Clark Street Wine Spirits v. Emporos Systems

Full title: CLARK STREET WINE AND SPIRITS (d/b/a Michael Towne Wine and Spirits) and…

Court: United States District Court, E.D. New York

Date published: Nov 24, 2010

754 F. Supp. 2d 474 (E.D.N.Y. 2010)

Opinion

No. 10-CV-1392.

November 24, 2010.

Emily Muider Milmail ) Nea J G e r b e r Eisenberg LLP, Chicago, IL, Matthew John Galluzzo, Galluzzo Johnson LLP, NewYork for Defendant

Ryan Gordon Blanch, The Blanch Law Firm, New York, NY, for Plaintiff.

MEMORANDUM ORDER

JACK B. WEINSTEIN, Senior District Judge.Page 2

I. Introduction

This case rests on serious charges that the defendant and its employees breached plaintiffs' electronic credit and sales system (supplied largely by defendant), resulting in the stealing of credit card information and losses to plaintiffs' customers, and ultimately, to plaintiffs. In view of the large damage that can be done by such thievery and negligence this case must be taken seriously. See, e.g., James Verini, The Great Cyberheist, N.Y. Times Mag., Nov. 10, 2010 (detailing the vast damage caused by online credit card frauds). A jury could find that the defendant — an expert selling computer secrecy protections — did not act appropriately.

Clark Street Wine and Spirits and 88 Seventh Avenue Inc. ("Plaintiffs") sue Emporos Systems Corporation ("Emporos") alleging violations of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 ("CFAA"), and common law claims of gross negligence, negligent supervision, conversion, and breach of contract. It is alleged that a current or former employee of Emporos, which installed credit card processing services for Plaintiffs, misappropriated customers' information. Sought are compensatory and punitive damages. Also requested is a declaratory judgment finding that any fines, penalties, or other judgments against Plaintiffs resulting from this delict are the legal responsibility of Emporos.

Emporos moves to dismiss the First Amended Complaint and Jury Demand for failure to state a claim upon which relief may be granted. Fed.R.Civ.Proc. 12(b)(6).

For the reasons set out below, the motion to dismiss is denied. A motion for sanctions based on Rule 11(c) was denied for reasons stated orally on the record.

II. Facts and Procedural History

For purposes of this motion, the plaintiff's factual allegations are accepted as true, with all reasonable inferences drawn in plaintiff's favor. Bernheim v. Litt, 79 F.3d 318, 321 (2d Cir. 1996). Further discovery is required, particularly to determine if the culprit who stole Plaintiffs' customers' credit card information was an employee of Emporos. By separate order, the magistrate judge was respectfully requested to expedite discovery so that the case can be set for trial in May, 2011.

Emporos is a North Carolina corporation that provides credit card processing services to businesses. Amended Complaint ("Am. Compl.") at ¶ 3. In January 2004, Plaintiffs, New York corporations that sell wine and spirits, entered into Software License Agreements with Emporos to provide credit card software hardware and services. Together, these features are known as a "point-of-sale" system. Am. Compl. at ¶¶ 18, 20; Emporos' Motion to Dismiss ("Def.'s Mot. Dismiss") at Ex B. As part of this system, Plaintiffs allege that Emporos required the installation of a program called "LogMeln." Am. Compl. at ¶ 27. This program allows persons with the specific user name and password to log into Plaintiffs' computers to update and support Emporos' point-of-sale system, no matter where they are physically located. Id. at ¶¶ 28-29.

During the course of 2007, through communications with American Express, Visa, MasterCard, and Cynergydata (Seventh Avenue's credit card processor), Plaintiffs learned that a consumer fraud had been traced to their stores. Am. Compl. at ¶¶ 30-46. Consumers' credit card information was compromised and fraudulent purchases were made on their accounts. Am. Compl. at ¶¶ 30, 33. They were assessed fines and penalties from credit card companies for non-compliance with security protocols; eventually they replaced the proprietary system installed by Emporos. Am. Compl. at ¶¶ 41, 67, 69. To determine the cause of the breach, Plaintiffs employed various information technology services and consultants.

The complaint was filed on March 29, 2010. Plaintiffs' Complaint and Jury Demand ("Original Complaint") ("Orig. Compl."). On May 13, 2010, Emporos moved to dismiss the Original Complaint on numerous grounds: (1) Plaintiffs' failure to allege their capacity to sue as required under Federal Rule of Civil Procedure 9(a); (2) failure to allege subject matter jurisdiction; and (3) with respect to the alleged violation of the CFAA, failure to state a claim upon which relief may be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). Emporos' Motion to Dismiss Plaintiffs' Complaint ("Original Motion to Dismiss") ("Orig. Mot. Dismiss"), at 3-5. On May 28, 2010, Plaintiffs' Amended Complaint added allegations regarding Plaintiffs' corporate status and the elements of a private CFAA claim. Am. Compl. at ¶ 1, 2, 105. Emporos thereafter filed the present Motion to Dismiss.

III. Contentions of the Parties, Law, and Application to Facts

A. Motion to Dismiss Standard

Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss for "failure to state a claim upon which relief may be granted." In reviewing a Rule 12(b)(6) motion, the task of the court "is merely to assess the legal feasibility of the complaint, not to assay the weight of the evidence which might be offered in support thereof." Geisler v. Petrocelli, 616 F.2d 636, 639 (2d Cir. 1980). "The issue is not whether a plaintiff will ultimately prevail but whether the claimant is entitled to offer evidence to support the claims." Scheuer v. Rhodes, 416 U.S. 232, 236 (1974). A court must accept the plaintiffs factual allegations as true, drawing all reasonable inferences in plaintiff's favor. Bernheim v. Litt, 79 F.3d 318, 321 (2d Cir. 1996); see also Ashcroft v. Iqbal, 129 S.Ct. 1937, 1949 (2009) ("To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to `state a claim to relief that is plausible on its face.'" (citation omitted)); Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 556 (2007) ("Asking for plausible grounds to infer an agreement does not impose a probability requirement at the pleading stage. . . .").

B. Propriety of Emporos' Motion to Dismiss Under the Federal Rules 1. Contentions of the Parties

Plaintiffs argue that because Emporos already filed a motion to dismiss that sought to dismiss one of Plaintiffs' claims pursuant to Federal Rule of Civil Procedure 12(b)(6), the current motion to dismiss is improper. Plaintiffs' Memorandum of Law in Opposition to Emporos' Motion to Dismiss ("Pl. Mem. L. Opp.") at 6-8. It is argued that since Emporos' current arguments could have been made in the Original Motion to Dismiss, Emporos may only raise 12(b)(6) arguments in an answer, in a 12(c) motion (which requires an answer), or at trial. Id.

Emporos maintains that this court still has discretion to entertain the 12(b)(6) motion, citing cases which allowed multiple 12(b)(6) motions where the second motion was "not interposed for delay, and its consideration will expedite the disposition of the case on the merits." Def.'s Mot. Dismiss at n. 1. It asserts that the current motion was not interposed for delay. Id. It is contended that even if Plaintiffs' position were correct, Emporos may file an answer and convert the current motion to dismiss into a motion for judgment on the pleadings under Rule 12(c), because the defense of failure to state a claim is not waivable under Rule 12(h). Id. 2. Law

Federal Rule of Civil Procedure Rule 12(g) generally provides that "a party that makes a motion under this rule must not make another motion under this rule raising a defense or objection that was available to the party but omitted from its earlier motion." The defense provided by Rule 12(b)(6) for failure to state a claim upon which relief may be granted is not waivable, but if not raised in an initial 12(b)(6) motion, it can only be raised (1) in any pleading allowed or ordered under Rule 7(a); (2) by a motion under Rule 12(c); or (3) at trial. See Fed.R.Civ.P. 12(h)(2). But successive 12(b)(6) motions may be allowed if the pending motion is not interposed for delay and its consideration will expedite the disposition of the case on the merits. See, e.g., Sharma v. Skaarup Ship. Mgmt. Corp., 699 F. Supp. 440, 444 (S.D.N.Y. 1988); Thorn v. New York City Dept. of Social Servs., 523 F. Supp. 1193, 1196 n. 1 (S.D.N.Y. 1981).

3. Application to Facts

Emporos' current motion is neither frivolous nor filed to improperly delay the proceedings. It puts forth reasonable and cogent arguments to dismiss each of Plaintiffs' claims. See Orig. Mot. Dis. at 3-5. Also, as Emporos points out, this motion may be considered in tandem with its answer as a motion for judgment on the pleadings under Rule 12(c), pursuant to which the same standards apply. See Ziemba v. Wezner, 366 F.3d 161, 163 (2d Cir. 2004). In any event, the issues now raised can be decided pursuant to Rule 16(c)(2)(A) and (B) in order to expedite discovery and trial and reduce further motions directed at the pleadings. C. Arguments to Dismiss Each of Plaintiffs' Counts 1. Gross Negligence a. Contentions of the Parties

In their Amended Complaint, Plaintiffs first claim that Emporos committed gross negligence ("Count I"). They contend that Emporos owed Plaintiffs two distinct duties: (1) to ensure that its service and devices meet industry standards; and (2) to protect the information needed to access Plaintiffs' computers through the remote access program, the LogMeIn utility. Am. Compl. at ¶¶ 75, 76; Pl. Mem. L. Opp. at 10. Specifically, it is alleged that a current or former employee of Emporos used the LogMeIn software to commit the fraud complained of. Am. Compl. at ¶¶ 47-48. Emporos, it is charged, improperly caused customers' credit card magnetic data to be stored on Plaintiffs' systems, was aware of the flaws in its security system, and improperly left the LogMeIn information "in the open." Id. at ¶¶ 42, 49.

Emporos argues that the duties it purportedly owed to Plaintiffs arise only out of the Software License Agreements and are properly considered claims only under a breach of contract theory. Def.'s Mot. Dismiss at 8-9. Alternatively, defendant contends that since Plaintiffs allege only economic damages, they cannot recover under a negligence theory. Id. at 9 (citing 532 Madison Ave. Gourmet Foods, Inc. v. Finlandia Ctr., Inc., 727 N.Y.S.2d 49, 55, 750, 750 N.E.2d 1097, 1103 (N.Y. Ct. Appl. 2001)).

In response, it is maintained that Emporos owed Plaintiffs duties outside the contract, and thus they have properly alleged gross negligence causes of action. Pl. Mem. L. Opp. at 13-14. They point to Emporos' interpretation of its own duty under the Software License Agreements to provide "a non-exclusive and non-transferable license" to use the computer software programs, not to offer technical support. Id.; Def.'s Mot. Dismiss at 12. Thus, it is alleged, the duty to properly maintain access to Plaintiffs' computers through the LogMeIn utility arises outside the contract and is subject to recovery under tort. Emporos' reliance on 532 Madison Avenue is misplaced, it is argued, as this limit on recovery of economic damages applies only where liability might extend to a large, indeterminate class of persons. Pl. Mem. L. Opp. at 14-15.

b. Law and Application to Facts

The contract calls for application of North Carolina law in interpreting the contract for contract law purposes. But New York tort law controls the negligence claim. See Curley v. AMR Corp., 153 F.3d 5, 12 (2d Cir. 1998).

To state a claim for gross negligence, Plaintiffs must allege that Emporos breached a duty owed to Plaintiffs that proximately caused Plaintiffs' damages, and that "the act or omission [is] of an aggravated character." Id. at 13 (2d Cir. 1998) (detailing New York common law); Schultz v. Boy Scouts of America, Inc., 65 N.Y.2d 189, 195 (1985) ("[W]hen the defendant's negligent conduct occurs in one jurisdiction and the plaintiff's injuries are suffered in another, the place of the wrong is considered to be . . . where the plaintiffs' injuries occurred."). Determining whether acts or omissions constitute gross negligence is reserved to the jury. Travelers Indemnity Co. of Connecticut v. The Losco Group, 136 F. Supp. 2d 253, 256, 257 (S.D.N.Y. 2001).

Emporos' argument is belied by its own interpretation of its contracts. It maintains that its only duty under the Agreements was to provide a "non-exclusive and non-transferable license to use the object code to the computer software program(s) identified and described" in the Agreements. Def.'s Mot. Dismiss at 12. Plaintiffs' allegations that Emporos routinely supported its product by accessing Plaintiffs' computers and that a current or former employee utilized this access to break into Plaintiffs' computers, construed liberally, provide evidence of an independent duty that may support an action in tort. See Am. Compl. at ¶¶ 28, 41. Plaintiff has alleged that Emporos failed to notify Plaintiffs of the security flaws in its system. See id. at ¶¶ 52, 54. "Whether these failures rise to the level of reckless disregard for the rights of others is a question properly reserved for a jury." Travelers Indem. Co. of Conn. v. Losco Group, Inc., 136 F. Supp. 2d 253, 257 (S.D.N.Y. 2001); see also Charter Oak Fire Ins. Co. v. Trio Realty Co., 2002 WL 123506, at *5 (S.D.N.Y. Jan. 31, 2002) ("The issue of gross negligence is ordinarily a question of fact for a jury to determine."). In view of great damage to customers and business that breaches of a computer system may cause, a jury may find that responsible entities, such as Emporos, should take special precautions to protect these systems. Emporos' motion to dismiss with respect to Counts I is denied.

2. Negligent Supervision a. Contentions of the Parties

Plaintiffs argue that Emporos breached its duty to supervise its employees to ensure that they did not use their access to the computers for improper purposes ("Count II"). Am. Compl. at ¶¶ 80-81. Because of this failure to supervise, their customers' credit card information was allegedly stolen, resulting in fines imposed by credit card companies and loss of "consumer good will." Id. at ¶¶ 82-83.

Emporos argues that Count II should be dismissed, in part, for the same reasons it seeks to dismiss Count I. It maintains that this duty to supervise its employees arises out of the Software License Agreements and thus Plaintiffs cannot recover in tort. Def.'s Mot. Dismiss at 8-9. It also argues that under New York law, an employer can be liable for negligent supervision only if the employer knew or should have known of the employee's propensity for the illegal conduct. Id. at 9 n. 7.

It is Plaintiffs' position that the duty to ensure that employees and former employees with knowledge of the LogMeIn information necessary to access Plaintiffs' computers arises outside the contract, as interpreted by Emporos, and thus supports this cause of action. Pl. Mem. L. Opp. at 13.

b. Law and Application to Facts

"A necessary element of a cause of action alleging negligent supervision or negligent retention is that `the employer knew or should have known of the employee's propensity for the conduct which caused the injury.'" Well v. Rambam, 753 N.Y.S.2d 512, 514 (2d Dep't 2002) (quoting Kenneth R. V. Roman Catholic Diocese of Brooklyn, 654 N.Y.S.2d 791, 793 (2d Dep't 1997) cert. denied by 522 U.S. 967 (1997)); see also Bouchard v. New York Archdiocese, No. 04 Civ. 9978, 2010 WL 1173001, at *4 (S.D.N.Y. Mar. 24, 2010) (stating that an element of negligent supervision is "that the employer `knew or should have known of the employee's propensity for the conduct which caused the injury'" (citations omitted)). This element is in addition to the standard elements of negligence. Bouchard, 2010 WL 1173001, at *4.

Although plaintiffs do not allege that Emporos knew or should have known that its employee had a propensity for any improper conduct, cf. Am. Compl. at ¶¶ 80-84, discovery into the remaining claims may very well unearth this information. In the interest of judicial and party economy, Count II is not dismissed.

3. Conversion a. Contentions of the Parties

Plaintiffs' third cause of action alleges that Emporos, or those in its employ, unlawfully converted plaintiffs' property without legal justification ("Count III"). Am. Compl. at ¶¶ 86-87. Emporos converted their customers' credit card information, Plaintiffs argue, resulting in fines imposed by credit card companies and loss of business.

In its motion to dismiss, Emporos claims that North Carolina law governs Count III. Under New York's "interest analysis" choice-of-law doctrine, Emporos argues the locus of a conversion claim is "the state where the Emporos' acts respecting the allegedly converted property are committed." Def.'s Mot. Dismiss at 8 (citing Pentagen Techs. Int'l, Ltd. v. CACI Int'l Inc., No. 93 Civ. 8512, 1996 WL 435157, at *12 (S.D.N.Y. Aug. 2, 1996)). Since North Carolina law requires the plaintiff allege "(a) the unauthorized assumption and exercise of the right of ownership; (2) over goods or personal chattels belonging to another; (3) to the exclusion of the owner's rights," and the Plaintiff has not specifically alleged these elements, Emporos contends this count should be dismissed. Def.'s Mot. Dismiss at 10 (citing Hammitt v. Petit, 176 N.C. App. 189, 2006 WL 389700, at *2 (N.C. App. Feb. 21, 2006)). Emporos also substantively argues that (1) "consumer credit card information" is not "goods" or "personal chattels" subject to recovery, (2) the Plaintiffs do not "own" their customers' credit card information, and (3) Emporos is not responsible for its employees alleged actions.

The locus of the harm is the most important factor in determining which law applies to a conversion claim, Plaintiffs contend. Pl. Mem. L. Opp. at 33-34. They assert that their penalties and loss of business are located in New York. Id. Second, they argue that credit card information, though intangible, is a "specific identifiable thing" subject to recovery under New York conversion law. Id. at 34-36 (citing Thyroff v. Nationwide Mut. Ins. Co., 8 N.Y.3d 283 (2007)). Finally, Plaintiffs maintain that they have a superior possessory right to its customers' credit card information, sufficient to support its conversion claim. Id. b. Law and Application to Facts i. Choice of Law

In a diversity action, the jurisdiction in which the court sits determines the choice of law principles, except, where as here, the contract calls for application of North Carolina law to Plaintiffs' breach of contract theory. See Krock v. Lipsay, 97 F.3d 640, 645 (2d Cir. 1996). "New York applies an `interest analysis' to its choice of law, under which the law of the jurisdiction having the greatest interest in the litigation controls." Softel, Inc. v. Dragon Med. and Scientific Comms., Inc., 118 F.3d 955, 967 (2d Cir. 1997); see also, e.g., Bakalar v. Vavra and Fischer, No. 08-5119, 2010 WL 3435375, at *2 (2d Cir. Sep. 2, 2010).

In evaluating which law applies to conversion claims, New York courts (or courts applying New York law) have not been uniform in their rationales. Some courts hold that the locus of the defendant's allegedly wrongful acts determines the applicable law. See, e.g., Pentagen Techs. Int'l, Ltd. v. CACI Int'l Inc., No. 93 Civ. 8512, 1996 WL 435157, at *12 (S.D.N.Y. Aug. 2, 1996) ("[T]he state where the defendant's acts respecting the allegedly converted property are committed" determines applicable law.); Hacohen v. Bollinger Ltd., 489 N.Y.S.2d 75, 78 (1st Dep't 1985) (deciding that since in a conversion claim it is "the defendant's standard of conduct that is to be judged," the location of the alleged acts determines applicable law). Others hold that the location of the alleged injury is determinative. See, e.g., Hoelzer v. City of Stamford, Conn., 722 F. Supp. 1106, 1112 (S.D.N.Y. 1989) ("Absent `special circumstances,' the law of the place of the injury applies [to a conversion claim].").

New York has a greater interest in the conversion issue. Although the parties are domiciled in different states — Plaintiffs in New York, Emporos in North Carolina — the alleged injury suffered by Plaintiffs is entirely in New York where the equipment was installed. New York has a strong interest in seeing that those doing business in New York and customers in New York are not cheated. See Bakalar, 2010 WL 3435375, at *7. Emporos' alleged wrongful acts may have taken place anywhere in the world. See Am. Compl. at ¶ 50. Absent further factual development, the locus of Plaintiffs' injury indicates that New York's law should be applied.

ii. New York Conversion Law

"To establish a cause of action to recover damages for conversion, `the plaintiff must show legal ownership or an immediate superior right of possession to a specific identifiable thing and must show that the defendant exercised an unauthorized dominion over the thing in question . . . to the exclusion of the plaintiffs rights.'" Eight In One Pet Products v. Janco Press, Inc., 838 N.Y.S.2d 899, 899 (2d Dep't 2007) (citation omitted). Electronic information suffices. See Thyroffv. Nationwide Mut. Ins. Co., 8 N.Y.3d 283, 292-293 (2007) ("[E]lectronic records that were stored on a computer and were indistinguishable from printed documents [are] subject to a claim of conversion in New York."). "The basis of an action for conversion is the denial or violation of the plaintiff's dominion over, rights to, or possession of property." Mirvish v. Mott, 901 N.Y.S.2d 603, (1st Dep't 2010) (citing Sporn v. MCA Records, 58 N.Y.2d 482, 487 (1983)). Electronic records are valuable property.

iii. Application of New York Conversion Law

Plaintiffs' possession of their customers' credit card information was adversely affected and its value attenuated by Emporos' alleged misconduct. It seriously diluted its value and became a disincentive rather than a reason for customers and the business to use the system. Cf. Thyroff, 8 N.Y.3d at 285 (plaintiff alleged that he was "unable to retrieve his customer information and other personal information"). Count III is not dismissed. 4. Breach of Contract a. Contentions of Parties

Plaintiffs fourth claim ("Count IV") asserts that Emporos breached the "valid and binding contracts" between the two parties, in which Emporos agreed to provide and support the point of service system. Am. Compl. at ¶ 90. They allege Emporos supplied a defective product, failed to properly monitor the point-of-sale system, failed to notify Plaintiffs of security breaches, and used its access to the computer system to steal its customers' credit card information. Id. at ¶¶ 90-92. They contend that Emporos, in effect, improperly repudiated its contracts, forcing Plaintiffs to overhaul their point-of-sale systems, resulting in fines and lost business. Id. at ¶¶ 93-98.

In its motion to dismiss, Emporos argues that under the Software License Agreements, its only duty was to provide a "non-exclusive and non-transferable license to use the object code," not to "support" or "monitor" Plaintiffs' systems. Def.'s Mot. Dismiss at 12. The Software License Agreements, it argues, allocate responsibility for the "supervision, management, and control of [the] use of the Program Product" to the Plaintiffs, and thus the only potentially viable claim is for providing a defective product. Id. Since the Agreements exclude Emporos' liability under the contract from "indirect, consequential, exemplary, punitive or incidental damages, or loss [sic] profits," it contends that Plaintiffs' purported damages are not recoverable. Id. at 12-13.

Even if Emporos was not required to support the point-of-sale system under the Software License Agreements, Plaintiffs maintain, it did so in practice. Am. Compl. at ¶¶ 27-29; Pl. Mem. L. Opp. at 16-17. They contend that this past practice altered the terms of its contracts. Pl. Mem. L. Opp. at 17-18. They also argue that Emporos breached the inherent duty of good faith, the liability limitations within the Software License Agreements are unenforceable, and Emporos improperly terminated the Agreements without proper cause. Id. at 18-22.

b. Law and Application to Facts

Under North Carolina law, which both Plaintiffs and Emporos agree apply to Count IV, the "elements of a claim for breach of contract are (1) existence of a valid contract and (2) breach of the terms of that contract." Ahmadi v. Triangle Rent A Car, Inc., 691 S.E.2d 101, 103 (N.C. App. 2010). The terms of a written contract, however, do not necessarily define the scope of the parties' duties. See Son-Shine Grading, Inc. v. ADC Const. Co., 68 N.C. App. 417, 422 (N.C. App. 1984) ("The provisions of a written contract may be modified or waived . . . by conduct which naturally and justly leads the other party to believe the provisions of the contract have been modified or waived. . . .").

Here, Emporos contends that its only duty under the Software License Agreements was to provide a "non-exclusive and non-transferable license." Def.'s Mot. Dismiss. at 12. Emporos also maintains that the Agreements allocated "exclusive[] responsibility for the supervision, management, and control of its use" of the services Emporos provided to Plaintiffs. Id. Plaintiffs, however, specifically allege in their complaint that Emporos required Plaintiffs to install the LogMeIn utility and that Emporos "routinely" corrected the problems associated with its product. Am. Compl. at ¶¶ 27-28. Taking these allegations as true, Emporos' conduct may be found by a jury to have effectively modified or interpreted the Software License Agreements' terms. Further factual development is required to determine the scope of Emporos' duties. Dismissal of Count IV is not appropriate. 5. Violation of Computer Fraud and Abuse Act a. Contentions of the Parties

Plaintiffs allege that Emporos (or Emporos' employees) deliberately and impermissibly exceeded the scope of authorized access to Plaintiffs' computers in violation of the CFAA ("Count V").

Emporos first maintains that Count V is time-barred by 18 U.S.C. § 1030(g), which states that "[n]o action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage." Def.'s Mot. Dismiss at 16. It cites Plaintiffs' allegation that on December 18, 2007, it received a letter from its credit card processor, Cynergydata, indicating that MasterCard had identified the liquor store as a "source of significant fraud activity" in 2007. Id.; see Am. Compl. at ¶ 39. Emporos also claims that it is not responsible for the criminal actions of its employees. Def.'s Mot. Dismiss at 17. It argues that Plaintiff alleges only misuse of information that it properly accessed, not improper access itself, Def.'s Mot. Dismiss at 18, which is not prohibited by the CFAA. Emporos also contends that Plaintiffs fail to allege intent to defraud and damage, as required by the CFAA.

In response, Plaintiffs contend that an employee's criminal actions may be attributable to its employer if it is within the scope of his or her employment, an issue for the jury. Pl. Mem. L. Opp. at 23-27. Their claims are not barred by the statute of limitations, they maintain, because they were only told that their stores were the source of the fraud in December of 2007. Id. at 32. Since "damage" is defined by the CFAA "as any impairment to the integrity or availability of data, a program, a system, or information," 18. U.S.C. § 1030(e)(8), they argue that they were not aware that their computer system had been compromised until 2008. Finally, they contend that their substantive allegations are sufficient. Pl. Mem. L. Opp. at 27-31.

b. Law and Application to Facts i. Generally

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(4) et seq., prohibits, among other things, anyone from "intentionally access[ing] a computer without authorization or exceed[ing] unauthorized access" and thereby obtains "information from any protected computer." 18 U.S.C. §§ 1030(a)(1), (2)(C). The CFAA also provides a limited private right of action against violators of this section for "any person who suffers damage or loss" of, among other things, "1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." Id. §§ 1030(g) (detailing private right of action), (c)(4)(A)(1)(I). "Damage" is defined as "any impairment to the integrity or availability of data, a program, a system, or information." Id. § 1030(e)(8). "Loss" is defined as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred." Id. § 1030(e)(11).

ii. Two-Year Statute of Limitations

Section 1030(g), the sole source of a private claim, states that "[n]o action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage." Id. § 1030(g). Thus, in order to proceed, a plaintiff must file suit within two years of discovering "any impairment to the integrity or availability of data, a program, a system, or information." Id. § 1030(e)(8). It was conceded by Plaintiffs on argument that this limitation period did not preempt state limitations on other causes of action.

Accepting Plaintiffs' allegations as true, Emporos' motion to dismiss Count V on this ground must fail. Emporos' reliance on paragraph 39 of the Amended Complaint is insufficient. See Def.'s Mot. Dismiss at 16. This paragraph alleges that on "December 18, 2007, Plaintiff Seventh Avenue received a letter . . . stating that Seventh Avenue had been identified by MasterCard as a significant fraud activity." Am. Compl. at ¶ 39. This statement does not indicate that Plaintiffs' computer system was compromised. Plaintiffs were not necessarily aware of any "impairment to the integrity or availability of data, a program, a system, or information." As Plaintiffs imply in their Amended Complaint, one of their own employees could have simply misappropriated the information without any access to a computer. See id. at ¶ 40 (alleging that Seventh Avenue was asked to perform a background check on every employee). Emporos' statute of limitations theory fails.

iii. Responsibility for Emporos' Employees

"[A]n employer is responsible for an employee's intentional tort only when the employee was acting within the scope of his or her employment when he or she committed the tort." Girden v. Sandals Intern, 262 F.3d 195, 205 (2d Cir. 2001). Whether an employee was acting within that scope is "heavily dependent on factual considerations," and "ordinarily [a question] for the jury." Riviello v. Waldron, 47 N.Y.2d 297, 303 (1979). Still, this determination "can be made as a matter of law in some instances." Girden, 262 F.3d at 205 (citing New York cases).

Numerous factors are relevant to a determination of whether an employee's acts fall within the scope of employment. These include "the connection between the time, place and occasion for the act; the history of the relationship between employer and employee as spelled

out in actual practice; whether the act is one commonly done by such an employee; the extent of departure from normal methods of performance; and whether the specific act was one that the employer could reasonably have anticipated." Burlarly v. Wal-Mart Stores, Inc., 904 N.Y.S.2d 826, 827 (3d Dep't 2010) (citations omitted). Some New York courts have stated that actions "committed for personal motives unrelated to the furtherance of the employers' business" are not within the scope of employment. Artalyan, Inc. v. Kitridge Realty Co., Inc., 860 N.Y.S.2d 100, 102 (1st Dep't 2008); see also Naegele v. Archdiocese of New York, 833 N.Y.S.2d 79, 80 (1st Dep't 2007) (finding actions committed "for wholly personal motives" are outside the scope of employment).

More evidence is needed to determine the Emporos' employees' scope of employment. Plaintiffs allege that their customers' information was misappropriated via Emporos' LogMeIn application. Am. Compl. at ¶¶ 47, 51. Emporos provided informational security services, and misappropriation by its employees may reasonably have been anticipated. Plaintiffs also allege that Emporos was aware of similar breaches, supporting the view that this employee conduct should have been prevented. Id. at ¶ 47. Further factual development is needed to define the scope of employment.

iv. Misuse of Information vs. Improper and Unauthorized Access

The Computer Fraud and Abuse Act proscribes conduct that exceeds authorized access to a protected computer. See 18 U.S.C. § 1030(a)(2). The Court of Appeals for the Second Circuit has not precisely defined the meaning of "exceeds authorized access." See United States v. Aleynikov, No. 10 Cr. 96, 2010 WL 3489383, at *16 (S.D.N.Y. Sep. 3, 2010) (noting this fact). Some courts have interpreted this statute to prevent any misuse of accessed information. See, e.g., United States v. John, 597 F.3d 263, 271 (5th Cir. 2010); Mktg. Tech. Solutions, Inc. v. Medizine LLC, No. 09 Civ. 8122, 2010 WL 2034404, at *7 (S.D.N.Y. May 18, 2010). Others have held that "an employee with authority to access his employer's computer system does not violate the CFAA by using his access privileges to misappropriate information." Aleynikov, 2010 WL 3489383, at *16; see also LVRCHoldings LLC v. Brekka, 581 F.3d 1127, 1130-31 (9th Cir. 2009).

This issue requires some factual development. If Emporos employees had permission to access Plaintiffs' computers, but not their customers' credit card information, Count V might survive even a strict interpretation. See Aleynikov, 2010 WL 3489383, at *15 ("[A] person who `exceeds authorized access' has permission to access the computer, but not the particular information on the computer that is at issue.").

It seems unlikely that the federal statute applies to the instant case. Emporos' motion to dismiss Count V is denied, with leave to renew at pretrial conferences before trial when the issues can be simplified.

6. Declaratory Judgment a. Contentions of the Parties

Plaintiffs request a declaratory judgment that states that any fines, penalties or other judgments against Plaintiffs as a result of the theft of their consumers' credit card information are the legal responsibility of Emporos. Am. Compl. at ¶ 113. Emporos argues that this declaratory judgment would serve no useful purpose since the other pending claims may fully resolve the matter. Def.'s Mot. Dismiss at 19. It is contended by Plaintiffs that it is not clear if the credit card companies' investigation is complete. It requests that payment of any future fines levied against Plaintiffs be deemed Emporos' legal responsibility. Pl. Mem. L. Opp. at 38. b. Law and Application to Facts

The Declaratory Judgment Act vests a district court with discretion to determine whether it will exert jurisdiction over a proposed declaratory action: "In a case of actual controversy . . . any court of the United States may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought." 28 U.S.C. § 2201(a) (emphasis added); see also Wilton v. Seven Falls Co., 515 U.S. 277, 282-83 (1995) (interpreting this language as permissive). "The fact that a lawsuit has been filed that will necessarily settle the issues for which the declaratory judgment is sought suggests that the declaratory judgment will serve `no useful purpose.'" Amusement Indus., Inc. v. Stern, 693 F. Supp. 2d 301, 311 (S.D.N.Y. 2010) (citations omitted).

Here, Plaintiffs seek a declaratory judgment stating that "any fines, penalties, or other judgments against Plaintiffs as a result of the theft of the credit card information are the legal responsibility of Emporos." Am. Compl. at ¶ 113. They seek to recover these same damages under Counts I-V, see id. at ¶¶ 77, 83, 87, 97, 105, for past losses; the declaratory judgment covers future, as yet undiscovered loss. This was not the case in Sofi Classic S.A. de C. V. v. Horowitz, where, "the [declaratory judgment] claim [was] duplicative in that it [sought] no relief that [was] not implicitly sought in the other causes of action." 444 F. Supp. 2d 231, 249-50 (S.D.N.Y. 2006). The only added judgments Plaintiffs proffer are future fines levied against Plaintiffs. Pl. Mem. L. Opp. at 38.

A declaratory judgment will not be granted. Since these possible and hypothetical future claims depend on particular facts, peculiar to each incident, a declaratory judgment is denied.

IV. Conclusion

The motion to dismiss is denied.

A trial date will be set for early May, 2011. On consent, the jury will be chosen by the magistrate judge. A pretrial hearing before the court will be set one week before the trial. The parties will provide lists of witnesses, exhibits, and proposed charges one week before this pretrial hearing. All in limine motions will be heard at that time.

SO ORDERED.

Date: November 24, 2010 Brooklyn, New York