Summary
holding that passive receipt of email communications does not qualify as “access” under CFAA
Summary of this case from Fink v. CableOpinion
Civil No. 03-1857
February 25, 2004
MEMORANDUM
Role Models America, Inc. ("RMA" or "Role Models"), the plaintiff in this case, operates a residential, military-style academy for high school dropouts. To fulfill a requirement of a two-year multimillion dollar grant Role Models received from the federal government, RMA hired Social Consultants International ("SCI") in June 2000 to monitor and evaluate the academy's performance during the grant period. During roughly the first year of the grant period, between approximately July 3, 2000 and August 28, 2001, one of the defendants, Dr. Jimmie Jones, served as the academy's principal. RMA alleges that Dr. Jones used "proprietary" information, including data compiled by SCI, to complete an Internet-based doctoral program offered by Nova Southeastern University, Inc. ("NSU"), the other defendant in this case. RMA claims that NSU's conduct entitles RMA to damages under the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030, a criminal statute that affords a private right of action, see id. § 1030(g), and the Maryland Uniform Trade Secrets Act ("MUTSA"), Md. Code Ann., Com. Law §§ 11-1201-09. NSU disagrees; it has filed a motion to dismiss both claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure. (Docket no. 22.) The motion has been fully briefed and no oral argument is necessary. Local Rule 105.6. For the reasons that follow, the court will grant NSU's motion as to the CFAA count, but deny it as to RMA's MUTSA claim.
According to the complaint, the grant ran from June 5, 2000 until May 30, 2002. (Compl. ¶ 16.)
"The purpose of a Rule 12(b)(6) motion is to test the sufficiency of a complaint; importantly, a Rule 12(b)(6) motion does not resolve contests surrounding the facts, the merits of a claim, or the applicability of defenses." Edwards v. City of Goldsboro, 178 F.3d 231, 243 (4th Cir. 1999) (internal quotation marks and alterations omitted). When ruling on such a motion, the court must "accept the well-pled allegations of the complaint as true," and "construe the facts and reasonable inferences derived therefrom in the light most favorable to the plaintiff." Ibarra v. United States, 120 F.3d 472, 474 (4th Cir. 1997). Consequently, a motion to dismiss under Rule 12(b)(6) may be granted only when "it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief." Conley v. Gibson, 355 U.S. 41, 45-46 (1957); see also Edwards, 178 F.3d at 244. In addition, because the court is testing the legal sufficiency of the claims, the court is not bound by the plaintiff's legal conclusions. See, e.g., Young v. City of Mount Ranier, 238 F.3d 567, 577 (4th Cir. 2001) (noting that the "presence . . . of a few conclusory legal terms does not insulate a complaint from dismissal under Rule 12(b)(6)" when the facts alleged do not support the legal conclusions); Labram v. Havel, 43 F.3d 918, 921 (4th Cir. 1995) (affirming Rule 12(b)(6) dismissal with prejudice because the plaintiffs alleged facts failed to support her conclusion that the defendant owed her a fiduciary duty at common law).
Even accepting the allegations as true and reading them in RMA's favor, RMA's first count fails to indicate a basis for recovery from NSU. Each of the CFAA provisions RMA cites would apply only if NSU "intentionally accesse[d]" information on a protected computer, 18 U.S.C. § 1030(a)(2)(C), 1030(a)(5)(C), or accessed such information "knowingly and with intent to defraud," id. § 1030(a)(4). RMA, however, has not alleged that NSU "accessed" RMA's computers at all, much less "intentionally" or "knowingly and with intent to defraud." What the complaint indicates, at best, is that NSU received information about RMA from Dr. Jones as Dr. Jones prepared his dissertation (Compl. ¶¶ 26, 31, 35-36), that Dr. Jones had begun writing the dissertation by late 2000 ( see id. ¶ 29), and that RMA's lawyer notified NSU on June 20, 2002 — roughly a year before Dr. Jones graduated — that the information came from RMA computers ( id. ¶ 41). Receipt of information under such circumstances, even with notice of its source, cannot qualify as "accessing" an RMA computer. As another district court has noted, the word "access," in this context, is an active verb: it means "to gain access to," or "to exercise the freedom or ability to make use of something." Am. Online, Inc. v. Nat'l Health Care Discount, Inc., 121 F. Supp.2d 1255, 1272-73 (N.D. Iowa 2000) (citing Mirriam-Webster's Collegiate Dictionary 6 (10th ed. 1994)) (internal quotations and alterations omitted). Because there is no indication in the complaint that NSU did anything more than permit Dr. Jones to complete his dissertation, NSU's alleged conduct does not meet the definition of "accesses," and RMA has not stated a violation of the CFAA with respect to NSU.
The relevant portions of the statute read as follows:
(a) Whoever —
. . .
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains —
. . .
(C) information from any protected computer if the conduct involved an interstate or foreign communication;
. . .
(4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period;
(5) . . .
(C) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage;
. . .
shall be punished [under this statute].
18 U.S.C. § 1030. While NSU could violate two of these provisions by "exceed[ing] authorized access," that phrase is itself defined in terms of "access[ing] a computer." See id. § 1030(e)(6).
It appears to be undisputed that RMA's computers qualify as "protected computers" under the statute. Under 18 U.S.C. § 1030(e)(2), "the term `protected computer' means a computer . . . (B) which is used in interstate or foreign commerce or communication."
The complaint does allege that Dr. Jones sent email directly from RMA computers during the period when he was employed by RMA. (Compl. ¶ 26.) Again, however, receiving email is not the same as "accessing" a computer. Moreover, RMA's brief focuses on the period after NSU received notice of the information's origin on June 20, 2002 — some ten months after Dr. Jones's employment with RMA concluded in August 2001.
Recognizing, perhaps, that NSU has not accessed its computers in any direct sense, RMA falls back on the argument that access to Dr. Jones's computer should suffice to establish NSU's liability. According to RMA, Dr. Jones's computer became a "clone" of RMA's computers when Dr. Jones placed proprietary information on it after leaving his employment with RMA; hence, RMA argues, accessing Dr. Jones's computer was tantamount to unauthorized access to RMA's computers. There are at least two errors in this argument. First, according to the complaint, Dr. Jones "sent" the information at issue to NSU by email. (Compl. ¶ 35.) Receiving electronic information is, again, not the same as "accessing" the computer from which the information derived; the former conduct is passive, whereas the latter is active. Furthermore, even if the theory were consistent with the complaint, NSU's conduct would not support liability under the CFAA, for the provisions RMA cites would apply only if NSU had accessed Dr. Jones's computer "without authorization." See 18 U.S.C. § 1030(a)(2)(C), 1030(a)(4), 1030(a)(5)(C). Even granting — rather improbably — that NSU may have actively retrieved assignments from Dr. Jones's computer, it would be unreasonable to suppose that it did so without Dr. Jones's authorization. Whether RMA would have given NSU the same authorization to access its own computers is irrelevant. See Davies v. Afilias Ltd., 293 F. Supp.2d 1265, 1273 (M.D. Fla. 2003) (rejecting a CFAA claim because there was "no evidence that Plaintiff directly accessed Defendant's computer system"); cf. Edge v. Prof'l Claims Bureau, Inc., 64 F. Supp.2d 115, 119 (E.D.N.Y. 1999) (holding that access to computerized credit information on a third-party's database "cannot be said to have been without `authorization'" where the access was made for a "permissible purpose" under the applicable credit reporting laws), aff'd, 234 F.3d 1261 (2d Cir. 2000) (unpublished table opinion).
These provisions are quoted in full in note 2, supra.
It would be a different case if Dr. Jones had acted as NSU's agent in accessing information on RMA's computers. For example, if NSU had told Dr. Jones to send "e-mails to the defendant containing various trade secrets and proprietary information belonging to the plaintiff," as occurred in Shurgard Storage Ctrs., Inc. v. Safeguard Self Storage, Inc., 119 F. Supp.2d 1121, 1123 (W.D. Wash. 2000), a case cited by RMA, then the fact that the information was transferred first to Dr. Jones's computer might not insulate NSU from liability. See id. at 1123-25 (holding the defendant liable for directing a key employee of a competitor to transfer trade secrets from the competitor's computers before leaving his position with the competitor and accepting employment with the defendant). In this case, however, RMA has merely alleged, with no supporting facts, that NSU "assisted" Dr. Jones in "violating RMA's trade secrets and proprietary information." (Compl. ¶ 31.) There is no claim that NSU directed or even encouraged Dr. Jones to access RMA computers, nor any factual allegations supporting an agency relationship. Absent some indication that Dr. Jones acted at NSU's behest, it is impossible to hold NSU liable for CFAA violations allegedly committed by Dr. Jones.
For all these reasons, Role Models's CFAA claim fails to state a basis for relief against NSU. Because this ruling disposes of RMA's first theory, the court will not address the parties' remaining arguments regarding the CFAA. Count one of the complaint will be dismissed as to NSU.
As for RMA's second theory, this claim remains viable under Rule 12(b)(6). The MUTSA provides a cause of action for damages and injunctive relief based on the "misappropriation" of a trade secret. See Md. Code Ann., Com. Law §§ 11-1202, 11-1203. As is relevant here, the statute defines "misappropriation" to mean:
(1) Acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or
(2) Disclosure or use of a trade secret of another without express or implied consent by a person who:
(i) Used improper means to acquire knowledge of the trade secret; or
(ii) At the time of disclosure or use, knew or had reason to know that the person's knowledge of the trade secret was:
1. Derived from or through a person who had utilized improper means to acquire it;
2. Acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use; or
3. Derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use. . . .Id. § 11-1201(c). The term "trade secret" is then defined to encompass information that:
(1) [d]erives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and (2) [i]s the subject of efforts that are reasonable under the circumstances to maintain its secrecy.Id. § 11-1201(e). Though the statutory definition may be somewhat broader, Maryland courts also look to the Restatement of Torts for guidance as to whether information is a trade secret. See, e.g., Home Paramount Pest Control Cos. v. FMC Corp./Agric. Prods. Group, 107 F. Supp.2d 684, 692-93 (D. Md. 2000); Optic Graphics, Inc. v. Agee, 591 A.2d 578, 584-85 (Md.Ct.Spec.App. 1991).
NSU argues that the information at issue here was not a trade secret under Maryland law, and that, in any event, NSU's alleged conduct did not constitute misappropriation because NSU received notice that the information was improperly obtained only when RMA's lawyer contacted NSU in June 2002, some eighteen months after Dr. Jones had begun preparing his dissertation and corresponding with NSU ( see Compl. ¶¶ 26, 29, 41). While further development of the record may permit NSU to prevail based on these arguments, the complaint's allegations are sufficient to preclude dismissal at this stage. Neither the briefs nor the complaint specify what exactly Dr. Jones included in his dissertation. Based on RMA's allegations alone, it is at least plausible that Dr. Jones's research involved data that were both secret and economically valuable; after all, RMA allegedly paid SCI over $250,000 to produce the information (Compl. ¶ 19). It also appears reasonable to infer, based on the allegation that Dr. Jones was scheduled to graduate on June 27, 2003 (Compl. ¶ 49), that at least the final draft of the dissertation was submitted after the June 2002 correspondence from RMA's lawyer. At that time, if not before, NSU arguably had reason to know that Dr. Jones had obtained his research improperly. Moreover, while NSU denies that it disseminated Dr. Jones's dissertation, it concedes that a copy was available upon request from the university's librarian. ( See Def.'s Mem. at 15-16.) Further details regarding NSU's handling of the paper might permit RMA to show that NSU "used" or "disclosed" the paper in the sense prohibited by the MUTSA. Thus, when all ambiguities are resolved in RMA's favor, the court is unable to conclude that RMA can prove no set of facts entitling it to relief.
At present, the record includes less than a dozen pages from a dissertation that appears to exceed 55 pages in length. ( See Pl.'s Opp'n Ex. A.)
RMA asserts in its brief, though not the complaint, that Dr. Jones forwarded the final draft to NSU in August 2002.
The court expresses no opinion as to whether placing the dissertation in the library is sufficient to constitute "use" or "disclosure" under the MUTSA. The point is simply that the facts regarding NSU's handling of the paper remain unclear.
NSU's motion, therefore, will be granted only as to the CFAA claim in count one of the complaint, not as to the MUTSA claim included in count two.
If this case is not resolved in the near future, the court will discuss efficient methods of obtaining the limited discovery that may be necessary to determine NSU's liability as a matter of law.
A separate order follows.
ORDER
For the reasons stated in the accompanying Memorandum, it is hereby Ordered that:
1. defendant Nova Southeastern University, Inc.'s Motion to Dismiss (docket no. 22) will be GRANTED as to count one of the complaint and DENIED as to count two; and
2. copies of this Order and the accompanying Memorandum shall be sent to counsel of record and to Dr. Robert L. Alexander, president of the plaintiff Role Models America, Inc.