Opinion
No. 17 C 06318
06-12-2018
ANDREW HILL and FOODTRACE, INC., Plaintiffs, v. RIANA LYNN and FOODTRACE, INC., Defendants.
MEMORANDUM OPINION AND ORDER
Andrew Hill and Riana Lynn are co-founders of a company called FoodTrace. After their business relationship soured, Hill brought this lawsuit against Lynn. His complaint alleges a variety of federal and state-law claims on his own behalf and on behalf of FoodTrace. See generally, R. 40, Am. Compl. Lynn moves to dismiss four of these claims for failure to state a claim upon which relief can be granted. R. 49, Mot. Dismiss. For the reasons stated below, the motion is denied as to Counts 1 (the CFAA), 9 (fraud), and 4 (unjust enrichment), but granted as to Count 6 (the shareholder derivative claim).
The Court has subject-matter jurisdiction over the federal claims under 28 U.S.C. § 1331, and supplemental jurisdiction over the state law claims under 28 U.S.C. § 1367.
Citations to the record are noted as "R." followed by the docket number and the page or paragraph number.
I. Background
For purposes of the motion to dismiss, the Court accepts as true the factual allegations in the Amended Complaint. Erickson v. Pardus, 551 U.S. 89, 94 (2007). In Summer 2014, Lynn approached Hill about developing a business venture, specifically a company called FoodTrace. Am. Compl. ¶¶ 10-15. Hill agreed to assist by coding a software application that would form the basis of the business, in exchange for an equity share in FoodTrace. Id. ¶¶ 15-16. Hill began work on the code and constructed an application using GitHub, a software development platform. Id. ¶ 21.
Hill devoted a lot of time to working on FoodTrace, and by December 2014 Hill and Lynn began to discuss having Hill leave his day job in order to work full-time at FoodTrace. Id. ¶¶ 24-33. In January 2015, Hill agreed to quit his other job and work exclusively for FoodTrace. Id. ¶ 35. Instead of receiving salary or wages, Hill and Lynn agreed that Hill would receive a 22.671% equity share in FoodTrace. Id. ¶ 36. At some point, Lynn presented Hill with a draft contract that incorrectly listed him as having only a 15% interest in FoodTrace. Id. ¶ 39. Lynn told Hill that she would fix the mistake and return a clean copy to Hill, but she never did, and Hill never signed a written agreement. Id. ¶ 40. Even so, Hill did eventually resign from his trading job and began to work full-time for FoodTrace. Id. ¶¶ 44-45.
Unfortunately, trouble was on the horizon. By the summer of 2015, Lynn had begun to be more and more absent from FoodTrace's office, and was often out of contact with Hill for long periods of time, despite his many attempts to contact her. Id. ¶¶ 51-52. Lynn (who handled the payroll) stopped paying FoodTrace's employees, which, not surprisingly, caused them all to quit. Id. ¶¶ 57-62. Despite these problems, Hill continued to work on FoodTrace, and attempted to reach out to Lynn for input on business decisions, but Lynn was not responsive. Id. ¶¶ 63-67. Eventually, Hill and Lynn both decided that they should sell FoodTrace, but Lynn did not communicate well with Hill about the process of selling FoodTrace. Id. ¶¶ 80-82. Because of the plan to sell FoodTrace, Hill got a new job in February 2016. Id. ¶ 84.
Relations between Hill and Lynn continued to decline. Around August 2016, Lynn cut off Hill's access to the FoodTrace email systems. Id. ¶ 91. During this time, Lynn accessed Hill's GitHub account, downloaded FoodTrace's computer code, deleted the code from GitHub, and deleted the history of edits made to the code. Id. ¶¶ 93-95. Hill immediately tried to contact Lynn to find out what was happening, but Lynn never responded. Id. ¶ 96.
In August 2017, Hill saw an announcement stating that FoodTrace had been sold for $14 million. Id. ¶ 100. Hill was not informed of a sale, and never received any profits from the sale. Id. ¶¶ 101-103. Hill alleges that Lynn misappropriated the share of the profits to which he was entitled for her own benefit. Id. ¶ 103. According to Hill, Lynn sold or dissolved FoodTrace in order to prevent Hill from recovering his fair share of FoodTrace's profits. Id. ¶ 104. Hill also asserts that Lynn used FoodTrace's funds for her own personal expenses. Id. ¶ 155.
II. Legal Standard
A motion under Rule 12(b)(6) challenges the sufficiency of the complaint to state a claim upon which relief may be granted. Hallinan v. Fraternal Order of Police Chi. Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009). "[W]hen ruling on a defendant's motion to dismiss, a judge must accept as true all of the factual allegations contained in the complaint." Erickson, 551 U.S. at 94. A "complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 570). These allegations "must be enough to raise a right to relief above the speculative level." Twombly, 550 U.S. at 555. And the allegations that are entitled to the assumption of truth are those that are factual, rather than mere legal conclusions. Iqbal, 556 U.S. at 679. The complaint is sufficient only if it gives enough factual detail to "present a story that holds together." Swanson v. Citibank, 614 F.3d 499, 404 (7th Cir. 2010).
III. Analysis
A. The CFAA
Hill's first claim against Lynn is that Lynn violated the Computer Fraud and Abuse Act (often referred to as the CFAA), 18 U.S.C. § 1030, by accessing Hill's GitHub account and deleting FoodTrace's code. Although the CFAA "is primarily a criminal anti-hacking statute," Section 1030(g) "provides a civil remedy for any person who suffers damage or loss due to a violation of § 1030." Fidlar Techs. v. LPS Real Estate Data Solns., Inc., 810 F.3d 1075, 1079 (7th Cir. 2016).
To succeed on the CFAA claim, Hill would need to prove a loss of at least $5,000 in a one-year period. Lynn argues that Hill has not pled a loss of $5,000, and asserts that the CFAA claim must be dismissed on that basis. R. 50, Def. Mem. at 3. That argument is rejected. Hill alleges that he has been damaged by Lynn's deletion of the code "in excess of $75,000." Am. Compl. ¶ 126. Specifically, Hill lost out because the code was deleted and sold without any profits being distributed to Hill. Id. Although there is not much explanation for the $75,000 figure, the allegations in the complaint are enough for a plausible inference that the code was worth at least that much, and indeed much more. FoodTrace was reportedly sold for $14 million, id. ¶ 100, so it is fair to infer that the code that formed the basis of the business (and Hill's claimed share of its value) was worth much more than the $5,000 required by the CFAA.
There are other paths to civil liability under the CFAA, but none plausibly apply here. See 18 U.S.C. § 1030(g) ("A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i)."); 18 U.S.C. § 1030(c)(4)(i).
Next, Lynn argues that the CFAA claim must be dismissed because Hill did not plead that Lynn accessed a "computer" within the meaning of the CFAA. Def. Mem. at 3-4. Lynn's argument is that the CFAA prohibits unauthorized access only to physical computers, not web-based accounts like GitHub. Id. But that argument misreads the text of the CFAA. The statute explicitly defines "computer" as "an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device." 18 U.S.C. § 1030(e)(1) (emphases added). This definition clearly includes not only physical computers, but also online data storage facilities—like GitHub—operating in conjunction with what is ordinarily thought of as a computer. Consistent with the plain language of the statute, most courts hold that unauthorized access to web-based accounts can form the basis of a CFAA violation, even if the defendant had permission to use the physical computer in question. See, e.g., Estes Forwarding Worldwide LLC v. Cuellar, 239 F. Supp. 3d 918, 921, 926-27 (E.D. Va. 2017) (plaintiff sufficiently pled access to a "protected computer" when it alleged that defendant accessed a confidential Google Drive); Brown Jordan Int'l, Inc. v. Carmicle, 2016 WL 815827, at *3, *40-41 (S.D. Fla. Mar. 2, 2016) (liability when defendant accessed fellow employees' email accounts through a web portal from his personal iPad); Hedgeye Risk Mgmt., LLC v. Heldman, 2017 WL 4250506, at *7 (D.D.C. Sept. 23, 2017) (plaintiff pled access to a "protected computer" by alleging that defendant accessed electronically stored emails and documents via computer connected to the internet).
Lynn cites one case, Owen v. Cigna, 188 F.Supp.3d 790, 793 (N.D. Ill. 2016), in support of the proposition that the CFAA does not apply to web-based accounts. Although the court in Owen did comment that "the CFAA is aimed at unauthorized access to computers, not unauthorized access to web-based accounts," that opinion did not consider the expansive definition of "computer" in 18 U.S.C. § 1030(e)(1).
Finally, Lynn argues that she did not access the GitHub account "without authorization" or "exceed[] authorized access" to the account. 18 U.S.C. § 1030(a)(2), (a)(4). In another circuit, Lynn's argument might have succeeded: Hill alleges (and thus concedes) that he gave Lynn access to his personal GitHub account, so Lynn did have some kind of authorization to access the account containing the FoodTrace code. See Am. Compl. ¶ 119; see also, e.g., WEC Carolina Energy Solns. LLC v. Miller, 687 F.3d 199, 204 (4th Cir. 2012) (holding that an employee does not "exceed authorized access" so long as the employee has permission to access the information at issue, even if the employee uses the validly accessed information for an improper purpose); United States v. Nosal, 676 F.3d 854, 863-64 (9th Cir. 2012) (en banc) (same). The Seventh Circuit, however, has held that an employee who violates her fiduciary duty to her employer forfeits her authorization to access her employer's computers. Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418, 420-21 (7th Cir. 2006). In Citrin, the Seventh Circuit held that an employee "exceed[ed] authorized access" when he violated the duty of loyalty by destroying company data, even though he was formerly authorized to use his work laptop. Id. This case follows the same pattern: Lynn allegedly violated her fiduciary duty to Hill and FoodTrace by downloading the code and deleting it from Hill's GitHub account so that she could sell it for her own gain. See Am. Compl. ¶ 124. On the facts as alleged, Lynn forfeited her authorization to access the GitHub account and code, and so, at the very least "exceed[ed] authorized access" under the CFAA.
To sum up, none of Lynn's arguments for dismissing the CFAA claim hold water, so Count 1 survives.
B. Fraud and Unjust Enrichment
Next up are Lynn's arguments for dismissing the fraud claim and the related unjust enrichment claim (Counts 9 and 4, respectively). To state a claim of fraud under Illinois law, a plaintiff must allege that (1) the defendant made a false statement of material fact; (2) the defendant knew that the statement was false; (3) the defendant intended that the statement induce the plaintiff to act; (4) the plaintiff relied on the statement; and (5) the plaintiff was damaged by reliance on the statement. Miller v. William Chevrolet/GEO, Inc., 762 N.E.2d 1, 7 (Ill. App. Ct. 2001). Even under the heightened Rule 9(b) pleading standard for fraud, Hill has done enough to state a claim. He has identified exactly what the supposed false statement was—that Lynn would give Hill a 22.671% equity interest in FoodTrace if Hill came to work for FoodTrace full-time. See Am. Compl. ¶¶ 177-179. He alleges that Lynn knew that this statement was untrue when she said it, and that she never intended to follow through on the promise. Id. ¶181. Finally, he alleges that Lynn made the false promise in order to induce Hill to quit his job and work for FoodTrace, and that he relied on that promise to his detriment by quitting his job. Id. ¶¶ 34-36, 44-45. Hill has identified the "who, what, when, where, and how" of the fraud, which is enough. United States ex rel. Lusby v. Rolls-Royce Corp., 570 F.3d 849, 854 (7th Cir. 2009) (quoting DiLeo v . Ernst & Young, 901 F.2d 624, 627 (7th Cir. 1990)).
Lynn attached some evidence to her brief purporting to show that she intended to follow through on her promise to Hill. See R. 51, Exhs. C and D. But this is a motion to dismiss, and the analysis is limited to the sufficiency of the pleadings. Lynn is welcome to present evidence rebutting the alleged intent to defraud at summary judgment or trial, but that evidence is not relevant at this stage of the case.
Because the fraud claim survives, so does the unjust enrichment claim. That is because Lynn's only argument for dismissal of the unjust enrichment claim is that the unjust enrichment claim was predicated on the fraud claim, and so had to be dismissed if the fraud claim was dismissed. Def. Mem. at 6-7. The fraud claim is not dismissed, so the unjust enrichment claim will not be dismissed either.
C. Shareholder Derivative Claim
Lynn's final argument is that Hill's shareholder derivative claim on behalf of FoodTrace must be dismissed because Hill has not alleged that he is a FoodTrace shareholder. The Illinois Business Corporation Act provides that "[n]o action shall be brought in this State by a shareholder in the right of a domestic or foreign corporation unless the plaintiff was a shareholder of record at the time of the transaction of which he or she complains." 805 ILCS 5/7.80(a). The Act also defines a "shareholder" as "one who is a holder of record of shares in a corporation." 805 ILCS 5/1.80(g).
Although Hill's allegations on his shareholder status are somewhat confusing, it seems clear that he is not alleging that he was a "shareholder of record" at the time of Lynn's misconduct. Hill does state that "[a]t all relevant time[s], [Hill] was a Co-Founder and shareholder of FoodTrace" and that he is "an owner with a 22.671% equity interest in FoodTrace." Am. Compl. ¶¶ 152, 128. But the more concrete factual allegations in the complaint make clear that Hill is actually saying that he is entitled to be a shareholder in FoodTrace—not that he is or was the record holder of 22.671% of the shares. Hill alleges that Lynn falsely promised a 22.671% equity interest in FoodTrace, that Lynn never intended to actually convey the shares promised, and that Lynn failed to perform her promise to convey the shares. See id. ¶¶ 162-167, 178-181. The only way to read these allegations is as a statement that Hill never received the shares that he was promised. Indeed, Hill states that his contract to work at FoodTrace in exchange for a percentage of the shares was never formalized. Am. Compl. ¶ 40. Of course, it is possible that Hill could still have some contractual right to damages or to the shares themselves via an oral contract, but that is not the same as alleging that Hill was the holder of record of the shares at the time of Lynn's alleged misconduct.
In response to Lynn's argument, Hill points to Delaware law as persuasive authority, arguing that Delaware courts allow equitable shareholders standing to sue on behalf of the corporation. But, even assuming that Illinois courts would find Delaware law persuasive in the face of the text of the Illinois statute, the Delaware cases cited by Hill are not analogous to this case. Although it is true that Delaware allows equitable shareholders to sue, Hill has not alleged that he is an equitable owner of FoodTrace stock. Equitable ownership occurs in situations where the legal title to property is in the hands of someone who holds the stock for the benefit of another—the equitable or beneficial owner of the property. See Wellpoint, Inc. v. Comm'r Internal Revenue, 599 F.3d 641, 648 (7th Cir. 2010) ("A trustee has title to the assets of the trust, but the beneficiaries are the real owners because they are entitled to the income or other benefits that the assets of the trust yield ...."). Equitable ownership usually arises from relationships like a trustee and a beneficiary, or an executor of a will and the will's legatees, or other relationships along those lines. See, e.g., Reis v. Hazelett Strip-Casting Corp., 28 A.3d 442, 478 (Del. Ch. 2011); Gamble-Skogmo, Inc. v. Saks, 122 A.2d 120, 121 (Del. 1956); Housman v. Albright, 857 N.E.2d 724, 730 (Ill. App. Ct. 2006) (applying Delaware law). Hill's situation is not comparable. At best, he has alleged that he has some kind of contractual right to the stock, which is not the same as being the current equitable owner of the stock. See, e.g., Reis, 28 A.2d at 478 (distinguishing between equitable ownership and the contractual rights of option or warrant holders). In invoking the equitable-ownership standing, Hill seems to think that "equitable" means common law "equity," that is, in fairness he ought to be the share's owners. But that is not how the Delaware cases cited earlier use the term "equitable" when it comes to equitable ownership. So, even if Delaware law was persuasive here, it would not change the result in Hill's case. The shareholder derivative claim is dismissed because Hill has not alleged that he is a shareholder.
Cf. Housman v. Albright, 857 N.E.2d 724, 730 (Ill. App. Ct. 2006) (discussing case recognizing an apparent distinction between Illinois and West Virginia law, which require plaintiffs in a derivative suit to be shareholders of record, and Delaware law, which allows standing for equitable stockholders); see also Black's Law Dictionary (10th ed. 2014) (defining "beneficial owner" as "[a] corporate shareholder who has the power to buy or sell the shares, but who is not registered on the corporation's books as the owner").
IV. Conclusion
For the reasons explained above, Lynn's motion to dismiss Counts 1, 9, and 4 is denied. Her motion to dismiss Count 6 is granted.
ENTERED:
s/Edmond E. Chang
Honorable Edmond E. Chang
United States District Judge DATE: June 12, 2018