Opinion
Case No. 2:05-CV-01026-KJD-GWF.
September 28, 2007
ORDER
Presently before the Court is Defendants' Motion for Summary Judgment (#45/46). Plaintiff filed a response in opposition (#49) to which Defendants replied (#56).
I. Facts
Defendants Christopher Brekka and Carolyn Quain are husband and wife. In 1999, Brekka established Defendants Employee Business Solutions, Inc. of Florida and in 2004, Employee Business Solutions, Inc. of Nevada ("the EBS companies"). Brekka is the only employee of the EBS companies which provide consulting services to companies including those operating residential treatment centers, including referrals, Internet marketing, drug and alcohol testing policies and related services.
Plaintiff LVRC Holdings, LLC ("LVRC") is principally owned by Third-Party Defendant Stuart Smith and is a for-profit residential treatment center for drug addicted persons. Smith has known Carolyn Quain for approximately twenty years. In April 2003, Brekka was hired by LVRC to conduct marketing programs and interact with LOAD, a company utilized by LVRC to provide e-mail, web site and related services.
On June 2, 2003, Nick Jones, LVRC's primary contact at LOAD, established an "administrative function" for Brekka. The administrative function included a username and password. The username ("cbrekka@fountainridge.com") and password were delivered to Brekka via Brekka's LVRC e-mail address. Brekka had use of a computer in his office at LVRC which remained when he was terminated. Third-party Defendant Brad Greenstein was later assigned that office, and the computer was used by several LVRC employees.
At an unknown point, the e-mail from Jones to Brekka containing the username and password for the administrative function was deleted. However, Brekka claims that he never deleted the e-mail. LVRC's computer forensics expert recovered the deleted e-mail from the hard drive of Brekka's LVRC computer after it had been deleted. However, any person who had access to the computer would have been able to view the e-mail.
Brekka's employment was terminated in mid-September 2003 when Brekka and Smith could not agree on a contract to cover his employment and purchase of an interest in LVRC.
On November 19, 2004, Jones observed someone logged onto LOAD's system using Brekka's username, cbrekka@fountainridge.com. While the software used by LOAD to track users on its system could identify visitors to the website and clients that were logged on to the website by username, it could not identify the particular person use the administrative function login and password. Jones identified the computer accessing LOAD's system using thecbrekka@fountainridge.com username by the IP address 199.107.156.30.
An IP address is an Internet address location from which the Internet session is taking place. IP addresses are traceable.
Jones identified the provider of the IP address as CERT.net. Undisputed testimony shows that CERT.net as the provider would have a greater likelihood of identifying where the address originated from. Jones was not asked by LVRC to investigate further the location of the IP address.
LVRC's computer forensics expert examined the hard drives of Brekka and Quain's three personal computers. He discovered no evidence that any of the computers had been used to access LOAD's website using the administrative function on November 19, 2004. However, the Internet history recovered from Brekka's personal desktop computer and laptop showed evidence of those machines having accessed the LOAD website and using the Cbrekka password to access reports and statistics relating to LVRC's website. Furthermore, the computers contained e-mails that had been forwarded from Brekka's LVRC e-mail account to his personal e-mail account. Those e-mails contained sensitive financial information and patient information.
On August 22, 2005, Plaintiff filed the present complaint. On September 1, 2006, Defendants filed the present motion for summary judgment alleging that Plaintiff could not present evidence that Defendants had violated the Electronic Communications Storage Act ("ECSA"), 19 U.S.C. §§ 2701-2711, or the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030. After lengthy continuances were granted briefing was completed in 2007 on all dispositive motions.
II. Standard for Summary Judgment
Summary judgment may be granted if the pleadings, depositions, answers to interrogatories, and admissions on file, together with affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law. See Fed.R.Civ.P. 56(c); see also Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986). The moving party bears the initial burden of showing the absence of a genuine issue of material fact. See Celotex, 477 U.S. at 323. The burden then shifts to the nonmoving party to set forth specific facts demonstrating a genuine factual issue for trial. See Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986); Fed.R.Civ.P. 56(e).
All justifiable inferences must be viewed in the light must favorable to the nonmoving party. See Matsushita, 475 U.S. at 587. However, the nonmoving party may not rest upon the mere allegations or denials of his or her pleadings, but he or she must produce specific facts, by affidavit or other evidentiary materials as provided by Rule 56(e), showing there is a genuine issue for trial. See Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 256 (1986). The court need only resolve factual issues of controversy in favor of the non-moving party where the facts specifically averred by that party contradict facts specifically averred by the movant. See Lujan v. Nat'l Wildlife Fed'n., 497 U.S. 871, 888 (1990); see also Anheuser-Busch, Inc. v. Natural Beverage Distribs., 69 F.3d 337, 345 (9th Cir. 1995) (stating that conclusory or speculative testimony is insufficient to raise a genuine issue of fact to defeat summary judgment). Evidence must be concrete and cannot rely on "mere speculation, conjecture, or fantasy. O.S.C. Corp. v. Apple Computer, Inc., 792 F.2d 1464, 1467 (9th Cir. 1986). "[U]ncorroborated and self-serving testimony," without more, will not create a "genuine issue" of material fact precluding summary judgment. Villiarimo v. Aloha Island Air Inc., 281 F.3d 1054, 1061 (9th Cir. 2002).
Summary judgment shall be entered "against a party who fails to make a showing sufficient to establish the existence of an element essential to that party's case, and on which that party will bear the burden of proof at trial." Celotex, 477 U.S. at 322. Summary judgment shall not be granted if a reasonable jury could return a verdict for the nonmoving party. See Anderson, 477 U.S. at 248.
III. Analysis
A. Electronic Communications Storage Act Claim
In response to Defendants' motion for summary judgment on Plaintiff's claims for violations of the ECSA, Plaintiff failed to file any points and authorities opposing the motion. Having considered the evidence in the record including the deposition testimony and expert reports filed in support of all the pending motions in this action, and in accordance with Local Rule 7-2(d), the Court grants Defendants' motion for summary judgment on this claim. B. Computer Fraud and Abuse Act Claim
In order to recover on a claim for violation of the CFAA, Plaintiff must demonstrate by a preponderance of the evidence that Defendants (1) have accessed a protected computer; (2) have done so without authorization or by exceeding such authorization as was granted; (3) have done so knowingly and with intent to defraud; and (4) as a result have furthered the intended fraud and obtained anything of value. See P.C. Yonkers, Inc. v. Celebrations the Party and Seasonal Superstore, LLC, 428 F.3d 504, 508 (3rd Cir. 2005). Plaintiff asserts that the following facts show that at a minimum a question of fact allows its claim. First, evidence was recovered by its expert from Brekka's home computer and laptop showing that Brekka had sent company documents to his private e-mail address. Second, its expert found evidence that Brekka's laptop had accessed the LOAD site using his cbrekka password at unspecified times. Finally, Plaintiff asserts that a reasonable trier of fact could infer that the November 19, 2004, intrusion into its account with LOAD was done by Defendants.
The Court disagrees that Plaintiff has adduced admissable and specific evidence as required by Rule 56 to raise at least a genuine issue of material fact that Defendants violated the CFAA by possessing copies of e-mails and documents on his home and laptop computers. It is undisputed that when Brekka was employed by Plaintiff that he had authority and authorization to access the documents and e-mails that were found on his home computer and laptop. Some of these documents Brekka had created as part of the terms of his employment. In order for Plaintiff to recover on a claim, it must show that Defendants accessed the documents without authorization. Plaintiffs have adduced no evidence to demonstrate that Defendants accessed these documents without authorization. Furthermore, Plaintiff has not demonstrated that Defendant's possession of the documents and e-mails required Defendants to access a protected computer. Finally, Plaintiff has produced no evidence that a special relationship to the information was created by virtue of an employment, confidentiality or other agreement requiring non-disclosure, return or destruction of the documents when his employment was terminated.
Next, evidence that Brekka had accessed Plaintiff's proprietary information via the LOAD website using the cbrekka password after his termination would suggest a violation of the CFAA. However, Plaintiff provided no admissibile evidence that access had been gained after his termination, i.e. when he was no longer authorized. In responding to a motion for summary judgment, a party must respond with concrete evidence and cannot rely on "mere speculation[.]" O.S.C. Corp. v. Apple Computer, Inc., 792 F.2d 1464, 1467 (9th Cir. 1986). Here, Plaintiff submits the vague assertions of its expert, "Upon reviewing the Internet history of [Brekka's home computer] I noted several occurrences of user Cbrekka accessing reports and statistics belonging to LVRC utilizing the LOAD web site. . . . similar access was made frequently [by Brekka's laptop]." However, the report of the expert is completely silent as to what dates access was made. If they were made before Brekka's employment was terminated, then he was authorized to access the LOAD site. Plaintiff's failure to respond to the motion with concrete non-speculative evidence as to the timing of the alleged unauthorized access is fatal to its claim. To any extent that Plaintiff suggests a violation of the statute by referring to the experts statement that the latest access by Brekka to the LOAD site statistics being September 17, 2005, the report of the expert is belied by the testimony of Nick Jones who stated that he deactivated the username and password alleged to be used by Brekka, no later than November 19, 2004, the day he initially discovered the alleged intrusion. This conflicting testimony by Plaintiff's own witnesses is not enough to create a triable issue of fact.
Finally, Plaintiff alleges that the November 19, 2004 intrusion is enough to assert a claim under the CFAA. However, the evidence merely shows that someone used the password on that date. There is not enough evidence for a reasonable trier of fact to conclude that Defendants were responsible for the unauthorized access. The undisputed testimony showed that the username and password remained on Brekka's LVRC computer and was available to at least two other employees on a daily basis after his termination. Other than use of the password there is no other evidence that links the intrusion to Brekka. The Court finds that Plaintiff has submitted evidence insufficient to raise a genuine issue of material fact requiring resolution by a factfinder. Therefore, the Court grants summary judgment on Plaintiff's claim for a violation of the CFAA.
C. State Law Claims
Plaintiff also raises state law claims. A district court has discretion to decline to exercise supplemental jurisdiction over a claim if all claims over which it has original jurisdiction have been dismissed or if the claim raises a novel or complex issue of state law. See 28 U.S.C. § 1367(c). Since the Court has dismissed all claims over which it has original jurisdiction, the Court declines to exercise its supplemental jurisdiction over Plaintiff's state law claims.
IV. Conclusion
Accordingly, IT IS HEREBY ORDERED that Defendants' Motion for Summary Judgment (#45/46) is GRANTED;
IT IS FURTHER ORDERED that the Clerk of the Court enter JUDGMENT for Defendants and against Plaintiff.