Elvey v. TD Ameritrade, Inc.

Filing 11

MOTION for Preliminary Injunction and for Class Certification filed by Matthew Elvey, Gadgetwiz.com, Inc.. Motion Hearing set for 8/14/2007 09:30 AM in Courtroom 11, 19th Floor, San Francisco. (Attachments: # 1 Declaration of Matthew Elvey# 2 Declaration of Joel Griffiths# 3 Exhibit A# 4 Exhibit B# 5 Exhibit C# 6 Exhibit D# 7 Exhibit E# 8 Exhibit F# 9 Exhibit G# 10 Exhibit H# 11 Exhibit I# 12 Exhibit J)(Himmelfarb, Alan) (Filed on 7/10/2007)

Download PDF
Elvey v. TD Ameritrade, Inc. Doc. 11 Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 1 of 37 1 Alan Himmelfarb LAW OFFICES OF ALAN HIMMELFARB 2 2757 Leonis Blvd Los Angeles, CA 90058 3 Telephone: (323) 585-8696 Fax: (323) 585-8198 4 consumerlaw1@earthlink.net 5 Scott A. Kamber Ethan Preston 6 KAMBER & ASSOCIATES, LLC 11 Broadway, 22d Floor 7 New York, NY 10004 Telephone: (212) 920-3072 8 Fax: (212) 202-6364 skamber@kolaw.com 9 epreston@kolaw.com 10 11 12 13 Counsel for Plaintiffs IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION No. C 07 2852 MJJ Judge Martin J. Jenkins NOTICE OF MOTION; MOTION FOR PRELIMINARY INJUNCTION AND CLASS CERTIFICATION Date: August 14, 2007 Time: 9:30 a.m. Location: Courtroom 11, 19th Floor 450 Golden Gate Ave. San Francisco, CA 94102 MATTHEW ELVEY, an individual, and 14 GADGETWIZ, INC., an Arizona corporation, on their own behalf and on behalf of all 15 others similarly situated, 16 17 v. Plaintiffs 18 TD AMERITRADE, INC., a New York corporation, and DOES 1 to 100, 19 Defendants. 20 21 22 23 24 25 26 27 28 Motion for Preliminary Injunction and Class Certification PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND CLASS CERTIFICATION No. C 07 2852 MJJ Dockets.Justia.com Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 2 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 NOTICE OF MOTION NOTICE IS HEREBY GIVEN that Matthew Elvey and Gadgetwiz, Inc. will move the Court for a preliminary injunction in the above referenced proceedings, pursuant to Federal Rule of Civil Procedure 65(a) on August 14, 2007, at 9:30 a.m., or as soon thereafter as counsel may be heard by the above-entitled Court, located at 450 Golden Gate Avenue, 19th Floor, San Francisco, CA 94102, in Courtroom 11, before the Honorable Martin Jenkins. This Motion is based on this Notice of Motion and Motion, the Brief in Support of the Motion to Intervene and the authorities cited therein, oral argument of counsel, and any other matter that may be submitted at the hearing. Through this Motion, Plaintiffs seek the following equitable remedies: To the extent Ameritrade is deliberately leaking email addresses to spammers, it must be enjoined from doing so. The evidence before Plaintiffs suggests, however, the disclosure of email addresses is the result of an ongoing security breach at Ameritrade. The Motion seeks an order that Ameritrade disclose all material information about the leaks to prospective and current accountholders and for an accounting of the record systems which contain accountholders' personal information, so that Plaintiffs' counsel can identify reasonable steps which Ameritrade can take to protect this information (or require Ameritrade to sequester these systems and their data). Second, Ameritrade is California Resident Class's stock broker. The spam resulting from the Ameritrade leaks are exclusively stock spam ­ the spam touts thinly-traded stocks which can be easily manipulated as part of the spammers' pump-and-dump scheme against the spam recipients. Ameritrade knows or could easily determine which stocks are thus being touted, and could prevent its accountholders from purchasing those stocks in the wake of the spam. At a minimum, Ameritrade should fully disclose to prospective purchasers of touted stocks that the stock's value is being manipulated by spammers. Lastly, the Motion seeks to prevent Ameritrade from telling accountholders to destroy evidence. There is evidence that Ameritrade encouraged accountholders to delete spam when communicating about the leak. These communications promote the destruction of evidence to Motion for Preliminary Injunction and Class Certification ii No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 3 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the prejudice of the FAC's CAN SPAM Class (which has claims for statutory damages based on each spam sent). These communications are tantamount to spoliation, and this Motion seeks to prohibit Ameritrade from continuing this spoliation. In sum, this Motion seeks an Order from this Court against TD AMERITRADE, Inc. that: 1. Certifies the action as a class action and designating Plaintiffs as representatives of the CAN SPAM Class and Kamber & Associates, LLC as Class counsel under Rule 23(b)(2) and Rule 23(c)(4) to the extent necessary for the preliminary injunction sought herein. Prohibits TD AMERITRADE, Inc. from instructing, directing, or suggesting that its accountholders destroy copies of spam which promotes stocks. Certifies the action as a class action and designating Elvey as representative of the California Resident Class and Kamber & Associates, LLC as Class counsel under Rule 23(b)(2) and Rule 23(c)(4) to the extent necessary for the preliminary injunction sought herein. Prohibits TD AMERITRADE, Inc. from disclosing its accountholders' personal information (including its email addresses) to third parties in a manner inconsistent with its February 2007 Privacy Statement. Requires TD AMERITRADE, Inc. to detect spam sent to its accountholders and to identify stocks touted by such spam. Requires TD AMERITRADE, Inc. to display the following disclosure to California Resident Class members (Ameritrade's accountholders in California) who attempts to purchase a stock which has been touted by spam detected by Ameritrade: ALERT: THIS STOCK SHOULD BE PURCHASED ONLY WITH EXTREME CAUTION. THIS STOCK HAS RECENTLY BEEN TOUTED IN UNSOLICITED COMMERCIAL EMAIL. IT IS LIKELY THAT THE PERSONS SENDING THESE EMAILS ARE MANIPULATING THE VALUE OF THIS STOCK AS PART OF A FRAUDULENT INVESTMENT SCHEME. THIS SCHEME MAY CAUSE ANY INVESTMENT IN THIS STOCK TO LOSE ITS VALUE, NOTWITHSTANDING THE COMPANY'S FINANCIAL PERFORMANCE. and require the purchaser to affirmatively indicate that the purchaser has read this warning, before executing any such purchase in such a time period for any California Resident Class members. 7. Requires TD AMERITRADE, Inc. to provide Plaintiffs and their counsel with an accounting of any of its records systems which store Plaintiffs' personal information or personal information of any members of the California Resident Class. Requires TD AMERITRADE, Inc. to prominently disclose in its Privacy ii i No. C 07 2852 MJJ 2. 3. 4. 5. 6. 8. Motion for Preliminary Injunction and Class Certification Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 4 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 9. Statement and in emails or other individual disclosures to its accountholders: ALERT: AMERITRADE'S INFORMATION SYSTEMS ARE NOT NECESSARILY SECURE AND WE CANNOT ASSURE THE SECURITY OF YOUR PERSONAL INFORMATION. THERE IS EVIDENCE THAT SOME ACCOUNTHOLDERS' EMAIL ADDRESSES HAVE LEAKED FROM AMERITRADE'S COMPUTER SYSTEMS TO SPAMMERS. AMERITRADE HAS AN ONGOING INVESTIGATION INTO THIS SITUATION. YOUR NAME, SOCIAL SECURITY NUMBER, AND YOUR EMAIL ADDRESS MAY HAVE BEEN LEAKED AS WELL. We recommend that you place a fraud alert on your credit file. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts. Call any one of the three major credit bureaus. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts. All three credit reports will be sent to you, free of charge, for your review. You can contact Equifax (800-685-1111), Experian (888-397-3742), or TransUnionCorp (800-680-7289). Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade Commission (FTC) recommends that you check your credit reports periodically. Victim information sometimes is held for use or shared among a group of thieves at different times. Checking your credit reports periodically can help you spot problems and address them quickly. If you find suspicious activity on your credit reports or have reason to believe your information is being misused, call [insert contact information for law enforcement] and file a police report. Get a copy of the report; many creditors want the information it contains to absolve you of the fraudulent debts. You also should file a complaint with the FTC at www.consumer.gov/idtheft or at 1-877-ID-THEFT (877-438-4338). Your complaint will be added to the FTC's Identity Theft Data Clearinghouse, where it will be accessible to law enforcers for their investigations. You can obtain a copy of Take Charge: Fighting Back Against Identity Theft, a comprehensive guide from the FTC to help you guard against and deal with identity theft at: http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt04.htm and to further publish to current and former accountholders a report to be drafted by Plaintiffs' counsel and approved by the Court upon completion of the accounting in Paragraph 7. Requires TD AMERITRADE, Inc. to take such reasonable measures to protect the security of California Resident Class members' personal information drafted by Plaintiffs' counsel and approved by the Court upon completion of the accounting in Paragraph 7. iv No. C 07 2852 MJJ Motion for Preliminary Injunction and Class Certification Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 5 of 37 1 2 3 I. 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 2 3 I II . 24 25 26 27 28 I I. D. C. Table of Contents Page Plaintiffs' Evidence Mandates Urgent Action ............................................................1 A. B. Ameritrade Disclosed Its Accountholders' Email Addresses to Spammers .........2 Ameritrade Has Been Unable or Unwilling to Explain How It Disclosed Email Addresses to Spammers.......................................................................................3 Unauthorized Disclosure of Plaintiff Elvey's Email Address Creates a Likelihood that He Will Prevail on His Claims, Irrespective of Whether the Disclosure Was Deliberate or Unintentional........................................................4 Disclosure of Accountholders' Personal Information Threatens Irreparable Harm....................................................................................................................7 Balance of Hardships and Public Interest Favor Relief Sought in Motion.........11 The Court Should Impose No Bond or a Minimal Bond ...................................13 E. F. The Preliminary Injunction Sought Is Carefully Tailored to Address the Ongoing Harm to the California Resident Class .....................................................................14 A. Plaintiff Elvey Seeks To Enjoin Disclosure of Accountholder Email Addresses ..........................................................................................................14 The Injunction Sought Requires Ameritrade to Mitigate the Security Breach...15 Ameritrade Should Be Prohibited From Instructing Its Accountholders to Spoliate Evidence ..............................................................................................16 B. C. Plaintiffs Seek Class Certification Under Rule 23(b)(2) and Rule 23(c)(4) to the Extent the Court Deems Class Certification Necessary to Obtain the Preliminary Injunction ....................................................................................................................18 A. B. Members of Both Classes Are So Numerous That Joinder Is Impractical .........20 The General Application of the Ameritrade Policies to Plaintiffs and the Other Members of the Classes Establish Commonality, Typicality, and Class Cohesion............................................................................................................21 v No. C 07 2852 MJJ Motion for Preliminary Injunction and Class Certification Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 6 of 37 1 2 3 4 5 IV. 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Motion for Preliminary Injunction and Class Certification Table of Contents Page C. Class Representatives And Their Counsel Are Adequate to Represent the Classes...............................................................................................................23 Co nc l us i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 4 vi No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 7 of 37 1 2 Federal Cases Table of Authorities Page 3 Armstrong v. Davis, 275 F.3d 849 (9th Cir. 2001)....................................................................23 4 Barahona-Gomez v. Reno, 167 F.3d 1228 (9th Cir. 1999)........................................................14 5 Barnes v. Am. Tobacco Co., 161 F.3d 127 (3d Cir. 1998).........................................................22 6 Blackie v. Barrack, 524 F.2d 891 (9th Cir. 1975)....................................................21, 22-23, 24 7 Bowman v. Nat'l Football League, 402 F. Supp. 754 (D. Minn. 1975) ..............................18 n.5 8 Burnham v. Rohnert Park, No. 92-1439, 1992 U.S. Dist. LEXIS 8540 (N.D. Cal. May 18, 1992).....................3 n.2 9 Caroline C. v. Johnson, 174 F.R.D. 452 (D. Neb. 1996) ..........................................................22 10 Cason v. Nissan Motor Acceptance Corp., 212 F.R.D. 518 (M.D. Tenn. 2002) .................20 n.6 11 Cent. Wesleyan College v. W.R. Grace & Co., 6 F.3d 177 (4th Cir. 1993) ................................19 12 Cobell v. Norton, 391 F.3d 251 (D.C. Cir. 2004) .....................................................................16 13 Chamberlan v. Ford Motor Co., 369 F. Supp. 2d 1138 (N.D. Cal. 2005)...................................6 14 Entm 't Software Assn'n v. Foit, 15 No. 06-431, 2006 U.S. Dist. LEXIS 67290 (M.D. La. Aug. 24, 2006) ...................18 n.5 16 Fraser v. Major League Soccer, LLC, 180 F.R.D. 178 (D. Mass. 1998).............................19 n.6 17 Flynt Distrib. Co. v. Harvey, 734 F.2d 1389 (9th Cir. 1984) ................................................1 n.1 18 FTC v. Affordable Media, LLC, 179 F.3d 1228 (9th Cir. 1999)................................................15 19 Gay v. Waiters' & Dairy Lunchmen's Union, 549 F.2d 1330 (9th Cir. 1977) ...........................21 20 Gilder v. PGA Tour, Inc., 936 F.2d 417 (9th Cir. 1991)..............................................................8 21 Gratz v. Bollinger, 539 U.S. 244 (2003) ............................................................................23 n.7 22 Guckenberger v. Boston Univ., 957 F. Supp. 306 (D. Mass. 1997).....................................19 n.6 23 Hanlon v. Chrysler Corp., 150 F.3d 1011 (9th Cir. 1998) ......................................17, 22, 23-24 24 Hicks v. Morgan Stanley & Co., No. 01-10071, 2003 U.S. Dist. LEXIS 11972 (S.D.N.Y. July 16, 2003) ...............23 n. 7 25 Howe v. Varity Corp., 26 No. 88-1598, 1989 U.S. Dist. LEXIS 17521 (S.D. Iowa July 14, 1989).................18 n.5 27 In re Activision Sec. Litig., 621 F. Supp. 415, 438 (N.D. Cal. 1985)........................................19 28 In re Data Access Systems Sec. Litig., 103 F.R.D. 130 (D. N.J. 1984).....................................24 Motion for Preliminary Injunction and Class Certification vii No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 8 of 37 1 2 Federal Cases Table of Authorities Page 3 In re Hanford Nuclear Reservation Litig., 292 F.3d 1124 (9th Cir. 2002) ...............................19 4 In re Niles, 106 F.3d 1456 (9th Cir. 1997) ...............................................................................16 5 In re Rubber Chems. Antitrust Litig., 232 F.R.D. 346 (N.D. Cal. 2005) ..................................21 6 In re WorldCom, Inc. Sec. Litig., 219 F.R.D. 267 (S.D.N.Y. 2003) ....................................23 n.7 7 Jordan v. County of Los Angeles, 669 F.2d 1311, 1319 (9th Cir. 1982) ...................................21 8 Justin v. City of Los Angeles, No. 00-12352, 2000 U.S. Dist. LEXIS 17881 (C.D. Cal. Dec. 5, 2000).......................14 9 Kleiner v. First Nat'l Bank, 751 F.2d 1193 (11th Cir. 1985)...............................................17-18 10 L.H. v. Schwarzenegger, 11 No. 06-2042, 2007 U.S. Dist. LEXIS 18728 (E.D. Cal. Feb. 28, 2007)........................20 12 Lynch v. Rank, 604 F. Supp. 30 (N.D. Cal. 1984).....................................................................22 13 Leon v. IDX Sys. Corp., 464 F.3d 951 (9th Cir. 2006)..............................................................18 14 Moeller v. Taco Bell Corp., 220 F.R.D. 604 (N.D. Cal. 2004) .................................................21 15 Molski v. Gleich, 318 F.3d 937 (9th Cir. 2003) ........................................................................24 16 Morgan v. UPS of Am., 169 F.R.D. 349 (E.D. Mo. 1996) .............................................19-20 n.6 17 Metro Publ'g, Inc. v. Surfmet, Inc., No. 02-01833, 2002 U.S. Dist. LEXIS 26232 (N.D. Cal. July 3, 2002) ...................3 n.2 18 Nat'l Ass'n of Radiation Survivors v. Walters, 111 F.R.D. 595 (N.D. Cal. 1986) ....................20 19 O'Connor v. Boeing North Am., Inc., 180 F.R.D. 359 (C.D. Cal. 1997) ..................................23 20 Pollar v. Judson Steel Corp., 21 No. 82-6833, 1984 U.S. Dist. LEXIS 19765 (N.D. Cal. Feb. 3, 1984) .........................17 22 Premier Nutrition, Inc. v. Organic Food Bar, Inc., 475 F. Supp. 2d 995 (C.D. Cal. 2007)...1 n.1 23 Rent-A-Center, Inc. v. Canyon Television & Appliance Rental, Inc., 944 F.2d 597 (9th Cir. 1991) .......................................................................................8-9 24 Santiago v. Philadelphia, 72 F.R.D. 619 (E.D. Pa. 1976) ........................................................19 25 Save Our Sonoran, Inc. v. Flowers, 408 F.3d 1113 (9th Cir. 2005) ..................................1-2, 14 26 Schreiber v. NCAA, 167 F.R.D. 169 (D. Kan. 1996) ..........................................................19 n.6 27 Smith v. Univ. of Wa. Law Sch., 2 F. Supp. 2d 1324 (W.D. Wash. 1998) ..................................23 28 Soc'y for Individual Rights, Inc. v. Hampton, 528 F.2d 905 (9th Cir. 1975) ............................19 Motion for Preliminary Injunction and Class Certification viii No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 9 of 37 1 2 Federal Cases Table of Authorities Page 3 Stollenwerk v. Tri-West Healthcare Alliance, No. 03-0185, 2005 U.S. Dist. LEXIS 41054 (D. Ariz. Sept. 28, 2005) ........................10 4 Sweet v. Pfizer, 232 F.R.D. 360 (C.D. Cal. 2005) ....................................................................21 5 Univ. of Tex. v. Camenisch, 451 U.S. 390 (1981) ................................................................1 n.1 6 Vision Sports, Inc. v. Melville Corp., 888 F.2d 609 (9th Cir. 1989) ...........................................8 7 Wakefield v. Monsanto Co., 120 F.R.D. 112 (E.D. Mo. 1988)............................................20 n.6 8 Walker v. Pierce, 665 F. Supp. 831 (N.D. Cal. 1987) ...............................................................14 9 Walters v. Reno, 145 F.3d 1032 (9th Cir. 1998)....................................................................8, 22 10 Wang v. Chinese Daily News, Inc., 236 F.R.D. 485 (C.D. Cal. 2006) ......................................17 11 Washington v. Reno, 35 F.3d 1093 (6th Cir. 1994) ...................................................................18 12 Weathers v. Peters Realty Corp., 499 F.2d 1197 (6th Cir. 1974) ........................................20 n.6 13 Federal Statutes Page 14 15 U.S.C. § 7706 (2007) ..........................................................................................................17 15 Federal Rules Page 16 Fed. R. Civ. P. 23 .....................................................................................................18-19, 21-23 17 Fed. R. Civ. P. 26 .....................................................................................................................13 18 Fed. R. Civ. P. 65 ............................................................................................................1, 13-14 19 California Cases Page 20 Balboa Ins. Co. v. Trans Global Equities, 21 218 Cal. App. 3d 1327, 267 Cal. Rptr. 787 (Cal. Ct. App. 1990)....................................5 22 Bank of Am. Nat'l Trust & Sav. Assoc. v. Ryan, 207 Cal. App. 2d 698, 24 Cal. Rptr. 739 (Cal. Ct. App. 1962) ....................................5-6 23 Cal. Ass'n of Dispensing Opticians v. Pearle Vision Ctr., 24 143 Cal. App. 3d 419, 191 Cal. Rptr. 762 (Cal. Ct. App. 1983) ..................................7-8 25 Colgan v. Leatherman Tool Group, Inc., 135 Cal. App. 4th 663, 38 Cal. Rptr. 3d 36 (Cal. Ct. App. 2006)..............................5, 15 26 Comm. on Children's TV v. General Foods Corp., 35 Cal. 3d 197, 673 P.2d 660 (1983)...........5 27 Consumer Advocates v. Echostar Satellite Corp., 28 113 Cal. App. 4th 1351, 8 Cal. Rptr. 3d 22 (Cal. Ct. App. 2003)....................................5 Motion for Preliminary Injunction and Class Certification ix No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 10 of 37 1 2 California Cases Table of Authorities Page 3 Cortez v. Purolator Air Filtration Prods. Co., 23 Cal. 4th 163, 999 P.2d 706 (2000) ..........5, 15 4 Duffy v. Cavalier, 215 Cal. App. 3d 1517, 264 Cal. Rptr. 740 (Cal. Ct. App. 1989)....................................5 5 Estate of Sanders, 40 Cal. 3d 607, 710 P.2d 232 (1985) ............................................................7 6 Ferguson v. Friendfinders, 7 94 Cal. App. 4th 1255, 115 Cal. Rptr. 2d 258 (Cal. Ct. App. 2002)................................9 8 Heckmann v. Ahmanson, 168 Cal. App. 3d 119, 214 Cal. Rptr. 177 (Cal. Ct. App. 1985) .......16 9 Herr v. Nestlé U.S.A., Inc., 109 Cal. App. 4th 779, 135 Cal. Rptr. 2d 477 (Cal. Ct. App. 2003)..............................15 10 Huong Que, Inc. v. Luu, 11 150 Cal. App. 4th 400, 58 Cal. Rptr. 3d 527 (Cal. Ct. App. 2007) ......................6, 15-16 12 Kasky v. Nike, Inc., 27 Cal. 4th 939, 45 P.3d 243 (2002) .......................................................5, 6 13 Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 63 P.3d 937 (2003) ...............15 14 L. Byron Culver & Assocs. v. Jaoudi Indus. & Trading Corp., 1 Cal. App. 4th 300, 1 Cal. Rptr. 2d 680 (Cal. Ct. App. 1991) .......................................7 15 Maria P. v. Riles, 43 Cal. 3d 1281, 743 P.2d 932 (1987)............................................................8 16 Moore v. Regents of Univ. of Cal., 51 Cal. 3d 120, 271 Cal. Rptr. 146 (1990)...........................7 17 Outboard Marine Corp. v. Superior Court, 18 52 Cal. App. 3d 30, 124 Cal. Rptr. 852 (Cal. Ct. App. 1975)..........................................6 19 S. Christian Leadership Conference v. Al Malaikah Auditorium Co., 230 Cal. App. 3d 207, 281 Cal. Rptr. 216 (Cal. Ct. App. 1991)......................................8 20 Stevens v. Marco, 147 Cal. App. 2d 357, 305 P.2d 669 (Cal. Ct. App. 1956).............................6 21 Twomey v. Mitchum, Jones & Templeton, Inc., 22 262 Cal. App. 2d 690, 69 Cal. Rptr. 222 (Cal. Ct. App. 1968) .......................................5 23 Other State Cases Page 24 Remsburg v. Docusearch, Inc., 149 N.H. 148, 816 A.2d 1001 (2003)......................................10 25 California Statutes Page 26 Cal. Civ. Code § 1780 (2007) ..................................................................................................15 27 Cal. Civ. Code § 1782 (2007) ....................................................................................................4 28 Cal. Civ. Code § 1785.11.2 (2007)...........................................................................................11 Motion for Preliminary Injunction and Class Certification x No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 11 of 37 1 2 California Statutes Table of Authorities Page 3 Cal. Bus. & Prof. Code § 17203 (2007) .........................................................................4, 15, 16 4 Cal. Bus. & Prof. Code § 17529 (2007).....................................................................................9 5 Miscellaneous Page 6 Richard W. Downing, Thinking Through Sentencing in Computer Hacking Cases: Did the U.S. Sentencing Commission Get It Right?, 76 Miss. L.J. 923 (2007) ......................9-10 7 H.R. Rep. No. 109-522 (2006) .............................................................................................9 8 ISP Planet, Top 21 U.S. ISPs by Subscriber: Q4 2006, at http://www.isp9 planet.com/research/rankings/usa.html (Apr. 12, 2007) ...............................................21 10 Manual for Complex Litigation § 21.24 (4th ed. 2004) ...........................................................19 11 S. Rep. No. 108-102 (2003) .................................................................................................8, 12 12 TD AMERITRADE Holding Corp., Form 10-K 31 (Dec. 12, 2006), available at http://edgar.sec.gov/Archives/edgar/data/1173431/000095013706013345/ 13 c10549e10vk.htm .........................................................................................................20 14 U.S. Census Bureau, California QuickFacts from the U.S. Census Bureau, at http://quickfacts.census.gov/qfd/states/06000.html (May 7, 2007)...............................20 15 U.S. Dep't of Justice, Former Officer of Internet Company Sentenced in Case of Massive 16 Data Theft from Acxiom Corporation, at http://www.usdoj.gov/criminal/cybercrime/levineSent.htm (Feb. 22, 2006)...................8 17 U.S. General Accounting Office, Identity Theft: Prevalence and Cost Appear to be Growing 18 55 (GAO-02-363 2002) .....................................................................................11, 12-13 19 William Shakespeare, The Tragedy of Hamlet, Prince of Denmark, act 1, sc. 4........................1 20 John K. Webb, Prosecuting Social Security Number Misuse: Attacking Identity Theft at its Source, 53 U.S. Att'ys Bull. 1, 1-2 (Jan. 2005), available at 21 http://www.usdoj.gov/usao/eousa/foia_reading_room/usab5301.pdf ...........................10 22 23 24 25 26 27 28 Motion for Preliminary Injunction and Class Certification xi No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 12 of 37 Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 13 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND CLASS CERTIFICATION Plaintiffs Matthew Elvey ("Elvey") and Gadgetwiz, Inc. ("Gadgetwiz"), respectfully files this Brief in Support of its Motion for Preliminary Injunction and Class Certification under Federal Rule of Civil Procedure 65. The gist of the allegations in Plaintiffs' First Amended Complaint ("FAC") is that TD AMERTRADE, Inc. ("Ameritrade") is disclosing, either deliberately or as a result of a security breach, its accountholders' email addresses to spammers. The FAC states claims for accountholders residing in California ("California Resident Class") and domain name/email service providers for Ameritrade accountholders which received spam because of Ameritrade's disclosure ("CAN SPAM Class"). Plaintiffs' evidence indicates that Ameritrade has disclosed the email addresses of its accountholders. Although Plaintiffs do not have access to evidence which directly shows how the disclosures occurred, the fact that the disclosures occurred at all is evidence that "[s]omething is rotten in the state of Denmark" sufficient to justify Plaintiffs' injunction. William Shakespeare, The Tragedy of Hamlet, Prince of Denmark, act 1, sc. 4.1 I. Plaintiffs' Evidence Mandates Urgent Action The Ninth Circuit has provided two tests for preliminary injunctive relief under Federal Rule 65. The traditional criteria are 1) likelihood of success on the merits, 2) risk of irreparable injury without a preliminary injunction, 3) a balance of hardships favoring the movant, and 4) advancement of the public interest. Save Our Sonoran, Inc. v. Flowers, 408 F.3d 1113, 1120 (9th Cir. 2005). Alternatively, the movant may demonstrate "either a combination of probable success on the merits and the possibility of irreparable injury or that 1 "A preliminary injunction is customarily granted on the basis of procedures that are less formal and evidence that is less complete than in a trial on the merits. A party thus is not required to prove his case in full at a preliminary-injunction hearing . . ." Univ. of Tex. v. Camenisch, 451 U.S. 390, 394-95 (1981) . "The urgency of obtaining a preliminary injunction necessitates a prompt determination and makes it difficult to obtain affidavits from persons who would be competent to testify at trial. The trial court may give even inadmissible evidence some weight. . . " Flynt Distrib. Co. v. Harvey, 734 F.2d 1389, 1394 (9th Cir. 1984) (quoted by Republic of Philippines v. Marcos, 862 F.2d 1355, 1363 (9th Cir. 1988) ). See also Premier Nutrition, Inc. v. Organic Food Bar, Inc., 475 F. Supp. 2d 995, 1000 n.1 (C.D. Cal. 2007) (inadmissible hearsay was evidentiary ground for preliminary injunction). Motion for Preliminary Injunction and Class Certification 1 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 14 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 serious questions are raised and the balance of hardships tips sharply in his favor." Id. (emphasis in original, citations omitted). "These two formulations represent two points on a sliding scale in which the required degree of irreparable harm increases as the probability of success decreases. They are not separate tests but rather outer reaches of a single continuum." Id. This brief establishes that Elvey is likely to succeed on his claims, that there is a risk of irreparable harm without the sought preliminary injunction, that the absence of the requested relief prejudices Elvey and the California Resident Class worse than the relief will prejudice Ameritrade, and that the public interest favors the injunctive relief sought. A. Ameritrade Disclosed Its Accountholders' Email Addresses to Spammers It is apparent that Ameritrade has disclosed its accountholders' email addresses to spammers. Elvey and one of Gadgetwiz user's, Joel Griffiths ("Griffiths"), are accountholders at Ameritrade. (Elvey Decl. ¶ 1; Griffiths Decl. ¶ 1.) Elvey and Griffiths provided a series of email addresses to Ameritrade, and subsequently received spam at these email addresses. (Elvey Decl. ¶¶ 2, 3; Griffiths Decl. ¶¶ 2, 3.) These spam are exclusively stock spam (authenticated, redacted copies are attached as Exhibits A and B): the spam encourages its recipients to purchased the stock of touted companies. Elvey and Griffiths should not have received this spam. The persons who sent the spam could have only obtained their email addresses from Elvey and Griffiths, or Ameritrade, and neither Elvey nor Griffiths disclosed these email addresses any person other than Ameritrade (except their counsel). (Elvey Decl. ¶ 2; Griffiths Decl. ¶ 2.) However, as discussed below, the disclosure of Elvey and Griffiths' email addresses by Ameritrade violates the February 2007 Privacy Statement published at Ameritrade's website (attached as Exhibit C) which purports to be the authoritative statement on Ameritrade's practices with respect to accountholders' personal information. Elvey and Griffiths' situation is not unique. On May 30, Plaintiffs' counsel found an article (a copy of which is attached as Exhibit D) on Slashdot (a prominent online forum for technology and technology policy news) indicating that many other Ameritrade accountholders had received spam at unique emails provided only to Ameritrade. (Ex. D 1-3, 6, 11, 19-20.) See Slashdot, Who's Trading Your E-mail Addresses?, at Motion for Preliminary Injunction and Class Certification 2 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 15 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 http://yro.slashdot.org/yro/07/05/30/1444236.shtml (May 30, 2007). Subsequently, Plaintiffs' counsel's performed several Internet searches which located other reported accounts (copies of which are attached as Exhibits E, F and G) which are consistent with Elvey and Griffiths' declarations. See Bill Katz, TD Ameritrade data definitely compromised, at http://www.billkatz.com/node/77 (last modified May 31, 2007), news.admin.net-abuse.email, Ameritrade Spam Again, at http://groups.google.com.fj/group/news.admin.netabuse.email/browse_thread/thread/de64222d0929c6b4/a402bc49558f7330 (July 28, 2006), and NetworkWorld, Ameritrade leaks and more Wi-Fi theft, at http://www.networkworld.com/columnists/2007/053107-backspin.html (May 31, 2007). As more accountholders report disclosing unique email addresses to Ameritrade and receiving spam at those email addresses, the probability that Ameritrade is not responsible for the disclosure of these email addresses approaches zero. At this point, it is extremely implausible that spammers independently obtained each of the email addresses involved in the public reports described above.2 B. Ameritrade Has Been Unable or Unwilling to Explain How It Disclosed Email Addresses to Spammers The only remaining alternative is that Ameritrade has disclosed the email addresses of 18 Elvey, Griffiths, and the other Ameritrade accountholders. Ameritrade's communications 19 buttress this conclusion. The Slashdot article links to a forwarded email (a copy of which is 20 attached as Exhibit H) from Ameritrade responding to an accountholder's inquiry about spam 21 and indicates that response was identical to Ameritrade's response the Slashdot author's own 22 inquiry. (Ex. D 2.) Ameritrade's response to accountholder inquiries regarding spam states: 23 24 25 We understand your concern and frustration over the spam e-mail you've received, and we want you to know that we take your privacy and security seriously. We will continue to do all we can to protect both. Our investigation into this issue is ongoing. We've recently expanded the directions in which 2 Preliminary injunctions have been entered on similar hearsay evidence, where the applicable 26 evidentiary standards are less demanding. See Metro Publ'g, Inc. v. Surfmet, Inc., No. 0201833, 2002 U.S. Dist. LEXIS 26232, at *10-11 & n.4 (N.D. Cal. July 3, 2002) (preliminary 27 injunction based on declarations, overruled admissibility objections); Burnham v. Rohnert Park, No. 92-1439, 1992 U.S. Dist. LEXIS 8540, at *2 n.2 (N.D. Cal. May 18, 1992) 28 (preliminary injunction based on declaration, overruled objections to hearsay, incompetence, or opinion). Motion for Preliminary Injunction and Class Certification 3 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 16 of 37 1 2 we're investigating, and have doubled our efforts in both internal and external investigations. We're looking at our own systems, and working closely with our vendors to examine theirs. . . . 3 (Ex. H 1) (emphasis added). Ameritrade has acknowledged that it is conducting an ongoing 4 investigation into the possibility of a information security breach. Such an investigation would 5 necessarily consider both rogue insiders (such as employees or partner firms), as well as 6 outside intruders. 7 Collectively, the evidence available to Plaintiffs strongly suggests that Ameritrade is 8 unable to control or prevent the disclosure of accountholder email addresses. The alternative is 9 that Ameritrade has deliberately and willfully disclosed email addresses. While Plaintiffs 10 cannot discount this explanation without discovery, Plaintiffs and their counsel are operating 11 on the assumption that there is an ongoing, systematic security breach at Ameritrade. 12 13 14 C. Unauthorized Disclosure of Plaintiff Elvey's Email Address Creates a Likelihood that He Will Prevail on His Claims, Irrespective of Whether the Disclosure Was Deliberate or Unintentional Elvey is likely to prevail on his claims under California's Consumer Legal Remedies 15 Act ("CLRA") (Cal. Civ. Code § 1782(a)) and Unfair Competition Law ("UCL") (Cal. Bus. & 16 Prof. Code § 17203), and for breach of fiduciary duty. 17 The disclosure of accountholder email addresses violates the Privacy Statement 18 published at Ameritrade's website. The Privacy Statement states "TD AMERITRADE does 19 not sell, license, lease or otherwise disclose your personal information to any third party for 20 any reason" subject to certain exceptions not applicable here.3 (Ex. C. 3.) This statement is not 21 consistent with an ongoing security breach at Ameritrade in which third parties regularly 22 obtain accountholders' email addresses, and such a security breach renders the Privacy 23 24 25 26 27 28 3 The Privacy Statement indicates that Ameritrade may share personal information "with affiliates if the information is required to provide the product or service [accountholders] have requested or to provide [accountholders] the opportunity to participate in the products or services our affiliates offer." (Ex. C. 2.) Also, the Privacy Statement also indicates that Ameritrade may share information in "partnerships and alliances, which may include joint marketing agreements, with other companies who offer high-quality products and services that might be of value to our clients" in order "to ensure that these products and services meet [accountholders'] needs and are delivered in a manner that is useful and relevant." (Id. 2.) With respect Ameritrade's affiliates, alliances and partners, the Privacy Statement indicates that Ameritrade "require[s] that it be identified that an offer is being extended because of the relationship with us." (Id. 2-3.) The spam does not indicate that the spammers have a relationship with Ameritrade. (Cf. Exs. A, B.) Motion for Preliminary Injunction and Class Certification 4 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 17 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Statement false and misleading. As the representations in the Privacy Statement are false and misleading, they are a sufficient basis for Elvey's CLRA and UCL claims, irrespective of whether it was unintentional, inadvertent, or deliberate. Elvey's claim under the UCL only requires "that members of the public are likely to be deceived." Kasky v. Nike, Inc., 27 Cal. 4th 939, 951, 45 P.3d 243, 250 (2002) (citations omitted). "The UCL imposes strict liability [on] conduct that constitutes an unfair business practice." Cortez v. Purolator Air Filtration Prods. Co., 23 Cal. 4th 163, 181, 999 P.2d 706, 717 (2000). "Allegations of actual deception, reasonable reliance, and damage are unnecessary" for UCL claims. Comm. on Children's TV v. General Foods Corp., 35 Cal. 3d 197, 211, 673 P.2d 660, 668 (1983). The liability standard applicable to UCL claims also applies to claims under the CLRA. Consumer Advocates v. Echostar Satellite Corp., 113 Cal. App. 4th 1351, 1360, 8 Cal. Rptr. 3d 22, 29 (Cal. Ct. App. 2003) (cited by Colgan v. Leatherman Tool Group, Inc., 135 Cal. App. 4th 663, 680, 38 Cal. Rptr. 3d 36, 46 (Cal. Ct. App. 2006)). "Conduct that is `likely to mislead a reasonable consumer' thus violates the CLRA." Colgan, 135 Cal. App. 4th at 680, 38 Cal. Rptr. 3d at 46. Ameritrade is liable for disclosing the California Class members' email addresses even without regard to the Privacy Statement. As a stock broker, Ameritrade is a fiduciary of its accountholders. Duffy v. Cavalier, 215 Cal. App. 3d 1517, 1534-35, 751-52 (Cal. Ct. App. 1989) (cited by Rosenthal v. Great W. Fin. Sec. Corp., 14 Cal. 4th 394, 425-26, 926 P.2d 1061, 1080 (1996) ); Twomey v. Mitchum, Jones & Templeton, Inc., 262 Cal. App. 2d 690, 708-09, 69 Cal. Rptr. 222, 235-36 (Cal. Ct. App. 1968). One of Ameritrade's fiduciary duties is to "not to use or communicate confidential information of the principal for the agent's own purposes or those of a third party." Huong Que, Inc. v. Luu, 150 Cal. App. 4th 400, 416, 58 Cal. Rptr. 3d 527, 540 (Cal. Ct. App. 2007) (quoting Restatement of Agency (Third) § 8.05 (2006)). See also Balboa Ins. Co. v. Trans Global Equities, 218 Cal. App. 3d 1327, 1344 & n.20, 267 Cal. Rptr. 787, 797 & n.20 (Cal. Ct. App. 1990) (elements of breach of confidence); Bank of Am. Nat'l Trust & Sav. Assoc. v. Ryan, 207 Cal. App. 2d 698, 706, 24 Cal. Rptr. 739, 744 (Cal. Ct. App. 1962) (fiduciary "who acquires confidential information in the course of his employment Motion for Preliminary Injunction and Class Certification 5 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 18 of 37 1 2 3 4 5 6 7 8 9 . . . has a duty not to use it to the disadvantage of the principal"); Stevens v. Marco, 147 Cal. App. 2d 357, 372-74, 305 P.2d 669, 678-79 (Cal. Ct. App. 1956) (breach of fiduciary duty by disclosure of confidential information). Likewise, the Privacy Statement represents that: All third parties with which we share personal information are required to protect personal information in a manner similar to the way we protect personal information. . . We have made a significant investment in leading-edge security software, systems, and procedures to offer you a safe and secure trading environment and protect your personal, financial and trading information. While no security system is absolutely impenetrable, we are constantly reviewing, refining and upgrading our security technology, as new tools become available. 10 (Ex. A 3-4.) These statements are misleading inasmuch as the Privacy Statement omits 11 mention of Ameritrade's investigation into the possibility of an ongoing security breach. The 12 UCL and CLRA prohibit misleading omissions of material facts, not just affirmative 13 misrepresentations. Kasky, 27 Cal. 4th at 951, 45 P.3d at 250 (UCL prohibits representations 14 which "although true, is either actually misleading or which has a capacity, likelihood or 15 tendency to deceive or confuse the public"); Outboard Marine Corp. v. Superior Court, 52 16 Cal. App. 3d 30, 38, 124 Cal. Rptr. 852, 857 (Cal. Ct. App. 1975) (CLRA prohibits omission 17 of material facts, cited by Bardin v. DaimlerChrysler Corp., 136 Cal. App. 4th 1255, 1276, 39 18 Cal. Rptr. 3d 634, 648 (Cal. Ct. App. 2006)). See also Chamberlan v. Ford Motor Co., 369 F. 19 Supp. 2d 1138, 1144-46 (N.D. Cal. 2005) (omitted disclosure of defects in non-metal 20 manifolds could violate UCL, CLRA). 21 Finally, Ameritrade's receipt of personal information from accountholders violates its 22 fiduciary duties to its accountholders, inasmuch as1) it is even now investigating the 23 possibility of an ongoing security breach and 2) the Privacy Statement fails to disclose either 24 the investigation or the possible security breach. Ameritrade's fiduciary duties include 25 26 27 full disclosure of all material facts within [its] knowledge relating to the transaction in question and any concealment of material facts [by a fiduciary] is a fraud. . . . Where there is [such] a duty to disclose, the disclosure must be full and complete, and any material concealment or misrepresentation will amount to fraud sufficient to entitle the party injured thereby to an action. 28 Estate of Sanders, 40 Cal. 3d 607, 616, 710 P.2d 232, 237 (1985) (citations, punctuation Motion for Preliminary Injunction and Class Certification 6 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 19 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 omitted). "An agent has a fiduciary duty to the principal to disclose all information in the agent's possession relevant to the subject matter of the agency." L. Byron Culver & Assocs. v. Jaoudi Indus. & Trading Corp., 1 Cal. App. 4th 300, 304, 1 Cal. Rptr. 2d 680, 682 (Cal. Ct. App. 1991) (citing Sierra Pac. Indus. v. Carter, 104 Cal. App. 3d 579, 581-83, 163 Cal. Rptr. 764, 766 (Cal. Ct. App. 1980)). See also Moore v. Regents of Univ. of Cal., 51 Cal. 3d 120, 129, 271 Cal. Rptr. 146, 150 (1990) (fiduciary has "duty to disclose all information material to the patient's decision," citing, e.g., Nelson v. Gaunt, 125 Cal. App. 3d 623, 634, 178 Cal. Rptr. 167, 172 (Cal. Ct. App. 1981)). Elvey and the California Resident Class are also entitled to disclosure of all material facts on the purchase of stocks that Ameritrade knows have been touted by spam. The fact that spammers are seeking to inflate the value of stock is material to the accountholders' decision to purchase the stock, and Ameritrade plainly has a duty to disclose such material facts. It is important to remember that Ameritrade earns commissions on trades induced by this stock spam. The misleading statements and omissions in the Privacy Statement (and the material omission that spammers have manipulated particular spammed stocks) are sufficient basis to conclude that Elvey will prevail in his claims. D. Disclosure of Accountholders' Personal Information Threatens Irreparable Harm As a matter of California law, Ameritrade's continued violation of the CLRA and UCL 21 ­ by disclosing email addresses to spammers, failing to disclosing its investigation or the 22 possible security breach, or manipulation of stock value by spammers ­ constitutes irreparable 23 harm. "[P]laintiffs are not required to wait until they have suffered actual harm before they 24 apply for an injunction, but may seek injunctive relief against the threatened infringement of 25 their rights." Maria P. v. Riles, 43 Cal. 3d 1281, 1292-93, 743 P.2d 932, 938 (1987); S. 26 Christian Leadership Conference v. Al Malaikah Auditorium Co., 230 Cal. App. 3d 207, 224, 27 281 Cal. Rptr. 216, 227 (Cal. Ct. App. 1991). Further, a presumption of irreparable injury 28 applies when there is a "substantial showing of prospective violation of California statutes" Motion for Preliminary Injunction and Class Certification 7 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 20 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 such as the UCL and CLRA. Cal. Ass'n of Dispensing Opticians v. Pearle Vision Ctr., 143 Cal. App. 3d 419, 434, 191 Cal. Rptr. 762, 772 (Cal. Ct. App. 1983). See also Vision Sports, Inc. v. Melville Corp., 888 F.2d 609, 612 n.3 (9th Cir. 1989) (in unfair competition actions, "once the plaintiff establishes a likelihood of confusion, it is ordinarily presumed that the plaintiff will suffer irreparable harm if injunctive relief is not granted"). Plaintiffs do not rely solely on formulaic points of law. When email addresses are leaked to spammers, the damage is irreparable: once accountholders' email addresses are known to spammers, those email addresses will never again be spam-free. Moreover, in most situations, accountholders will not be able successfully identify the spammers ­ let alone successfully claim damages from them in a lawsuit. S. Rep. No. 108-102, at 5 (2003) (Congressional testimony that 90 percent of all of the spam sent worldwide is ``untraceable'' to its actual source). See also U.S. Dep't of Justice, Former Officer of Internet Company Sentenced in Case of Massive Data Theft from Acxiom Corporation, at http://www.usdoj.gov/criminal/cybercrime/levineSent.htm (Feb. 22, 2006) (defendant stole more than one billion records containing names, physical and e-mail addresses, as well as phone numbers from data broker, and resold some data to another broker for use in an ad campaign).4 Thus, most accountholders will be unable trace particular spam back to Ameritrade's disclosure of their email address, and hence unable to calculate their damages from Ameritrade's disclosure. Where "[t]here is no way to calculate the value of" of the movant's damages, a movant for preliminary injunction has no adequate legal remedies and irreparable harm exists. Walters v. Reno, 145 F.3d 1032, 1048 (9th Cir. 1998). "[W]here the threat of injury is imminent and the measure of that injury defies calculation, damages will not provide a remedy at law." Gilder v. PGA Tour, Inc., 936 F.2d 417, 423 (9th Cir. 1991). See also Rent-A-Center, Inc. v. Canyon Television & Appliance Rental, Inc., 944 F.2d 597, 603 (9th Cir. 1991) (where "damages would be difficult to valuate," they "constituted possible 4 Westpac Audiotext, Inc. v. Wilks, 756 F. Supp. 1267, 1268-69 (N.D. Cal. 1991), vacated on other grounds, 804 F. Supp. 1225 (N.D. Cal. 1992) (under loosened evidentiary standards 28 applicable in preliminary injunction, legislative history was evidentiary grounds for preliminary injunction). Motion for Preliminary Injunction and Class Certification 8 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 21 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 irreparable harm"). This is especially true where much of the damages from spam are noneconomic. Cal. Bus. & Prof. Code § 17529(e) (2007) ("spam . . . discourages people from using e-mail"); Ferguson v. Friendfinders, 94 Cal. App. 4th 1255, 1267, 115 Cal. Rptr. 2d 258, 267 (Cal. Ct. App. 2002) (spam consumes the time of recipients "required to sort, read, discard and attempt to prevent future" spam). More critically, however, Ameritrade collects not only email addresses from accountholders, but other, more sensitive personal information. It unlikely that Ameritrade failed to protect accountholders' email addresses from disclosure but managed to protect their names and Social Security numbers. Certainly, Ameritrade has not offered any evidence to Plaintiffs to support this inference. Consequently, an ongoing security breach at Ameritrade threatens accountholders with a much more grave irreparable harm than spam ­ the risk of identity theft. Like email addresses, Social Security numbers can be traded and retraded among identity thieves once they are disclosed: [O]rganized criminals have increasingly turned to computer crime to engage in identity theft and financial fraud. . . . The criminal organizations traffic this information through underground websites on the Internet, creating a black market in cyberspace for stolen personal and finan cial information. Some of these identity thieves advertise that they have access to literally millions of stolen credit card and bank records for sale. . . . A year-long Secret Service investigation of the ``Shadowcrew'' organization led to the indictment of 27 U.S. and foreign persons involved in an organized identity theft and financial fraud ring. According to government estimates, the members of the Shadowcrew organization trafficked in at least 1.5 million stolen credit and bank card numbers, and caused an estimated $40 million in losses. A recent investigation by U.S. and U.K. authorities of the website ``carderplanet.net'' revealed that the site boasted nearly 7,000 members and served as a marketplace for millions of stolen bank and credit card accounts. 22 H.R. Rep. No. 109-522, at 5-6 (2006). Where an "intruder copies digital information" the 23 privacy invasion may be the "most salient harm"; "where a hacker sells identity information 24 on the black market. . . .the severity of the harm increases dramatically." See Richard W. 25 Downing, Thinking Through Sentencing in Computer Hacking Cases: Did the U.S. Sentencing 26 Commission Get It Right?, 76 Miss. L.J. 923, 937-38 (2007) (citing U.S. Dep't of Justice, Six 27 Defendants Plead Guilty in Internet Identity Theft and Credit Card Fraud Conspiracy, at 28 http://www.cybercrime.gov/mantovaniPlea.htm (Nov. 17, 2005), which describes an black Motion for Preliminary Injunction and Class Certification 9 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 22 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 market for misappropriated identity documents, credit and bank card numbers, and email addresses). The threat of identity theft is so prevalent and foreseeable that at least one court has imposed a duty of care on data brokers which disclose personal information to clients. Remsburg v. Docusearch, Inc., 149 N.H. 148, 153-55, 816 A.2d 1001, 1006-08 (2003). Social Security numbers are vastly more difficult to change than email addresses, and the potential costs of misappropriation of Social Security number are correspondingly greater: The extent of the threat to individual privacy is readily apparent when considering that the SSN is used as an identification code that brings individuals into contact for everyday communication with databases containing a wide range of financial, medical, educational, and credit information. Once obtained by an identity thief, the SSN opens practically every door related to a person's identity and personal history and completely compromises an individual's personal privacy. . . . Identity theft occurs when an individual steals another individual's personal identifying information and uses it fraudulently. It is a crime that can affect all Americans. SSNs and other personal information, for example, are used to fraudulently obtain credit cards, open utility accounts, access existing financial accounts, commit bank fraud, file false tax returns, and falsely obtain employment and government benefits. The SSN plays an important role in identity theft because it is used as breeder information to create additional false identification documents . . . 15 John K. Webb, Prosecuting Social Security Number Misuse: Attacking Identity Theft at its 16 Source, 53 U.S. Att'ys Bull. 1, 1-2 (Jan. 2005), available at 17 http://www.usdoj.gov/usao/eousa/foia_reading_room/usab5301.pdf. Again, it will typically be 18 impossible for accountholders to trace any particular instance of identity theft back to 19 Ameritrade's disclosure of their personal information, and therefore their legal remedy is 20 inadequate because they will generally not be able to calculate their damages. Stollenwerk v. 21 Tri-West Healthcare Alliance, No. 03-0185, 2005 U.S. Dist. LEXIS 41054, at *15-21 (D. Ariz. 22 Sept. 28, 2005) (evidence of six instances of identity theft against plaintiff beginning six 23 weeks after defendant suffered security breach was not sufficient to survive motion for 24 summary judgment). Indeed, someone used Elvey's name and Social Security number to open 25 a cellular phone account and incurred $2,500 in charges in 2006. (Elvey Decl. ¶ 4.) Elvey has 26 no adequate legal remedy for this claim, because he has no way to prove that his information 27 was obtained from Ameritrade. (Id.) Like spam, identity theft imposes significant non28 monetary damages on its victims, including denial of credit or other financial services, time Motion for Preliminary Injunction and Class Certification 10 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 23 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 lost to resolve the problems, harassment by creditors, and even criminal investigation, arrest, or conviction. U.S. General Accounting Office, Identity Theft: Prevalence and Cost Appear to be Growing 55 (GAO-02-363 2002). Further, other members of the California Resident Class may be victims of identity theft due to personal information obtained from Ameritrade ­ but not even know it. Plainly, these accountholders cannot have an adequate legal remedy if they do not even know their claim exists. Where accountholders' legal claims with respect to Ameritrade's disclosure of email addresses or other personal information face insurmountable barriers, those legal claims are inadequate ­ and the accountholders face irreparable harm. Consequently, it is critical that Ameritrade act to protect accountholders ­ by disclosing its internal investigation and the possibility of a security breach, providing an accounting of California Resident Class members' personal information and implementing reasonable security measures (or sequestering that information). The disclosure of the possible security breach is imperative because it will give California Resident Class members the opportunity to place a security freeze on their credit report ­ which will hamper any efforts at identity theft. See Cal. Civ. Code § 1785.11.2 (2007) (identity freeze legislation). Further, accountholders who purchase spammed stocks also face irreparable harm, because they will generally be unable to calculate the damage caused by Ameritrade's failure to disclose that particular stocks were manipulated by spammers. E. Balance of Hardships and Public Interest Favor Relief Sought in Motion The balance of hardships between Ameritrade, and Plaintiffs, the California Class Members and the public interest, tips sharply in favor of the injunction. Ameritrade should not be heard to complain of the costs of either complying with its Privacy Statement or amending the Privacy Statement so that it is not misleading, and the relief sought in the Motion imposes few out-of-pocket costs on Ameritrade. Ceasing any voluntary disclosure of accountholder email addresses will not burden Ameritrade at all. Ameritrade's out-of-pocket costs for disclosing its investigation into a possible ongoing security breach, or alerting accountholders who try to purchase stock that is being manipulated by spam, are negligible. Ameritrade's own Motion for Preliminary Injunction and Class Certification 11 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 24 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 internal investigation should subsume the costs involved in setting up token email addresses to detect stock spam sent to its accountholders, and many or most of the costs associated with providing an accounting of the California Resident Class members' personal information and Ameritrade's information systems. Conversely, many parties, not just accountholders, face potentially grave burdens if the injunction does not issue. Without the injunction, it is plain that Ameritrade will continue to contribute (whether intentionally or not) to the societal problems spam imposes. Spam imposes significant economic burdens on ISPs, consumers, and businesses. Left unchecked at its present rate of increase, spam may soon undermine the usefulness and efficiency of e-mail as a communications tool. Massive volumes of spam can clog a computer network, slowing Internet service for those who share that network. ISPs must respond to rising volumes of spam by investing in new equipment to increase capacity and customer service personnel to deal with increased subscriber complaints. ISPs also face high costs maintaining e-mail filtering systems and other antispam technology on their networks to reduce the deluge of spam. Increasingly, ISPs are also undertaking extensive investigative and legal efforts to track down and prosecute those who send the most spam, in some cases spending over a million dollars to find and sue a single, heavy-volume spammer. 15 S. Rep. No. 108-102, at 6. The Senate report cites two studies: one estimated that spam costs 16 Internet subscribers worldwide $9.4 billion annually, and the other estimated that anti-spam 17 efforts increase the cost of an individual's Internet access service by an average of $2 per 18 month. Id. Still another study cited by the Senate report estimated that spam cost U.S. 19 businesses over $10 billion in 2003 from lost productivity, network system upgrades, 20 unrecoverable data, and increased personnel costs, and that the employee productivity losses 21 from sifting through and deleting spam accounted for nearly $4 billion alone. Id. at 7. 22 If Ameritrade has disclosed personal information besides email addresses, the potential 23 burdens imposed by the lack of an injunction become still more grave. One detailed study 24 indicates that the average identity theft victim estimated he or she spent 175 hours and $100 in 25 costs on resolving their identity theft-related problems , and suffered a loss of $808. U.S. 26 General Accounting Office, Identity Theft: Prevalence and Cost Appear to be Growing 60-61. 27 Identity theft imposes a high cost on the rest of society, as well. The majority of bank 28 respondents to a American Bankers Association survey regarded identity theft as one of the Motion for Preliminary Injunction and Class Certification 12 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 25 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 top three threats against deposit accounts and spend significant sums of money to prevent identity theft-related fraud. Id. at 41-42, 46-47. The Secret Service estimated its average cost for investigating an incident of identity theft was $15,000. Id. at 65. The Executive Office for U.S. Attorneys estimated the average cost of prosecuting white-collar criminals was $11,443. Id. at 66. Plainly, identity theft imposes high costs on our financial institutions and our justice system, and the public interest favors the mitigation of identity theft to the greatest extent possible. Nonetheless, this Motion presents an unusual set of equities to the Court. Ameritrade's counsel has stated to Plaintiffs' counsel that Ameritrade is investigating these matters, and has asserted that this investigation might be prejudiced if it were disclosed publicly. Although counsel held several phone conferences that have been largely productive, Ameritrade has not yet provide adequate evidence to support this assertion. Elvey cannot simply take Ameritrade at its word and delay until Ameritrade deems its investigation complete (especially where Ameritrade has already publicly disclosed the fact of the internal investigation). (See Exs. D, E, F, G, and I.) As it stands, the parties have not been able to complete a Rule 26(f) conference, and so Plaintiffs have not propounded any discovery to test Ameritrade's claims. See Fed. R. Civ. P. 26(d). However, Elvey and the other California Resident Class members have as much interest in Ameritrade's investigation concluding successfully as Ameritrade itself, and Elvey does not dispute that Ameritrade may yet present persuasive evidence that its investigation (or certain aspects of the investigation) require or will benefit from a degree of confidentiality. Elvey and his counsel have repeatedly indicated they would enter into an appropriate confidentiality agreement if Ameritrade presented such evidence (as related in an email to Ameritrade's counsel, attached as Exhibit I)). (Ex. I 1.) Ultimately, Plaintiffs may alter or narrow the remedies sought in the Motion as Ameritrade produces more information in its response. F. The Court Should Impose No Bond or a Minimal Bond Federal Rule of Civil Procedure 65(c) requires that a movant for a preliminary injunction give "security . . . in such sum as the court deems proper" before any preliminary Motion for Preliminary Injunction and Class Certification 13 No. C 07 2852 MJJ Case 3:07-cv-02852-MJJ Document 11 Filed 07/10/2007 Page 26 of 37 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 injunction issues. Fed. R. Civil P. 65(c). Rule 65(c) "invest[s] the district court with discretion as to the amount of security required, if any." Barahona-Gomez v. Reno, 167 F.3d 1228, 1237 (9th Cir. 1999) (citing three other circuit court cases); Justin v. City of Los Angeles, No. 0012352, 2000 U.S. Dist. LEXIS 17881, at *6-7 (C.D. Cal. Dec. 5, 2000) (bonds under Rule 65(c) have "been dispensed with entirely where there was no proof of likelihood of harm to the party enjoined"). Consequently, the Ninth Circuit boasts "long-standing precedent that requiring nominal bonds is perfectly proper in public interest litigation." Save Our Sonoran, 408 F.3d at 1126. See also Walker v. Pierce, 665 F. Supp. 831, 843-44 (N.D. Cal. 1987) (waiving bond requirement for class representative). Elvey's status as class representative, his inability to absorb the expenses of a massive commercial empire like Ameritrade, and the public interest features of the relief sought all weigh in favor of a minimal bond, or no bond at all. (Cf. Elvey Decl. ¶ 5) (Elvey cannot afford a bond over $1,000) with Barahona-Gomez, 167 F.3d at 1237 (affirming district court's discretion to require only nominal bond of $1,000); Justin, 2000 U.S. Dist. LEXIS 17881, at *38 (where injunction on constitutional claim "pose[d] no risk of pecuniary injury . . . from being restrained and enjoined," class representative exempted from bond). II. The Preliminary Injunction Sought Is Carefully Tailored to Address the Ongoing Harm to the California Resident Class Elvey seeks for himself and the California Resident Class a preliminary injunction that 20 addresses the harms arising from the disclosure of email addresses and potential security 21 breach. The injunction accounts for two alternative possibilities: that the disclosure of email 22 addresses is deliberate, or that the disclosure of email addresses is unintentional and is

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?