Summary
denying motion to dismiss CFAA claim and observing Van Buren's holding on the exceeds authorized access prong of CFAA “has no application” to claims brought under the without authorization prong
Summary of this case from ACI Payments, Inc. v. Conservice, LLCOpinion
CIVIL ACTION FILE NO. 1:21-CV-471-MHC
2021-09-20
Kent BOWEN, Individually and on Behalf of Others Similarly Situated, Plaintiff, v. PORSCHE CARS, N.A., INC., Defendant.
Alexander James Bukac, Pro Hac Vice, David Stein, Gibbs Law Group LLP, Oakland, CA, Matthew R. Wilson, Pro Hac Vice, Michael Joseph Boyle, Jr., Meyer Wilson Co., LPA, Columbus, OH, Michael A. Caplan, Timothy Brandon Waddell, Caplan Cobb LLP, Atlanta, GA, for Plaintiff. Anderson Kemp, Kara Frances Kennedy, Matthew David Lawson, Cari K. Dawson, Alston & Bird, LLP, Atlanta, GA, for Defendant.
Alexander James Bukac, Pro Hac Vice, David Stein, Gibbs Law Group LLP, Oakland, CA, Matthew R. Wilson, Pro Hac Vice, Michael Joseph Boyle, Jr., Meyer Wilson Co., LPA, Columbus, OH, Michael A. Caplan, Timothy Brandon Waddell, Caplan Cobb LLP, Atlanta, GA, for Plaintiff.
Anderson Kemp, Kara Frances Kennedy, Matthew David Lawson, Cari K. Dawson, Alston & Bird, LLP, Atlanta, GA, for Defendant.
ORDER
MARK H. COHEN, United States District Judge
This case comes before the Court on Defendant Porsche Cars, N.A., Inc. ("Porsche")’s Motion to Dismiss for Failure to State a Claim [Doc. 14].
I. BACKGROUND
Because this case is before the Court on a motion to dismiss, the facts are presented as alleged in Plaintiff's Complaint. See Silberman v. Miami Dade Transit, 927 F.3d 1123, 1128 (11th Cir. 2019) (citation omitted).
On January 29, 2021, Plaintiff Kent Bowen ("Bowen"), the owner of a 2011 Porsche Panamera and an Ohio citizen, filed the present Class Action Complaint [Doc. 1], individually and on behalf of others similarly situated, alleging claims against Porsche arising from damages to Porsche Communication Management devices ("PCMs") which are present in thousands of vehicles distributed by Porsche. Compl. ¶¶ 1, 5. Porsche distributes and sells approximately 60,000 vehicles annually in the United States. Id. ¶¶ 11-12. Most of Porsche's vehicles come equipped with a satellite radio antenna, and all of them come equipped with a PCM. Id. ¶ 12. The PCM is the central control unit for many of the "infotainment" data processing and communication features of Porsche vehicles, allowing Porsche drivers to access a number of options, including radio and sound preferences, the use of paired mobile devices, and GPS navigation services, among other content. Id. ¶¶ 18-19. Sirius XM Radio ("Sirius") is a satellite radio provider with a business relationship with Porsche and, as part of that relationship, Porsche allows and facilitates distribution of Sirius products, including hardware and software for satellite radio use, in Porsche's vehicles. Id. ¶¶ 3, 15-16.
Bowen alleges that a software or firmware update (the "Update") related to the Sirius satellite radio functionality of PCMs was sent to Porsche vehicles on or around May 21, 2020, causing many Porsche owners’ PCMs to malfunction and engage in a constant cycle of rebooting. Id. ¶¶ 2-3. The Update was allegedly sent either by Porsche directly, or from Sirius at Porsche's direction or with Porsche's facilitation. Id. ¶ 3.
The Update allegedly was defective and caused damage to all Porsche vehicles with a satellite radio antenna and a PCM system version 3.0 or 3.1 (the "Affected Vehicles"). Id. ¶¶ 24, 26-27. PCMs for the Affected Vehicles store their programming information on disks contained within hard drives. Id. ¶ 21. In an effort to distribute promotional content, Porsche allegedly transmitted or facilitated the transmission of the Update to the Affected Vehicles remotely, without advance notice or permission of vehicle owners, and regardless of whether the vehicle owner was a Sirius customer. Id. ¶¶ 23-25. Bowen alleges that the Update was unable to write over existing PCM software and caused PCMs in the Affected Vehicles to enter "a near-continuous reboot cycle, draining the vehicle's battery, damaging the PCM hard drive, depriving the owner of the ability to enjoy his vehicle, causing an irritating and potentially dangerous ‘static’ noise, and resulting in numerous other significant problems." Id. ¶¶ 26-27. Porsche allegedly knew or should have known that such Sirius-related software updates put its customers at risk, and Bowen alleges that but for Porsche's failure to adequately test the Update, it would not have caused the damages alleged. Id. ¶¶ 28-30.
Bowen also alleges that owners and lessees of the Affected Vehicles, himself included, have borne the costs of damage caused by the Update and that Porsche, despite acknowledging the damage caused by the Update, has not properly responded or compensated Affected Vehicle owners and lessees. Id. ¶¶ 32-48. The Class Action Complaint contains causes of action for trespass to personalty (Count I); violation of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030 (Count II); negligence (Count III); and unjust enrichment (Count IV). Id. ¶¶ 60-85.
II. LEGAL STANDARD
Federal Rule of Civil Procedure 8(a)(2) requires that a pleading contain a "short and plain statement of the claim showing that the pleader is entitled to relief." FED. R. CIV. P. 8(a)(2). While this pleading standard does not require "detailed factual allegations," the Supreme Court has held that "labels and conclusions" or "a formulaic recitation of the elements of a cause of action will not do." Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). Under Federal Rule of Civil Procedure 12(b)(6), a claim will be dismissed for failure to state a claim upon which relief can be granted if it does not plead "enough facts to state a claim to relief that is plausible on its face." Twombly, 550 U.S. at 570, 127 S.Ct. 1955. The Supreme Court has explained this standard as follows:
A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. The plausibility standard is not akin to a "probability requirement," but it asks for more than a sheer possibility that a defendant has acted unlawfully.
Ashcroft, 556 U.S. at 678, 129 S.Ct. 1937 (internal citation omitted). Thus, a claim will survive a motion to dismiss only if the factual allegations in the pleading are "enough to raise a right to relief above the speculative level." Twombly, 550 U.S. at 555, 127 S.Ct. 1955.
At the motion to dismiss stage, the court accepts all well-pleaded facts in the plaintiff's complaint as true, as well as all reasonable inferences drawn from those facts. McGinley v. Houston, 361 F.3d 1328, 1330 (11th Cir. 2004) ; Lotierzo v. Woman's World Med. Ctr., Inc., 278 F.3d 1180, 1182 (11th Cir. 2002). Not only must the court accept the well-pleaded allegations as true, but these allegations must also be construed in the light most favorable to the pleader. Powell v. Thomas, 643 F.3d 1300, 1302 (11th Cir. 2011). However, the court need not accept legal conclusions, nor must it accept as true legal conclusions couched as factual allegations. Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. Thus, evaluation of a motion to dismiss requires the court to assume the veracity of well-pleaded factual allegations and "determine whether they plausibly give rise to an entitlement to relief." Id. at 679, 129 S.Ct. 1937.
III. DISCUSSION
Porsche argues that all of Bowen's claims should be dismissed for failure to state a claim pursuant to Rule 12(b)(6). Def.’s Mem. of Law in Supp. of Its Mot. to Dismiss ("Def.’s Mem.") [Doc. 14-1]. The Court will address Porsche's argument as to each claim individually, but will begin with the sole federal cause of action even though it is not raised in the Class Action Complaint as the first cause of action.
Bowen asserts both diversity and federal question jurisdiction in the Class Action Complaint. Compl. ¶¶ 7-8.
A. Bowen States a Claim for a Violation of the CFAA.
The CFAA "prohibits accessing a computer and obtaining information without authorization or by exceeding authorized access." Diamond Power Int'l., Inc. v. Davidson, 540 F. Supp. 2d 1322, 1341 (N.D. Ga. 2007). Bowen brings his CFAA claims pursuant to 18 U.S.C. §§ 1030(a)(5)(B) and (C). Compl. ¶¶ 68-70. These sections penalize anyone who:
(B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or
(C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.
18 U.S.C. §§ 1030(a)(5)(B), (C). Although principally a criminal statute, the CFAA provides that "any person who suffers damage or loss [as a result of a violation] ... may maintain a civil action ... for compensatory damages and injunctive relief or other equitable relief." Diamond Power, 540 F. Supp. 2d at 1341 (quoting 18 U.S.C. § 1030(g) ).
"To make out a claim under the CFAA, [a plaintiff] must prove that [a defendant] has (1) intentionally accessed (2) a protected computer (3) without authorization, and (4) as a result of such conduct, has (5) intentionally, recklessly or otherwise caused (6) damage." FERCO Enters., Inc. v. Taylor Recycling Facility LLC, No. 1:05-CV-2980-ODE, 2007 WL 9701361, at *30 (N.D. Ga. Oct. 16, 2007), aff'd, 291 F. App'x 304 (11th Cir. 2008). Porsche argues that Bowen's CFAA claim fails because (1) Bowen has not sufficiently alleged that Porsche intended to access Bowen's PCM, (2) any alleged access was authorized because Bowen consented to receiving satellite radio transmissions, and (3) Bowen fails to allege damages sufficient to meet the $5,000 threshold for CFAA claims. Def.’s Mem. at 14-20. The Court will address these arguments seriatim.
1. The Class Action Complaint Adequately Pleads Porsche Acted Intentionally Under the CFAA.
Porsche argues that Bowen has not pleaded that Porsche intentionally accessed the PCMs without authorization because "[b]y purchasing a car with a satellite receiver, a buyer accepts—indeed consents to—the type of access Mr. Bowen alleges." Def.’s Mem. at 14. In response, Bowen asserts that he has satisfied his pleading requirement by alleging that Porsche intentionally transmitted the Update to the PCMs. Pl.’s Mem. in Opp'n to Mot. to Dismiss ("Pl.’s Resp.") [Doc. 21] at 5.
The intent element under the CFAA requires merely that access to a computer system not be a careless or inadvertent mistake. See, e.g., Health First, Inc. v. Hynes, No. 6:11-CV-715-ORL-41KRS, 2014 WL 12648552, at *10 (M.D. Fla. Sept. 17, 2014), aff'd, 628 F. App'x 723 (11th Cir. 2016). An inquiry into a defendant's particular motives is not necessary so long as he purposefully accessed the computer at issue. Id.; see also Fla. Atl. Univ. Bd. of Trs. v. Parsont, 465 F. Supp. 3d 1279, 1291 (S.D. Fla. 2020) ("[T]he CFAA does not limit its own reach to ‘personal’ or ‘direct’ access. To the contrary, it penalizes even indirect access to a ‘protected computer’ "). Here, Bowen specifically alleges that Porsche "intentionally accessed" the PCMs by either directly sending or facilitating the transmittal of the Update. Compl. ¶¶ 23, 68. These allegations are plausible because Bowen also pleads that Porsche had the technical capacity to modify PCMs and that Porsche subsequently released a statement to Porsche owners about the damage allegedly caused by the Update. Id. ¶¶ 22, 36.
In addition, to the extent Porsche argues that it is not liable because Bowen pleaded in the alternative that Sirius transmitted the Update, courts in this circuit have held that even indirect access through a third party may establish intent under the CFAA. See Parsont, 465 F. Supp. 3d at 1291 (citing Teva Pharm. USA, Inc. v. Sandhu, 291 F. Supp. 3d 659, 671 (E.D. Pa. 2018) ). Accordingly, the Court finds that Bowen has sufficiently pleaded that Porsche intentionally accessed the PCMs under the CFAA.
2. The Class Action Complaint Adequately Pleads Porsche Did Not Have Authorization to Access the PCMs Under the CFAA.
Porsche asserts that Bowen's purchase of a vehicle with an antenna which receives Sirius satellite radio transmissions amounts to consent to receive software updates that modify the vehicle's PCM. Def.’s Mem. at 15-17. First, in order to find that Bowen consented to Porsche accessing his PCM through his purchase and use of a vehicle with a satellite antenna, the Court would have to consider evidence not yet produced in this case. Second, even if this Court could determine from the alleged facts that Bowen's purchase of a vehicle with a satellite antenna constitutes consent to receive satellite transmissions in general, Porsche's argument that such consent extends to software updates to his PCM is beyond the scope of the Court's inquiry at this stage of the litigation.
In support of its argument that Bowen tacitly authorized the Update, Porsche cites to three clearly distinguishable cases. Def.’s Mem. at 15-16 (citing In re iPhone Application Litig., 844 F. Supp. 2d 1040 (N.D. Cal. 2012) ; In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d 434 (N.D. Cal. 2018) ; and In re AOL, Inc. Version 5.0 Software Litig., 168 F. Supp. 2d 1359 (S.D. Fla. 2001) (collectively, the "Download Cases")). Porsche correctly points out that in each of the Download Cases, the plaintiffs’ act of voluntarily downloading certain software updates or applications precluded CFAA claims for unauthorized access. Def.’s Mem. at 15-17. However, for that exact reason, Porsche's cited authority is distinguishable from this case.
In the Download Cases, the plaintiffs all took overt action to grant access or authorization when they voluntarily downloaded and installed an update or application. In each of those cases, the court's holding hinged on that overt step which amounted to consent to the allegedly unlawful conduct. See In re iPhone Application Litig., 844 F. Supp. 2d at 1066 ("Voluntary installation of software that allegedly harmed the phone was voluntarily downloaded by the user.... Apple had authority to access the iDevice ... as a result of the voluntary installation of the software."); In re Apple Inc. Device Performance Litig., 347 F. Supp. 3d at 452 ("Here, Apple had permission to access Plaintiffs’ iPhones. Indeed, Plaintiffs gave Apple permission by choosing to voluntarily download and install the iOS updates."); In re Am. Online, Inc., 168 F. Supp. 2d at 1368 ("[T]he consumers expressly authorized the installation of AOL 5.0 on their computers."). Such an overt action is not contained in the allegations of this case nor agreed to by all parties. Porsche's contention that Diamond Power compels a more narrow interpretation of "without authorization" also is mistaken because in that case there was "no dispute that Davidson was authorized to initially access the computers he used .... [and] no dispute that his level of authorized access included express permission (and password access) to obtain the specific information he later disclosed ...." Diamond Power, 540 F. Supp. 2d at 1343. In none of these cases did the court find that the passive receipt of digital signals, alone, amounts to open authorization to install a software update onto the owner's device.
This case also is distinguishable from Van Buren v. United States, ––– U.S. ––––, 141 S. Ct. 1648, 210 L.Ed.2d 26 (2021), which Porsche filed as supplemental authority on June 9, 2021 [Doc. 33]. In Van Buren, the defendant, a police sergeant, was paid by an FBI informant to search the state law enforcement computer database for a license plate of a woman. Id. at 1653. The defendant was charged with a felony violation of the CFAA on the ground that running the license plate for the third party violated the "exceeds authorized access" clause of 18 U.S.C. § 1030(a)(2). Id. The Supreme Court's decision has no impact on the Court's consideration of Porsche's Motion to Dismiss. First, in Van Buren, the parties agreed that the defendant was authorized to use his patrol car computer to log into the law enforcement computer database to acquire license plate information. Id. at 1654. Second, the issue in Van Buren was whether the provision in 18 U.S.C. § 1030(a)(2) made it illegal for the defendant to obtain the license plate information for the purpose intended. Id. This required the Supreme Court to analyze the CFAA's definition of "exceeds authorized access," which revolved around the use of the phrase to obtain information "that the accessor is not entitled so to obtain." Id. at 1654-57. Suffice it to say that the Supreme Court's decision that the police officer could use the law enforcement database to retrieve the license plate in question has no application to the issues before this Court.
Unlike the provisions of the CFAA involved in this case, 18 U.S.C. § 1030(a)(2) makes it illegal for someone who "intentionally accesses a computer without authorization or exceeds authorized access[.]"
Bowen's tacit consent to receive satellite radio signals does not imply consent to modify his vehicle's software. Bowen alleges that the PCM does not solely function as a satellite radio, but also encompasses his vehicle's GPS system, on-board computer, and features that pair with his telephone. Compl. ¶¶ 18-19. In addition, a satellite antenna is a distinctly different device and feature from a PCM. See id. ¶ 12. While the satellite antenna may utilize the PCM, nothing in the facts alleged implies that access to the antenna or consent to receive satellite radio transmissions is the same as an authorization to directly access, much less modify, the PCM.
After discovery, Porsche may be able to provide evidence that Bowen did authorize the Update, but viewing the pleadings in the light most favorable to the plaintiff, Bowen's allegations are sufficient to survive a motion to dismiss. Accordingly, the Court finds that Bowen has sufficiently pleaded that Porsche was unauthorized to access the PCMs under the CFAA.
Because Bowen has sufficiently pleaded that Porsche had no authorization to access his PCM at all, the Court need not address Bowen's "intended use" argument.
3. Bowen's CFAA Claim Meets the Minimum Damages Threshold.
Finally, Porsche argues that Bowen has failed to sufficiently allege facts supporting damages that meet the CFAA's minimum threshold. Def.’s Mem. at 18-20. To successfully assert his civil CFAA claim, Bowen must allege facts to support a finding of at least $5,000.00 in economic damages resulting from the alleged violation. 18 U.S.C. §§ 1030(c)(4)(A)(i)(I), (g).
The plain language of the [CFAA] includes two separate types of loss:
(1) reasonable costs incurred in connection with such activities as responding to a violation, assessing the damage done, and restoring the affected data, program system, or information to its condition prior to the violation; and (2) any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.
Brown Jordan Int'l, Inc. v. Carmicle, 846 F.3d 1167, 1174 (11th Cir. 2017). Bowen alleges specifically that he was billed $3,270.78 to replace his PCM and that he spent between five and ten hours of time he otherwise would have spent working to address the issue. Compl. ¶¶ 47-48. According to Bowen, this time was worth at least $2,000 in addition to the direct costs of his repairs. Id. While the value of Bowen's time may be disputed at a later stage in this litigation, when considering a motion to dismiss, this Court is required to construe the pleadings in the light most favorable to the plaintiff. See also Hynes, 2014 WL 12648552, at *11 ("[T]he final [CFAA] element, a loss exceeding $5,000, is ultimately a question of fact for the factfinder."). Thus, the Court takes Bowen's asserted valuation of his working hours as true and finds that Bowen has sufficiently pleaded the statutory minimum loss for a CFAA claim.
Even if this Court did not consider Bowen's $2,000 of damages alleged for time spent addressing the PCM repairs, he has still pleaded facts supporting a finding of aggregate damages sufficient to meet the $5,000 CFAA minimum. Other district courts have held that individual damages for a putative class under the CFAA may be aggregated if the violation can be described as "one act." In re iPhone Application Litig., 844 F. Supp. 2d at 1066. This Court agrees.
[Defendant]’s interpretation of the dangling participle, "to a protected computer," would lead to the absurd result that a party who accesses one computer without authorization, and thereby causes $5,000 worth of damage to that one computer, would be guilty of violating the CFAA and, therefore, civilly liable. On the other band, a party who accesses millions of computers and causes only $100 worth of damage to each computer
would not be guilty of violating the CFAA.
In re Am. Online, Inc., 168 F. Supp. 2d at 1374. Bowen has alleged that the Update affected "at least thousands of Porsche owners" and that those who had to replace their PCMs likely spent between $2,000 and $4,000 apiece. Compl. ¶¶ 32, 53. Thus, if even one of Bowen's alleged class members suffered damages similar to Bowen's, the CFAA damages threshold would be met. The Court finds that Bowen has sufficiently pleaded that Porsche caused over $5,000 in damage through its alleged violation of the CFAA.
Consequently, for the reasons stated above, Porsche's motion to dismiss Bowen's CFAA claim is DENIED.
B. Bowen States a Claim for Trespass to Personalty.
1. Georgia Common Law Governs Bowen's Trespass to Personalty Claim.
Porsche concedes that Bowen's negligence and unjust enrichment claims are governed by Georgia common law but contends that his trespass to personalty claim is governed by Ohio common law. Def.’s Mem. at 6. In support of this argument, Porsche relies on Glock v. Glock, 247 F. Supp. 3d 1307 (N.D. Ga. 2017), for the proposition that, because the action for trespass to personalty is governed by Georgia statutory law, Ohio common law should apply "to avoid the extraterritorial application of Georgia statutes." Id. In response, Bowen argues that Glock does not support Porsche's contentions, that Georgia's common law for trespass has not been usurped by statute, and that Georgia's choice of law principles require application of Georgia common law. Pl.’s Resp. at 13-15.
"When it exercises jurisdiction based on diversity of citizenship, 28 U.S.C. § 1332, a federal court must apply the choice of law rules of the forum state to determine which substantive law governs the action." U.S. Fid. & Guar. Co. v. Liberty Surplus Ins. Corp., 550 F.3d 1031, 1033 (11th Cir. 2008) (citation omitted); see also Boardman Petroleum, Inc. v. Federated Mut. Ins. Co., 135 F.3d 750, 752 (11th Cir. 1998) ("Federal courts sitting in diversity apply the forum state's choice-of-law rules.").
In Georgia,
[u]nder the rule of lex loci delicti, tort cases are governed by the substantive law of the state where the tort was committed. Under the rule of lex fori, procedural or remedial questions are governed by the law of the forum, the state in which the action is brought.
Lloyd v. Prudential Sec., Inc., 211 Ga. App. 247, 248, 438 S.E.2d 703 (1993) (citations omitted); see also Federated Rural Elec. Ins. Exch. v. R.D. Moody & Assocs., Inc., 468 F.3d 1322, 1325 (11th Cir. 2006) (same). "[T]he place of wrong, the locus delicti , is the place where the injury sustained was suffered rather than the place where the act was committed, or ... it is the place where the last event necessary to make an actor liable for an alleged tort takes place." McCarthy v. Yamaha Motor Mfg. Corp., 994 F. Supp. 2d 1329, 1332 (N.D. Ga. 2014) (quoting Risdon Enters., Inc. v. Colemill Enters., Inc., 172 Ga. App. 902, 903, 324 S.E.2d 738 (1984) ).
There is an exception to this general principle. "As a matter of comity, a Georgia court will defer to another state's statutes, as well as judicial decisions authoritatively interpreting those statutes, in determining the law of that state." Coon v. Med. Ctr., Inc., 300 Ga. 722, 729, 797 S.E.2d 828 (2017). "In the absence of a statute, however, at least with respect to a state where the common law is in force, a Georgia court will apply the common law as espoused by the courts of Georgia." Id. See also In re Equifax, Inc. Customer Data Sec. Breach Litig., 371 F. Supp. 3d 1150, 1159 (N.D. Ga. 2019) (citing In re Tri-State Crematory Litig., 215 F.R.D. 660, 677 (N.D. Ga. 2003) and Coon, 300 Ga. at 729, 797 S.E.2d 828 ); Frank Briscoe Co., Inc. v. Ga. Sprinkler Co., Inc., 713 F.2d 1500, 1503 (11th Cir. 1983) (citations omitted) ("When no statute [of another state] is involved, Georgia courts apply the common law as developed in Georgia rather than foreign case law."). Porsche does not cite to a statute from the state of Ohio which would apply with respect to Bowen's trespass to personalty claim.
Instead, Porsche contends that Bowen's trespass to personalty claim still should be governed by Ohio common law because Bowen's claim is governed by O.C.G.A. §§ 51-10-1 through 51-10-3. None of Porsche's cited authority supports its contention that foreign common law should apply when a Georgia statute codifies the tort allegedly committed out-of-state. In Glock, the district court found that the plaintiff failed to sufficiently state a claim when she did not allege a domestic injury under Georgia's RICO statute; however, Glock contains no choice of law analysis. See Glock, 247 F. Supp. 3d at 1318-20.
In its reply brief, Porsche asserts that only one statute applies to Bowen's trespass to personalty claim: O.C.G.A. § 51-10-3. Def.’s Reply in Supp. of its Mot. to Dismiss ("Def.’s Reply") [Doc. 25] at 1-2. Given that none of the cases cited by Porsche support its argument that Ohio common law should apply in this case, the Court need not resolve this discrepancy. None of Porsche's cited authority would support a conclusion that Georgia has eliminated the common law tort of trespass, so that the existence of concurrent statutory law would not change the choice of law analysis. See Green v. Johnson, 71 Ga. App. 777, 32 S.E.2d 443 (1944) (citing Selma, Rome and Dalton R. Co. v. Lacy, 43 Ga. 461 (1871) ) (declining to apply Georgia statutory law extraterritorially to a tort alleged to have occurred in South Carolina but still following Georgia's interpretation of common law).
Porsche's citation to Auld v. Forbes, 309 Ga. 893, 848 S.E.2d 876 (2020), fares no better. See Def.’s Reply at 3. The Supreme Court of Georgia's holding in Auld had nothing to do with whether common law of a foreign state should be applied over a Georgia statute; Auld concerned the issue of which state's statute of limitations applied under the principle of lex fori. Auld, 309 Ga. at 895, 848 S.E.2d 876 ("Thus, when the applicable foreign law creates a cause of action that is not recognized in the common law and includes a specific limitation period, that limitation period is a substantive provision of the foreign law that governs, and it applies when it is shorter than the period provided for under Georgia law.").
In its reply, Porsche argues, for the first time, that application of Georgia law would violate due process. Def.’s Reply at 4-5. As a general rule, federal courts in this Circuit do not consider arguments that are presented for the first time in a reply brief. See Herring v. Sec'y, Dep't of Corrs., 397 F.3d 1338, 1342 (11th Cir. 2005) ("As we repeatedly have admonished, arguments raised for the first time in a reply brief are not properly before a reviewing court."). Nevertheless, even if the Court considered this argument, it would fail. The application of Georgia law here is consistent with due process if Georgia has "significant contact or significant aggregation of contacts to the claims asserted by each member or the plaintiff class, contacts creating state interests in order to ensure that the choice of [Georgia] law is not arbitrary or unfair." Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 821-22, 105 S.Ct. 2965, 86 L.Ed.2d 628 (1985) (citations and punctuation omitted); see also Kirkpatrick v. J.C. Bradford & Co., 827 F.2d 718, 725 n.6 (11th Cir. 1987) (citation omitted) ("[T]he law of Georgia could be applied consistent with due process only if the particular transaction had some significant relation to Georgia."). Porsche argues that the facts of this case require this Court to find that the application of Georgia law would be arbitrary and unfair. In support of this argument, Porsche cites to the district court's decision in Krise v. SEI/Aaron's, Inc., No. 1:14-CV-1209-TWT, 2017 WL 3608189 (N.D. Ga. Aug. 22, 2017), which determined that due process prohibited the application of Georgia law for invasion of privacy claims based on software installed on a computer the defendant leased to plaintiffs.
Curiously, Porsche fails to explain how the application of Georgia law would violate due process regarding Bowen's trespass claim while Porsche continues to cite Georgia law in support of its arguments against the other state-law claims.
This case is distinguishable from Krise. In Krise, the court found insufficient contacts with a defendant headquartered in Georgia, but the actions most relevant to the alleged cyber tort occurred entirely in Connecticut. Krise, 2017 WL 3608189 at *8. Specifically, while the Krise defendant purchased software and paid for it from its Atlanta office, the plaintiffs lived in Connecticut, the subject computer was leased from defendant's Connecticut store, the allegedly tortious software was installed on the computer in Connecticut, and any information gathered by the software would have been transmitted to defendant's Connecticut store employees. Id. Thus, the allegedly tortious conduct itself had no ties to the state of Georgia. In contrast, Bowen has asserted that "a substantial part of the events giving rise to the claims" occurred in Georgia and that Porsche transmitted or authorized the Update which caused the alleged damages from Porsche's Georgia headquarters. Compl. ¶ 10; see also Terrill v. Electrolux Home Prods., Inc., 753 F. Supp. 2d 1272, 1282 (S.D. Ga. 2010) (finding that the plaintiffs’ allegations that the defendant's principal place of business was in Georgia and that "the corporate decisions surrounding [defendant]’s response to the alleged defects were made in Augusta, Georgia" established sufficient contacts for the application of Georgia law to out-of-state tort claims).
Based upon the foregoing, this Court will apply Georgia law to all of the state law claims, including trespass to personalty.
2. Bowen Alleges Sufficient Facts to Support His Trespass to Personalty Claim.
As an initial matter, Porsche does not argue or cite to any authority in its motion supporting a dismissal of Bowen's trespass claim when properly applying Georgia common law. On this ground alone, the motion to dismiss that claim fails. Porsche finally argues that Bowen fails to state a claim under Georgia law in its reply brief (Def.’s Reply at 7-8) which, as stated earlier, is usually not permitted in this Circuit. See supra part III.B. 1. That deficiency notwithstanding, the Court will address the parties’ arguments under the correct choice of law.
Porsche contends that Bowen's trespass claim is deficient because (1) there is no allegation that Porsche made contact with Bowen's personal property, (2) Bowen fails to allege that Porsche had an intent to trespass, and (3) Bowen consented to the alleged trespass. Def.’s Mem. at 8-13; Def.’s Reply at 5-8. Bowen disputes Porsche's contentions, arguing that he has sufficiently pleaded interference with goods under Georgia law, that Sirius alternatively sent the Update at the direction of Porsche, and that there is no scienter requirement to establish a claim for trespass. Pl.’s Opp'n at 16-19.
The allegations in Bowen's Complaint are sufficient to state a claim for trespass to personalty.
"Any unlawful abuse of or damage done to the personal property of another constitutes a trespass for which damages may be recovered." OCGA § 51-10-3. Where "the property alleged to have been taken was personalty, and alleged to have been taken without the owner's consent, such action is tortious and a trespass for which damages may be recovered." Lowery v. McTier, 99 Ga. App. 423 (1), 108 S.E.2d 771 (1959). "The gist of such an action of trespass to personal property is the injury done to the possession of the property." Duncan v. Ellis, 63 Ga. App. 687, 689, 11 S.E.2d 841 (1940). "The action of trespass to personalty is concurrent with the action of ... conversion, although the two actions are not entirely coextensive. Trespass will doubtless lie for acts of interference with goods." Maryland Cas. Ins. Co. v. Welchel, 257 Ga. 259, 260 (1), 356 S.E.2d 877 (1987) (citations and punctuation omitted).
Caldwell v. Church, 341 Ga. App. 852, 856-57, 802 S.E.2d 835 (2017) (alterations accepted and parallel citations omitted).
Courts applying Georgia law have found that "digital trespass" can sustain a claim for trespass upon one's personal belongings. See, e.g., AT&T Mobility LLC v. Does 1-4, No. 1:09-cv-00277-JOF, 2011 WL 13213864, at *2 (N.D. Ga. May 26, 2011) (finding that the defendant's transmittal of unsolicited telemarking calls interfered with the plaintiff's property rights); Skapinetz v. CoesterVMS.com, Inc., No. PX-17-1098, 2018 WL 805393, at *5 (D. Md. Feb. 9, 2018) (finding that the plaintiff plausibly established a trespass claim by alleging that the defendant accessed his email account without authorization). Courts in other districts also have held that "temporary electronic intrusion upon another person's computerized electronic equipment" can constitute trespass. See Mey v. Got Warranty, Inc., 193 F. Supp. 3d 641, 646-47 (N.D. W. Va. 2016) (listing cases). Under Georgia law, an action for trespass requires that the trespass be "without the owner's consent ...." Caldwell, 341 Ga. App. 852, 856, 802 S.E.2d 835 (2017) ; see also Mr. Transmission, Inc. v. Thompson, 173 Ga. App. 773, 773, 328 S.E.2d 397 (1985). Here, the Complaint specifically alleges that "[t]he Update was transmitted to vehicles remotely and without advance notice to, or permission from, drivers." Compl. ¶ 23.
Porsche primarily relies on two cases in support of its argument that Bowen consented to the Update; however, neither of them are from courts in this circuit, and both are distinguishable. Porsche primarily relies on CompuServe Inc., v. Cyber Promotions, Inc., 962 F. Supp. 1015 (S.D. Ohio 1997), where the court noted that "there is at least a tacit invitation for anyone on the internet to utilize plaintiff's computer equipment to send e-mail to its subscribers." Id. at 1023-24. But the court in CompuServe was referring to a business that marketed the use of its e-mail service, and the only damage alleged in that case arose from misuse of functions otherwise permitted by CompuServe. Id. Porsche also cites Brodsky v. Apple Inc., 445 F. Supp. 3d 110 (N.D. Cal. 2020), but that case is distinguishable as well. In Brodsky, the basis of the plaintiffs’ claims was the effect of a software update that plaintiffs voluntarily installed, and there was no way for the defendant to activate the software "unilaterally and without Plaintiffs’ authorization." 445 F. Supp. 3d at 123 (citation and punctuation omitted). In addition, the Brodsky court never found that the mere ownership and use of a device connected to the internet established consent to software updates; instead, the Court noted that the updates to plaintiffs’ phones themselves were voluntary. Id.
Bowen's claims stand in stark contrast to those addressed in CompuServe and Brodsky. Here, Bowen alleges that, unlike the Brodsky plaintiffs, he never took the affirmative step of downloading or otherwise approving the Update. Compl. ¶ 23. Even if Bowen's ownership of a Porsche vehicle with a satellite antenna implies tacit consent to the receipt of satellite transmissions, that consent is a far stretch from the conclusion that Bowen also consented to transmissions which would modify his PCM. See Mr. Transmission, Inc., 173 Ga. App. at 773, 328 S.E.2d 397 (sustaining a claim for trespass where the defendant's actions exceeded the consent given by the plaintiff). This case is more analogous to ownership of a cell phone which, although it may tacitly imply consent to receive some phone calls or texts, does not authorize all calls or texts to the extent a claim for trespass cannot be established by unsolicited communications. See Mey, 193 F. Supp. 3d at 647 (citations omitted). Bowen's ownership and use of a Porsche vehicle with a satellite antenna alone does not imply that he consented to the Update which caused the alleged damage to his PCM.
Porsche's argument that Bowen does not allege that Porsche was the party who made physical contact with Bowen's personal property also is without merit because Bowen specifically pleads that Porsche transmitted the Update or, in the alternative , that Porsche facilitated Sirius's transmission of the Update. Compl. ¶ 23; see also FED. R. CIV. P. 8(d)(2) (permitting alternative pleading). In addition, Georgia law allows vicarious liability for trespass to chattels. See Whatley v. Manry, 60 Ga. App. 273, 273, 3 S.E.2d 839 (1939).
Finally, with respect to Porsche's contention that Bowen failed to adequately allege that Porsche had an intent to trespass, Porsche fails to cite to a Georgia case where a scienter requirement has been imposed as a prerequisite for a claim for trespass to personalty. Even if Bowen was required to allege intentional contact, as is the case under Ohio law, Porsche's cited authority describes the transmission of electronic messages or signals to specific computers as "clearly intentional," CompuServe Inc., 962 F. Supp. at 1021, and Bowen alleges that the Update was directed specifically to "all owners of a Porsche vehicle equipped with a satellite radio antenna." Compl. ¶ 23. In addition, Ohio law will sustain a claim for trespass premised on internet contact that amounts to "intentionally using or intermeddling with the [plaintiff's] chattel," and "[i]ntermeddling means intentionally bringing about a physical contact with the chattel." Jedson Eng'g, Inc. v. Spirit Const. Servs., Inc., 720 F. Supp. 2d 904, 925 (S.D. Ohio 2010). Thus, even if this Court applied Ohio law, Bowen's claim for trespass survives Porsche's motion to dismiss.
Accordingly, Porsche's motion to dismiss Bowen's claim for trespass to personalty is DENIED.
C. Bowen Does Not State a Plausible Claim for Negligence.
Porsche also argues that Bowen fails to allege a claim for negligence because he fails to identify a duty owed by Porsche to Bowen. Def.’s Mem. at 20-23. "In Georgia, the essential elements of a cause of action for negligence are: (1) a legal duty; (2) a breach of this duty; (3) an injury; and (4) a causal connection between the breach and the injury." Morton v. Horace Mann Ins. Co., 282 Ga. App. 734, 735, 639 S.E.2d 352 (2006). "A legal duty sufficient to support liability in negligence is either a duty imposed by a valid statutory enactment of the legislature or a duty imposed by a recognized common law principle declared in the reported decisions of our appellate courts." Ceasar v. Wells Fargo Bank, N.A., 322 Ga. App. 529, 533, 744 S.E.2d 369 (2013) (citation omitted). This duty may arise from state or federal statutes. See McLain v. Mariner Health Care, Inc., 279 Ga. App. 410, 412-13, 631 S.E.2d 435 (2006) (holding that the trial court erred by dismissing a negligence action based upon a violation of Medicare and Medicaid regulations).
The Complaint does not identify a statutory basis for its negligence claim; instead, the only duty alleged is Porsche's "duty to refrain from depriving or interfering with possession of, or otherwise causing damage to, Plaintiff's ... personal property and chattel." Compl. ¶ 76. "Georgia law, however, does not impose an absolute duty to avoid injuring others." In re Arby's Rest. Grp. Inc. Litig., No. 1:17-CV-0514-AT, 2018 WL 2128441, at *3 (N.D. Ga. Mar. 5, 2018) (citations omitted); see also T.J. Morris Co. v. Dykes, 197 Ga. App. 392, 395, 398 S.E.2d 403 (1990) (reversing verdict in trial court because the trial judge's jury charge was "deficient in that it implied that negligence is the breach of an absolute duty to avoid injuring others ....").
Bowen now argues in his opposition to the motion to dismiss that because Porsche either sent or helped send the Update, it "owed a duty to use reasonable care and skill in doing so." Pl.’s Opp'n at 22. As opposed to the allegations of the Complaint which allege a general duty to avoid damaging personal property, this is a new allegation not included in the Complaint, which cannot be amended in an opposition brief. Huls v. Llabona, 437 F. App'x 830, 832 n.5 (11th Cir. 2011) ("Because [plaintiff] raised this argument for the first time in his response to [defendant]’s motion to dismiss, instead of seeking leave to file an amended complaint, pursuant to Fed.R.Civ.P. 15(a), it was not properly raised ...."); see also Jallali v. Nova Se. Univ., Inc., 486 F. App'x 765, 767 (11th Cir. 2012) ("a party cannot amend a complaint by attaching documents to response to a motion to dismiss") (citing Fin. Sec. Assur., Inc. v. Stephens, Inc., 500 F.3d 1276, 1284 (11th Cir. 2007) ).
None of the authority cited by Bowen supports a negligence claim premised on a general duty to avoid damaging property, as alleged in the Complaint. See Encompass Indem. Co. v. Ascend Techs., Inc., No. 1:13-CV-02668-SCJ, 2015 WL 10582168, at *6 (N.D. Ga. Sept. 29, 2015) (punctuation and citations omitted) ("Georgia law imposes an obligation upon everyone who attempts to do anything, even gratuitously, for another, to exercise some degree of care and skill in the performance of what he has undertaken."); Energy Sys. Grp., LLC v. Ware, Inc., No. 1:14-CV-03049-ELR, 2016 WL 7888028, at *1, 3 (N.D. Ga. June 28, 2016) (finding that the defendant contractor who undertook the completion of maintenance and repair services for plaintiff "had a duty to use ordinary care in making the repairs and service to [plaintiff's] boiler ...."); Unger v. Bryant Equip. Sales & Servs., Inc., 255 Ga. 53, 54, 335 S.E.2d 109 (1985) (finding that the defendant had a duty arising from its allegedly negligent installation and service of a cattle feeding system); Monroe v. Guess, 41 Ga. App. 697, 697, 154 S.E. 301 (1930) (affirming verdict for plaintiffs where the defendant had a duty to avoid harming plaintiffs in his performance of duties under a contract between the parties).
In addition, to the extent Bowen argues that O.C.G.A. §§ 51-9-1 and 51-10-3 establish the alleged duty, his argument misinterprets those statutes. O.C.G.A. §§ 51-9-1 and 51-10-3 establish the independent torts of interfering with the enjoyment of private property and trespass, which allow a plaintiff to bring separate claims under those statutes; however, neither addresses the existence of a duty which would support a negligence claim in addition to commission of the codified tort. See O.C.G.A. § 51-9-1 ("The right of enjoyment of private property being an absolute right of every citizen, every act of another which unlawfully interferes with such enjoyment is a tort for which an action shall lie."); id. § 51-10-3 ("Any unlawful abuse of or damage done to the personal property of another constitutes a trespass for which damages may be recovered."). Accordingly, the Court finds that Bowen has not sufficiently pleaded that Porsche owed a duty to Bowen and, consequently, Porsche's motion to dismiss Bowen's claim for negligence is GRANTED.
D. Bowen Does Not State a Claim for Unjust Enrichment.
Finally, Porsche argues that Bowen's unjust enrichment claim fails because Bowen has failed to adequately plead that Bowen conferred a benefit on Porsche and that Porsche was aware of such benefit. Def.’s Mem. at 24-25. This Court agrees.
"The concept of unjust enrichment in law is premised upon the principle that a party cannot induce, accept, or encourage another to furnish or render something of value to such party and avoid payment for the value received." Morris v. Britt, 275 Ga. App. 293, 620 S.E.2d 422 (2005). To state a claim for unjust enrichment under Georgia law, a plaintiff must assert that (1) the defendant induced or encouraged the plaintiff to provide something of value to the defendant; (2) the plaintiff provided a benefit to the defendant with the expectation that the defendant would be responsible for the cost thereof; and (3) the defendant knew of the benefit being bestowed upon it by the plaintiff and either affirmatively chose to accept the benefit or failed to reject it. Campbell v. Ailion, 338 Ga. App. 382, 387, 790 S.E.2d 68 (2016). In addition, "to maintain an action for unjust enrichment, it is not necessary that the plaintiff allege a direct payment by the plaintiff to the allegedly unjustly-enriched defendant." Bolinger v. First Multiple Listing Serv., Inc., 838 F. Supp. 2d 1340, 1367 n.2 (N.D. Ga. 2012).
Here, the alleged benefit conferred on Porsche is payment for PCMs purchased to replace those damaged by the Update. Compl. ¶ 83. However, Bowen's alleged facts contradict his assertion that he paid Porsche to repair the PCMs. Specifically, Bowen alleges that he paid Byers Imports, LLC ("Byers") for a replacement PCM. Id. ¶¶ 45-47. Although Bowen describes Byers as his "local Porsche Dealer," he does not allege that Byers had a relationship with Porsche or that Porsche benefitted from Byers’ repair and replacement business. Instead, Bowen, without alleging any other facts to support the allegation, claims that Porsche was paid to repair damaged PCMs. Id. ¶ 83. Bowen's failure to plead facts supporting a finding that Porsche benefitted from the PCM repairs or replacements is fatal to his unjust enrichment claim. Even if Porsche did receive some "downstream" benefit from the payments to third-party business to replace the PCMs, Bowen has not alleged facts to support the conclusion that Porsche induced Bowen to pay for PCM repairs or knew of any alleged benefit it retained. The Complaint alleges that Porsche was aware that the Update caused problems with PCMs and that Porsche had informed dealers of potential solutions; however, according to the pleadings, the proposed solutions did not include replacing the PCM. Compl. ¶ 35 ("Porsche informed its dealers of potential solutions—a ‘handover,’ or a ‘hard reset’ of the PCM settings—but these did not ... resolve the malfunction, nor do they account for the permanent damage the [m]alfunction had already caused."). Bowen also argues that Porsche was unjustly enriched because Porsche's improper conduct in sending or authorizing the Update damaged PCMs and eventually compelled the purchase of new PCMs. Pl.’s Opp'n at 24-25. While these facts support Bowen's claims for trespass and violation of the CFAA, they are irrelevant to his unjust enrichment claim. See AT&T Mobility LLC, 2011 WL 13213864, at *4 (declining to enter default judgment on unjust enrichment claims where "[p]laintiff's theory more closely matches that of trespass or conversion, than unjust enrichment."). Accordingly, Bowen has failed to state a claim for unjust enrichment, and Porsche's motion to dismiss that claim is GRANTED.
To the extent Bowen also argues that Porsche was benefitted by the sale of Porsche vehicles, any sale of affected vehicles would have occurred before the Update and thus been unrelated to the factual basis of Bowen's unjust enrichment claim.
IV. CONCLUSION
For the foregoing reasons, Defendant Porsche Cars, N.A., Inc.’s Motion to Dismiss for Failure to State a Claim [Doc. 14] is GRANTED IN PART and DENIED IN PART. The motion is GRANTED as to Counts III and IV of the Complaint. The motion is otherwise DENIED.
Porsche's request for oral argument [Doc. 14] is DENIED. The Court found that the briefs submitted to the Court were of sufficient assistance to enable the Court to render its decision without the necessity of additional argument. Moreover, Porsche did not indicate that any portion of its oral argument would be conducted by a recently admitted member of the bar, in which case the Court would have granted oral argument. Standing Order [Doc. 4] at 16.
IT IS SO ORDERED this 20th day of September, 2021.