UNITED STATES DISTRICT COURT IN THE DISTRICT OF SOUTH CAROLINA ROCK HILL DIVISION
February 3, 2011
WEC CAROLINA ENERGY SOLUTIONS, LLC,
WILLIE "MIKE" MILLER, EMILY KELLEY, AND ARC ENERGY SERVICES, INC., DEFENDANTS.
The opinion of the court was delivered by: Cameron Mcgowan Currie United States District Judge Columbia, South Carolina
AMENDED OPINION AND ORDER
This matter is before the court on motions to dismiss filed by Defendants Willie "Mike" Miller ("Miller"), Emily Kelley ("Kelley"), and Arc Energy Services, Inc. ("Arc Energy") (collectively "Defendants). Dkt. Nos. 19 & 20. Through their motions Defendants first seek dismissal of the claim for violation of the Computer Fraud and Abuse Act ("the CFAA"), 18 U.S.C. § 1030 et seq., asserted by Plaintiff WEC Carolina Energy Solutions, LLC ("WEC"). See Dkt. No. 1 (complaint filed October 27, 2010). Assuming the CFAA claim is dismissed, Defendants seek dismissal of the remaining state-law claims pursuant to 28 U.S.C. § 1367(c) because the CFAA claim provides the sole basis for the assertion of subject matter jurisdiction.
For the reasons set forth below, the court grants Defendants' motions to dismiss the CFAA claim and declines to exercise supplemental jurisdiction over the remaining state-law claims. The latter are, therefore, dismissed without prejudice.
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) should be granted only if, after accepting all well-pleaded allegations in the complaint as true, it appears certain that the plaintiff cannot prove any set of facts in support of its claims that entitles it to relief. See Edwards v. City of Goldsboro, 178 F.3d 231, 244 (4th Cir. 1999). Although the court must take the facts in the light most favorable to the plaintiff, it "need not accept the legal conclusions [the plaintiff would draw] from the facts." Giarratano v. Johnson, 521 F.3d 298, 302 (4th Cir. 2008) (quoting Eastern Shore Mkts., Inc. v. J.D. Assocs. Ltd. P'ship, 213 F.3d 175, 180 (4th Cir. 2000)). The court may also disregard any "unwarranted inferences, unreasonable conclusions, or arguments." Id.
The Rule 12(b)(6) standard has often been expressed as precluding dismissal unless it is certain that the plaintiff is not entitled to relief under any legal theory that plausibly could be suggested by the facts alleged. See Mylan Labs., Inc. v. Markari, 7 F.3d 1130, 1134 (4th Cir. 1993). Nonetheless, the plaintiff must allege "enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) (quoted in Giarratano, 521 F.3d at 302); see also Wolman v. Tose, 467 F.2d 29, 33 n.5 (4th Cir. 1972) ("Under the liberal rules of federal pleading, a complaint should survive a motion to dismiss if it sets out facts sufficient for the court to infer that all the required elements of the cause of action are present.").
Thus, in applying Rule 12(b)(6), the court also applies the relevant pleading standard. Despite the liberal pleading standard of Rule 8, a plaintiff must include more than mere conclusory statements in support of its claims. See Ashcroft v. Iqbal, 129 S. Ct. 1937, 1949 (2009). The complaint must contain sufficient factual matter, accepted as true, to state a claim that is plausible on its face. Iqbal, 129 S. Ct. at 1949; Twombly, 550 U.S. at 570. The reviewing court need only accept as true the complaint's factual allegations, not its legal conclusions. Iqbal, 129 S. Ct. at 1949; Twombly, 550 U.S. at 555.
Expounding on its decision in Twombly, the United States Supreme Court stated in Iqbal:
[T]he pleading standard Rule 8 announces does not require "detailed factual allegations," but it demands more than an unadorned, the defendant-unlawfully-harmed-me accusation. A pleading that offers "labels and conclusions" or "a formulaic recitation of the elements of a cause of action will not do." Nor does a complaint suffice if it tenders "naked assertion[s]" devoid of "further factual enhancement."
To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to "state a claim to relief that is plausible on its face." A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.
Iqbal, 129 S. Ct. at 1949 (quoting Twombly, 550 U.S. at 555, 556, 557, 570) (citations omitted); see also Bass v. Dupont, 324 F.3d 761, 765 (4th Cir. 2003) (holding that "[w]hile a plaintiff is not charged with pleading facts sufficient to prove her case, as an evidentiary matter, in her complaint, a plaintiff is required to allege facts that support a claim for relief.").
The complaint alleges that Miller and his assistant Kelley, while employed by WEC, were in contact with Arc Energy, a competitor of WEC. Dkt. 1 at ¶ 11. At Arc Energy's direction, Miller and Kelley allegedly downloaded a substantial number of WEC's confidential documents and emailed the documents to Miller's personal email address. Id. at ¶¶ 12-14. After resigning from WEC, Miller used the confidential documents to benefit Arc Energy at the expense of WEC. Id. at ¶ 15.
Based on these allegations, the complaint asserts ten causes of action against Defendants including one based on federal law: a claim that Defendants violated the CFAA by obtaining confidential information from WEC without authorization or in excess of their authorization. Id. at ¶ 32. As to this claim, WEC alleges that although Miller and Kelley had permission to access the confidential documents (Id. at ¶ 8), WEC's policies prohibit (1) downloading confidential and proprietary information to a personal computer and (2) using any confidential information or trade secret unless authorized by WEC. Id. at ¶¶ 12 and 32. Further, WEC alleges that Miller and Kelley exceeded their authorized access by agreeing to share WEC's confidential information with Arc Energy. Id. at ¶ 10.
I. CFAA CLAIM
The only federal claim in the complaint is founded on 18 U.S.C. § 1030 et seq., the CFAA. Dkt. No. 1 ¶¶ 29-34. Although the CFAA is primarily a criminal statute generally intended to deter computer hackers, it permits private parties who suffer sufficient injuries as a result of a violation to bring a civil action. A.V. ex rel Vanderhye v. iParadigms, LLC, 562 F.3d 630, 645 (4th Cir. 2009). Specifically, the statute provides that "[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action" when damages or losses meet or exceed $5,000 in one year. § 1030(g).*fn1 WEC asserts that Defendants violated sections 1030(a)(2)(C), (a)(4), (a)(5)(B), and (a)(5)(C) of the CFAA.*fn2 These sections provide a remedy against a party who: (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains (C) information from any protected computer; *** (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value . . . ; *** (5) (B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.
Liability under the relevant sections requires, as a predicate, showing that an individual acted "without authorization" (all four sections) or "exceed[ed] authorized access" (two sections). WEC alleges that the CFAA was violated when, at the direction of Arc Energy, Miller and Kelley intentionally accessed WEC's computer system to download confidential and proprietary information for the benefit of Arc Energy. Dkt. No. 1 ¶ 32. WEC alleges that "Miller and Kelly's conduct constituted breaches of their fiduciary duties to WEC and therefore, they did not have authorization or exceeded their authorization." Id.
For the reasons set forth below, the court concludes that WEC fails to state a claim for relief under the CFAA.*fn3 In order for WEC's CFAA claim to succeed, the court would have to conclude that an employee acts "without authorization" or "exceeds authorized access" when he is "disloyal and acts in violation of [employer] policies prohibiting the use of confidential information for purposes other than the business of [the employer]." Dkt. No. 23 at 5 (emphasis added). As this court has previously held, the plain meaning of the statute does not support such an interpretation.*fn4
A. Meaning of "Without Authorization"
WEC alleges that, by downloading the confidential information and sending it to Miller's personal email account, Miller and Kelley acted "without authorization" because they violated WEC's policies prohibiting (1) downloading confidential and proprietary information to a personal computer or (2) using any confidential information or trade secrets unless authorized by WEC. Dkt. No. 1 at ¶¶ 32, 12.
The CFAA creates liability when an individual "accesses" a computer or a protected computer "without authorization." The company policies at issue in this case do not restrict an employee's ability to access data. Instead, they restrict how a WEC employee may use confidential information after accessing it. Because liability under the CFAA is based on access not use, Miller and Kelley's intended use of WEC's confidential information does not create liability under the CFAA. See, e.g., LVRV Holdings LLC v. Brekka, 581 F.3d 1127, 1131 (9th Cir. 2009) (interpreting "without authorization" as being without permission or having permission rescinded, and concluding that an employee's intended later use of information he has permission to access has no bearing on "authorization" to access it under the CFAA).*fn5
It is undisputed that Miller and Kelley were employed by WEC when they downloaded the confidential information. During that employment, Miller and Kelley were authorized to access WEC's computers and servers, which contained the confidential information at issue in this case.*fn6 The court assumes without deciding that Miller and Kelly violated company policies prohibiting employees from downloading and using confidential information without WEC's permission. This does not, however, change the result because the allegedly improper actions of downloading, emailing, and sharing information with a third party are distinct from the action of accessing the information. At the point Miller and Kelley were allegedly accessing the confidential information, they were performing an action authorized by WEC. In short, accessing the confidential information did not involve accessing a computer "without authorization" under the CFAA. Therefore, Defendants were not acting "without authorization" when they accessed the confidential information.*fn7
B. Meaning of "Exceeds Authorized Access"
In the alternative, WEC asserts that even if Miller and Kelley were authorized to access the confidential information, they exceeded that authorization by (1) accessing the confidential information on behalf of Arc Energy*fn8 and (2) violating company policy regarding confidential information.
WEC incorrectly argues that the CFAA does not define "exceeds authorized access" and crafts its own definition of the phrase. Using definitions from Dictionary.com, WEC argues that "exceeds authorized access" means "to go beyond the permission given by the party giving the access," and, therefore, "using information obtained by access for a purpose to benefit a third party qualifies as going beyond the authorization." Id. at 6-7. In fact, the CFAA defines "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information on the computer that the accessor is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). Thus, liability under the CFAA, based on an allegation that an employee exceeded authorized access, depends on whether the employee accessed information he was not entitled to access. WEC has not alleged that Miller or Kelley accessed information that they were not "entitled to access." Therefore its allegation falls outside the scope of this portion of the CFAA.
Access on Behalf of Third Party. The argument that breaching fiduciary duties forfeits an employee's authorization to access follows the Citrin analysis of the CFAA, which this court rejected in its order in Sloan Fin. Grp, LLC v. Coe, No. 0:09-cv-02659-CMC, 2010 WL 4668341 (D.S.C. Nov. 18, 2010). See n.4 supra (explanation of Citrin line of cases). There, this court joined the "critical mass" of cases holding that CFAA liability depends on actions taken by an employer in authorizing access to information rather than on an employee's purpose or intended future use of that information that is adverse to the employer's interests. Sloan, 2010 WL 4668341, at *5; see Lewis-Burke Assoc., LLC v. Widder, No. 09-302, 2010 WL 2926161, at *5 (D.D.C. July 28, 2010); see, e.g., Cvent, 2010 WL 3732183, at *4; Orbit One Com., Inc. v. Numerex Corp., 692 F. Supp. 2d 373, 385 (S.D.N.Y. 2010); Nat'l City Bank, N.A. v. Republic Mortg. Home Loans, LLC, No. 09-CV-1550, 2010 WL 959925, at *2 (W.D. Wash. Mar. 12, 2010); Bell Aerospace Servs. Inc. v. U.S. Aero Servs., Inc., 690 F. Supp. 2d 1267, 1272 (M.D. Ala. 2010); ReMedPar, Inc. v. AllParts Medical, LLC, 683 F.Supp.2d 605, 611 (M.D. Tenn. 2010). Acting on behalf of a third party competitor is merely another form of acting with an intended future use that is adverse to the interests of one's employer. WEC's allegation that Miller and Kelley accessed the confidential information on behalf of Arc does not bring the actions of any of the Defendants under the scope of the CFAA. See supra n.6.
Violating Company Policy. For WEC to succeed on its claim that Defendants exceeded authorized access by violating company policies, the court would have to adopt the Fifth Circuit's interpretation of "exceeds authorized access" as expressed in United States v. John, which suggests that, when an employee's purpose in accessing information is in violation of employer policies, he has exceeded authorized access. 597 F.3d at 273 (supra n.4). Even if the court adopted this interpretation, it would not fit the facts of this case. To the extent an employee's purpose is to violate an employer policy regulating access to information, the conclusion of the John court would be consistent with the language of the CFAA. For example, the Eleventh Circuit recently held that an employee of the Social Security Administration was liable under the CFAA for violating company policy "prohibit[ing] an employee from obtaining information from its databases without a business reason." United States v. Rodriguez, No. 09-15265, 2010 WL 5253231, at *1 (11th Cir. Dec. 27, 2010). That policy controlled what information employees could access, and because defendant accessed Social Security information about individuals for a personal rather than business reason, the court held he had exceeded his authorized access. Id. at *4.
However, in this case, WEC's company policies regulated use of information not access to that information. Thus, even if Miller and Kelley's purpose in accessing the information was contrary to company policies regulating use, it would not establish a violation of company policies relevant to access and, consequently, would not support liability under the CFAA.
A narrow reading of the statute is supported by the fact that the CFAA is primarily a criminal statute enacted by Congress to deter computer hackers and enhance the government's ability to prosecute computer crimes. Vanderhye, 562 F.3d at 645. Although there is a civil remedy available, there is no evidence that Congress intended the statute be used to help companies enforce their confidentiality or non-competition policies. See Nat'l City Bank, 2010 WL 959925, at *4 ("There is no reason to believe that Congress intended [the CFAA] to create a federal enforcement mechanism for corporate policies regarding document handling and retention."). There are a variety of other legal remedies potentially available to an employer who finds that an employee has misused or misappropriated proprietary or confidential information.*fn9
Additionally, where a statute has both criminal and non-criminal applications, courts should interpret the statute consistently. See Leocal v. Ashcroft, 543 U.S. 1, 11 n.8 (2004). The Supreme Court cautions against interpreting criminal statutes in surprising and novel ways that impose unexpected burdens on defendants. See United States v. Bass, 401 U.S. 336, 347-49 (1971). To interpret "authorization" or "exceeds authorized access" based on an employee's purpose or based on whether the employee's interests were adverse to the interests of his employer at the time of access would expand the reach of this statute well beyond its literal terms. This would be both confusing and antithetical to the rule of lenity which states, a court "will not interpret a federal criminal statute so as to increase the penalty that it places on an individual when such an interpretation can be based on no more than a guess as to what Congress intended." U.S. v. Seidman, 156 F.3d 542, 559 (4th Cir. 1998).
For the reasons set forth above, Defendants' motions to dismiss the CFAA claim are granted.*fn10
II. SUPPLEMENTAL JURISDICTION
Assuming the CFAA claim is dismissed, Defendants ask the court to dismiss the remaining state law clams pursuant to the court's discretion under 28 U.S.C. § 1367. WEC has not filed any opposition to this aspect of Defendants' motions.
The court's jurisdiction over the state law claims is premised on supplemental jurisdiction. See 28 U.S.C. § 1367(a). The court may decline to exercise supplemental jurisdiction if it "has dismissed all claims over which it has original jurisdiction." 28 U.S.C. § 1367(c)(3); see also Shanaghan v. Cahill, 58 F.3d 106, 109 (4th Cir. 1995) ("The doctrine of supplemental jurisdiction indicates that federal courts generally have discretion to retain or dismiss state law claims when the federal basis for an action drops away.").
"[T]rial courts enjoy wide latitude in determining whether or not to retain jurisdiction over state claims when all federal claims have been extinguished." Shanaghan, 58 F.3d at 110. The Fourth Circuit has identified several factors for a court to consider when making this determination:
(1) "convenience and fairness to the parties," (2) "the existence of any underlying issues of federal policy," (3) "comity," and (4) "considerations of judicial economy." Id. (citing Carnegie-Mellon Univ. v. Cohill, 484 U.S. 343, 350 n.7 (1988); Growth Horizons, Inc. v. Delaware County, 983 F.2d 1277, 1284 (3d Cir.1993)).
Fairness. A key fairness consideration is whether any applicable statute of limitations would prevent Plaintiff from refiling the dismissed state law claims in the appropriate state court. See Ketema v. Midwest Stamping, Inc., 180 Fed. Appx. 427, 428 (4th Cir. 2006) ("[T]he dismissal may be an abuse of discretion where the state statute of limitations expired prior to dismissal of the anchor federal claim."). However, 28 U.S.C. § 1367(d) provides that "[t]he period of limitations for any [state law claim asserted under 1367(a)] . . . shall be tolled while the claim is pending [in federal court] and for a period of 30 days after it is dismissed unless State law provides for a longer tolling period."*fn11 Therefore, the court's dismissal of WEC Carolina's state law claims will not result in WEC Carolina losing the opportunity to have its case considered on the merits.
Other Factors. The other factors, likewise, support dismissal. There are, for example, no federal policy or other federal issues remaining. Comity, therefore, favors dismissal because a state court is better suited to handle a matter involving only state law claims. The early stage at which the viability of the CFAA claim was raised and resolved also favors dismissal as any loss of judicial economy resulting from the dismissal will be minimal.
Accordingly, pursuant to 28 U.S.C. § 1367(c)(3), the court dismisses the remaining state law claims without prejudice.
For the reasons stated above, the court grants Defendants' motions to dismiss as to the CFAA claim. Under 28 U.S.C. § 1367(c)(3), the court dismisses the remaining state law claims without prejudice.
IT IS SO ORDERED.
Cameron McGowan Currie