Opinion
20 Civ. 08907 (VM)
03-26-2024
WILLIAM GOTTLIEB MANAGEMENT CO., LLC, Plaintiff, v. ALLAN H. CARLIN, Defendant.
DECISION AND ORDER
VICTOR MARRERO, United States District Judge.
Plaintiff William Gottlieb Management Co., LLC ("WGM") alleges that Defendant Allan H. Carlin ("Carlin") improperly interfered with WGM's computer files. WGM brings claims for violations of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030, and the Stored Communications Act ("SCA"), 18 U.S.C. § 2701 et seq., as well as claims under New York common law for trespass to chattels and negligence. Carlin moves to dismiss these claims pursuant to Federal Rule of Civil Procedure 12(b) (6) ("Rule 12(b) (6)”). For the following reasons, the Court GRANTS the motion to dismiss the CFAA and trespass to chattels claims and DENIES the motion to dismiss the SCA and negligence claims.
Except as otherwise noted, the following background derives from the Complaint. The Court takes all facts alleged therein as true and construes all justifiable inferences arising therefrom in the light most favorable to the plaintiff, as required under the standard set forth in Section II below.
Carlin, a New York-barred attorney, worked at times as outside legal counsel for WGM. (See Complaint, Dkt. No. 1, ¶ 8 [hereinafter “Compl.”].) Around September 2017, WGM provided Carlin with individual login credentials to WGM's organizational account on the cloud-based file-sharing platform Dropbox (the “WGM Dropbox Professional account”). (See id.) WGM terminated Carlin around October 24, 2018, after which personnel at WGM “noticed that Defendant Carlin had been regularly accessing the WGM Dropbox Professional account since the date of his termination.” (Id. ¶¶ 10, 12.)
WGM then retained “a licensed private investigation firm specializing in digital forensics,” nonparty NGH Group, Inc. (“NGH”), “to investigate the scope and nature of Carlin's unauthorized access to the WGM Dropbox Professional account.” (Id. ¶ 13.) NGH provided “confirmation” that Carlin accessed the account. (Id. ¶ 15.) Carlin purportedly “accessed, viewed, added, edited, and/or deleted files and folders within the WGM Dropbox Professional Account” on eleven occasions. (Id. ¶ 14.) After NGH's “confirmation,” Carlin continued to access the account “after being notified that he was committing computer trespass.” (Id. ¶ 15.) WGM alleges that Carlin's conduct caused “monetary loss” exceeding $5,000 “in internal effort and to engage contractors to investigate the scope of breach, unauthorized access, potential risks deriving from the conduct, and installing heightened measures to prevent access.” (Id. ¶¶ 2, 16.)
WGM filed its Complaint against Carlin on October 23, 2020. (See Compl.) On March 22, 2021, the Clerk of the Court entered a certificate of default against Carlin. (See Dkt. No. 8.) While this action was pending before Judge Paul A. Crotty, the Court entered a default judgement on May 10, 2021. (See Dkt. No. 9.) On December 20, 2022, the Court granted Carlin's motion to set aside the certificate of default and default judgment. (See Dkt. No. 28.)
After the default judgment was set aside, Carlin moved to dismiss all four claims pursuant to Rule 12(b) (6) (see Dkt. No. 49 [hereinafter the “Motion”]) and filed a memorandum of law in support of the Motion (see Dkt. No. 51 [hereinafter the “Memorandum” or “Mem.”]). WGM timely filed a memorandum of law in opposition to the Motion (see Dkt. No. 52 [hereinafter the “Opposition” or “Opp.”]), and Carlin timely filed a memorandum of law in reply (see Dkt. No. 53 [hereinafter the “Reply”]).
II. LEGAL STANDARD
Carlin moves to dismiss the Complaint under Rule 12(b)(6). To survive such a motion, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). This standard is satisfied “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Put differently, a complaint should not be dismissed when the plaintiff's allegations sufficiently “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. However, “the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions.” Iqbal, 556 U.S. at 678.
A Rule 12(b)(6) motion challenges only the legal feasibility of the complaint, and courts adjudicating such motions “take[] no account of the complaint's ‘basis in evidence.'” Nunes v. NBCUniversal Media, LLC, 643 F.Supp.3d 403, 411 (S.D.N.Y. 2022) (quoting Goel v. Bunge, Ltd., 820 F.3d 554, 559 (2d Cir. 2016)). “Generally, courts do not look beyond facts stated on the face of the complaint, documents incorporated in the complaint, matters of which judicial notice may be taken and documents that are ‘integral' to the complaint.” Id. (quoting Goel, 820 F.3d at 559). At the same time, the Rule 12(b)(6) standard instructs the Court to construe the complaint “liberally.” In re Inclusive Access Course Materials Antitrust Litig., 544 F.Supp.3d 420, 431 (S.D.N.Y. 2021) (quoting Coal. for Competitive Elec. v. Zibelman, 906 F.3d 41, 48-49 (2d Cir. 2018)).
III. DISCUSSION
A. EXHIBITS EXTRANEOUS TO THE COMPLAINT
In support of his motion to dismiss, Carlin has submitted a declaration with thirteen attached exhibits. (See Decl. of Allan H. Carlin, Dkt. No. 50; see also Exs. A-M to Decl. of Allan H. Carlin, Dkt. Nos. 50-1 to 50-13.) The exhibits can be grouped into three categories: (1) memoranda of law and letters filed in a related state court action between the parties; (2) information and correspondence from Dropbox; and (3) two affidavits of WGM's forensic expert filed in the state court action. (See Dkt. No. 50 ¶ 3.) These documents would be appropriate to consider on the motion to dismiss only if they are “documents that are attached to the complaint, incorporated in it by reference, integral to the complaint, or the proper subject of judicial notice.” United States v. Strock, 982 F.3d 51, 63 (2d Cir. 2020) (quotation marks omitted).
If the documents do not fall into any of those categories, then the Court may consider them only if it converts the motion to dismiss into a motion for summary judgment governed by Rule 56. See Fed.R.Civ.P. 12(d). Prior to converting the motion, “[a]ll parties must be given a reasonable opportunity to present all the material that is pertinent to the motion.” Id.
The Court concludes that the Carlin declaration and its exhibits are not appropriate to consider at this stage. None is attached to or explicitly incorporated by reference in the Complaint. See, e.g., Madu, Edozie & Madu, P.C. v. SocketWorks Ltd. Nigeria, 265 F.R.D. 106, 123 (S.D.N.Y. 2010) (“A clear and definite reference to extraneous submissions not attached to the complaint is necessary ....” (brackets omitted)).
Though the Court may take judicial notice that the statecourt documents exist, the Court cannot take judicial notice that the contents of those documents are true. See Kramer v. Time Warner Inc., 937 F.2d 767, 774 (2d Cir. 1991). Further, the Complaint does not “rel[y] heavily upon [the documents'] terms and effect” such that the Court could fairly describe them as “integral” to the Complaint. Goel, 820 F.3d at 559.
WGM's expert's affidavits (see Dkt. No. 50-11; Dkt. No. 50-12) do present a close call as to whether they may be considered integral to the Complaint. Ultimately, the Court finds that it would be inappropriate to consider the contents of those affidavits on this Motion. The Complaint's mere reference to NGH's forensic work (Compl. ¶ 15) is insufficient to render the affidavits integral because the Complaint does not rely heavily on the affidavits themselves, only the underlying events that the affidavits describe. See Goel, 820 F.3d at 559-60. In Goel, the Second Circuit determined that a district court deciding a Rule 12(b)(6) motion had abused its discretion when it considered a plaintiff's deposition testimony from a related state court action. Id. at 560. Even though the complaint in Goel referenced “sworn testimony” and the plaintiffs learned a “substantial portion of the facts” from the state court litigation, that testimony was not integral to the complaint because the complaint did not allege that the “terms and effect of [the plaintiff's] testimony” amounted to wrongdoing. Id. at 559-60. Similarly, here, WGM's expert's testimony in state court may discuss relevant matters, but the Complaint is not about the way the affidavits were written, or the legal effect of the affidavits themselves. The affidavits therefore cannot properly be labeled “integral” to WGM's Complaint. Id.
Finally, the Court will not convert the motion to dismiss into a motion for summary judgment to consider the exhibits pursuant to Rule 12(d). Summary judgment before completing discovery is appropriate “only in the rarest of cases” because the parties must ordinarily be afforded an opportunity to develop the factual record. Great Wall De Venezuela C.A. v. Interaudi Bank, 117 F.Supp.3d 474, 492 (S.D.N.Y. 2015) (quoting Hellstrom v. U.S. Dep't of Veterans Affairs, 201 F.3d 94, 97 (2d Cir. 2000)); see also Fed.R.Civ.P. 12(d). Especially because this case is still at the pleading stage and because the parties sharply disagree on the underlying circumstances and effects of Carlin's access to the WGM Dropbox Professional account, there is no reason to bypass discovery and decide the instant motion as one for summary judgment.
B. COMPUTER FRAUD AND ABUSE ACT
WGM alleges that Carlin's unauthorized access of WGM's computer system violated the CFAA. (Compl. ¶ 21.) Carlin contends that this claim should be dismissed because WGM has not sufficiently alleged the type of damage or loss the statute seeks to prevent. (Mem. at 10-16.)
The CFAA is a “federal computer-crime statute,” Van Buren v. United States, 141 S.Ct. 1648, 1652 (2021), that authorizes civil actions against anyone who “intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage.” 18 U.S.C. § 1030(a)(5)(B); see id. § 1030(g). To bring a civil action, the plaintiff must also allege “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.” Id. § 1030(c)(4)(A)(i)(I); see id. § 1030(g). Though “loss” and “damage” represent different legal concepts, both terms “focus on technological harms - such as the corruption of files - of the type unauthorized users cause to computer systems and data.” Van Buren, 141 S.Ct. at 1660. The Court finds that WGM has not pleaded the existence of either “loss” or “damage” under the CFAA.
The Court's analysis begins with “loss,” which is “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). A plaintiff must plead that their “loss” exceeded $5,000 to state a civil claim under the CFAA. Id. § 1030(c) (4) (A) (i) (I); LivePerson, Inc. v. 24/7 Customer, Inc., 83 F.Supp.3d 501, 514 (S.D.N.Y. 2015) (granting a motion to dismiss where plaintiff failed to “quantify the loss it alleges”).
WGM's allegations are insufficient to allege “loss” under this definition. As a general rule, remedial loss incurred to investigate computer damage constitutes loss under the statute. See, e.g., Tyco Int'l (US) Inc. v. John Does 1-3, No. 01 Civ. 3856, 2003 WL 21638205, at *1 (S.D.N.Y. July 11, 2003) (limiting loss to “those costs necessary to assess the damage caused to the plaintiff's computer system”). However, general investigatory costs do not amount to loss in every case. See Nexans Wires S.A. v. Sark-USA, Inc., 319 F.Supp.2d 468, 477 (S.D.N.Y. 2004) (holding that travel expenses necessary to meet to discuss the information stolen by a former employee did not constitute loss), aff'd, 166 Fed.Appx. 559 (2d Cir. 2006). Courts in this District have held plaintiffs to the burden of alleging how the “costs of responding to an offense” are linked “to situations involving damage to or impairment of the protected computer.” Better Holdco, Inc. v. Beeline Loans, Inc., No. 20 Civ. 8686, 2021 WL 3173736, at *3 (collecting cases); see Nanobeak Biotech Inc. v. Barbera, No. 20 Civ. 07080, 2021 WL 1393457, at *4 (S.D.N.Y. Apr. 13, 2021) (granting motion to dismiss where there were “no specific allegations connecting the alleged ‘investigative expenses' to any effort to investigate damage done to the computer systems”); Van Buren, 141 S.Ct. at 1660 (emphasizing that “loss” must relate to “technological harms”).
As Carlin points out, the Complaint alleges that NGH's investigation only confirmed what WGM already knew - i.e., that Carlin accessed its data - rather than analyzing the effect of Carlin's access on WGM's computer systems. (See Compl. ¶ 12 (“WGM's IT personnel noticed that Defendant Carlin had been regularly accessing the WGM Dropbox Professional account since the date of his termination[.]”); id. ¶ 15 (stating that NGH provided “confirmation of
Defendant Carlin's unauthorized access to WGM's Dropbox Professional account” (emphasis added)); id. ¶ 13 (stating that NGH “investigate[d] the scope and nature of Carlin's unauthorized access to the WGM Dropbox Professional account” (emphasis added)).) These allegations do not even support the inference that NGH's investigation was helpful to reveal the infringing conduct given that NGH provided only confirmation of what WGM already knew. See Tyco, 2003 WL 21638205, at *2 (holding that because the defendant's conduct “would have been immediately apparent,” the cost of the investigation was limited to locating the defendant and collecting information about him, which is not compensable loss). WGM's response to this argument does not cite a single case to support that its allegations regarding loss are sufficient to state a claim under the CFAA.
Next, distinct from the concept of “loss” under the CFAA, “damage” is “any impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). WGM's allegations are deficient with respect to “damage” as defined by the CFAA. The Complaint never states how Carlin's conduct “impaired” or otherwise affected WGM's computers, data, or files. See Better Holdco, 2021 WL 3173736, at *4 (granting motion to dismiss where the plaintiff did “not allege that it lost service or access to its data, or that its systems were otherwise harmed”). Carlin's mere access to and use of information obtained from a computer system does not equate to damage to the computer redressable by the CFAA. See Register.com, Inc. v. Verio, Inc., 126 F.Supp.2d 238, 252 n.12 (S.D.N.Y. 2000) (concluding that whether or not the extracted data was used to obtain a competitive advantage “has no bearing” on whether the data or computer systems were impaired), aff'd, 356 F.3d 393 (2d Cir. 2004).
WGM's argument that Carlin must have caused “damage” by editing or deleting files on the WGM Professional Dropbox account is not persuasive. Even editing or deleting a file does not in every case amount to “impairment to the integrity” of data, a program, a system, or information. 18 U.S.C. § 1030(e)(8); cf. Opp. at 4-7. The Complaint is barren as to the significance of the documents that were allegedly edited or deleted, or how WGM was impacted in any way by Carlin's actions. In other words, if Carlin's actions did impair data, a program, a system, or information, the Complaint does not state how or why. See 18 U.S.C. § 1030(e)(8). Indeed, WGM's allegations in this respect are conclusory, lack factual context, and parrot the law. See Compl. ¶¶ 16, 22-23. WGM has thus failed to allege damage under the CFAA.
Accordingly, Carlin's motion to dismiss the CFAA claim is GRANTED.
C. STORED COMMUNICATIONS ACT
Civil liability under the SCA extends to whoever “(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.” 18 U.S.C. § 2701(a); see also id. § 2707(a) (expressly permitting any “person aggrieved by any violation of [the SCA]” to bring a civil action against the “person or entity” that engaged in such violation).
Carlin argues that WGM's SCA claim rests on a conclusory allegation that his access to the Dropbox account was unauthorized. (See Mem. at 18-19.) In support, Carlin cites In re DoubleClick Inc. Privacy Litigation, where the court dismissed an SCA claim because the plaintiffs relied “solely on the naked allegation that defendant's access was ‘unauthorized.'” 154 F.Supp.2d 497, 510 (S.D.N.Y. 2001). However, in DoubleClick, the court was bound to reject the plaintiff's “bare assertion that [defendant's] access was unauthorized” because “every fact [plaintiffs] do allege supports the inference that the [plaintiffs] did authorize [defendants'] access.” Id.
Here, WGM has met its burden of pleading that Carlin's access to the WGM Dropbox Professional account was unauthorized. Unlike in DoubleClick, the facts pleaded in the Complaint here plausibly support WGM's conclusions that Carlin exceeded the scope of his authorized access to the WGM Dropbox Professional account. It is reasonable to infer that once Carlin's professional relationship with WGM ended, Carlin did not continue to have authorization to continue to use WGM's computer systems or view WGM's files. (See Compl. ¶¶ 8, 10, 15.) Allegations that one has exceeded the scope of his or her permitted access are sufficient to survive a motion to dismiss. See, e.g., Penrose Comput. Marketgroup, Inc. v. Camin, 682 F.Supp.2d 202, 210 (N.D.N.Y. 2010) (“Accepting, arguendo, that Defendant had full access to the Plaintiff's computer system, this does not support the conclusion that Defendant had authorization to access another employee's email account.”); Monson v. Whitby Sch., Inc., No. 3:09 Civ. 1096, 2010 WL 3023873, at *5 (D. Conn. Aug. 2, 2010) (denying motion to dismiss where complaint sufficiently alleged the employee exceeded the scope of her access to the school's computer system); cf. Van Buren, 141 S.Ct. at 1662 (interpreting “exceeds authorized access” in context of the CFAA to mean “when [one] accesses a computer with authorization but then obtains information located in particular areas of the computer - such as files, folders, or databases - that are off limits to him”).
Carlin's other SCA arguments relate to two statutory exceptions to liability. (See Mem. at 18-19 (discussing 18 U.S.C. § 2701(c) exceptions).) Because Carlin's arguments hinge on facts not raised on the face of the Complaint, they are not properly before the Court on this motion to dismiss. See Pani v. Empire Blue Cross Blue Shield, 152 F.3d 67, 74 (2d Cir. 1998) (“An affirmative defense may be raised by a pre-answer motion to dismiss under Rule 12(b)(6), without resort to summary judgment procedure, if the defense appears on the face of the complaint.”); see also Wright & Miller, 5 Fed. Prac. & Proc. Civ. § 1277 (4th ed.) (“Since the facts necessary to establish an affirmative defense generally must be shown by matter outside the complaint, the defense technically cannot be adjudicated on a motion under Rule 12.”); id. (“[M]otions to dismiss . . . only can attack matters appearing on the face of the complaint.”); cf. DoubleClick, 154 F.Supp.2d at 508 (dismissing an SCA claim pursuant to statutory exceptions grounded on “on the face of the pleadings”). Accordingly, Carlin's motion to dismiss the SCA claim is DENIED.
D. STATE LAW CLAIMS
WGM brings two claims under New York common law: trespass to chattels and negligence. Carlin moves to dismiss these claims on the basis that WGM has not sufficiently alleged damage to its data or computer system. (See Mem. at 20.)
1. Trespass to Chattels
WGM alleges that Carlin committed trespass to chattels when Carlin accessed WGM's Dropbox account without consent and WGM “suffered damages, financially and otherwise.” (See Compl. ¶¶ 33-34.) To bring a claim for trespass to chattels, a plaintiff must allege that the defendant “intentionally, and without justification or consent, physically interfered with the use and enjoyment of personal property in [plaintiff's] possession” in a manner that causes harm to the property. Jackie's Enterprises, Inc. v. Belleville, 87 N.Y.S.3d 124, 130-31 (N.Y. A.D.3d Dep't 2018).
“The ‘harm' at issue is ‘harm to the condition, quality or material value of the chattels at issue' and the showing of such harm is ‘an essential element' in pleading trespass to chattels.” Fischkoff v. lovance Biotherapeutics, Inc., 339 F.Supp.3d 408, 416 (S.D.N.Y. 2018) (quoting J. Doe No. 1 v. CBS Broad. Inc., 806 N.Y.S.2d 38, 39 (N.Y.App.Div. 1st Dep't 2005)).
WGM fails to allege how Carlin harmed the condition, quality, or value of WGM's files or computer. It offers only conclusory allegations that WGM “suffered damages.” (See Compl. ¶ 34.) Without more, WGM has failed to state a claim for trespass to chattels. See, e.g., Twin Sec., Inc. v. Advoc. & Lichtenstein, LLP, 980 N.Y.S.2d 18, 19 (N.Y.App.Div. 1st Dep't 2014) (dismissing trespass to chattels claim because “there is no indication that the condition, quality or value of the computer, its hard drive, or any of the information on the computer was diminished as a result of defendants' duplication of the hard drive”); Hecht v. Components Int'l, Inc., 867 N.Y.S.2d 889, 899 (N.Y. Sup. Ct. Nassau Cnty. 2008) (“Since the emails were stored in Hecht's Outlook Express folder, Components has not shown that Hecht's deletion of the emails was anything other than harmless intermeddling with the computer system.”); Fischkoff, 339 F.Supp.3d at 417 (collecting cases requiring allegations of diminished capacity or harm to the integrity of the computer). Accordingly, the motion to dismiss this claim is GRANTED.
2. Negligence
WGM next alleges that Carlin was negligent when he breached his duty of refraining from using WGM's Dropbox account after his termination. (See Compl. ¶¶ 38-39.) WGM 17 alleges that his breach of that duty caused WGM to be “injured financially.” Id. ¶ 40.
“It is well-settled that to establish a claim of negligence, a plaintiff must prove: a duty owed to the plaintiff by the defendant, a breach of that duty, and injury proximately resulting therefrom.” Moore Charitable Found. v. PJT Partners, Inc., 217 N.E.3d 8, 14 (N.Y. 2023). Carlin moves to dismiss only on the basis that WGM has failed to allege an injury resulting from the alleged breach of duty.
The Court disagrees. WGM alleges that it retained a private investigation firm “to investigate the scope and nature of Carlin's unauthorized access” in response to WGM's IT personnel observing Carlin access the WGM Dropbox. (Compl. ¶¶ 12-13.) WGM incurred over $5,000 in costs to investigate the scope of Carlin's breach. (See id. ¶ 2.) Those allegations are sufficient to allege injury in the context of Carlin's purported breach (despite not being sufficient to allege “loss” under the CFAA for the reasons previously discussed). See, e.g., Sackin v. TransPerfect Glob., Inc., 278 F.Supp.3d 739, 749 (S.D.N.Y. 2017) (allegations that plaintiffs had “to take reasonable steps to mitigate the consequences of the data breach” were sufficient to allege injury for negligence claim); Rudolph v. Hudson's Bay Co., No. 18 Civ. 8472, 2019 WL 2023713, at *9 (S.D.N.Y. May 7, 2019) (alleging injury based on the expenses incurred when plaintiff “drove to a Bank of America branch to obtain a new debit card, as well as time expended to retrieve the card and update account records”). Accordingly, the motion to dismiss this claim is DENIED.
IV. ORDER
For the reasons stated above, it is hereby
ORDERED that the motion (Dkt. No. 49) filed by defendant Allan H. Carlin (“Carlin”) to dismiss the Complaint (Dkt. No. 1), pursuant to Federal Rule of Civil Procedure Rule 12(b)(6) (“Rule 12(b)(6)”) is GRANTED in part and DENIED in part; and it is further
ORDERED that Carlin shall respond to those portions of the Complaint that have not been dismissed no later than 21 days after the date of this Order.
SO ORDERED.