Oracle Corporation et al v. SAP AG et al
Declaration of Tharan Gregory Lanier in Support of 816 Defendants' Cross Motion for Partial Summary Judgment and Opposition to Plaintiffs' Motion for Partial Summary Judgment (FILED PURSUANT TO D.I. 810) filed by SAP AG, SAP America Inc, Tomorrownow Inc. (Attachments: # 1 Exhibit 1, # 2 Exhibit 2, # 3 Exhibit 3, # 4 Exhibit 4, # 5 Exhibit 5, # 6 Exhibit 6, # 7 Exhibit 7, # 8 Exhibit 8, # 9 Exhibit 9, # 10 Exhibit 10, # 11 Exhibit 11, # 12 Exhibit 12, # 13 Exhibit 13, # 14 Exhibit 14, # 15 Exhibit 15, # 16 Exhibit 16, # 17 Exhibit 17, # 18 Exhibit 18, # 19 Exhibit 19, # 20 Exhibit 20, # 21 Exhibit 21, # 22 Exhibit 22, # 23 Exhibit 23, # 24 Exhibit 24, # 25 Exhibit 25, # 26 Exhibit 26, # 27 Exhibit 27, # 28 Exhibit 28, # 29 Exhibit 29, # 30 Exhibit 30, # 31 Exhibit 31, # 32 Exhibit 32, # 33 Exhibit 33, # 34 Exhibit 34, # 35 Exhibit 35, # 36 Exhibit 36, # 37 Exhibit 37, # 38 Exhibit 38, # 39 Exhibit 39, # 40 Exhibit 40, # 41 Exhibit 41, # 42 Exhibit 42, # 43 Exhibit 43, # 44 Exhibit 44, # 45 Exhibit 45, # 46 Exhibit 46, # 47 Exhibit 47, # 48 Exhibit 48, # 49 Exhibit 49, # 50 Exhibit 50, # 51 Exhibit 51, # 52 Exhibit 52, # 53 Exhibit 53)(Related document(s) 810 ) (Froyd, Jane) (Filed on 8/27/2010) Modified on 8/30/2010 (vlk, COURT STAFF).
Oracle Corporation et al v. SAP AG et al
Doc. 817 Att. 51
LEXSEE 2005 U.S. DIST. LEXIS 19099
Positive As of: Mar 29, 2010 RESDEV, LLC, Plaintiff, -vs- LOT BUILDERS ASSOCIATION, INC., MICHAEL SHANNON BOSWELL & BRAD LUKENS, Defendants. Case No. 6:04-cv-1374-Orl-31DAB UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF FLORIDA, ORLANDO DIVISION 2005 U.S. Dist. LEXIS 19099
August 10, 2005, Decided This case is before the Court on Defendants Lot Builders Association Inc.'s, Michael Boswell's, and Brad Luken's (collectively, "Lot Builders") Motion for Summary Judgment (Doc. 52), Plaintiff ResDev LLC's Cross Motion for Summary Judgment (Doc. 53), and Resdev's and Lot Builder's respective Oppositions (Docs. 73 and 71). I. BACKGROUND ResDev has sued Lot Builders for violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 ("CFAA"), on ground that Lot Builders absconded with ResDev's "scattered-lots database," a computerized [*2] resource on available residential lots. 1 Lot Builder's principals, two former ResDev employees, acknowledge that, after leaving ResDev's employ, they visited its website and were able to access information that was not password protected. Based on that event and others, ResDev claims that Lot Builders committed unauthorized computer access in violation of the CFAA, and ResDev seeks to recover, inter alia, damages based on the information's alleged trade secret value. Lot Builders asserts, in response, that ResDev has not suffered
COUNSEL: [*1] For Resdev, LLC, a Florida Limited Liability Company, Plaintiff: Barbara Rudolph Smith, Herbert L. Allen, Stephen H. Luther, Allen, Dyer, Doppelt, Milbrath & Gilchrist, P.A., Orlando, FL. For Lot Builders Association, Inc., a Florida Corporation, Michael Shannon Boswell, Brad Lukens, Defendants: Daniel P. Osterndorf, Winderweedle, Haines, Ward & Woodman, P.A., Winter Park, FL. Matthew David Pardy, Kim, Smith & Pardy, P.A., Orlando, FL. Richard G. Wack, Mediation Offices of Lisa J. Long, Winter Park, FL, Pro se. JUDGES: GREGORY A. STATES DISTRICT JUDGE. PRESNELL, UNITED
OPINION BY: GREGORY A. PRESNELL OPINION
Page 2 2005 U.S. Dist. LEXIS 19099, *2
cognizable loss. 1 ResDev has also sued Lot Builders in state court on various unfair-competition claims. II. STANDARD OF REVIEW Summary judgment "shall be rendered forthwith if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." FED. R. CIV. P. 56(c) [*3] . Whether a fact is material depends on the substantive law of the case. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248, 91 L. Ed. 2d 202, 106 S. Ct. 2505 (1986). If there is an absence of evidence on a dispositive issue for which the nonmoving party bears the burden of proof, that party must "go beyond the pleadings and by ... affidavits, or by the depositions, answers to interrogatories, and admissions on file, designate specific facts showing that there is a genuine issue for trial." Celotex Corp. v. Catrett, 477 U.S. 317, 324-25, 91 L. Ed. 2d 265, 106 S. Ct. 2548 (1986) (internal quotations and citation omitted). Summary judgment is mandated against the nonmoving party who thereafter fails to present sufficient evidence to establish a genuine issue of fact for trial. Id. at 322, 324-25. In this review, the Court must consider all inferences drawn from the underlying facts in a light most favorable to the nonmoving party, and resolve all reasonable doubts against the moving party. Anderson, 477 U.S. at 255. If a material issue of fact exists, the court must not decide it, but rather, must deny summary judgment and proceed to trial. Environmental Def. Fund v. Marsh, 651 F.2d 983, 991 (5th Cir. 1981). [*4] 2 But "there is no issue for trial unless there is sufficient evidence favoring the nonmoving party for a jury to return a verdict for that party. If the evidence is merely colorable, or is not significantly probative, summary judgment may be granted." Anderson, 477 U.S. at 249-50 (citations omitted). 2 Unless reversed, decisions of the Fifth Circuit prior to October 1, 1981 are binding precedent on this Court. Bonner v. City of Prichard, 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc). III. LEGAL ANALYSIS
This case turns primarily on statutory construction. In that regard, there are certain basic rules this Court must follow. There is a presumption that, in drafting a statute, Congress said what it meant and meant what it said. American Bankers Ins. Group v. United States, 408 F.3d 1328, 1332 (11th Cir. 2005). Indeed, "the first rule in statutory construction is to determine whether the language at issue has a plain and unambiguous meaning with [*5] regard to the particular dispute." Shotz v. City of Plantation, Florida, 344 F.3d 1161, 1167 (11th Cir. 2003). Words carry their ordinary meaning, unless otherwise defined. American Bankers, 408 F.3d at 1332. If Congress has used clear statutory language, a court need not consider extrinsic materials, such as legislative history, and certainly should not derive from such materials a meaning that is inconsistent with the statute's plain meaning. Shotz, 344 F.3d at 1167. The only exception is this narrow one: "courts my reach results inconsistent with the plain meaning of a statute 'if giving the words of a statute their plain and ordinary meaning produces a result that is not just unwise but is clearly absurd.'" CBS Inc. v. PrimeTime 24 Joint Venture, 245 F.3d 1217, 1228 (11th Cir. 2001) (citation omitted). Even where Congress has used statutory language that is not entirely transparent, courts are to resort, in the first instance, to canons of construction -- time-tested interpretive rules developed to determine the meaning of individual statutory terms from a methodical inquiry into their broader, statutory context. [*6] Id. at 1225. In construing a statute's meaning and application to a particular case, a court should resort to extrinsic materials, such as legislative history, only if the statutory language either produces a clearly absurd result or presents a substantial ambiguity. See Shotz, 344 F.3d at 1367; CBS Inc., 245 F.3d at 1225. A. Relevant Excerpts of the CFAA's Statutory Text
(a) Whoever -... (5)(A)(i) knowingly causes the transmission of . . . information . . . and as a
Page 3 2005 U.S. Dist. LEXIS 19099, *6
result of such conduct, intentionally causes damage without authorization, to a protected computer; (ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (iii) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage; and (B) by [such] conduct described in ... subparagraph (A) caused ... -(i) loss to 1 or more persons during any 1-year period . . . aggregating at least $ 5,000 in value; (ii) the modification or impairment, or potential modification [*7] or impairment of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (iii) physical injury to any person; (iv) a threat to public health or safety; or (v) damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or
national security. ... shall be [subject to criminal penalties]. (e) As used in this section -... (8) the term "damage" means any impairment to the integrity or availability of data, a program, a system, or information; ... (11) the term "loss" means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service; ...
(g) Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive [*8] relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv) or (v) of subsection (a)(5)(B). Damages for a violation involving only conduct described in subsection (a)(5)(B)(i) are limited to economic damages. * * * No action may be brought under this subsection for the negligent design or manufacture of computer hardware,
Page 4 2005 U.S. Dist. LEXIS 19099, *8
computer software, or firmware. 18 U.S.C. § 1030 (emphasis added). B. Construction of the CFAA's Relevant Statutory Text At the outset, subsection (g) cites two explicitly-defined injuries - "damage" or "loss" - either of which a plaintiff must suffer, as a result of a CFAA violation, in order to maintain a cause of action for "compensatory damages." Id. (g). A further precondition is that the alleged violation involve one of five enumerated factors. Id. For example, if a hospital patient suffers "damage" - an "impairment to the . . . availability of . . . information" -- by reason of a CFAA violation, the patient may maintain a civil action against the violator for compensatory damages, if the [*9] violation also involved "impairment . . . of care" or "physical injury." Id. (g), (e)(8), (a)(5)(B)(ii)-(iii)(g). In this regard, the CFAA's private cause of action is principally defined by a two-part injury requirement; a plaintiff must suffer a certain type of root injury, which is not sufficient to support a civil action, unless one of five operatively-substantial effects occurs. Id. (a)(5)(B)(i)-(v), (g). A plaintiff who has suffered injuries fitting subsection (g)'s two-part injury requirement may, in turn, obtain "compensatory damages and injunctive relief or other equitable relief." Id. (g). In ordinary legal parlance, "compensatory damages" are "damages sufficient in amount to indemnify the injured person for the loss suffered." BLACK'S LAW DICTIONARY 416 (8th ed. 2004). And in ordinary practice, "compensatory damages are not restricted to actual loss of time or money; they cover both mental and physical aspects of injury tangible and intangible." ELEVENTH CIRCUIT PATTERN JURY INSTRUCTIONS (CIVIL CASES), Federal Claims Instruction 1.2.1 (1999). Subsection (g), however, further limits the available damages to "economic damages," if a violation involved only conduct [*10] which caused "loss" aggregating at least $ 5,000 in a 1-year period. Id. So it is fairly clear that, for conduct which results only in "loss," the only available measure of damages is actual monetary loss. 18 U.S.C. § 1030(g). Thus, besides requiring "damage" or "loss," subsection (g)'s terminology provides two additional limits in regard to damages - damages must be "compensatory" and, for "loss," can only be "economic."
Id. 1. ResDev's Principal Position In the instant case, ResDev claims, as its greatest loss, an amount equal to Lot Builders' revenues, about $ 175,000, which ResDev sees as resulting from Lot Builder's unauthorized obtainment of ResDev's scattered-lots database. ResDev also acknowledges that the viability of its civil action hinges on subsection (a)(5)(B)(i). ResDev, therefore, assumes that Lot Builder's allegedly ill-gotten revenues qualify as "loss" aggregating over $ 5,000 in a 1-year period. See id. (a)(5)(B)(i). ResDev's position, however, does not fit the CFAA's meaning of "loss." The CFAA defines "loss" in terms of "any reasonable cost." Id. (e)(11). "Cost" ordinarily means an "amount paid or charged for something; [*11] price or expenditure." BLACK'S LAW DICTIONARY 371 (8th Ed. 2004). The CFAA's "loss" definition goes on to list costs that are similar in that they are all directly associated with, or with addressing, an unauthorized-computer-access event. Among those costs are: "any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11) (emphasis added). By use of the term "cost" and its listing potential injuries directly associated with, or with addressing, an unauthorized-computer-access event, the CFAA plainly enumerates a narrow grouping of "loss" distinct from -and thus excluding -- the far greater range of losses that could flow from a violation of the CFAA. ResDev's position, that "loss" can cover a trade secret's exclusivity value, disregards the ordinary meaning of statutory terms, fails to account for surrounding context, and runs counter to the "expression unius . . ." canon of construction, which translates as "the expression of one implies the exclusion of others." See Barnhart v. Peabody Coal Co., 537 U.S. 149, 168, 154 L. Ed. 2d 653, 123 S. Ct. 748 (2003) (indicating that [*12] expressio unius cannon has force "when the items expressed are members of an 'associated group or series,' justifying the inference that items not mentioned were excluded by deliberate choice, not inadvertence."). Futhermore, to the extent ResDev asserts that sufficient "damage" or "loss" can open the door to a broader class of damages, ResDev's position both ignores subsection (g)'s wording: "any person who suffers damage or loss by reason of a violation of this section
Page 5 2005 U.S. Dist. LEXIS 19099, *12
may maintain a civil action against the violator to obtain compensatory damages," 18 U.S.C. § 1030(g) (emphasis added); and also ignores the selection of factors listed in subsection (a)(5)(B). Each of the explicitly-defined root injuries -- "damage" or "loss" -- is an immanently foreseeable effect of unauthorized computer access, and subsection (a)(5)(B)'s five-factor list includes things which clearly may result from "damage" or otherwise constitute "loss." ResDev's position fails to acknowledge that allegedly ill-gotten revenues from a trade secret are neither a "but-for" nor a proximate consequence of "damage," and nor do they fit within the grouping of "loss." In that regard, [*13] ResDev's position conflicts with the CFAA's language, where the sine qua non of the private cause of action -- either of two explicitly-defined root injuries - narrows the available "damages" to "compensatory damages" -- those damages which result from, or constitute, an explicit type of injury. Although ResDev cites two cases that appear to support its position, neither is helpful. In Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc., 119 F. Supp. 2d 1121 (W.D. Wash. 2000), the district court considered a version of the CFAA predating its most recent version. On or after October 26, 2001, Congress amended the CFAA, in relevant part, by defining the term "loss" in subsection (e)(11). See USA Patriot Act of 2001, Pub. L. No. 107-56, § 814(d)(5). That rendered subsection (g)'s reference to "damage" and "loss" a reference to two defined terms, which was not previously the case. See 18 U.S.C. § 1030 (1996). Whereas ResDev's principal alleged loss -- trade secret value -- may have been considered an actionable loss under the CFAA's previous version, its current version precludes that interpretation. 3 3 Another thing that detracts from Shurgard is its heavy reliance on legislative history. Id. at 1126-29. For instance, based on legislative history, Shurgard adopted an unusual and extraordinary interpretation of the word "integrity" within the CFAA's definition of "damage" - i.e., "any impairment to the integrity or availability of data . . . or information." It found "integrity" to contemplate the loss of a trade secret's exclusivity value. Id. at 1126-27. "Integrity," however, ordinarily means "wholeness" or "soundness," OXFORD ENGLISH REFERENCE DICTIONARY 731 (Rev. 2nd ed. 2002), and contemplates, in this
context, some diminution in the completeness or useability of data or information on a computer system. This Court finds no meaningful ambiguity that might weigh in favor of relying on legislative history, especially when it predates the CFAA's more recent amendments. And, whether real or apparent, there appears to have been a recent up-tick in cases looking ill upon such analyses. See e.g., Exxon Mobil Corp. v. Allapattah Servs. Inc., 162 L. Ed. 2d 502, 125 S. Ct. 2611, 2626 (2005) (favorably mentioning the view that legislative-history analyses are akin to "looking over a crowd and picking out your friends."). [*14] As to the second case, it is unfortunate that in Four Seasons Hotels & Resorts B. V. v. Consorcio Barr, S.A., the court failed to analyze the effect of the CFAA's 2001 amendments and relied on both Shurgard and another case dealing with an earlier version of the statute. See Four Seasons Hotels, 267 F. Supp. 2d 1268, 1322 (S.D. Fla. 2003) (otherwise relying on EF Culture Travel, B.V. v. Explorica, Inc., 274 F.3d 577, 585 (1st Cir. 2001), which defined "loss" as "detriment, disadvantage, or deprivation from failure to keep, have or get."). 4 In the end, however, it is Congress' words and definitions that generally control statutory meaning. See American Bankers, 408 F.3d at 1332. The CFAA's amendment and current language were not meaningfully analyzed, nor perhaps even flagged as a concern, in Four Seasons Hotels, and the absence of meaningful analysis renders that case unpersuasive. 4 In an unpublish, non-precedential opinion, the Eleventh Circuit affirmed the district court's liability determination without discussion. [*15] 2. ResDev's Secondary Position In its Opposition (Doc. 73), ResDev claims, as a fallback, that it has incurred loss by having to undertake extensive and costly efforts in response to Lot Builder's unauthorized computer access. It is undisputed that Lot Builder's principals no longer work at ResDev's place of business. Accordingly, remote access is the ongoing threat that apparently causes ResDev concern. 5 As an indication of the threat's magnitude, ResDev points out that one of Lot Builder's principals helped design ResDev's computer system, knows "the type of security he placed on the computers at ResDev, how the security was set up, how many levels of security were in place and where the vulnerabilities in ResDev's security existed."
Page 6 2005 U.S. Dist. LEXIS 19099, *15
Based on the view that its computers "will never be truly secure" until it sets up "a new security framework," ResDev estimates that the ultimate cost of responding to the threat will probably exceed $ 150,000, exclusive of interim cost for security evaluation and implementation. 5 The Court finds utterly meritless ResDev's suggestion that a CFAA violation occurs every time Lot Builders accesses its own computers and allegedly looks at information belonging to Resdev. Such access, if it can be called that, is conduct from which ResDev could not, as a matter of law, reasonably suffer "damage" or "loss" within the CFAA's meaning. [*16] Whether by strategy or a lack of notice, Lot Builders has not clearly addressed ResDev's cost-of-response estimates. Lot Builders has indicated, however, that the extent of its remote access has been one or more visits to ResDev's website; that, each time, the visit to the website occurred under attorney supervision; and that the purpose of the visits was to show how ResDev's website is not adequately secured. Lot Builders, therefore, may have challenged (albeit vaguely) whether its conduct could give rise to cognizable loss. In that regard, the CFAA provides potential redress for "loss," which includes "any reasonable cost" of responding to a violation. 18 U.S.C. § 1030(e)(11), (g). To enable a cause of action, however, the "loss" from a violation must aggregate at least $ 5,000 to 1 or more persons in a 1-year period. Id. (a)(5)(B)(i), (g). The CFAA, in addition, explicitly rejects any notion that it provides a cause of action for negligent computer hardware or software design. Id. (g).
Based on the current state 'of the record, the Court cannot say that either party has revealed the absence of a material issue of fact. Yet it is evident that, at [*17] least insofar as ResDev seeks to recoup the cost of building a new computer system with far greater security, the reasonableness of ResDev's alleged "loss" will be an issue. The parties, however, simply have not presented the issue in a manner in which this Court could reasonably consider it. Nevertheless, as the threshold viability of ResDev's cause of action depends on a minimum amount of "loss," the Court will consider, if filed by September 12, 2005, further pre-trial motions on that issue, even though the dispositive-motion's deadline has passed. IV. CONCLUSION For the foregoing reasons, it is therefore ORDERED that Lot Builder's Motion for Summary Judgment (Doc. 52) is GRANTED in part and DENIED in part; ResDev's Motion for Summary Judgment (Doc. 53) is DENIED; and ResDev's claim is dismissed to the extent it seeks compensatory damages for alleged injuries that do not constitute "loss" within the meaning of the CFAA. DONE and ORDERED in Chambers, Orlando, Florida on August 10, 2005. GREGORY A. PRESNELL UNITED STATES DISTRICT JUDGE