Summary
granting leave to amend because plaintiff's new allegations of losses attributable to increased server traffic, diagnosing data breach, and installing a new server "would seem to salvage" plaintiff's CFAA claim
Summary of this case from In re Lenovo Adware Litig.Opinion
608CV094.
January 25, 2010
ORDER
I. INTRODUCTION
This case involves a dispute over the ownership and control of an online discussion forum, its trademark name (The High Road), and the domain name at which it is located (www.thehighroad.org). Doc. # 17 at 1. Plaintiff Oleg Volk has asserted claims for declaratory judgment of ownership of the domain name, cyberpiracy in violation of the Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), breach of fiduciary duty, conversion/replevin of computer hardware, tortious interference with business relations, and copyright infringement. Doc. ## 1 (complaint), 7 (amended complaint). Defendant Derek Zeanah has asserted counterclaims for declaratory judgment of ownership, violations of Georgia's Uniform Deceptive Trade Practices Act, O.C.G.A. § 10-1-370 et seq., and Georgia's laws against unfair competition and deceiving and misleading the public, O.C.G.A. § 23-2-55, conversion, breach of fiduciary duty, and a violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq. ("CFAA"). Doc. # 9 at 11-21. The CFAA claim is premised on the allegation that Volk — or someone under his direction — accessed Zeanah's computer on which the forum database was stored, copied it, and reposted it at another website (www.thehighroad.us). Id. at 18-19. Volk's F.R.Civ.P. 12(c) motion for judgment on the pleadings on Zeanah's CFAA claim is currently before the Court. Doc. # 17.
II. RULE 12(c) MOTION TO DISMISS STANDARD
"After the pleadings are closed, but early enough not to delay trial, a party may move for judgment on the pleadings" under F.R.Civ.P. 12(c). Rule 12(c) effectively allows a litigant to assert a F.R.Civ.P. 12(b)(6) motion for an opponent's failure to state a claim upon which relief may be granted. The Court, therefore, applies the same standards to the Rule 12(c) motion as if it were brought directly under Rule 12(b)(6). Bivens v. Robert, 2009 WL 891869, at *1 n. 3 (S.D. Ga. 2009).
In considering a Rule 12(b)(6) (and, thus, a Rule 12(c)) motion, all facts in the plaintiff's complaint "are to be accepted as true, and the court limits its consideration to the pleadings and exhibits attached thereto." GSW, Inc. v. Long County, 999 F.2d 1508, 1510 (11th Cir. 1993). A complaint will not be dismissed so long as it contains factual allegations sufficient "to raise a right to relief above the speculative level. . . ." Bell Atl. Corp. v. Twombly, 550 U.S. 544 at 545 (2007) (citations omitted). If it does not, the complaint should be dismissed. Id. Thus, while F.R.Civ.P. 8(a)(2) requires only a "short plain statement of the claim showing that the pleader is entitled to relief," allegations in the complaint must "possess enough heft to show entitlement to relief." Twombly, 550 U.S. at 557 (quotes, cite, and alterations omitted). Furthermore, there remains the longstanding rule that "conclusory allegations and unwarranted deductions of fact are not admitted as true in a motion to dismiss." S. Fla. Water Mgmt. Dist. v. Montalvo, 84 F.3d 402, 408 n. 10 (11th Cir. 1996).
The Supreme Court's decision in Ashcroft v. Iqbal made clear that the stricter pleading standard announced in Twombly applied to all civil actions in the federal district courts. 129 S. Ct. 1937, 1941 (2009).
III. STATING A CFAA CLAIM
The CFAA is meant to reduce hacking of computer systems/networks and to address several federal computer-related offenses. The statute provides that "[w]hoever . . . intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer . . . shall be [subject to criminal penalties]." 18 U.S.C. § 1030(a)(2)(C). While primarily a criminal statute, the CFAA also provides a civil cause of action to
[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought if the conduct involves . . . the factor[] set forth in subclause[] (I) . . . of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages."18 U.S.C. § 1030(g) (emphasis added).
Subsection (c)(4)(A)(i)(I), meanwhile, requires the offense to cause "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." 18 U.S.C. § 1030(c)(4)(A)(i)(I).
Setting aside other material questions of whether Volk acted "without authorization," "exceeded authorization," or was "entitled" to access and copy the online forum, doc. # 17 at 5, the Court restricts its analysis to whether Zeanah adequately pled damage or loss to bring a civil action under the CFAA. Specifically, did Zeanah's counterclaim present some factual allegation of damage or loss, which amounted to at least $5,000 during a one-year period?
A. Damage under the CFAA
The CFAA defines damage as "any impairment to the integrity or availability of data, a program, a system, or information[.]" 18 U.S.C. § 1030(e)(8).
The pertinent paragraphs of Zeanah's counterclaim set forth the following:
Upon information and belief, Volk, without authorization, or at the very least in excess of any authorization which he might have reasonably claimed, knowingly and willfully caused, through means of a computer and in interstate commerce, the transmission of programs, information, codes, or commands to Zeanah's computers, with the intent, at the very least with a reckless disregard of a substantial and unjustified risk that the transmissions were damaged, or caused damage to, a computer, computer system, network, information, data, and programs of Zeanah's computer facilities, and thereby causing injury to Zeanah.
The foregoing acts and conduct of Volk have caused, and if not enjoined will continue to cause, loss or damage to one or more persons, including Zeanah, of a value aggregating more than $5,000.00 during the applicable one year period.
As a result of Volk's acts, Zeanah has suffered and continues to suffer irreparable injury, loss of reputation, and pecuniary damages to be proven at trial. Unless and until enjoined by this Court, Volk will continue these acts, thereby causing Zeanah further immediate and irreparable damage.
Doc. # 9 at 18-19.
Although Zeanah concludes that Volk has caused the requisite damage to Zeanah's computer facilities, this is nothing more than a "formulaic recitation of the elements" of a CFAA claim. Twombly, 550 U.S. at 555. Zeanah, however, suggests that "hacking and copying essentially the entire contents of the website . . . for later posting on another website . . . necessarily made those contents less secure under the CFAA." Doc. # 18 at 7. He continues, "[i]n a time when most computer crimes result in loss of revenue and little to no physical damage, it is nonsensical to conclude that Congress did not intend to create a remedy for circumstances such as those Zeanah has pled in this matter." Id. The Court disagrees. First, Zeanah does not explain how copying the contents of a website make those contents less secure. In Black Decker, Inc. v. Smith, a case relied upon by Zeanah, the court held that the copying of "certain confidential documents from a secure server to a non-secure share company drive" constituted damage under the CFAA. 586 F. Supp. 2d 929, 917 (W.D. Tenn. 2008). Here, the contents of one public forum were copied and then posted to another public forum. There is nothing to suggest that those contents have somehow become less secure as a result of that process.
Second, the plain language of the statute does not require "physical damage," as Zeanah implies, but does require "some alteration of or diminution to the integrity, stability, or accessibility of the computer data itself." Cont'l Group, Inc. v. KW Prop. Mgmt., LLC, 622 F. Supp. 2d 1357, 1371 (S.D. Fla. 2009). Without some allegation of alteration, impairment, or deletion, the mere copying of data does not create a cognizable claim for damage under the CFAA.
B. Loss under the CFAA
Under the CFAA, "loss" means "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service[.]" 18 U.S.C. § 1030(e)(11). Losses not directly related to "damage" of the accessed computer or network, such as revenue lost because a defendant used proprietary information and intellectual property to unfairly compete, or lost business opportunities resulting from a defendant's use of improperly gained information, are not the types of losses contemplated by the CFAA. Andritz, Inc. v. S. Maint. Contractor, LLC, 626 F. Supp. 2d 1264, 1266-67 (M.D. Ga. 2009).
Again, Zeanah's counterclaim is plentiful with conclusory allegations that he "suffered and continues to suffer" losses, but it is also conspicuously devoid of factual allegations relating to those losses. Doc. # 9 at 19. Zeanah, however, supplements his counterclaim and presents the absent factual allegations in his response to Volk's Rule 12(c) motion. Doc. # 18. Zeanah, via affidavit, opines that the "act of hacking into a website and transferring vast quantities of data from the server hosting that site lead to spikes in bandwidth costs." Doc. # 18 at 10. The additional costs attributable to the increased traffic on the server were at least $1,000. Id. at 10-11. Zeanah claims to have spent at least 10 hours and $1,200 investigating and diagnosing the breach. Id. at 11. He also procured a new server at a cost of approximately $2,800 and spent around $1,200 installing and migrating data to that new server. Id. at 11. Volk further claims that he engaged an expert in computer forensics for a fee likely to exceed $4,000. Id. at 11. Finally, he estimates that costs associated with maintaining a heightened security status are at least $3,500. Id. at 11.
While these new factual allegations would seem to salvage Zeanah's CFAA, the Court cannot consider them without running afoul of Rule 12. Rule 12(d) provides, in pertinent part: "If, on a motion under Rule 12(b)(6) or 12(c), matters outside the pleadings are presented to and not excluded by the court, the motion must be treated as one for summary judgment under [F.R.Civ.P.] 56." F.R.Civ.P. 12(d). F.R.Civ.P. 7(a) defines "pleadings" to include both the complaint and the answer, and F.R.Civ.P. 10(c) provides that "[a] copy of any written instrument which is an exhibit to a pleading is a part thereof for all purposes." Horsley v. Feldt, 304 F.3d 1125, 1134 (11th Cir. 2002). Here, the new factual allegations were first presented in an affidavit attached to Zeanah's response to Volk's Rule 12(c) motion. Since that document was not part of Zeanah's original answer (nor an exhibit of that answer), it is outside the pleadings and cannot be considered without converting Volk's motion to one for summary judgment. See Hagerman v. Cobb County, 2008 WL 839803, at *3 (N.D. Ga. 2008) ("[A] court has discretion to convert a motion for judgment on the pleadings into a motion for summary judgment and proceed under Rule 56.") (emphasis added).
The Court, however, disregards the new factual allegations, making it unnecessary to apply the conversion provision described in Rule 12(d). Because it is fairly evident that Zeanah is capable of stating a cognizable claim for loss under the CFAA, the Court grants him leave to amend his answer, solely for the purpose of adding the necessary allegations of loss to his CFAA counterclaim. Zeanah is given five days from the date of this Order to submit an amended answer. In its present form, nonetheless, Zeanah's counterclaim does not state a valid claim for loss under the CFAA and must be dismissed without prejudice.
Zeanah's counsel should have pled the needed factual allegations in his answer and counterclaim (or even in an amendment to that filing). The Court is being lenient in this case only because it believes that Zeanah can plead loss under the CFAA and should not have his claim dismissed because of his counsel's omission.
IV. CONCLUSION.
Volk's F.R.Civ.P. 12(c) motion for judgment on the pleadings is GRANTED. Doc. # 17. Because Zeanah's CFAA claim lacked the factual allegations needed "to raise a right to relief above the speculative level," Count VI of his counterclaims is DISMISSED WITHOUT PREJUDICE. Doc. # 9 at 18-19. The Court, however, GRANTS Zeanah leave to amend his answer to make the requisite allegations of loss to his CFAA counterclaim. Zeanah must submit his amendment within five (5) days from the date of this Order, or Count VI of his counterclaims will be dismissed with prejudice.