Opinion
CIVIL ACTION NO. 3:06-CV-2175.
June 25, 2007
MEMORANDUM
Presently before the Court is Defendants Michael Vaccarro, individually and in his capacity as an officer and director of Susquehanna Precision, Inc., Andrew Vaccarro and Endless Mountains Specialties, Inc.'s Motion to Dismiss Plaintiff Robert Dudick's First Amended Complaint. (Doc. 9.) For the reasons set forth below, the Court will deny this motion. The Court has jurisdiction over this matter pursuant to 28 U.S.C. §§ 1331 and 1367.
BACKGROUND
On February 7, 2007, Plaintiff filed his First Amended Complaint (Doc. 6). Therein, he alleges as follows. Susquehanna Precision, Inc. ("SPI") was incorporated on February 20, 1980. ( Id. ¶ 8.) From the time of its incorporation, Plaintiff has held a fifty percent (50%) ownership interest in SPI. ( Id. ¶ 9.) Michael Vaccarro owned and does now still own the other 50% interest in SPI. ( Id. ¶ 10.) Plaintiff and Michael Vaccarro serve as the officers and directors of SPI, receive compensation and dividends in equal amounts, and have done so since its incorporation. ( Id. ¶¶ 12, 17.)
Plaintiff filed his Complaint (Doc. 1) on November 6, 2006. Defendants filed a motion to dismiss (Doc. 5) on January 29, 2007 but failed to file a supporting brief. As such, the Court deemed the motion withdrawn. (Doc. 8.)
SPI is in the business of providing mechanical and electrical engineering services and products to customers in the aerospace industry. ( Id. ¶ 18.) SPI has amassed a significant library of proprietary blue prints, plans and drawings provided to it by its customers for the purpose of enabling it to supply services and products. ( Id. ¶ 20.) Many of these blueprints, plans and drawings are stored on SPI's computer system. ( Id. ¶ 21.) SPI considers these documents to be proprietary and confidential business information. ( Id. ¶ 22.)
On October 1, 1997, SPI hired Andrew Vaccarro, Michael Vaccarro's son, as an employee. ( Id. ¶ 24.) As a SPI employee, Andrew was entrusted with the duty of maintaining contact with customers concerning bids, proposals, and the filling and completion of orders. ( Id. ¶ 25.) SPI entrusted Andrew with access to its customers, bids, proposals, orders and other proprietary and confidential information. ( Id. ¶ 26.) Andrew contacted SPI customers via mail, email and telephone, as well as in person. ( Id. ¶ 27.)
At SPI, Andrew came into contact with proprietary and confidential information, particularly email correspondence, involving SPI's most significant customer, Aerospace International, Inc. ("Aero"). ( Id. ¶ 29.) SPI received more than one million dollars ($1,000,000) in revenue from its sales to Aero. ( Id. ¶ 30.)
In 2003, Andrew incorporated Endless Mountains Specialties ("EMS"). ( Id. ¶ 31.) Without the knowledge of Plaintiff, and with the assistance of his father Michael, Andrew, while employed by SPI, used SPI's computers, including its computer programs and equipment, to divert SPI's proprietary and confidential information, received from Aero, to EMS. ( Id. ¶ 32.) This confidential information included purchase orders from Aero that SPI could have accepted and filled, orders which contained Aero's requirements, requests, products and services. ( Id. ¶¶ 32-33.)
Since 2003, SPI's revenue from sales to Aero has significantly declined as a result of Defendants' actions. ( Id. ¶¶ 35-36.) In 2003, SPI's revenue from sales to Aero was one million fifty-seven thousand dollars ($1,057,000). ( Id. ¶ 35.) In 2004, this figure was approximately nine hundred seventy-eight thousand dollars ($978,000). ( Id.) In 2005, this figure was reduced to approximately three hundred sixty-nine thousand dollars ($369,000). ( Id.) Through May, SPI's 2006 revenue from Aero was only one hundred twenty-two thousand dollars ($122,000). ( Id.)
Plaintiff confronted Michael Vaccarro concerning the loss in sales revenue and sought to persuade him to take appropriate action against EMS. ( Id. ¶ 36.) Michael refused to take any such action. ( Id. ¶ 37.) Instead, Michael attempted to freeze Plaintiff out and exclude him from the proper share of benefits owed to him as a shareholder of SPI. ( Id. ¶ 37.)
On June 20, 2006, Michael Vaccarro took the following actions: (1) he changed the locks on all of SPI's buildings and refused to provide Plaintiff with a set of keys; (2) he contacted the post office to divert the delivery of SPI's mail to an address unknown to Plaintiff; and (3) he closed SPI's bank account and opened a separate bank account to which Plaintiff has no access. ( Id.) Since that time, Michael has refused to recognize Plaintiff as a fifty-percent (50%) shareholder of SPI. ( Id.)
Plaintiff bases the Court's jurisdiction over this matter on Count I of his First Amended Complaint (Doc. 6). This count sets forth a claim under the federal Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030. ( Id. ¶ 40-46.) As such, Plaintiff claims the Court has federal question jurisdiction over his action pursuant to 28 U.S.C. § 1331. ( Id. ¶ 6.) Plaintiff contends that the Court has jurisdiction over his thirteen (13) remaining counts pursuant to supplemental jurisdiction, 28 U.S.C. § 1367. ( Id.)
Count I of Plaintiff's First Amended Complaint reads as follows.
40. The averments of paragraphs 1 through 39 are herein incorporated by reference.
41. SPI's computers are used by SPI in transacting interstate commerce.
42. As set forth hereinabove, in violation of the CFAA, ANDREW, individually and as an agent of EMS, did, without authorization or exceeding the authorization he had been given as an employee of SPI, intentionally accessed the SPI computer system and obtained, communicated, delivered and/or transmitted information from SPI's protected computer to EMS, an entity not entitled to receive such information.
43. As set forth hereinabove, in violation of the CFAA, ANDREW, individually and as an agent of EMS, did intentionally cause customers orders, including but not limited to orders from Aero, and other valuable, confidential, and proprietary business information to be transmitted from SPI's protected computer to EMS, an entity not entitled to receive such information.
44. Such conduct caused damage because it impaired the integrity of the confidential and proprietary information on the SPI computer.
45. By reason of ANDREW's violation of the CFAA, SPI has suffered damage and loss in excess of $5000, said damage/loss includes:
a. the time and resources spent and the cost of hiring of an expert to research and assess the unauthorized information and assets transmitted to/from SPI's protected computer and, to the extent possible, remedy the damage done and protect against such damage and loss in the future; and
b. the diminution in value and impairment of the integrity of SPI's confidential, proprietary and trade secret information, the loss of goodwill; and
c. the economic loss caused by Andrew's interference with SPI's customer relationships, particularly its relationship with Aero.
46. ANDREW, individually and through his new company EMS, has, and upon information and belief, intends to continue using the information which he unlawfully acquired from SPI's protected computer.
( Id. ¶¶ 40-46.)
Defendants have filed a Motion to Dismiss Plaintiff's First Amended Complaint (Doc. 9), arguing that Plaintiff, in setting forth his CFAA claim, has failed to state a claim upon which relief can be granted. ( Id. ¶¶ 1-3.) As such, Defendants assert that Plaintiff's First Amended Complaint must be dismissed for lack of subject matter jurisdiction. ( Id.)
This motion is fully briefed and ripe for disposition.
LEGAL STANDARD
Rule 12(b)(6) of the Federal Rules of Civil Procedure provides for the dismissal of a complaint, in whole or in part, for failure to state a claim upon which relief can be granted. Dismissal is appropriate only if, accepting all factual allegations in the complaint as true and "drawing all reasonable inferences in the plaintiff's favor, no relief could be granted under any set of facts consistent with the allegations in the complaint." Trump Hotels Casino Resorts, Inc. v. Mirage Resorts Inc., 140 F.3d 478, 483 (3d Cir. 1998).In deciding a motion to dismiss, the Court should consider the allegations in the complaint, exhibits attached to the complaint and matters of public record. See Pension Benefit Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993). The Court may also consider "undisputedly authentic" documents where the plaintiff's claims are based on the documents and the defendant has attached a copy of the document to the motion to dismiss. Id. The Court need not assume that the plaintiff can prove facts that were not alleged in the complaint, see City of Pittsburgh v. West Penn Power Co., 147 F.3d 256, 263 (3d Cir. 1998), nor credit a complaint's "bald assertions" or "legal conclusions." Morse v. Lower Merion Sch. Dist., 132 F.3d 902, 906 (3d Cir. 1997).
When considering a Rule 12(b)(6) motion, the Court's role is limited to determining whether the plaintiff is entitled to offer evidence in support of the claims. See Scheuer v. Rhodes, 416 U.S. 232, 236 (1974). The Court does not consider whether the plaintiff will ultimately prevail. See id. In order to survive a motion to dismiss, the plaintiff must set forth information from which each element of a claim may be inferred. See Kost v. Kozakiewicz, 1 F.3d 176, 183 (3d Cir. 1993). The defendant bears the burden of establishing that the plaintiff's complaint fails to state a claim upon which relief can be granted. See Gould Elecs. v. United States, 220 F.3d 169, 178 (3d Cir. 2000).
DISCUSSION
I. Defendants' Arguments
Defendants submit two arguments challenging the sufficiency of Count I of Plaintiff's First Amended Complaint. First, Defendants argue that "[o]ther than setting forth conclusory allegations mirroring the language of the CFAA, the First Amended Complaint avers no specific or factual conduct constituting a violation of the CFAA." (Doc. 10 at 7.) "The First Amended Complaint does not identify a single piece of information accessed, obtained or transmitted from an SPI computer nor does it identify any instances of Defendant, Andrew Vaccarro, accessing SPI's computers or any information obtained and/or improperly used by such access." ( Id.) Further, Defendants point out that "[t]he First Amended Complaint does not set forth what information is contained in SPI's computers or what level of access or authorization was granted to Andrew Vaccarro on such computers." ( Id.) Indeed, Defendants posit that Plaintiff's contention that Andrew Vaccarro exceeded his authorization directly contradicts Plaintiff's allegation that Andrew was entrusted with access to SPI's proprietary and confidential information. ( Id.) As such, Defendants assert that Plaintiff has failed to allege conduct that violates the CFAA. ( Id.)Second, Defendants argue that the First Amended Complaint "has not set forth damage or loss permitting a civil action under the CFAA." ( Id. at 8.) "Under the CFAA, the term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information[.] 18 U.S.C. § 1030(e)(8)." ( Id.) "[T]he term 'loss' means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service. 18 U.S.C. § 1030(e)(12)." ( Id.) Defendants argue that "[t]he First Amended Complaint fails to allege or identify any impairment to the integrity, availability of data, a program, a system, or information, nor does it allege or identify any loss of data, programs, systems or information or any interruption of service of SPI's computer." ( Id.) As such, Defendants assert, Plaintiff has failed to state a claim under the CFAA. ( Id.)
The Court will address these arguments in reverse order.
II. Has Plaintiff sufficiently pled "damage" or "loss"?
The CFAA is primarily a criminal statute because of its location in Title 18 of the United States Code. However, a private cause of action does exist. The CFAA provides:
Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B). Damages for a violation involving only conduct described in subsection (a)(5)(B)(i) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damages. No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware.18 U.S.C. § 1030(g).
Thus, under section 1030(g), in order to maintain a private cause of action under the CFAA, a plaintiff must suffer: (1) a root injury of damage or loss; and (2) one of the five operatively-substantial effects set forth in subsection (a)(5)(B)(i)-(v). P.C. of Yonkers, Inc. v. Celebrations! The Party Seasonal Superstore, L.L.C., Civ. A. No. 04-4554 (JAG), 2007 WL 708978, at *4 (D.N.J. Mar. 5, 2007). "The factors in Sections 1030(a)(5)(B)(i)-(v) do not address prohibited conduct, but instead list specific forms of 'damage' or 'loss' that are possible harmful results of violations of other parts of the statute, . . . under which Plaintiff ha[s] brought [his] claims." Id.
Subsection (g) requires a plaintiff to allege one of the following five effects set forth in section 1030(a)(5)(B):
(I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value;
(ii) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals;
(iii) physical injury to any person;
(iv) a threat to public health or safety; or
(v) damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security[.]18 U.S.C. § 1030(a)(5)(B).
The CFAA defines "damage" as "any impairment to the integrity or availability of data, a system, or information." 18 U.S.C. § 1030(e)(8). "Loss" is treated separately from "damage" under the CFAA, and is defined as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11).
Here, Plaintiff, in paragraph 45 of his First Amended Complaint, alleges that he has suffered the following damage/loss: (a) the time and resources spent and the cost of hiring an expert to research and assess the unauthorized information and assets, transmitted to/from SPI's protected computer and, to the extent possible, remedy the damage done and protect against such damage and loss in the future; (b) the diminution in value and impairment of the integrity of SPI's confidential, proprietary and trade secret information, and the loss of goodwill; and (c) the economic loss caused by Andrew Vaccarro's interference with SPI's customer relationships, particularly its relationship with Aero. (Doc. 6 ¶ 45.) This damage/loss exceeds five thousand dollars ($5,000). ( Id.)
These incurred costs in paragraph 45(a) of Plaintiff's First Amended Complaint are explicitly identified in the CFAA's definition of "loss," which includes "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense. . . ." 18 U.S.C. § 1030(e)(11); P.C. of Yonkers, Inc., 2007 WL 708978, at *5. Moreover, while Defendants may be correct in arguing that no physical damage or impairment to the integrity of SPI's computer system, the CFAA has been held to apply in cases involving former employees wrongfully acquiring and using a plaintiff employer's confidential or trade secret information. See, e.g., Pacific Aerospace Electronics, Inc. v. Taylor, 295 F. Supp. 2d 1188, 1196-97 (E.D. Wash. 2003) (holding that CFAA enabled former employer to maintain action to prevent former employee from using wrongfully acquired trade secret information in order to compete against former employer). While "the majority of CFAA cases still involve 'classic' hacking activities[,] . . . [e]mployers . . . are increasingly taking advantage of the CFAA's civil remedies to sue former employees and their new companies who seek a competitive edge through wrongful use of information from the former employer's computer system." Id. at 1196. Indeed, the United States District Court for the Western District of Washington explicitly recognized that the CFAA allows civil claims challenging the unauthorized removal of information or programs from a company's computer database. Id. (citing Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc., 119 F. Supp. 2d 1121 (W.D. Wash. 2000) (holding that (1) a "damage" claim was stated even though the defendant former employee's misappropriation of trade secret information did not affect the integrity of the trade secrets within the employer's computers and (2) a "loss" claim was stated in that the employer suffered loss in the form of expenses incurred in modifying its computers to prevent future misappropriations).
Accordingly, Plaintiff has adequately alleged "damage" or "loss" in the form of the responsive costs he incurred due to Andrew Vaccarro's putative violation of the CFAA. However, to the extent that Plaintiff claims lost revenue, loss of goodwill, and interference with his customers, particularly Aero, such injuries are not cognizable losses under the CFAA. Nexans Wires S.A. v. Sark-USA, Inc., 166 Fed. Appx. 559, 562 (2d Cir. 2006); P.C. of Yonkers, Inc., 2007 WL 708978, at *5 n. 2.
Plaintiff has also sufficiently pleaded one of the five operatively-substantial effects set forth in subsection (a)(5)(B)(i)-(v) by specifically alleging damage or loss in excess of five thousand dollars ($5,000). See 18 U.S.C. § 1030(a)(5)(B)(i). Defendants do not contest this assertion.
Because Plaintiff has sufficiently pleaded the predicate loss and effect required to state a claim under the CFAA, Defendants' motion to dismiss for failure to adequately allege such loss will be denied.
III. Has Plaintiff sufficiently alleged conduct that violates the CFAA?
Plaintiff argues in his brief that he has sufficiently alleged violations of 18 U.S.C. § 1030(a)(4) and (a)(5)(A)(iii). (Doc. 21 at 7.) However, the Court initially notes that Plaintiff failed to specify the particular subsection of the CFAA under which he seeks relief. While Plaintiff was not required to plead the specific subsection of the statute he claims has been violated in order to satisfy the notice-pleading standard of Rule 8(a)(2) of the Federal Rules of Civil Procedure, FED. R. CIV. P. 8(a)(2), see P.C. of Yonkers, Inc., 2007 WL 708978, at *6 n. 3, the failure to do so complicates matters for the Court.
Plaintiff cannot rely on section 1030(a)(5)(B)(I) because it does not prohibit conduct, but instead lists specific forms of "damage" or "loss" that are possible harmful results of CFAA violations.
A. Section 1030(a)(4)
The United States Court of Appeals for the Third Circuit has held that "[a] claim under CFAA § 1030(a)(4) has four elements: (1) defendant has accessed a 'protected computer;' (2) has done so without authorization or by exceeding such authorization as was granted; (3) has done so 'knowingly' and with 'intent to defraud'; and (4) as a result has 'further[ed] the intended fraud and obtain[ed] anything of value.'" P.C. Yonkers, Inc. v. Celebrations the Party Seasonal Superstore, LLC, 428 F.3d 504, 508 (3d Cir. 2005).
Noticeably absent from Plaintiff's First Amended Complaint are any allegations that Defendants acted with the "intent to defraud," and, by accessing SPI's protected computer without authorization or exceeding the authorization that was granted, "further[ed] the intended fraud and obtain[ed] anything of value." As such, Defendants cannot fairly be said to be on notice of a section 1030(a)(4) claim. Therefore, to the extent that Plaintiff claims a violation of section 1030(a)(4), the Court finds that he has failed to adequately plead such violation.
B. Section 1030(a)(5)(A)(iii)
A violation of section 1030(a)(5)(A)(iii) occurs whenever one "intentionally accesses a protected computer without authorization, and as a result of such conduct, causes" one of the five operatively-substantial effects set forth in subsection (a)(5)(B)(i)-(v).
In the opinion of the Court, the First Amended Complaint clearly indicates that Plaintiff seeks relief pursuant to section 1030(a)(5)(A)(iii), because, as Defendants point out, Plaintiff's allegations closely track the language of this subsection. However, Defendants argue that Plaintiff's First Amended Complaint so closely tracks the language of the CFAA that it merely sets forth conclusory allegations.
Plaintiff alleged in his First Amended Complaint that Andrew Vaccarro, "individually and as an agent of EMS, did, without authorization or exceeding the authorization he had been given as an employee of SPI, intentionally access the SPI computer system. . . ." (Doc. 6 ¶ 42.)
Under the Federal Rules of Civil Procedure liberal notice-pleading requirements, see FED. R. CIV. P. 8(a) and 12(b)(6), these allegations are sufficient to put Defendants on notice of the claims against them. See P.C. of Yonkers, Inc., 2007 WL 708978, at *7 (holding that the plaintiffs adequately alleged a violation of the CFAA when their complaint exactly mirrored the statutory language). As such, the Court rejects Defendants' argument.
Defendants also assert that Plaintiff's allegation that Andrew exceeded his authorization directly contradicts Plaintiff's allegation that Andrew was entrusted with access to SPI's proprietary and confidential information. This assertion is also rejected. Courts faced with CFAA claims brought by employers against their former employees have found that an employee can act without authorization when he obtains proprietary information from his former employer's computers for the benefit of his new employer. See, e.g., Shurgard Storage Centers, Inc., 119 F. Supp. 2d 1121. As such, Plaintiff's allegations, that (1) Andrew was trusted with access to SPI's proprietary information and (2) acted without authorization in obtaining that information for the benefit of EMS, are entirely consistent with his section 1030(a)(5)(iii) claim.
Accordingly, the Court concludes that Plaintiff has stated a claim upon which relief can be granted pursuant to section 1030(a)(5)(A)(iii) of the CFAA.
CONCLUSION
For the reasons stated above, the Court will deny Defendants' Motion to Dismiss. (Doc. 9.) Plaintiff may proceed with Count I of the First Amended Complaint as an 18 U.S.C. § 1030(a)(5)(iii) claim. Because this federal count will not be dismissed, Plaintiff's state law claims also remain pursuant to the Court's supplemental jurisdiction.
An appropriate Order follows.
ORDER
NOW, this 25th day of June, 2007, IT IS HEREBY ORDERED that Defendants Michael Vaccarro, individually and in his capacity as an officer and director of Susquehanna Precision, Inc., Andrew Vaccarro and Endless Mountains Specialties, Inc.'s Motion to Dismiss Plaintiff Robert Dudick's First Amended Complaint (Doc. 9) is DENIED.