Delta Pilots Association v. Doe

MEMORANDUM OF LAW in Support re: 67 MOTION to Dismiss . . Document

S.D.N.Y.December 13, 2016

762-000-00001: 10738231_4.doc UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK DELTA PILOTS ASSOCIATION, Plaintiff, v. RUSSELL C. MELVIN, Defendant. Civil Action No. 1:14-cv-00225-AKH MEMORANDUM OF LAW IN SUPPORT OF DEFENDANT’S MOTION TO DISMISS THE AMENDED COMPLAINT Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 1 of 22 762-000-00001: 10746011.docx TABLE OF CONTENTS PRELIMINARY STATEMENT .................................................................................................... 1 ARGUMENT .................................................................................................................................. 1 I. LEGAL STANDARD FOR A MOTION TO DISMISS ..................................................... 1 II. THE AMENDED COMPLAINT IS BARRED BY THE APPLICABLE STATUTE OF LIMITATIONS ........................................................................................... 2 III. PLAINTIFF FAILS TO STATE A CLAIM UPON WHICH RELIEF MAY BE GRANTED ..................................................................................................................... 7 A. Required Elements of DPA’s CFAA Claims ................................................................... 7 B. DPA Failed To Adequately Plead Causation, as Required by All Three Causes of Action .............................................................................................................. 8 C. DPA Failed To Adequately Plead a Loss of $5,000 Within 1 Year, as Required by All Three Causes of Action ....................................................................... 10 D. DPA Failed to Adequately Plead a Lack of Authorization, as Required by All Three Causes of Action............................................................................................ 13 E. DPA Failed To Adequately Plead the Additional Elements Necessary for Each Cause of Action ..................................................................................................... 14 F. DPA’s Allegation of Ongoing Damage is Not Cognizable Under CFAA ..................... 15 IV. PLAINTIFF SHOULD NOT BE GRANTED FURTHER LEAVE TO AMEND TO CURE DEFICIENCIES IN THE AMENDED COMPLAINT .......................................... 16 A. Granting Leave to Amend Would Be Futile .................................................................. 16 B. Granting Leave to Amend Would Unduly Prejudice Mr. Melvin .................................. 17 CONCLUSION ............................................................................................................................. 18 Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 2 of 22 ii TABLE OF AUTHORITIES Page(s) CASES Arnold v. KPMG LLP, 334 F. App’x 349 (2d Cir. 2009) .............................................................................................16 Ashcroft v. Iqbal, 556 U.S. 662 (2009) .....................................................................................................1, 7, 9, 13 Aslanidis v. U.S. Lines, Inc., 7 F.3d 1067 (2d Cir. 1993).........................................................................................................6 Barrow v. Wethersfield Police Dept., 66 F.3d 466 (2d Cir. 1995), modified, 74 F.3d 1366 (2d Cir. 1996) ..........................................5 Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) ......................................................................................................... passim Burnett v. New York Central R. Co., 380 U.S. 424 (1965) ...................................................................................................................6 Freund v. Fleetwood Enterprises, Inc., 956 F.2d 354 (1st Cir. 1992) ......................................................................................................6 Gurary v. Winehouse, 235 F.3d 792 (2d Cir. 2000).....................................................................................................16 Hogan v. Fischer, 738 F.3d 509 (2d Cir. 2013).......................................................................................................5 Joblove v. Barr Labs., Inc., 429 F.3d 370 (2d Cir. 2005).....................................................................................................17 Kassner v. 2nd Ave. Delicatessen, Inc., 496 F.3d 229 (2d Cir. 2007).......................................................................................................1 LivePerson, Inc. v. 24/7 Customer, Inc., 83 F. Supp. 3d 501 ...............................................................................................................8, 10 Millenium TGA, Inc. v. Leon, No. 12 Civ. 1360, 2013 U.S. Dist. LEXIS 150508 (E.D.N.Y. September 23, 2013) ..............11 Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 3 of 22 iii Nechis v. Oxford Health Plans, Inc., 421 F.3d 96 (2d Cir. 2005).........................................................................................................5 Nexans Wires S.A. v. Sark-USA, Inc., 319 F. Supp. 2d 468 (S.D.N.Y. 2004) aff’d, 166 F. App’x 559 (2d Cir. 2006) .................10, 11 Polite v. Town of Clarkstown, 198 F.R.D. 610 (S.D.N.Y. 2001) ...............................................................................................6 Reis, Inc. v. Lennar Corp., No. 15 Civ. 7905, 2016 U.S. Dist. LEXIS 88228 (S.D.N.Y. July 5, 2016) .............................11 Reis, Inc. v. Spring11 LLC, No. 15 Civ. 2836, 2016 U.S. Dist. LEXIS 131486 ............................................................11, 12 Rodriguez v. Bear Stearns Cos., No. 07-cv-1816(JCH), 2009 U.S. Dist. LEXIS 31525 (D. Conn. Apr. 14, 2009) ...................17 Schiavone v. Fortune, 477 U.S. 21 (1986) .....................................................................................................................6 Tyco Int’l Inc. v. John Does, No. 01 Civ. 3856, 2003 U.S. Dist. LEXIS 11800 (S.D.N.Y. July 11, 2003 ............................10 STATUTES 18 U.S.C. § 1030 et seq.......................................................................................................... passim RULES Federal Rule of Civil Procedure 4(m) ..............................................................................................5 Federal Rule of Civil Procedure 12(b)(6) ........................................................................................1 Federal Rule of Civil Procedure 15 ...................................................................................5, 6, 7, 16 Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 4 of 22 762-000-00001: 10738231_4.doc 1 PRELIMINARY STATEMENT Plaintiff’s Amended Complaint should be dismissed on statute of limitations grounds and for failure to state a claim upon which relief may be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). ARGUMENT I. LEGAL STANDARD FOR A MOTION TO DISMISS When considering a motion to dismiss under Fed. R. Civ. P. 12(b)(6), the Court assumes all facts alleged in the complaint to be true, and draws all reasonable inferences in favor of the plaintiff. Kassner v. 2nd Ave. Delicatessen, Inc., 496 F.3d 229, 237 (2d Cir. 2007). However, this principle is “inapplicable to legal conclusions.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id.; see also Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (“a formulaic recitation of the elements of a cause of action will not do”). Statements that simply regurgitate the elements of a claim are not entitled to the assumption of truth. Iqbal, 556 U.S. at 679. “While legal conclusions can provide the framework of a complaint, they must be supported by factual allegations.” Id. A complaint that “tenders ‘naked assertion[s]’ devoid of ‘further factual enhancement’” will not satisfy the pleading standard. Id. at 678 (quoting Twombly, 550 U.S. at 557). To avoid dismissal, the complaint must contain “enough facts to state a claim to relief that is plausible on its face,” that is to say, facts that “nudge[ ] [the plaintiff’s] claims across the line from conceivable to plausible. . . .” Twombly, 550 U.S. at 570. As shown below, the Amended Complaint at issue here relies entirely on legal conclusions and naked assertions, without factual support sufficient to make the claim plausible Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 5 of 22 762-000-00001: 10738231_4.doc 2 - in spite of significant third-party discovery prior to the filing of the Amended Complaint. For this reason, and because it is untimely, the Amended Complaint must be dismissed. II. THE AMENDED COMPLAINT IS BARRED BY THE APPLICABLE STATUTE OF LIMITATIONS An action under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. §1030 et seq., must be “begun within 2 years of the date of the act complained of or the date of the discovery of the damage.” 18 U.S.C. §1030(g). The action was not begun against Defendant Melvin until almost three years after the date of the act complained of. Accordingly, the Amended Complaint should be dismissed. The complained-of hacking, if there was one, is alleged to have occurred “on or about November 8, 2013, and continuing thereafter.” Amended Complaint (“AC”) ¶ 32. Plaintiff does not allege that it was unaware of the complained-of act on November 8, 2013, and that is therefore the relevant date for a statute of limitations analysis. Plaintiff Delta Pilots Association (“DPA”) initiated this action against a “John Doe” defendant on January 13, 2014. (Docket # 1). The Court granted DPA permission, on January 29, 2014, to serve “immediate discovery upon third-parties in order to identify defendant John Doe.” (Docket # 5). During a status conference on August 14, 2014, DPA’s counsel received information containing Mr. Melvin’s identity from counsel to third-party Air Line Pilots Association. The following discussion was had between the Court and DPA’s counsel: THE COURT: This case will proceed in normal fashion. The next step will be a motion to amend the caption. When will that occur, Mr. Silverst[one]? MR. SILVERSTONE: I believe, your Honor, we are going to need at least 30 days. We have some outstanding subpoenas that have not been responded to. Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 6 of 22 762-000-00001: 10738231_4.doc 3 THE COURT: I’m not sure you are going to do very well with subpoena practice. It seems to me that you are using this case as a fishing expedition for a lot of other information that is intended as relevant not to this case but for other purposes in your jurisdictional dispute. I want you to know that this Court will not lend itself to that practice. MR. SILVERSTONE: Your Honor, I respectfully disagree with that. We have only conducted this litigation for the sole purpose of finding out who is at the bottom of this hacking incident. THE COURT: I heard what you said. I gave you the discovery that you have asked for. You now know the name of the person who was involved. If you want to take that person’s deposition to see if anyone else was involved, you can do so. But I don’t see any room for bothering other people with subpoenas. MR. SILVERSTONE: As I said, there is a subpoena outstanding to the web hosting company. The subpoena was written by our computer expert. * * * THE COURT: If they give discovery voluntarily, of course, they can give it. If you ask me, I don’t see that it is relevant, at least not until you take the deposition of the individual. MR. SILVERSTONE: We will do that, your Honor. THE COURT: Let your client know what I said before. You have to show me what is relevant. At this point in time it seems to me you have everything and you are prolonging the case simply for other purposes. I’m not saying that is a finding. It is not a finding. It is an observation. We have a date in September. There is no need to accelerate at this point in time. I do want to have a fixed date. When does your case management plan say you have to make a motion. Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 7 of 22 762-000-00001: 10738231_4.doc 4 MR. SILVERSTONE: We don’t have a plan yet, your Honor. I think we were supposed to do that at the September 5th conference. THE COURT: OK. On September 5 have in mind that the date for making this motion will be very close to September 5. (8/14/14 Tr. pp. 10-12)(Emphasis added.) DPA learned Mr. Melvin’s identity on or before August 14, 2014. See also Docket # 41 at 1 (referring to “the disclosed individual” and describing Mr. Melvin as “having been identified”). DPA also understood on August 14, 2014 that the next step in the proceeding was to amend the caption. (8/14/14 Tr. 10:19-21). On September 8, 2014, the Court gave DPA “until September 30, 2014 to either amend the complaint to name a defendant or to dismiss the complaint without prejudice.” (Docket # 24). Yet, in all the time from August 14, 2014 until November 3, 2016, DPA never provided Mr. Melvin with a summons or a copy of the complaint. While DPA was ordered not to reveal Mr. Melvin’s name absent the Court’s permission to change the name of the caption (Docket # 22), nothing prevented DPA from contacting Mr. Melvin directly, as the Court itself suggested. (8/14/14 Tr. 11:23-12:2). DPA makes no allegation in the Amended Complaint that it contacted Mr. Melvin prior to serving the Amended Complaint upon him on November 3, 2016, even though Mr. Melvin is a Delta pilot whose contact information is freely available to DPA and its officers. Given the perishable nature of evidence, particularly electronic evidence, Mr. Melvin should have been put on notice of this action much earlier than three years after the act complained of. He also should have been put on notice of DPA’s motion to amend the complaint, even if it were sealed, so that he could Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 8 of 22 762-000-00001: 10738231_4.doc 5 defend his interests in this matter.1 The law is clear that the Amended Complaint does not relate back to the filing of the initial Complaint in this matter. Federal Rule of Civil Procedure 15(c)(1) permits relation back of amended pleadings only under limited circumstances. Rule 15(c) Relation Back of Amendments. (1) When an Amendment Relates Back. An amendment to a pleading relates back to the date of the original pleading when: (A) the law that provides the applicable statute of limitations allows relation back; (B) the amendment asserts a claim or defense that arose out of the conduct, transaction, or occurrence set out--or attempted to be set out--in the original pleading; or (C) the amendment changes the party or the naming of the party against whom a claim is asserted, if Rule 15(c)(1)(B) is satisfied and if, within the period provided by Rule 4(m) for serving the summons and complaint, the party to be brought in by amendment: (i) received such notice of the action that it will not be prejudiced in defending on the merits; and (ii) knew or should have known that the action would have been brought against it, but for a mistake concerning the proper party's identity. The Second Circuit Court of Appeals has consistently held that the lack of knowledge of a “John Doe” defendant’s name does not constitute a mistake of identity so as to permit an amended complaint substituting “John Doe” with a named party to relate back to the date of the original complaint. See, e.g., Hogan v. Fischer, 738 F.3d 509, 517-18 (2d Cir. 2013); Barrow v. Wethersfield Police Dept., 66 F.3d 466, 470 (2d Cir. 1995), modified, 74 F.3d 1366 (2d Cir. 1 In evaluating a motion to dismiss for failure to state a claim, the Court limits its consideration to “facts stated in the complaint or documents attached to the complaint as exhibits or incorporated by reference.” Nechis v. Oxford Health Plans, Inc., 421 F.3d 96, 100 (2d Cir. 2005). Information provided to the Court in the context of discovery motions or other motions, including DPA’s January 29, 2016 sealed motion seeking leave to amend, may not be considered. Consideration of any such facts would be particularly unfair here, where DPA’s counsel refused to provide a copy of the sealed motion to Mr. Melvin’s counsel upon our request. (Docket # 65 at Attachment B). Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 9 of 22 762-000-00001: 10738231_4.doc 6 1996) (“Rule 15(c) does not allow an amended complaint adding new defendants to relate back if the newly-added defendants were not named originally because the plaintiff did not know their identities.”); Polite v. Town of Clarkstown, 198 F.R.D. 610, 612 (S.D.N.Y. 2001). A core purpose of Rule 15 is to protect the due process rights of defendants, and the Rule rightly focuses on the notice provided to defendant, rather than the efforts or even the good faith of the plaintiff. As the Supreme Court has noted in connection with Rule 15(c), “[t]he linchpin is notice, and notice within the limitations period.” Schiavone v. Fortune, 477 U.S. 21, 31 (1986); see also Aslanidis v. U.S. Lines, Inc., 7 F.3d 1067, 1076 (2d Cir. 1993) (discussing post-Shiavone changes in Rule 15 and reaffirming that the defendant to be added must have had actual notice within the statutory period or within 120 days of the filing of the original complaint, neither of which was satisfied here.). It should be noted that service of the original complaint would have sufficed, but it was not provided. See Freund v. Fleetwood Enterprises, Inc., 956 F.2d 354, 362 (1st Cir. 1992) (noting that where a defendant had actual notice of the lawsuit, that would satisfy the notice requirement, even if the caption listed the wrong party). DPA has not even alleged that Mr. Melvin “knew or should have known that the action would have been brought against [him].” Rule 15(c)(1)(C). DPA did not depose Mr. Melvin, as the Court suggested and as DPA counsel had agreed to do. Nor did DPA serve Mr. Melvin with the original complaint or the motion to amend. There is no allegation that DPA alerted Mr. Melvin to the existence of this action prior to serving him with the summons and Amended Complaint on November 3, 2016. Statutes of limitation characteristically embody a “policy of repose, designed to protect defendants.” Burnett v. New York Central R. Co., 380 U.S. 424, 428 (1965). To the extent DPA may argue for suspension of the statute of limitations during the pendency of its motion to Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 10 of 22 762-000-00001: 10738231_4.doc 7 amend, such a claim would be contrary to the purposes of Rule 15(c) and the applicable statute of limitations. Where, as here, timely notice was not provided, the due process rights of the defendant should be paramount. III. PLAINTIFF FAILS TO STATE A CLAIM UPON WHICH RELIEF MAY BE GRANTED The Amended Complaint should be dismissed, as it contains little other than “a formulaic recitation of the elements of a cause of action.” Twombly, 550 U.S. at 555.  There are no allegations concerning any Internet Protocol (“IP”) address, phone number, computer records, or any other “trackable” data that would link Mr. Melvin to the alleged “hack.”  There is no allegation that Mr. Melvin used usernames, passwords, or other unauthorized information to transmit information to and/or access DPA’s website.  The allegations of loss amount to no more than a laundry list of various types of losses, some cognizable, some not, with no specific costs or losses alleged. Apart from DPA’s jurisdictional allegations, the Amended Complaint contains no factual allegations about Mr. Melvin at all, only legal conclusions that mirror the language of the statute. Devoid of any “factual enhancement,” the Amended Complaint falls far beneath the plausibility standard set forth in Iqbal and Twombly. A. Required Elements of DPA’s CFAA Claims DPA asserts causes of action under §1030(a)(5)(A), (B) and (C). The first cause of action alleges knowing transmission of a program, information, code, or command, with the intent to damage a protected computer. (§1030(a)(5)(A)). The second cause of action alleges intentional access to a protected computer, recklessly causing damage. (§1030(a)(5)(B)). The third cause of action alleges intentional access to a protected computer resulting in damage and loss. (§1030(a)(5)(C)). The following elements are common to all three causes of action, and must be Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 11 of 22 762-000-00001: 10738231_4.doc 8 adequately pleaded by DPA in order to make out a CFAA claim: - There was damage to a protected computer, - The transmission/access was the cause of the damage, - DPA sustained a loss of at least $5,000 within a 1-year period, and - Mr. Melvin lacked authorization. See §1030(a)(5)(A)-(C). In addition, the first cause of action, under §1030(a)(5)(A), requires DPA to adequately plead that Mr. Melvin transmitted a program, information, code, or command, that Mr. Melvin’s transmission was knowing, and that Mr. Melvin intended to cause damage to the protected computer. Meanwhile, the second cause of action requires DPA to adequately plead that Mr. Melvin intentionally accessed the protected computer, and recklessly caused the damage. §1030(a)(5)(B). The third cause of action has no recklessness component, but does require Plaintiff to adequately plead intentional access. §1030(a)(5)(C). “Loss” is a required element for all three causes of action even though it does not appear in Section 1030(a)(5)(A) or (B). This is because CFAA makes civil actions available only where the alleged conduct involves one of the factors set forth in Section 1030(c)(4)(A)(i)(I)-(V). See §1030(g). The allegations in DPA’s Amended Complaint foreclose all bases of liability except Section 1030(c)(4)(A)(i)(I), the one involving loss of $5,000 within a 1-year period. Accordingly, all three of the causes of action require that DPA adequately plead a loss of at least $5,000 within a 1-year period. See LivePerson, Inc. v. 24/7 Customer, Inc., 83 F. Supp. 3d 501, 511 (S.D.N.Y. 2015). B. DPA Failed To Adequately Plead Causation, as Required by All Three Causes of Action All three causes of action require a causal connection between a defendant’s conduct and the damage to a protected computer. §1030(a)(5). Here, DPA has failed to plead any specific Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 12 of 22 762-000-00001: 10738231_4.doc 9 facts about Mr. Melvin’s conduct. DPA merely regurgitates the statutory language. With respect to the First Cause of Action, DPA has copied and pasted the language of Section 1030(a)(5)(A), but does not allege any specific facts about what Mr. Melvin allegedly did to “cause or procure transmission,” or what was actually “transmitted” - a program, information, code, commands? All DPA does is describe the effects of the alleged “hacking” or “hijacking,” i.e., redirection of the website to another domain. These allegations may go to the element of “damage,” but they say nothing to establish a causal connection between Mr. Melvin and the alleged “hack.” In order to make out a claim that Mr. Melvin knowingly transmitted code or information, and that this caused the alleged damage, DPA has to offer some kind of explanation for what happened, when it happened, who caused it, and how. What file or program was accessed? What was changed? How did that cause the damage DPA alleges? The Amended Complaint offers no answer to any of these questions. It lacks the factual allegations necessary to make the claim plausible under Iqbal and Twombly. The Second and Third Causes of Action suffer from the same defect, but to an even greater degree. Paragraphs 44 and 45 of the Amended Complaint regurgitate Sections 1030(a)(5)(B) and (C) of CFAA, respectively, but contain no specific facts about how Mr. Melvin’s alleged “access” of a protected computer caused damage. This causation gap is unbridgeable. DPA asks the Court to infer that Mr. Melvin accomplished a full-scale redirection of a website, severing all links and locking out the site’s administrators, merely by “accessing” the computer. That assertion is implausible on its face and is not backed up by a single allegation of fact. Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 13 of 22 762-000-00001: 10738231_4.doc 10 In justifying the need for expedited discovery, DPA claimed that it would learn the “online tracks” of the hacker. DPA assured the Court that “the hacker gained access to DPA’s web hosting site by some method and at some certain time,” and that the hacker “had to have left indications of his or her actions.” According to DPA, “those ‘tracks’ can be analyzed.” (Docket # 41, p. 9) (Emphasis added). DPA served at least three third-party subpoenas on SquareSpace, the company DPA claims is the host for its website, and SquareSpace produced documents. See Docket # 4; Docket # 47. DPA also communicated with SquareSpace directly after the alleged “hack.” AC ¶ 46. Yet after all that discovery, the Amended Complaint is devoid of any facts asserting what happened to DPA’s website, by what method, or when. C. DPA Failed To Adequately Plead a Loss of $5,000 Within 1 Year, as Required by All Three Causes of Action Loss is defined as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). Loss “must relate to the victim’s computer systems.” LivePerson, 83 F. Supp. 3d at 514 (citing Nexans Wires S.A. v. Sark-USA, Inc., 319 F. Supp. 2d 468, 477 (S.D.N.Y. 2004) aff’d, 166 F. App’x 559 (2d Cir. 2006)). Apart from losses related to physical damage, courts have generally limited losses to “those costs necessary to assess the damage caused to the plaintiff's computer system or to resecure the system in the wake of a hacking attack.” Nexans, 319 F. Supp. 2d at 475 (quoting Tyco Int’l Inc. v. John Does, No. 01 Civ. 3856, 2003 U.S. Dist. LEXIS 11800, at *4 (S.D.N.Y. Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 14 of 22 762-000-00001: 10738231_4.doc 11 July 11, 2003)). “General non-computer costs incurred in investigating the violation” are “too far outside the scope of the Act.” Id. For example, “[c]osts associated with locating and collecting information about the hacker are not recoverable under the CFAA.” Reis, Inc. v. Spring11 LLC, No. 15 Civ. 2836, 2016 U.S. Dist. LEXIS 131486, at *25) (S.D.N.Y. Sept. 24, 2016) (quoting Millenium TGA, Inc. v. Leon, No. 12 Civ. 1360, 2013 U.S. Dist. LEXIS 150508, at *18 (E.D.N.Y. September 23, 2013)). To qualify, a plaintiff’s loss must be sustained in the effort to “restor[e] the data, program, system or information to its condition prior to the offense.” Reis, Inc. v. Lennar Corp., No. 15 Civ. 7905, 2016 U.S. Dist. LEXIS 88228, at *15 (S.D.N.Y. July 5, 2016). If the plaintiff claims some cost as constituting a loss, the cost must “be directed in some way at the effects of the prior intrusion, not at those of some potential future offense.” Id. Here, Plaintiff alleges the following losses: - Costs to assess and discover extent that website rendered inoperable - Costs to determine nature of the damage to the website’s integrity - Costs to restore the integrity of the web site - Costs to re-establish critical links - Costs to communicate with hosting service - Donations not received - Expenses to identify and pursue the offenders to ensure future security - Lost good will based on interference with union rights See AC ¶¶ 46-49. Initially, as a matter of law, lost good will based on interference with union rights does not qualify under CFAA. By DPA’s own admission, the “lost good will” that it claims bears no relation to any alleged damage to the protected computer. DPA claims that the “hack” interfered with the ability of its members to exercise their union rights. Similarly, the lost donations DPA claims are entirely speculative. Hypothetical donations do not qualify as “revenue lost” under CFAA. Even if they did, DPA has not alleged facts to show that any particular supporter Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 15 of 22 762-000-00001: 10738231_4.doc 12 attempted to donate, or that such individual ultimately did not donate because of interruption in service, as the statute would require. See § 1030(e)(11). Costs associated with identifying an alleged hacker also do not qualify, and are not even recoverable. See Spring11, 2016 U.S. Dist. LEXIS 131486, at *25. Nor can DPA meet the threshold by citing costs associated with protecting against the possibility of future attacks. Id. For these reasons DPA cannot rely on the losses alleged in paragraphs 47-49 of the Amended Complaint. As to the rest of the losses, set forth in paragraph 46, DPA makes the facially implausible assertion that these undertakings cost in excess of $5,000. DPA offers no specificity as to what was done, by DPA or others, to incur any of these losses. Some could not have involved any significant expense. For example, it is difficult to imagine how communicating with SquareSpace could have cost DPA a significant amount. Once the “hack” was discovered, it should have been possible to redirect the website back to its original domain, and reset some passwords if necessary, at very little cost or no cost at all. Plaintiff does not allege that any information was deleted, so the reestablishment of critical links should have been automatic. Nevertheless DPA claims losses “in excess of $5,000” associated with these undertakings. It may be possible to spend that amount, but it would take more than a “nudge” to make DPA’s bare allegations plausible. Twombly, 550 U.S. at 570. DPA offers no factual support at all. Paragraph 46 amounts to a laundry list of possible losses, some of which have been recognized as compensable under CFAA. The lack of specificity, however, dooms DPA’s pleading. It is impossible for the Court to infer that these losses arose from the alleged damage without specific facts as to what was done in connection with the alleged damage, by whom, and what it cost. Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 16 of 22 762-000-00001: 10738231_4.doc 13 DPA also failed to adequately plead that the losses described above were incurred within a 1-year period, as required by the statute. See § 1030(c)(4)(A)(i)(I). The Amended Complaint was filed on October 26, 2016, almost three years after the alleged damage occurred. Given the timing, DPA was obligated to identify when specifically its alleged losses occurred in order to state a claim. D. DPA Failed to Adequately Plead a Lack of Authorization, as Required by All Three Causes of Action DPA alleges that Mr. Melvin accessed a protected computer, and that he transmitted information to a protected computer. To make out a claim under CFAA, DPA must adequately plead that Mr. Melvin lacked authorization to do these things. The Amended Complaint contains no such factual allegation. It only recites the statutory language. This, without more, is not entitled to the presumption of truth under Iqbal. DPA did not allege sufficient facts in the Amended Complaint for the Court to infer anything about Mr. Melvin’s authorization to access the website. The Amended Complaint states that the website has private and public pages, with the private pages accessible via a login and password. (AC ¶ 24). It also states that Tim Caplinger had access to the website, and that Rick Eagan was the “Web Master,” implying Eagan’s access. (AC ¶¶ 28-29). DPA says nothing about who else has access, who was given or denied information necessary to access the website or DPA’s SquareSpace account, or who (including Mr. Melvin) was given or denied permission to share access. Applying common sense, the Court might conclude that such websites generally have protections in place, but this is not a universal rule. DPA has failed to allege that Mr. Melvin lacked access, which is fatal to a CFAA pleading. Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 17 of 22 762-000-00001: 10738231_4.doc 14 Even if the Court were to infer that the website was protected and that Mr. Melvin never had authorization to make changes, there is a critical complication in this case that further dooms DPA’s pleading: DPA does not own or control the computer that it claims Mr. Melvin damaged. Per the Amended Complaint, that computer is owned, operated, and controlled by SquareSpace. (AC ¶ 30). SquareSpace also “maintains” DPA’s website. Id. Therefore, it would not be enough for DPA to plead that Mr. Melvin lacked DPA’s authorization. To state a claim, DPA must also adequately plead that Mr. Melvin lacked authorization from SquareSpace, which it has not done either. The Amended Complaint contains no allegations with respect to Mr. Melvin’s use of SquareSpace. Nor does it explain or describe how the computer at issue, allegedly owned and maintained by SquareSpace, would be accessed, or files transmitted. Without these facts DPA cannot adequately plead lack of authorization. As noted above, DPA subpoenaed SquareSpace at least three times and communicated with them about the “hack.” Two individuals associated with DPA, Caplinger and Eagan, had access to the website and the SquareSpace account. Despite DPA’s access to relevant information, the Amended Complaint is devoid of facts on the authorization element, just as it is on loss and causation. E. DPA Failed To Adequately Plead the Additional Elements Necessary for Each Cause of Action DPA’s First Cause of Action, under 18 U.S.C. § 1030(a)(5)(A), requires that the alleged transmission be “knowing,” and further requires that Mr. Melvin intentionally caused the damage. As set forth above, DPA pleaded no details whatsoever about what Mr. Melvin allegedly transmitted, to where, or how the transmission caused the damage alleged. Facts concerning the remaining elements of “knowing” transmission and “intentional” damage are also Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 18 of 22 762-000-00001: 10738231_4.doc 15 missing. DPA recites the elements of a §1030(a)(5)(A) claim, but makes no factual allegations concerning Mr. Melvin’s state of mind. If DPA had offered any more specifics about the events at issue, it might be possible for the Court to make a plausible inference concerning Mr. Melvin’s alleged mental state. For example, allegations that a defendant stole a password, misrepresented himself as an authorized user, and then transmitted a virus to an operating system might give rise to the plausible conclusion that the defendant acted “knowingly” with “intent to cause” damage. DPA offered no facts about the first cause of action, let alone facts that could support an inference as to mental state. This critical element of the First Cause of Action is inadequately pleaded. For the same reason, DPA failed to adequately plead recklessness under §1030(a)(5)(B), as required for the Second Cause of Action. Recklessness requires some evaluation of the standard of care. Without facts, the Court cannot even review what Mr. Melvin’s alleged conduct was, much less evaluate whether it was reckless within the meaning of CFAA. Finally, both the Second and Third Causes of Action require DPA to plead intentional access. See §1030(a)(5)(B)-(C). Again, without any facts about the nature of the alleged access, the Court has no basis to infer that it was intentional. Had sufficient details about the alleged “hacking” been offered, the Court might have been able to infer intentionality. DPA has not provided such factual support. F. DPA’s Allegation of Ongoing Damage is Not Cognizable Under CFAA The statute defines “damage” as “any impairment to the integrity or availability of data, a program, a system, or information.” §1030(e)(8). DPA alleges that Mr. Melvin inserted commands or codes that remain on the affected computer. (AC ¶ 51). This allegation is insufficient to adequately plead “damage” under CFAA’s definition. DPA alleges no ongoing Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 19 of 22 762-000-00001: 10738231_4.doc 16 impairment to the availability or integrity of the website, nor does DPA claim any ongoing interruption in service. The vague specter of a “potential” future disruption, with no specific facts to explain why or how this might occur, does not raise a plausible claim of “damage.” As such, that allegation fails to meet even the “damage” prong under CFAA, let alone the other elements discussed above. IV. PLAINTIFF SHOULD NOT BE GRANTED FURTHER LEAVE TO AMEND TO CURE DEFICIENCIES IN THE AMENDED COMPLAINT Rule 15 instructs courts to “freely give leave [to amend] when justice so requires.” (Emphasis added). “Although leave to amend should be liberally granted, it may properly be denied for undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party by virtue of allowance of the amendment, futility of amendment, etc.” Arnold v. KPMG LLP, 334 F. App’x 349, 352 (2d Cir. 2009) (internal quotations omitted). A district court has “broad discretion” in weighing these issues. Gurary v. Winehouse, 235 F.3d 792, 801 (2d Cir. 2000). Here, granting leave to amend would be futile and would cause undue prejudice to Mr. Melvin. A. Granting Leave to Amend Would Be Futile DPA has already engaged in discovery and repeatedly subpoenaed third parties to learn the details of what happened to its website. DPA has now learned whatever there is to learn, at least under the Court’s order granting expedited discovery. Apart from amending the caption to include Mr. Melvin, DPA has declined, or was unable, to offer any additional factual allegations so as to render the pleadings adequate. Seeing as DPA has had three years to conduct its investigation, granting further leave to amend will do nothing but prolong the litigation. It will Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 20 of 22 762-000-00001: 10738231_4.doc 17 not lead to a pleading that adequately states claims under the CFAA.2 With respect to the Second and Third Causes of action, leave to amend would be utterly futile for the additional reason that “access” alone could not cause the damage that DPA alleges, namely, redirection of it’s website to another domain. It is simply not plausible and it cannot be made plausible by amendment of the complaint. See Joblove v. Barr Labs., Inc., 429 F.3d 370, 404 (2d Cir. 2005) (“where amendment would be futile, denial of leave to amend is proper”). B. Granting Leave to Amend Would Unduly Prejudice Mr. Melvin It has now been three years since the filing of the Complaint. DPA took expedited discovery, learned Mr. Melvin’s identity in August 2014, was told in no uncertain terms at that time that the next step would be amendment of the caption, failed to move to amend the caption by the September 30, 2014 deadline imposed by the Court, and then finally sought leave to amend the caption on January 29, 2015, without providing any notice of that motion or of the underlying action to Mr. Melvin. DPA gave no notice to Mr. Melvin until November 3, 2016, nearly three years after the alleged “hacking.” The post-discovery Amended Complaint fails to adequately plead CFAA claims. Permitting another amendment would add further delay before Mr. Melvin is notified of what precisely DPA accuses him of doing. As DPA pointed out in its request for discovery, electronic evidence may disappear over time. DPA has had its opportunity to amend the complaint. Giving a second opportunity would further exacerbate the problem of missing evidence and would further hamper Mr. Melvin’s ability to defend this case. See Rodriguez v. Bear Stearns Cos., No. 07-cv-1816(JCH), 2009 U.S. Dist. LEXIS 31525, at *28 (D. Conn. Apr. 2 We share the concern expressed by the Court that DPA is using this case as a fishing expedition for information that is relevant not to this case but for other purposes in its jurisdictional dispute with ALPA. (8/14/14 Tr. 11:1-5.) Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 21 of 22 762-000-00001: 10738231_4.doc 18 14, 2009) (finding that, after discovery and plaintiffs’ subsequent failure to plead a claim, “the defendant’s interest in the expeditious adjudication of this litigation outweighs the plaintiffs’ interest in “yet another bite at the proverbial apple.”) CONCLUSION For each of these reasons, the Amended Complaint should be dismissed in its entirety without leave to amend. Dated: December 13, 2016 New York, New York LEVY RATNER, P.C. /s/ By: Dana E. Lossia Attorneys for Defendant 80 Eighth Avenue New York, New York 10011 (212) 627-8100 (212) 627-8182 (fax) dlossia@levyratner.com Case 1:14-cv-00225-AKH Document 68 Filed 12/13/16 Page 22 of 22