiss. They do so because the Superseding Indictment sufficiently alleges that.
Whether obtaining the services fees was in fact an object of Sullivan's scheme is a question the jury will ultimately have to answer. It is not for me to decide, on a motion to dismiss, whether the government will be able to prove its theory. See Buckley, 689 F.2d at 897. I am limited by the allegations within the Superseding Indictment. Accepting the truth of those allegations, the indictment sufficiently states that obtaining the service fees was an object of Sullivan's scheme. This is enough for the wire fraud charges to proceed.
II. Convergence
Sullivan next argues that the wire fraud counts should be dismissed because they violate the convergence requirement articulated in United States v. Lew, 875 F.2d 219 (9th Cir. 1989), and United States v. Ali, 620 F.3d 1062 (9th Cir. 2010). See MTD at 9:21-27. Under these cases, “the indictment must show that the defendant intended to deprive the alleged victim of their money or property.” United States v. Holmes (“Holmes I”), No. 18-CR-00258-EJD, 2020 WL 666563, at *17 (N.D. Cal. Feb. 11, 2020).
Sullivan argues that none of the misrepresentations alleged in the Superseding Indictment was directed to Uber drivers from whom Sullivan purportedly intended to obtain the service fees. Id. at 10:1-13 (citing SI ¶ 10). Instead, he contends, the people allegedly deceived by these misrepresentations were Uber's CEO and outside counsel. See id. at 10:12-19; see also Reply [Dkt. No. 117] 6:1-2 (“Those alleged misrepresentations could not possibly have ‘deceived' the drivers because, for all the indictment shows, they were never communicated to the drivers.”). Sullivan contends that the affirmative misrepresentation theory underlying the wire fraud counts therefore violates the convergence theory, warranting dismissal. MTD at 9:24-25.
The government accuses Sullivan of reading the case law too narrowly. It contends that under Lew and Ali, as Judge Davila stated in Holmes I, “the indictment must show that the defendant intended to deprive the alleged victim.” Oppo. at 11:10-12 (citing Holmes I, 2020 WL 666563, at *18). According to the government, the Superseding Indictment does just this. It alleges that Sullivan made “material misrepresentations of fact to ensure that Uber's drivers and others did not learn the true nature of the breach.” Id. at 11:12-26 (citing SI ¶ 10). The misrepresentations, it contends, were part of “a broad scheme to defraud Uber's drivers” by inserting false claims into corporate records to maintain that deception. See Id. at 11:10-26.
The government has the better read of the case law. In Lew, the Ninth Circuit held that “the intent must be to obtain money or property from the one who is deceived.” 875 F.2d at 221. There, the government argued that the defendant, an immigration attorney, intended to defraud his clients of the fees they paid him. Id. But the Ninth Circuit held there was no evidence that the defendant intended to deceive his clients; instead, it showed that he intended to deceive the Department of Labor about their immigration status. See id. The court reversed his wire fraud convictions, finding that the jury was wrongly instructed that the “scheme was to make false statements to the United States for the purpose of obtaining money from the defendant's clients.” Id. at 221-22.
In Ali, the Ninth Circuit upheld wire and mail fraud convictions based on misrepresentations that were not directly made to the victim. See 620 F.3d at 1070. There, the defendants devised a scheme to fraudulently obtain a preferred status for various companies in order to buy software from Microsoft, then sell that software to unauthorized users. See id. at 1064-65. Although the defendants made some misrepresentations directly to Microsoft, after Microsoft terminated its agreement with the defendants, they then acquired existing companies with the preferred status in order to continue purchasing the software. Id. at 1065. The Ninth Circuit recognized that although the defendants initially made misrepresentations directly to Microsoft, they did not do so in the latter part of the scheme. See id. at 1070. But the court still upheld their convictions, finding that because their acquisition of the companies was “part of a larger scheme to defraud Microsoft,” they “need not have made a misrepresentation directly to Microsoft in order to be guilty of mail and wire fraud.” Id. Because of that larger scheme, and because the alleged victim, Microsoft, lost money or property, the court upheld the defendants' convictions “with respect to all the transactions”-even those where the underlying misrepresentations were not made directly to Microsoft. See id. at 1070-71 (“[W]e conclude that there is sufficient evidence to demonstrate that defendants were engaged in a scheme to defraud Microsoft, even if there were no specific false statements made to Microsoft.”).
Finally, in Holmes I, the wire fraud charges centered on the defendants' alleged scheme to deprive patients of the money paid for blood tests that the defendants knew were inaccurate and unreliable. See 2020 WL 666563, at *3. Judge Davila dismissed the wire fraud charges in part, finding that there was a “divergence between the intent to defraud and the harm suffered.” Id. at *18. The issue was that the indictment alleged that insurance companies paid for tests for some of the alleged patient victims. See id. at *17-18. Because the money came from the insurance companies, not the patients who were allegedly deceived, Judge Davila held that convergence was not satisfied. Id. at *19.
The takeaway from these cases is simply that the indictment must show that the defendant intended to deprive the alleged victim of their money or property. The Superseding Indictment alleges this: that Sullivan made misrepresentations to “ensure that Uber's drivers and others did not learn the true nature of the breach” in order to obtain their service fees. See SI ¶¶ 9-10. Although the Superseding Indictment alleges that those misrepresentations were made to and through intermediaries-through the non-disclosure agreement signed by the hackers and the emails to Uber's new CEO and others-it also alleges that Sullivan's intent was to deprive the victims (the Uber drivers) of their money and property (the service fees). See id. at ¶¶ 6, 10. As in Ali, those purported misrepresentations, though not made directly to Uber drivers, were part of a larger scheme to defraud them.
Another decision from Judge Davila is informative. After he granted the defendants' motion to dismiss the wire fraud counts in Holmes I, a grand jury returned a second, then third, superseding indictment. See United States v. Holmes (“Holmes II”), No. 18-CR-00258-EJD, 2020 WL 6047232, at *1 (Oct. 13, 2020). Again, the defendants moved to dismiss the wire fraud counts, alleging that they violated the convergence principle because the operative indictment alleged that the defendants deceived doctors in order to deprive patients of money or property. See id. at *14. This time, Judge Davila rejected this argument. “[T]hat,” he wrote, “is not the government's theory.” Id.
The government's theory is that defendants intended to deceive patients, and that part of the scheme to deceive patients involved deceiving doctors....There is no question that doctors may serve as conduits of information to their patients. That there must be ‘at least some level of convergence between the fraud and the loss' does not make irrelevant all misrepresentations made to individuals other than those deprived of money or property.Id. at *15 (citing in part Ali, 620 F.3d at 1070). Similarly, Uber may serve as a conduit for information to Uber drivers-particularly regarding breaches of information about those drivers that Uber held. Any misrepresentations that Sullivan allegedly made to deceive Uber, then, may be part of a scheme to deceive those drivers.
Taken together, Lew, Ali, and the two Holmes decisions show that the allegations within the Superseding Indictment satisfy the convergence principle-at least for the purposes of surviving this motion to dismiss. It alleges that Sullivan's intent was to obtain money (the service fees) from the alleged victim (the Uber drivers), and that the misrepresentations made to others were part of that larger scheme to defraud the drivers. The case law does not foreclose this as a basis for the wire fraud charges, at least as a matter of law. Whether the government's theory is plausible, or can be proven beyond a reasonable doubt, is a question for the jury.
III. Duty to Disclose
The Ninth Circuit has held that a non-disclosure “can support a wire fraud charge only when there exists an independent duty that has been breached by the person so charged.” United States v. Shields, 844 F.3d 819, 822 (9th Cir. 2016) (citations and internal modifications omitted).
State law may provide such a duty. California Civil Code section 1798.82(a) imposes upon a “person or business that conducts business in California, and that owns or licenses computerized data that includes personal information,” a duty to “disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California.” Cal. Civ. Code § 1798.82(a).
Sullivan argues that section 1798.82(a) imposes no duty to disclose on Sullivan. The Superseding Indictment does not allege that he owned or licensed computerized data that includes personal information. MTD at 10:26-11:7. Uber might have owned or licensed such data, Sullivan contends. See id. But he did not. See id. And because section 1798.82(a) is the only source of any duty to disclose alleged in the Superseding Indictment, Sullivan contends that the government's omission theory fails. See id. (citing SI ¶ 8).
The government attacks Sullivan's interpretation of Shields, stating that it does not state that the duty in question must run directly to the defendant. See Oppo. at 12:15-20. The government then offers a somewhat-contradictory statement, asserting that “[t]he question is not to whom, precisely, the duty runs, but rather whether the defendant has breached a duty.” Id. at 12:18-19. In the next sentence, the government contends that “[a]s alleged in the Superseding Indictment, defendant knowingly breached a duty owed to Uber's drivers.” Id. at 12:20.
Looking at the allegations within the Superseding Indictment and the language of section 1798.82(a), it certainly appears that Uber had a duty to disclose the data breach as a business conducting business in California that “owns or licenses computerized data” including personal information. See SI ¶ 8; Cal. Civ. Code § 1798.82(a). The question is whether Sullivan had any duty and if so, to whom.
The Ninth Circuit recently stated in an unpublished memorandum disposition that in order to be convicted on a wire fraud charge based on an omission, the defendant must have an “independent duty to the defrauded party to disclose the omitted information.” See United States v. Farrace , 805 Fed. App'x 470, 473 (9th Cir. 2020) (emphasis added). Although Farrace is not binding, its reasoning is persuasive. It cites to Shields, which focused on the defendants' relationships with their investors and whether it supported a duty to disclose. See id.; see also Shields, 844 F.3d at 822. The Superseding Indictment alleges that it was the Uber drivers who were defrauded by Sullivan's alleged omissions. See SI ¶ 9. Under Shields, as interpreted by Farrace, for the Superseding Indictment to state an omission-based wire fraud offense against Sullivan, it must allege that he owed a duty to the drivers to disclose the omitted information.
Sullivan ties this to a broader point about federalism, arguing that expanding section 1798.82(a) to establish criminal liability would turn the “knowing breach of a state statute that lacks any criminal provision” into a “federal felony with a twenty year statutory maximum punishment.” See MTD at 12:1-7, 14:1-6. But the government only relied on 1798.82(a) in arguing that Sullivan had a duty to disclose. Whether a defendant is guilty of wire fraud does not rise and fall solely with such a duty; it is but one element of an omission-based charge. In any case, section 1798.82(a) does not impose a duty on Sullivan, as I further explain.
The Superseding Indictment alleges that Sullivan knew that California law required businesses to notify residents of data breaches under certain circumstances. SI ¶ 8. It alleges that he “had been aware of, and had participated in, Uber's efforts to notify” individuals about a previous data breach. Id. And it alleges that after the 2016 breach, Sullivan “took measures to ensure that drivers did not receive the notification required by state law.” Id. ¶ 9.
But it does not allege that Sullivan owed the drivers any duty, namely because it does not allege that he owned or licensed the data that was breached. See generally SI. This is required to establish a duty under the language of section 1798.82(a), which is the only source of any duty alleged in the Superseding Indictment. See generally id. Without more, the government has not stated a wire fraud offense against Sullivan based on material omissions.
There may be other sources of a duty supporting the government's omission theory. For example, section 1798.82(b) states that a “person or business that maintains computerized data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery” of that breach. Cal. Civ. Code § 1798.82(b) (emphasis added). This might have provided a foundation for the government to argue that Sullivan owed at least Uber a duty to disclose the breach.
But the Superseding Indictment only alleges a duty to disclose based on section 1798.82(a). See SI ¶ 8. Without any allegations that Sullivan owned or licensed the data at issue, any duty to the defrauded party (again, the Uber drivers) cannot arise from this provision. The indictment “either states an offense or it doesn't.” Boren, 278 F.3d at 914. Here, it does not.
This does not require dismissal of the wire fraud counts. Sullivan's alleged omissions are but one theory underlying these charges; the Superseding Indictment also alleges that he defrauded Uber drivers by making material misrepresentations of fact. See SI ¶ 10. As explained above, the wire fraud claims may proceed on that basis.
Sullivan's counsel stated as much at oral argument, conceding that the government's failure to state a duty to disclose, on its own, did not warrant dismissing the wire fraud counts and instead could be addressed via jury instructions. See Tr. at 4:9-5:6.
CONCLUSION
For these reasons, Sullivan's motion to dismiss is DENIED.
IT IS SO ORDERED.