Facebook, Inc. v. Wallace et alMOTION for Default Judgment as to Defendant Sanford WallaceN.D. Cal.June 1, 2009Case5:09-cv-00798-JF Document65 Filed06/01/09 Page1 of 23 TABLE OF CONTENTS Page I. INTRODUCTION 1 A II. STATEMENT OF FACTS 2 4 A. Wallace Has Failed to Answer or Appear in the Action 2 5 B. Facebook Background 3 6 C. Wallace's Unauthorized Activities 4 D. Harm to Facebook III. LEGAL ARGUMENT 6 8 A. The Default Judgment Standard 6 9 B. Wallace's Violations of the CAN-SPAM Act 7 1. False Header Information- 15 U.S.C. § 7704(a)(l) 8 2. Misleading Subject Headings-15 U.S.C. § 7704(a)(2) 9 12 3. Return Address and Required Opt-Out Language - 15 U.S.C. §7704(a)(3) 9 4. Required Identifiers, Opt-Out and Physical Address - 15 U.S.C. 13 §7704(a)(5) 9 C. Facebook Is Entitled to Significant Statutory Damages Under the CAN- 14 SPAM Act 10 15 1. No Reduction in Statutory Damages Is Warranted Here 11 2. Wallace's Spam Campaign Warrants Aggravated Damages - 15 16 U.S.C. § 7704(b)(3) 11 17 D. Wallace's Violations of California's Anti-Phishing Statute Support an Award of Statutory Damages Under California Business and Professions 18 Code § 22948 15 g E. Wallace Should Be Permanently Enjoined from Accessing and Abusing Facebook's Services 15 20 1. The CAN-SPAM Act Supports Entry of a Permanent Injunction 15 2. Wallace's Violations of the Computer Fraud and Abuse Act Support Entry of a Permanent Injunction 16 22 3. Wallace's Violations of California Penal Code § 502 Support Entry of a Permanent Injunction 18 23 IV. CONCLUSION 18 24 25 26 27 28 -i- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page2 of 23 1 TABLE OF AUTHORITIES 2 Page Cases 4 Aitken v. Commc'ns Workers of Am., 496 F. Supp. 2d 653 (E.D. Va. 2007) 8 5 Bigfoot Partners, L.P. v. Cyber Promotions, Civil Action Number 97 CIV 7397 (S.D.N.Y. 6 1998) 11 Columbia Pictures Film Prod. Asia Ltd. v. Uth, 2007 WL 36283 (E.D. Cal. Jan. 4, 2007) 6 CompuServe, Inc. v. Cyber Promotions, Case No. C2-96-1070(S.D. Ohio 1996) 12 Concentric Network Corp. v. Wallace, Case No. C-96-20829-RMV (N.D. Cal. 1996) 11 Cyber Promotions, Inc. v. America Online, Inc., 948 F. Supp. 436 (E.D. Pa. 1996) 12 .. Earthlink Networks v. Cyber Promotions, Case No. BC 167502 (Cal. Super. Ct. LA. 11 County Mar. 30,1998) 11 12 Eitel v. McCool, 782 F.2d 1470 (9th Cir. 1986) 7 13 Facebookv. Guerbuez, order, No. C08-03889-JF-HRL (N.D. Cal. 2008) 14 14 FTC v. Seismic Entm 't Prods., Inc., Case No. 1:04-CV-00377-JD (N.H. 2006) 11 15 Gable-Leigh, Inc. v. North Am. Miss, No. CV 01 -01019,2001 WL 521695 (CD. Cal. 16 Apr. 13,2001) 5 , n Kramer v. Cash Link Sys., No. 3-03-CV-80109-CRW-TJ, 2004 WL 2952561 (S.D. Iowa 11 2004) 14 18 MySpace v. Wallace, 498 F. Supp. 2d 1293 (CD. Cal. 2007) passim 19 PepsiCo v. Cal. Sec. Cans, 238 F. Supp. 2d 1172 (CD. Cal. 2002) 7,8 PepsiCo v. Triunfo-Mex, Inc., 189 F.R.D. 431 (CD. Cal. 1999) 7 21 Philip Morris USA Inc. v. Castworld Prods., Inc., 219 F.R.D. 494 (CD. Cal. 2003) 7 22 StuhlbergInt'l Sales Co. v. John D. Brush & Co., 240 F.3d 832 (9th Cir. 2001) 5 23 TeleVideo Sys., Inc. v. Heidenthal, 826 F.2d 915 (9th Cir. 1987) 6 24 TomDohertyAssocs., Inc. v. Saban Entm't, Inc., 60 F.3d27 (2d Cir. 1995) 5 25 Statutes 26 15 U.S.C. § 7701 et. seq 1, 8 27 15 U.S.C. §7701 (a)(6) 14 28 15 U.S.C. § 7702(5) 8 -ii- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page3 of 23 1 TABLE OF AUTHORITIES (continued) 2 Page 3 15 U.S.C. § 7702(6) 8 4 15 U.S.C. § 7702(11) 10 5 15 U.S.C. § 7704(a)(l) 7, 8, 10 6 15 U.S.C. § 7704(a)(l)(A) 8 7 15 U.S.C. § 7704(a)(3) 7,9 8 15 U.S.C. § 7704(a)(5) 7,9 9 15 U.S.C. § 7704(a)(6) 8 10 15 U.S.C. § 7704(b) 12 11 15 U.S.C. § 7704(b)(l) 12 12 15 U.S.C. § 7704(b)(l)(A) 12 13 15 U.S.C. § 7704(b)(l)(A)(i) 10 14 15 U.S.C. § 7704(b)(3) 11,12,13 15 15 U.S.C. § 7706(g)(l) 10 16 15 U.S.C. § 7706(g)(l)(A) 15 17 15 U.S.C. § 7706(g)(3)(A) 10 18 15 U.S.C. § 7706(g)(3)(C) 12,13 19 15 U.S.C. § 7706(g)(3)(C)(i) 12 20 15 U.S.C. § 7706(g)(3)(D) 11 21 18 U.S.C. § 1030(a)(2) 16,17 22 18 U.S.C. § 1030(a)(4) 16,17 23 18 U.S.C. § 1030(a)(5)(A)(ii) 16,17 24 18 U.S.C. § 1030(a)(5)(A)(iii) 16,17 25 18 U.S.C. § 1030(a)(6) 16 26 Cal. Bus. & Prof. Code § 17529(d) 14 27 Cal. Business and Professions Code § 22984 et. seq 1 28 Cal. Penal Code § 502 18 -iii- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page4 of 23 1 TABLE OF AUTHORITIES (continued) 2 Page 3 Cal. Penal Code § 502(c) 16 4 Cal. Penal Code § 502(e)(l) 18 Regulations and Rules 6 Fed. R. Civ. P. 12 2 7 Fed. R. Civ. P. 55(a) 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -iv- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page5 of 23 1 APPLICATION FOR DEFAULT JUDGMENT 2 On June 12,2009 at 9:00 am, or as soon thereafter as this matter may be heard by the 3 above-entitled Court, located at 280 South 1st Street, San Jose, CA 95113, Courtroom 3, 5th 4 Floor, Plaintiff Facebook, Inc. will present its application for entry of a default judgment, 5 including statutory damages and a permanent injunction against Defendant Sanford Wallace 6 ("Wallace")- Facebook requests that the judgment include an award of statutory damages 7 pursuant to the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 8 ("CAN-SPAM Act"), 15 U.S.C. § 7701 et. seq., in the amount of $4,264,425,900 and statutory 9 damages pursuant to California Business and Professions Code § 22984 et. seq., in the amount of 10 $3,247,500,000. Facebook further requests that the Court enter a permanent injunction against 11 Wallace restraining him from engaging in future violations of Facebook's rights. Facebook 12 presents this application on the grounds that Wallace is not an infant or incompetent person, he 13 failed to respond to Facebook's Complaint, and on March 27,2009, the Clerk of the Court 14 entered defaults against him for failure to appear, plead, or answer Facebook's Complaint within 15 the time allowed by law. 16 Facebook's request for default judgment is based on this Application For, and 17 Memorandum of Points and Authorities in Support of, Default Judgment Against Defendant 18 Sanford Wallace, the default entered by the Clerk of the Court on file herein, Facebook's 19 Complaint, Facebook's Memorandum in Support of its Motion for a Temporary Restraining 20 Order, Facebook's Memorandum in Support of its Motion for a Preliminary Injunction, the 21 Declarations of Joseph P. Cutler and a Facebook Employee in Support of Facebook's Application 22 for Default Judgment Against Defendants Sanford Wallace, and the files and records in this 23 action. A proposed order accompanies this Application. 24 I. INTRODUCTION ^^^^^^^^^ 25 Wallace willfully violated the CAN-SPAM Act by sending ̂ ^^^^^^^m 26 spam messages to Facebook users over a three-month period. Wallace impersonated Facebook 27 users and sent unsolicited commercial messages to those users' friends deceptively and falsely 28 warning that their photographs were purportedly posted onto another website. The fake warnings -1 - APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page6 of 23 1 also contained fake and misleading links that, once clicked, took unsuspecting victims to a 2 website operated by Wallace. That fake website tricked the unsuspecting victims into divulging 3 their Facebook login information. Next, Wallace redirected the victims to unrelated commercial 4 websites that paid Wallace a referral fee. Wallace then used the stolen user login information to 5 log into the users' accounts and send even more spam to the users' friends - thus propagating the 6 fraudulent scheme virally. 7 Facebook has devoted substantial resources to combat Wallace's attacks. Worse yet, 8 because Wallace's messages seemed to be coming from, and be endorsed by, Facebook users, 9 many of those users were embarrassed, frustrated, and annoyed to be associated with these 10 misleading messages. 11 12 Facebook stopped Wallace by filing this lawsuit and obtaining a court order enjoining 13 Wallace from further engaging in his scheme. Wallace has not answered or otherwise responded 14 to the Complaint, and Default has been entered by the Clerk of the Court. Facebook hereby 15 requests that the Court now enter a Default Judgment against Wallace in the form of statutory 16 damages and the entry of a permanent injunction. 17 II. STATEMENT OF FACTS 18 A. Wallace Has Failed to Answer or Appear in the Action 19 Facebook personally served Defendant Wallace with the Complaint, Summons and all 20 papers required for this matter on March 2, 2009. See DE 20. 21 Wallace did not answer or otherwise respond within the prescribed period of time. See 22 Fed. R. Civ. P. 12. On March 27,2009, the Clerk of the Court entered Default against Wallace. 23 DE 41. Wallace is not a minor, incompetent person, in military service or otherwise exempted 24 under the Soldiers' and Sailors' Civil Relief Act of 1940. See Declaration of Joseph P. Cutler in 25 Support of Plaintiff s Application for Default Judgment Against Sanford Wallace ("Cutler Decl. 26 ISO Default") H 2; DE 41. 27 28 -2- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page7 of 23 1 B. Facebook Background 2 Facebook owns and operates the widely popular social networking website located at 3 http://www.facebook.com. Complaint H 16; DE 17 (Declaration of Facebook Employee in 4 Support of PI. 's Ex Parte Mot. for Temporary Restraining Order ("Facebook Decl.")) U 2. 5 Facebook currently has more than 200 million active users. Users must register with Facebook, 6 agree to its Terms of Use, and obtain a unique username and password before being granted full 7 access to the Facebook website. Complaint 117. Only registered users may access Facebook 8 user profiles, invite other Facebook users to be "friends," send messages on Facebook, and use 9 applications on Facebook's developer platform. Complaint ffl| 20-22. I o Facebook users have control over those with whom they interact on Facebook. Id. Users I1 have the ability to control access to their user profiles, including various messaging options. 12 Complaint \ 24. Privacy controls and secure communications among Facebook users are vital to 13 the integrity of Facebook's proprietary network as well as to the level of confidence that users 14 have in using Facebook. Complaint ffl| 21,24; Facebook Decl. 16. The privacy controls 15 provided by Facebook, Facebook's security measures, and the resulting secure communications 16 are key aspects of Facebook's success. Complaint ffl| 21,24; Facebook Decl. ̂ 6. 17 Facebook's Terms of Use apply to anyone who uses or accesses Facebook's website and 18 explicitly prohibit any unsolicited or unauthorized advertising, solicitations, promotions, junk 19 mail, spam, chain letters, or pyramid schemes. Complaint ̂ 24. Facebook's Terms of Use also 20 prohibit, among other things, (1) using the Facebook website in a manner that could damage, 21 disable, overburden or impair the website; (2) using any data mining, robots, scraping, or similar 22 data-gathering or extraction methods to access Facebook; (3) using automated scripts to collect 23 information from or otherwise interact with the website; (4) posting or otherwise making 24 available any unsolicited or unauthorized advertising; (5) harvesting or collecting Facebook 25 users' contact information without consent; (6) registering for more than one Facebook user 26 account or falsely stating one's identity or otherwise misrepresenting oneself; (7) soliciting 27 passwords or personal identifying information from Facebook users for commercial purposes; 28 (8) impersonating any person or entity; (9) using or attempting to use another's account without -3- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page8 of 23 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 authorization from Facebook, or creating a false identity on Facebook; and (10) using the Facebook website for commercial use without the express permission of Facebook. Complaint H26. C. Wallace's Unauthorized Activities Sanford Wallace is a Facebook user and during all relevant times agreed to abide by Facebook's Terms of Use. Complaint U 27; Facebook Decl. ̂ j 4. At no time has Wallace received permission from Facebook to conduct any commercial activity on Facebook's website. Complaint ̂ 29; Facebook Decl. 110. Wallace's attack on Facebook is sophisticated, constantly evolving, and quickly increasing in scope. Complaint fflj 30-32; Facebook Decl. H 13. ^^^^^^^^^^^^HJjj^H Wallace developed increasingly sophisticated code that tested user login information, accessed user accounts without authorization, circumvented Facebook's security measures and distributed spam to Facebook users' friends. Complaint Uf 30-32; Facebook Decl. H 13. Wallace sent spam using other users' accounts so that each message sent appeared to have originated from a known Facebook friend. Complaint ̂ 33. The spam contains statements such as "Hey I just saw a lot of your images up at XXXXX.com, go there," or "How long have your profile pics been up at XXXXX.net - you gotta see it!" These messages were typically accompanied by hypertext clickable links. Facebook Decl. U 16. Id. After users provided their personal login information, they were redirected to one of several third-party commercial websites that pay Wallace to drive traffic to them. Id. U 17; DE 16 (Decl. of Leota Bates in Support of PL's Ex Parte Mot. for Temporary Restraining Order ("Bates Decl.")) fflj 3-4. Wallace then added the newly phished user accounts to his collection and commenced spamming from these accounts. Wallace's use of stolen user accounts facilitated the rapid spread of their malicious spam. -4- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page9 of 23 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Facebook Employee Declaration In Support of Plaintiff s Application for Default Judgment Against Sanford Wallace ("Facebook Decl. ISO Default") J 2. Facebook Decl. H 17. D. Harm to Facebook Facebook has been significantly harmed as a result of Wallace's spamming campaigns. Complaint Tfil 33-35; Facebook Decl |||| I I I ^^^^^BB^BH^^^^B ^^^^^^^^^^mH^^^mU^^^^^^I Complaint Iflf 33-35; Facebook Decl. Ifl] 19-21. The damage Wallace has caused to Facebook's relationships with its users and to its reputation as the world's leading social network is irreparable, and Facebook will continue to suffer this harm if he is not permanently enjoined. Perhaps most damaging of all is the anger and embarrassment suffered by users whose accounts have been hijacked and used by Wallace to send spam. Facebook has evidence of the actual loss1 of user support due to Wallace's illegal and unauthorized acts. Facebook Decl. ̂ 20. 2 Additionally, every username and password stolen by Wallace is an irreparable injury. 1 Intangible injuries, such as evidence of even threatened loss of customers or loss of goodwill, support a finding of the possibility of irreparable harm. Stuhlberg Int 7 Sales Co. v. John D. Brush & Co., 240 F.3d 832, 841 (9th Cir. 2001) (citing Tom Doherty Assocs., Inc. v. Saban Entm 't, Inc., 60 F.3d 27, 37- 38(2dCir. 1995)). 2 See, e.g., Gable-Leigh, Inc. v. North Am. Miss, No. CV 01-01019, 2001 WL 521695, at *18 (CD. Cal. Apr. 13, 2001) ("Once a trade secret is enabled to fly from its oubliette, it cannot be recaptured. Once lost, it is lost forever. The harm is irreparable.") (internal quotation marks and citation omitted). -5- APPLICATION FOR DEFAULT JUDGMENT CaseNo.C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page10 of 23 1 suffered significant harm to its reputation and goodwill as a result of Wallace's actions, as well as 2 economic damages. Complaint T|f 33-34. As a result, it is expected that, absent continued 3 injunctive relief and the imposition of significant monetary penalties, Facebook will be unable to 4 effectively prevent the continued spread of Wallace's deceptive spam. Facebook Decl. ffij 19-20. 5 Absent a permanent injunction, Facebook will suffer irreparable harm through the 6 continued loss of users, loss of potential users, loss of goodwill, damage to its reputation, and 7 compromise of its users' login names and passwords. Complaint ]| 35; Facebook Decl. fflj 6,11- 8 12,19-21. Wallace is undermining the very tenets of the Facebook network - connections and 9 communication between friends in a private and secure online community. Facebook Decl. ffl| 5- 10 7,13,18-21. 11 III. LEGAL ARGUMENT 12 A. The Default Judgment Standard 13 After a defendant's default is entered by the court clerk, the well-pleaded factual 14 allegations of the complaint are taken as true. TeleVideo Sys., Inc. v. Heidenthal, 826 F.2d 915, 15 917 (9th Cir. 1987). Where the factual allegations of the complaint provide a sufficient legal 16 basis for entry of a default judgment, the court then conducts an inquiry to ascertain the amount 17 of damages. See Columbia Pictures Film Prod. Asia Ltd. v. Uth, 2007 WL 36283 (E.D. Cal. Jan. 18 4,2007). 19 The Ninth Circuit has enumerated the following factors for a district court to consider 20 when determining whether to grant default judgment: 21 (1) the possibility of prejudice to the plaintiff, (2) the merits of plaintiff s substantive claim, (3) the sufficiency of the complaint, (4) the sum of money 22 at stake in the action, (5) the possibility of a dispute concerning material facts, (6) whether the default was due to excusable neglect, and (7) the 23 strong policy underlying the Federal Rules of Civil Procedure favoring decisions on the merits. 24 Eitel v. McCool, 782 F.2d 1470, 1471-72 (9th Cir. 1986). "In applying this discretionary 25 standard, default judgments are more often granted than denied." PepsiCo v. Triunfo-Mex, Inc., 26 189 F.R.D. 431, 432 (CD. Cal. 1999). 27 28 -6- APPLICATION FOR DEFAULT JUDGMENT CaseNo.C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page11 of 23 1 In this case, the enumerated factors weigh heavily in favor of granting default judgment. 2 Facebook would unquestionably suffer prejudice if the default judgment is not entered because 3 Facebook would be without any other recourse for recovery. See PepsiCo v. Cal. Sec. Cans, 238 4 F. Supp. 2d 1172, 1177 (CD. Cal. 2002) ("Potential prejudice to [plaintiff) favors granting a 5 default judgment."). Facebook's Complaint and subsequent pleadings properly alleged the 6 necessary elements and supporting facts for each cause of action, giving the Court the capacity to 7 grant relief as to all of them. This satisfies Eitel factors two and three, which simply "require that 8 a plaintiff state a claim on which [it] may recover." Cal. Sec. Cans, 238 F. Supp. 2d at 1175 9 (internal quotation marks and citation omitted); see also Philip Morris USA Inc. v. Castworld 10 Prods., Inc.,219 F.R.D. 494,499 (CD. Cal. 2003). As for the fourth Eitel factor, Facebook seeks 11 only appropriate statutory damages to which it is entitled under federal and state law. 12 Furthermore, pursuant to the fifth and sixth Eitel factors, there is virtually no possibility of a 13 dispute as to material fact or excusable neglect in this case. The facts that are now admitted show 14 that Wallace willfully and relentlessly waged a massive spam attack against Facebook's network, 15 was personally served with Facebook's Complaint and subsequent pleadings, and had clear notice 16 of his responsibility to answer. 17 18 Cutler Decl. ISO Default 1J 3. As for the final Eitel factor, Wallace's failure to answer Facebook's 19 Complaint makes a resolution on the merits impossible. Cal. Sec. Cans, 238 F. Supp 2d at 1177 20 ("Under FRCP 55(a), termination of a case before hearing the merits is allowed whenever a 21 defendant fails to defend an action."). 22 B. WaUace's Violations of the CAN-SPAM Act 23 The undisputed facts set forth above in Facebook's Complaint, its Motion for Temporary 24 Restraining Order, and its Motion for Preliminary Injunction demonstrate the Wallace's liability 25 for |^^| violations of 15 U.S.C. §§ 7704(a)(l), (3), and (5). See Facebook Decl. ISO 26 Default f 2. Wallace's responsibility for ̂ ^^^^^^^H messages is established by his 27 failure to appear in this action or to otherwise dispute the veracity of the allegations made in 28 Facebook's Complaint and associated pleadings. Cal. Sec. Cans, 238 F. Supp. 2d at 1177. Given -7- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page12 of 23 1 the severity of the allegations, one would expect that if Wallace were not responsible for the 2 Facebook spam, he would have appeared to defend himself, or, at a minimum, to explain any 3 misunderstandings. Wallace's silence speaks volumes. Regardless, the facts deemed admitted as 4 well as the evidence submitted establish that Wallace's spam messages satisfy all of the elements 5 of various CAN-SPAM Act violations. 6 The CAN-SPAM Act permits Internet access services to bring actions alleging violations 7 of 15 U.S.C. § 7701 et seq. Wallace has sent ̂ ^^^^| unsolicited commercial messages to 8 Facebook users in violation of this act. Facebook Decl. ISO Default f 2. Commercial messages 9 sent to users of social networking services are "electronic mail messages" sent to "electronic mail 10 addresses," as those terms are defined by the CAN-SPAM Act. 15 U.S.C. § 7702(5), (6). 11 MySpace v. Wallace, 498 F. Supp. 2d 1293,1301-02 (CD. Cal. 2007) (holding that electronic 12 mail and related posts using a website's internal account addresses are within the scope of the 13 CAN-SPAM Act). 14 1. False Header Information - 15 U.S.C. § 7704(a)(l) 15 15 U.S.C. § 7704(a)(l) prohibits the transmission of commercial electronic mail messages 16 containing or accompanied by materially false or materially misleading information headers. A 17 header is "materially" misleading if it impairs the ability of the recipient to locate or respond to 18 the person who initiated the message. 15 U.S.C. § 7704(a)(6); see also Aitken v. Commc 'ns 19 Workers of Am., 496 F. Supp. 2d 653, 667 (E.D. Va. 2007) (finding that an inaccurate "From:" 20 line that affects an objective recipient's opinion of the value of the message is materially 21 misleading). A header that is technically accurate may nevertheless be misleading if the header 22 information was obtained fraudulently. 15 U.S.C. § 7704(a)(l)(A). 23 Wallace's spam messages contain information headers that are materially false and 24 misleading because they make it appear as if the spam originated from legitimate Facebook users, 25 when in fact it comes from Wallace. Complaint ̂ 22; Facebook Decl. ̂ 12,15-16. A reasonable 26 person viewing Wallace's spam would incorrectly conclude that the user whose name appears on 27 the message was the sender. Complaint % 22; Facebook Decl. ̂ Hj 12,15-16. Thus, even though 28 the message technically came from a legitimate Facebook user's account, the headers are still -8- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page13 of 23 1 materially misleading because Wallace fraudulently obtained control of such accounts by stealing 2 the users' login information. Complaint H 22; Facebook Decl. ffll 12, 15-16; MySpace, 498 F. 3 Supp. 2d at 1301-02 ("hijacking" member accounts to send out mass email messages is prohibited 4 under § 7704(a)( 1) even where the header might be technically accurate). 5 2. Misleading Subject Headings -15 U.S.C. § 7704(a)(2) 6 15 U.S.C. § 7704(a)(2) prohibits the transmission of commercial electronic mail messages 7 to a protected computer (a computer used in interstate or foreign commerce or communication) 8 with misleading subject headings. Wallace violated this statute by sending spam messages with 9 misleading subject headings. Recipients were led to believe that the messages were about images 10 or photographs on another website, when in fact they led recipients to a website designed to 11 fraudulently obtain the users' Facebook usemames and passwords and then to a commercial 12 website completely unrelated to the purported subject. Complaint 146; Facebook Decl. Tflj 16-17. 13 3. Return Address and Required Opt-Out Language - 15 U.S.C. § 7704(a)(3) 14 15 U.S.C. § 7704(a)(3) prohibits the transmission of commercial electronic messages to a 15 protected computer that does not provide a means for the recipient to opt out of future messages. 16 In violation of this statute, none of Wallace's spam messages contained valid opt-out mechanisms. 17 They did not include a return email address or other Internet-based opt-out mechanism as 18 required by statute. Complaint ffi| 47-48; Facebook Decl. ̂ 11, 15-18; MySpace, 498 F. Supp. 2d 19 at 1302 (finding that use of "hijacked" profiles eviscerates ability to request that no further 20 messages be sent in violation of § 7704(a)(3)). 2! 4. Required Identifiers, Opt-Out and Physical Address -15 U.S.C. § 7704(a)(5) 22 15 U.S.C. § 7704(a)(5) requires (1) clear and conspicuous identification that the message 23 is an advertisement or solicitation, (2) clear and conspicuous notice of the opportunity to decline 24 to receive further commercial electronic mail messages, and (3) a valid physical postal address for 25 the sender. Wallace violated this statute because his spam messages did not meet any of these 26 three requirements. Complaint Iffl 47-48; Facebook Decl. 1fl| 11,15-18; MySpace, 498 F. Supp. 2d 27 at 1303-04. 28 -9- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page14 of 23 1 2 3 19 20 21 22 23 24 25 26 27 28 C. Faccbook Is Entitled to Significant Statutory Damages Under the CAN-SPAM Act The facts set forth in Facebook's Complaint, which are deemed admitted by Wallace, as well as the other evidence submitted by Facebook, to which Wallace has also not responded, establish his liability for CAN-SPAM Act violations. Facebook requests statutory damages for violations of the CAN-SPAM Act set forth in the Complaint. Complaint ffij 40- 56; Facebook Decl. ISO Default 12. As a provider of Internet access services3 adversely affected by Wallace's violations of 15 U.S.C. § 7704(a)(l), Facebook is entitled to bring a civil action to seek recovery of damages in an amount equal to the greater of Facebook's actual monetary losses or statutory damages specified by the CAN-SPAM Act. See 15 U.S.C. § 7706(g)(l). Here, Facebook elects to recover statutory damages. CAN-SPAM Act statutory damages are determined according to the formula set forth in 15 U.S.C. § 7706(g)(3)(A): [T]he amount determined under this paragraph is the amount calculated by multiplying the number of violations (with each separately addressed unlawful message that is transmitted or attempted to be transmitted over the facilities of the provider of Internet access service, or that is transmitted or attempted to be transmitted to an electronic mail address obtained from the provider of Internet access service in violation of 10 11 12 13 14 15 16 section 7704(b)(l)(A)(i)of this title, treated as a separate violation) by- 17 (i) up to $100, in the case of a violation of section 7704(a)(l) of this title[.] 1 o (Emphasis added.) Because of Wallace's blatant and willful violations, the Court should impose the maximum penalty See Facebook Decl. ISO Default f 2. 3 15 U.S.C. § 7702(11) states that "the term 'Internet access service' has the meaning given that term in section 231(e)(4) of the Communications Act of 1934 of Title 47," which states, "The term 'Internet access service' means a service that enables users to access content, information, electronic mail, or other services offered over the Internet, and may also include access to proprietary content, information, and other services as part of a package of services offered to consumers." Social networking sites like Facebook that provide, among other things, electronic messaging systems have been held to be Internet access services for purposes of the CAN-SPAM Act. See, e.g., MySpace, Inc. v. Wallace, 498 F. Supp. 2d 1293 (CD. Cal. 2007). -10- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page15 of 23 1 1. No Reduction in Statutory Damages Is Warranted Here 2 None of the circumstances that would warrant a reduction of damages are present in this 3 case. 15 U.S.C. § 7706(g)(3)(D) allows for the reduction of damages as follows: 4 (D) Reduction of damages. In assessing damages under subparagraph (A), the court may consider whether - (i) the defendant has established and implemented, with due care, commercially reasonable practices and procedures designed to effectively 7 prevent such violations; or 8 (ii) the violation occurred despite commercially reasonable efforts to maintain compliance with the practices and procedures to which reference 9 is made in clause (i). Wallace took none of the precautions described in 15 U.S.C. § 7706(g)(3)(D). Rather, Wallace's entire business model is to profit from deliberate and willful violations of the CAN-SPAM Act as 12 described above. 2. Wallace's Spam Campaign Warrants Aggravated Damages -15 U.S.C. 14 §7704(b)(3) Wallace's actions warrant an award of aggravated damages under multiple sections of the CAN-SPAM Act. Each violation described below independently supports an award of aggravated damages. The fact that Wallace committed multiple violations of multiple statutes makes the case for aggravated damages even stronger. Wallace has been successfully sued by , q multiple private parties and disciplined by the FTC already - and continues to remorselessly 2Q attack new targets (like Facebook in this instance). See MySpace v. Wallace, 498 F. Supp. 2d 2 j 1293 (CD. Cal. 2007) (court later awarded MySpace $230 million for Wallace's spam on 22 MySpace's network); FTC v. Seismic Entm 7 Prods., Inc., Case No. 1:04-CV-00377-JD (N.H. 2006) (court ordered default judgment against Wallace for $4,089,550 and a permanent injunction 24 from spamming); Earthlink Networks v. Cyber Promotions, Case No. BC 167502 (Cal. Super. Ct. L.A. County Mar. 30, 1998) (alleging spam on Earthlink's network - the case settled for an 26 alleged $ 1,000,000); Bigfoot Partners, L.P. v. Cyber Promotions, Civil Action Number 97 CIV 7391 (S.D.N.Y. 1998) (suit alleging spam by Wallace and his company); Concentric Network Corp. v. Wallace, Case No. C-96-20829-RMV (N.D. Cal. 1996) (suit alleging spamming and -11 - APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page16 of 23 1 email "spoofing"); CompuServe, Inc. v. Cyber Promotions, Case No. C2-96-1070 (S.D. Ohio 2 1996) (court ordered injunction against Wallace and his company Cyber Promotions, Inc. in 3 response to spamming); Cyber Promotions, Inc. v. America Online, Inc., 948 F. Supp. 436 (E.D. 4 Pa. 1996) (court held that AOL had the right to block Wallace's spam because there is no First 5 Amendment right to send spam). 6 15 U.S.C. § 7706(g)(3)(C) provides for aggravated damages as follows: ' (C) Aggravated damages. The court may increase a damage award to an amount equal to not more than three times the amount otherwise available under this paragraph if- 9 (i) the court determines that the defendant committed the violation 10 willfully and knowingly; or 11 (ii) the defendant's unlawful activity included one or more of the aggravated violations set forth in section 7704(b) of this title. 13 Wallace is in the business of sending commercial spam. Clearly, as described above, he 14 knowingly and willfully sent HB^^^I spam messages to Facebook users. Consequently, aggravated damages are warranted pursuant to 15 U.S.C. § 7706(g)(3)(C)(i). As set forth below, Wallace also violated 15 U.S.C. §§ 7704(b)(l) (address harvesting) and 7704(b)(3) (relay or retransmission through unauthorized access). Each of these actions also independently supports an award of aggravated damages. 19 a. Address Harvesting 20 I5 U.S.C. § 7704(b)(l)(A) specifies that it is an unlawful aggravated violation to send spam messages with: 22 actual knowledge, or knowledge fairly implied on the basis of objective circumstances, that - 23 (i) the electronic mail address of the recipient was obtained using an automated means from an Internet website or proprietary online service operated by another person, and such website or online service included, at the time the address was obtained, a notice stating that the operator of 26 sucn website or online service will not give, sell, or otherwise transfer addresses maintained by such website or online service to any other third 27 party for the purposes of initiating, or enabling others to initiate, electronic messages[.] -12- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page17 of 23 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Wallace committed address harvesting allace's harvesting of addresses further supports an award of aggravated damages. b. Relay or Retransmission Through Unauthorized Access 15 U.S.C. § 7704(b)(3) specifies that it is an unlawful aggravated violation: for any person knowingly to relay or retransmit a commercial electronic mail message that is unlawful under subsection (a) from a protected computer or computer network that such person has accessed without authorization. See Complaint ffif 30-32; Facebook Decl. ffi| 11-18. The hijacked accounts and the spam recipient accounts were all located within Facebook's protected network, and all spam messages were sent and received over Facebook's protected network. See Complaint ffl 30-32; Facebook Decl. ffl| 11-18. Wallace's knowing unauthorized access to Facebook's protected network for the purpose of relaying/retransmitting spam further supports an award of aggravated damages. c. Aggravated Damages Are Warranted Because of Wallace's numerous violations, each independently supporting an award of aggravated damages, his actions warrant the imposition of treble damages. See 15 U.S.C. § 7706(g)(3)(C). ^^^^^^^^H|||||^|^| Substantial damage awards are justified under the CAN-SPAM Act to punish defendants, to deter them from -13- APPLICATION FOR DEFAULT JUDGMENT CaseNo.C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page18 of 23 1 conducting further spam campaigns, and to deter others from engaging in similar misconduct. 2 See Kramer v. Cash Link Sys., No. 3-03-CV-80109-CRW-TJ, 2004 WL 2952561, at *7 (S.D. 3 Iowa 2004) (entering default judgment against three defendants for statutory trebled and punitive 4 damages totaling $360,000,000, $720,000,000 and $ 140,000); see also Cutler Decl. ISO Default 5 14, Exhibit A (MySpace, Inc. v. Wallace, order (CD. Cal. 2008) (awarding MySpace over 6 $223,000,000 in statutory damages against Defendant Wallace for violations of the CAN-SPAM 7 Act, as well as attorneys' fees and a permanent injunction)); Id. ̂ 5, Exhibit B (Facebook v. 8 Guerbuez, order, No. C08-03889-JF-HRL (N.D. Cal. 2008) (awarding Facebook $873,277,200 in 9 statutory and aggravated damages as well as additional attorneys' fees and costs of suit for 10 violations of the CAN-SPAM Act)). 11 Facebook now has over 200 million active users. Accordingly, it is an attractive target for 12 spammers. Complaint ̂ 22. The Court should issue a substantial damage award to deter and 13 punish Wallace and to deter others who would seek to profit by illegally spamming Facebook's 14 large user base. 15 Facebook recognizes that the size of the damage award it seeks is substantial and that the 16 Court has discretion in awarding statutory damages. Nevertheless, given the facts of this case and 17 the recidivist tendencies of Sanford Wallace, Facebook urges the Court to send a message to any 18 would-be perpetrators that spamming and phishing will not be tolerated. Congress specifically 19 provided for substantial damages for spamming activities in order to deter such improper conduct. 20 It recognized that spam imposes significant monetary costs that must be addressed. See 15 U.S.C. 21 § 7701(a)(6) ("The growth in unsolicited commercial electronic mail imposes significant 22 monetary costs on providers of Internet access services."). Indeed, in 2003 it was estimated that 23 spam cost U.S. organizations billions of dollars per year, "including lost productivity and the 24 additional equipment, software, and manpower needed to combat the problem." Cal. Bus. & 25 Prof. Code § 17529(d). Accordingly, significant damages are authorized and warranted against 26 mass spammers such as Wallace. 27 28 -14- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page19 of 23 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 D. Wallace's Violations of California's Anti-Phishing Statute Support an Award of Statutory Damages Under California Business and Professions Code § 22948 California law permits Internet access service providers (like Facebook) to bring actions for recovery of "the greater of actual damages or five hundred thousand dollars ($500,000)" for violations of its anti-phishing statute. Cal. Bus. & Prof. Code § 22948.3(a)(l). For cases where the defendant engages in a "pattern and practice of violating Section 22948.2," the court is authorized to "[i]ncrease the recoverable damages to an amount up to three times the damages otherwise recoverable." Cal. Bus. & Prof. Code §§ 22948.3(c)(l) and (2). Facebook Decl. H 16. While Cal. Bus. & Prof. Code § 22948.3(e) states that "multiple violations of Section 22948.2 resulting from any single action or conduct shall constitute one violation," Wallace took the time and spent the resources to separately create and register each and every different domain that he used as part of his phishing scheme. E. Wallace Should Be Permanently Enjoined from Accessing and Abusing Facebook's Services Facebook is entitled to the entry of a permanent injunction against Defendant Wallace in the same form as previously entered by the court in its Order of Preliminary Injunction. DE 39. 1. The CAN-SPAM Act Supports Entry of a Permanent Injunction The CAN-SPAM Act expressly authorizes the Court to grant Facebook permanent injunctive relief to enjoin further violations of the Act. See 15 U.S.C. § 7706(g)(l)(A). As previously discussed, there is no question that Wallace's actions violated the CAN-SPAM Act. See Section III(B). -15- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page20 of 23 26 27 28 1 2. Wallace's Violations of the Computer Fraud and Abuse Act Support Entry of a Permanent Injunction 2 In addition to Wallace's violation of the CAN-SPAM Act, the undisputed facts set forth above, Facebook's Complaint, its Motion for Temporary Restraining Order, and its Motion for 4 Preliminary Injunction demonstrate Wallace's liability under the Computer Fraud and Abuse Act ("CFAA"). 18 U.S.C. §§ 1030(a)(2) (intentional access and information theft), 1030(a)(4) (knowing access with intent to defraud), 1030(a)(5)(A)(ii) (intentional access that recklessly causes damage), 18 U.S.C. § 1030(a)(5)(A)(iii) (intentional access that causes damage). These 8 violations arise from Wallace's unauthorized use of Facebook user login information to gain 9 access to the users' accounts and Facebook's services and to obtain information from Facebook, 10 which he then used to send spam to additional Facebook users. The CFAA provides a private right of action for the knowing and unauthorized access of a 12 computer used in interstate commerce that causes loss or damage in excess of $5,000. The CFAA also allows claims based upon attempted violations. 18 U.S.C. § 1030(a)(6). 14 Throughout his cycle of spamming, phishing, unauthorized access, and monetary profit, Wallace accessed Facebook's computers and network without authorization or in excess of 16 authorization. Complaint ffi| 29-32, 57-69; Facebook Decl. ffi| 4, 7-8,10-11 17 18 19 20 Facebook Decl. 21 Facebook has expended resources far in excess of $5,000 to investigate and prevent Wallace's 22 unauthorized access and activities and make hardware and software upgrades and repairs to better 23 combat his illegal and unauthorized activities. Complaint Tj 61; Facebook Decl. ̂ 19. 24 25 4 Wallace violated no less than nine provisions of Facebook's Terms of Use, triggering the automatic revocation of his license to access Facebook. See supra Section II. Therefore, Wallace's use of the Facebook site constitutes unauthorized access. Facebook Decl. ffl[ 4, 7-8, 10-12; Facebook v. ConnectU, LLC, 489 F. Supp. 2d 1087,1090-91 (N.D. Cal. 2007) (finding that, under Cal. Penal Code § 502(c), where terms of use prohibit an activity and an individual engages in the activity, the activity is "without permission"). -16- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page21 of 23 1 18 U.S.C. § 1030(a)(2) prohibits the intentional accessing of protected computers without 2 authorization or exceeding one's authorized access and causing losses of more than $5,000. 3 Wallace repeatedly violated this statute by purposefully exceeding his authorized access to the 4 Facebook service by using other users' accounts without authorization to obtain information and 5 sending spam messages in violation of Facebook's Terms of Use. Complaint ffi| 14,57-69; 6 Facebook Decl. ffl 4, 7-8, 11, 19. 7 18 U.S.C. § 1030(a)(4) prohibits knowingly and with the intent to defraud, accessing 8 protected computers without authorization or exceeding authorized access, to further the intended 9 fraud and obtain more than $5,000 in value. 18 U.S.C. § 1030(a)(4). As explained above in 10 Section III(B), Wallace repeatedly accessed Facebook's protected computers cloaked as 11 legitimate Facebook users. He misappropriated the accounts and identities of innocent Facebook 12 users and used them to fraudulently represent that the messages were sent by the user of the 13 misappropriated account. Wallace also defrauded Facebook users by falsely representing the true 14 purpose of his messages. Complaint U 31; Facebook Decl. ffl] 11-17; Bates Decl. ffl[ 3-4. 15 18 U.S.C. § 1030(a)(5)(A)(ii) prohibits intentionally accessing protected computers (a) 16 without authorization, and recklessly causing an aggregate loss of $5,000 or more, or (b) without 17 authorization and causing aggregate damage or loss of $5,000 or more. 18 Wallace violated 18 U.S.C. § 1030(a)(5)(A)(ii) by repeatedly accessing Facebook's 19 computers without authorization and recklessly causing harm to Facebook. Complaint ffll 29-32; 20 Facebook Decl. Ifll 10, 12, 18-19. Even if Wallace's actions are not determined to be reckless, 21 they would be in violation of 18 U.S.C. § 1030(a)(5)(A)(iii), because he has caused over $5,000 22 of aggregated damage to Facebook through his actions. Complaint ̂ 34; Facebook Decl. H 19. 23 3. Wallace's Violations of California Penal Code § 502 Support Entry of a Permanent Injunction 24 J California Penal Code § 502 provides: 25 the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a 27 violation of any of the provisions of subdivision (c) may bring a civil action against the violator for compensatory damages and injunctive 28 relief or other equitable relief. -17- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page22 of 23 1 Cal. Penal Code § 502(e)(l) (emphasis added). 2 As pled in the Complaint, Facebook alleged violations of six separate subsections of subdivision (c). Complaint ffll 70-83. These subsections address the unauthorized access of 4 Facebook's computers and computer systems. Facebook has supported each of these allegations 5 with the facts pled in the Complaint and subsequent requests for injunctive relief. Wallace has 6 _ not responded to any of these facts or allegations. Therefore, Facebook is entitled to the g injunctive relief requested pursuant to Cal. Penal Code § 502(e)(l). 9 IV. CONCLUSION 10 Based on the reasoning above, Facebook respectfully requests that the Court grant relief against Wallace as set forth in the Proposed Order submitted concurrently with this Application to 12 prevent further irreparable harm to Facebook and its users. 13 DATED: May 8,2009 PERKINS COIE llp 14 15 By: _/§/_ David Chiappetta 16 Attorneys for Plaintiff Facebook, Inc. 17 18 19 20 21 22 23 24 25 26 27 28 -18- APPLICATION FOR DEFAULT JUDGMENT Case No. C-09-00798-JF Case5:09-cv-00798-JF Document65 Filed06/01/09 Page23 of 23
