Summary
granting leave to amend complaint to allege the cost of a computer forensics professional and an attorney to remedy a data breach as damage cognizable under the CFAA
Summary of this case from Obeid v. La MackOpinion
Civil No. 13-11501-FDS
01-29-2014
JAMES MAHONEY, Plaintiff, v. DANIELLE DeNUZZIO, Defendant.
MEMORANDUM AND ORDER ON DEFENDANT'S MOTIONS TO DISMISS
AND TO STRIKE AND PLAINTIFF'S MOTION TO AMEND
SAYLOR, J.
This is a claim arising out of alleged unlawful access to another's e-mail and social media accounts. Plaintiff James Mahoney has brought suit against defendant Danielle DeNuzzio, who is his former girlfriend and the mother of his child. He contends that she obtained access to his personal Yahoo! e-mail account and Facebook account, altered information in those accounts, and sent racist messages on multiple occasions. On June 21, 2013, Mahoney filed a complaint in this Court alleging violations of the Stored Communications Act, the Computer Fraud and Abuse Act, Massachusetts wiretap law, and Massachusetts privacy law, as well as bringing common-law claims for intentional infliction of emotional distress and defamation.
On October 31, 2013, DeNuzzio moved to dismiss the complaint for failure to state a claim upon which relief can be granted. Mahoney filed opposition to this motion, and filed a motion to amend the complaint on December 20, 2013. DeNuzzio, in turn, filed an opposition to the motion to amend as well as a motion to strike the affidavit submitted with plaintiff's opposition. For the reasons set forth below, the motion to amend will be granted, the motion to dismiss will be denied, and the motion to strike will be denied as moot.
I. Background
Unless otherwise noted, the facts are presented as stated in the amended complaint.
A. Factual Background
James Mahoney and Danielle DeNuzzio are residents of Massachusetts. They began dating in September 2005 and had a daughter in October 2008. DeNuzzio then filed an action in Middlesex Probate and Family Court seeking child support. In December 2008, she and Mahoney entered into an agreement under which Mahoney waived legal custody and limited his visitation rights. Mahoney petitioned to modify the agreement in November 2010 to gain joint legal custody and greater visitation rights. The Probate Court appointed a guardian ad litem to investigate Mahoney's and DeNuzzio's fitness as parents and prepare a report.
On February 21, 2011, DeNuzzio sent Mahoney an e-mail and told him, in the fifth and last paragraph, that she would start recording their telephone calls the following day. Mahoney, however, regarded her statement as "an empty threat." (Am. Compl. ¶ 13). In late May or early June 2011, DeNuzzio called Mahoney. They argued and swore at one another. Toward the end of the ten-minute call, DeNuzzio told him that the call was being recorded. The amended complaint alleges that Mahoney believes that she recorded various telephone conversations between November 3, 2010 and June 2011. (Am. Compl. ¶ 14). DeNuzzio played portions of the late May or early June call to the guardian ad litem in June 2011, and later provided an edited or altered copy on a compact disc to her. The complaint also alleges that she told the guardian that Mahoney was a racist and antisemitic, and provided printouts of a white supremacist website with the explanation that Mahoney wrote some of the website posts. According to the complaint, DeNuzzio knew that Mahoney did not write the postings and was not a white supremacist.
Periodically since 2010, Mahoney has been to DeNuzzio's house and, while there, obtained access to his Yahoo! e-mail and Facebook accounts from her computer. However, the amended complaint alleges that Mahoney did so only a "handful" of times since 2010 or "several" times from January through June 2011. (Am. Compl. ¶ 11). He did not give her his e-mail password or consent to her having access to his accounts. In a June 22, 2011 filing with the Probate Court, DeNuzzio disclosed two pages of e-mails of a racist nature from Mahoney's Yahoo! account. The complaint alleges that Mahoney did not compose or send these e-mails, and that this was the first notice Mahoney received that DeNuzzio had obtained access to his accounts. (Am. Compl. ¶ 20). Mahoney then retained a computer forensics expert who concluded that on 502 occasions from January 1 through June 27, 2011, someone using the computer DeNuzzio regularly used had obtained access to Mahoney's Yahoo! e-mail account. The complaint alleges that DeNuzzio is that person. (Am. Compl. ¶ 22). It also states that DeNuzzio obtained access to his Facebook account on a "couple of occasions" in 2011 and altered his personal information to make it appear that Mahoney is homosexual. (Am. Compl. ¶ 26). Mahoney suspects that DeNuzzio obtained his password by using a software program to capture the keystrokes when he logged in.
DeNuzzio has also made false statements about Mahoney on her Facebook page and verbally elsewhere, accusing him of being a racist, an antisemite, a criminal, and a drug addict.
In 2012, a Town of Rowley detective conducted a criminal investigation after Mahoney provided him with a copy of the computer forensic report. A criminal complaint issued, but the Commonwealth filed a nolle prosequi, terminating the prosecution.
On February 29, 2013, Mahoney filed pro se a small-claims complaint against DeNuzzio in state district court. He then dismissed the matter without prejudice on April 25, 2013.
B. Procedural Background
Mahoney filed this action on June 21, 2013. Defendant now moves to dismiss the complaint pursuant to Fed. R. Civ. P. 12(b)(6) and to strike the affidavit attached to plaintiff's opposition. Plaintiff has moved to amend the complaint pursuant to Fed. R. Civ. P. 15(a).
II. Standard of Review
A. Motion to Amend
Under Fed. R. Civ. P. 15, a party may amend its pleading once as a matter of course within 21 days after serving it, or within 21 days after service of a responsive pleading or motion under Fed. R. Civ. P. 12(b), (e), or (f). See Fed. R. Civ. P. 15(a)(1). In all other cases, a party may amend a pleading only with consent of the opposing party or leave of the court. See Fed. R. Civ. P. 15(a)(2). "The court should freely give leave when justice so requires." Id. "The leave sought should be granted unless the amendment would be futile or reward undue delay." Abraham v. Woods Hole Oceanographic Inst., 553 F.3d 114, 117 (1st Cir.2009). If the proposed amendment would not survive a motion to dismiss, the amendment would be futile. See, e.g., Kemper Ins. Co. v. Federal Express Corp., 115 F.Supp.2d 116 (D. Mass. 2000).
B. Motion to Dismiss
On a motion to dismiss, the Court "must assume the truth of all well-plead[ed] facts and give plaintiff the benefit of all reasonable inferences therefrom." Ruiz v. Bally Total Fitness Holding Corp., 496 F.3d 1, 5 (1st Cir. 2007) (citing Rogan v. Menino, 175 F.3d 75, 77 (1st Cir.1999)). To survive a motion to dismiss, the complaint must state a claim that is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). That is, "[f]actual allegations must be enough to raise a right to relief above the speculative level, . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact)." Id. at 555 (citations omitted).
III. Analysis
The Court will address defendant's motion to dismiss and plaintiff's motion to amend in tandem. The amended complaint adds details to the allegations of the original complaint, but the two are, in large part, the same. Defendant's only objection to the motion to amend is futility; in other words, she contends that it would not survive a motion to dismiss. If the more-detailed amended complaint would not withstand such a motion, then the original complaint would not, either, and therefore there is no reason to consider them separately.
A. Stored Communications Act (Count 1)
The Secured Communications Act ("SCA"), 18 U.S.C. § 2701 et seq., renders unlawful whenever a person or entity:
(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or18 U.S.C. § 2701(a); see also id. § 2707 (providing a private cause of action where the conduct was knowing or intentional).
(2) intentionally exceeds an authorization to access that facility;
and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.
Here, the complaint alleges that defendant violated the SCA by intentionally obtaining access to plaintiff's e-mail and Facebook accounts from her computer without his consent. Defendant contends that the complaint does not provide sufficient facts to state a claim or adequate proof of damages. She also contends that the claims are barred by the statute of limitations and by collateral estoppel, that plaintiff's use of her computer amounted to consent, and that there was no violation of the statute if the information was stored on her computer.
The amended complaint addresses some of these arguments. As to the statute of limitations, it specifically alleges that prior to June 22, 2011, plaintiff had no knowledge, and implicitly did not have a reasonable opportunity to discover, that defendant had obtained access to his e-mail and Facebook accounts. (See Am. Compl. ¶ 19). Plaintiff filed the original complaint on June 21, 2013. Therefore, the amended complaint sufficiently alleges that plaintiff filed this action before the two-year limitations period had expired. See 18 U.S.C. § 2707(f).
The collateral estoppel argument is based on the criminal complaint and the small-claims complaint. However, the amended complaint alleges that both were dismissed prior to a final adjudication on the merits. (See Am. Compl. ¶¶ 28-29). Accordingly, they do not bar the present action. Kobrin v. Bd. of Registration in Medicine, 444 Mass. 837, 843-44 (2005) (holding that claim preclusion requires prior final judgment on the merits, as well as privity of the parties and identity of the cause of action).
Furthermore, the amended complaint clarifies the contention that plaintiff did not consent to defendant having access to his accounts. (See Am. Compl. ¶¶ 11, 19). Whether any of his actions should be deemed to constitute consent is not a question that can be determined at this stage of litigation.
As to the question of obtaining access to a communication "in electronic storage," that, too, cannot be determined at this stage. Generally, courts have found that using a computer to obtain access to an e-mail on a server without authorization falls within the ambit of the SCA. See Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2003); Cheng v. Romo, 2013 WL 6814691 (D. Mass. Dec. 20, 2013) (Casper, J.) (finding that "electronic storage" definition applied to access of e-mails on Yahoo! server); see also In re iPhone Application Litig., In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1057 (N.D. Cal. 2012) (stating that "the computer systems of an email provider, a bulletin board system, or an ISP are uncontroversial examples of facilities that provide electronic communications services to multiple users"). On the other hand, courts have held that a personal computer does not "provide [ ] an electronic communication service" and information stored there is not "in electronic storage" in a "facility" for the purposes of the SCA. See In re iPhone Application Litig., 844 F. Supp. 2d at 1057-58; In re DoubleClick, Inc. Privacy Litigation, 154 F.Supp.2d 497, 512 (S.D.N.Y. 2001); Crowley v. CyberSource Corp., 166 F.Supp.2d 1263, 1270-71 (N.D. Cal. 2001). Whether the alleged access at issue here falls into the first or second category is unclear. But it suffices for present purposes that the complaint plausibly alleges that defendant obtained access to Yahoo! and Facebook information in electronic storage in violation of the SCA.
In short, the complaint provides sufficient allegations to support a claim under the SCA. Accordingly, the motion to amend count 1 of the complaint will be granted, and the motion to dismiss count 1 will be denied.
B. Computer Fraud and Abuse Act (Count 2)
The Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030 et seq., makes it a crime when a person "intentionally accesses a computer without authorization or exceeds authorized access and thereby obtains . . . information from any computer" or "intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damages." 18 U.S.C. §§ 1030(a)(2)(C), (a)(5)(C). The statute defines "protected computer" as any computer "which is used in or affecting interstate or foreign commerce or communication." 18 U.S.C. § 1030(e)(2)(B). It also provides a private cause of action in limited circumstances, including where the offense caused a loss to one or more persons in a one-year period that aggregates to more than $5,000. Id. §§ 1030(c)(4)(A)(i)(I), (g).
The amended complaint clarifies the basis of the claim and plausibly states grounds for relief. The amended complaint alleges that the Yahoo! and Facebook computers are "protected computers" within the meaning of the statute that were used in interstate commerce. See United States v. Pires, 642 F.3d 1, 9 (1st Cir. 2011) (holding that transmission over the Internet qualifies as interstate commerce under 18 U.S.C. § 2252); United States v. Drew, 259 F.R.D. 449, 457 (C.D. Cal. 2009) (holding that obtaining access to a website satisfies the interstate commerce component of the CFAA). And it alleges that defendant obtained access to those computers without authorization, and thereby obtained information from those computers.
Furthermore, plaintiff's alleged losses—the costs of hiring a computer forensics firm and of hiring an attorney in the probate matter to remedy the breach—fit within the definition of a "loss" under the CFAA. See 18 U.S.C. § 1030(e)(11) (defining "loss" as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring . . . the system . . . to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service") (emphasis added); A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630, 646 (4th Cir. 2009) (noting that "the costs of responding to the offense are recoverable including costs to investigate and take remedial steps" (internal quotations omitted)); NCMIC Fin. Corp. v. Artino, 638 F. Supp. 2d 1042, 1065-66 (S.D. Iowa 2009) ("[A]ttorneys' fees incurred responding to the actual CFAA violation to place the plaintiff in their ex ante position are permissible as costs."); see also Mintz v. Mark Bartelstein & Associates Inc., 906 F. Supp. 2d 1017, 1029-30 (C.D. Cal. 2012) (same). Because the alleged losses aggregate to more than $5,000, the threshold has been sufficiently pleaded.
Accordingly, the motion to amend count 2 will be granted, and the motion to dismiss count 2 will be denied.
C. Massachusetts Wiretap Statute (Count 3)
Mass. Gen. Laws ch. 272, § 99(Q), provides as follows:
Any aggrieved person whose oral or wire communications were intercepted, disclosed or used . . . or whose personal or property interests or privacy were violated by means of an interception . . . shall have a civil cause of action against any person who so intercepts, discloses or uses such communications or who so violates his personal, property or privacy interest . . . .Prohibited uses include the willful disclosure of an intercepted communication and the willful alteration of a recording with intent to present it in a judicial proceeding. Id. §§ 99(C)(2)-(3). An "interception" includes a secret recording. See Mass. Gen. Laws ch. 272, § 99(B)(4). However, there is no violation where the recording was not secret, that is, that it was made with the parties' consent or actual knowledge. Com. v. Jackson, 370 Mass. 502, 505-06 (1976).
The complaint plausibly and with sufficient detail contends that defendant secretly recorded telephone conversations with plaintiff from November 2010 through June 2011, and that she altered one recording and presented it to a third party, the guardian ad litem. Whether plaintiff had actual knowledge that defendant was recording their telephone calls after the February 21, 2011 e-mail need not be resolved at this stage, because the allegations of earlier recordings and unlawful disclosure satisfy the elements of the offense.
Accordingly, the motion to amend as to count 3 will be granted, and the motion to dismiss count 3 will be denied.
D. Litigation Privilege (Counts 3, 4, 5 and 6)
Counts 3, 4, 5, and 6 of the amended complaint allege a violation of Mass. Gen. Laws ch. 272; an invasion of privacy in violation of Mass. Gen. Laws ch. 214, § 1B; intentional infliction of emotional distress; and defamation, respectively. Defendant seeks to dismiss these counts under the litigation privilege.
The Massachusetts Privacy Act provides:
A person shall have a right against unreasonable, substantial or serious interference with his privacy. The superior court shall have jurisdiction in equity to enforce such right and in connection therewith to award damages.Mass. Gen. Laws ch. 214, § 1B.
Statements "by a party, counsel or witness in the institution of, or during the course of, a judicial proceeding are absolutely privileged provided such statements relate to that proceeding." Sriberg v. Raymond, 370 Mass. 105, 108 (1976). Plaintiff concedes that statements defendant made to the guardian ad litem are protected by this privilege. (See Pl. Opp. at 18). However, the amended complaint also alleges that defendant made statements on her Facebook page that were defamatory, and that this conduct and other actions outside the litigation caused him emotional distress. Similarly, certain actions that allegedly violate the wiretap and privacy statutes are unconnected with the Probate Court action. Therefore, the litigation privilege claim fails to render the amendment of the complaint futile, or to support a motion to dismiss.
E. Supplemental Jurisdiction (Counts 3, 4, 5 and 6)
Finally, defendant contends that this Court should decline to exercise supplemental jurisdiction over the state claims if the motion to dismiss the federal causes of action are denied. Because the motion to dismiss counts 1 and 2 will be denied, the motion to dismiss on this ground will likewise be denied.
F. Motion to Strike
Defendant has moved to strike the affidavit attached to plaintiff's opposition to the motion to dismiss because it presents information outside the pleadings. Plaintiff's proposed amended complaint incorporates this information as part of the pleadings. The issue has been rendered moot by the granting of leave to amend the complaint. Accordingly, the motion to strike will be denied as moot.
IV. Conclusion
For the foregoing reasons, plaintiff's motion to amend the complaint is GRANTED. Defendant's motion to dismiss is DENIED, and defendant's motion to strike is DENIED as moot.
So ordered.
__________
F. Dennis Saylor IV
United States District Judge