Elvey v. TD Ameritrade, Inc.

Filing 26

Elvey v. TD Ameritrade, Inc.

Doc. 26

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 1 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

MAYER, BROWN, ROWE & MAW LLP LEE H. RUBIN (SBN 141331) SHIRISH GUPTA (SBN 205584) Two Palo Alto Square, Suite 300 Palo Alto, CA 94306 Telephone: [phone] Facsimile: [phone] [e-mail] [e-mail] Counsel for Defendant TD AMERITRADE, Inc.

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA ­ SAN FRANCISCO DIVISION MATTHEW ELVEY, an individual, and GADGETWIZ, INC., an Arizona corporation, on their own behalf and on behalf of all others similarly situated, Plaintiffs v. TD AMERITRADE, INC., a New York corporation, and DOES 1 to 100, Defendants. Case No. C-07-2852 MJJ OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION Judge Martin J. Jenkins Date: September 18, 2007 Time: 9:30 a.m. Location: Courtroom 11, 19th Floor 450 Golden Gate Ave. San Francisco, CA 94102

OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ Dockets.Justia.com

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 2 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 II. 4. 3. C. B.

TABLE OF CONTENTS Page INTRODUCTION ........................................................................................................................ 1 STATEMENT OF FACTS ........................................................................................................... 3 ARGUMENT ................................................................................................................................ 5 I. PLAINTIFFS ARE NOT ENTITLED TO INJUNCTIVE RELIEF................................. 5 A. Plaintiffs Have Failed To Show That There Is Even A Fair Chance That They Will Succeed On The Merits. .............................................................. 6 1. 2. 3. CLRA claim. ............................................................................................. 6 UCL claim. ................................................................................................ 8 Fiduciary duty claim. ................................................................................ 8

Plaintiffs Have Not Established An Irreparable Injury. ........................................ 9 1. 2. 3. Fear of future identity theft is too speculative to warrant injunctive relief. ...................................................................................... 10 Any injury from the receipt of spam e-mails is de minimis, at most. .................................................................................................... 12 Injury caused by spam-based securities manipulation is neither irreparable nor immediately threatened. ..................................... 13

Plaintiffs Have Not Shown A Need For The Preliminary Injunction Sought ................................................................................................................. 14 1. 2. A mandatory injunction requiring TD AMERITRADE to detect, identify, and disclose stock touted by spam should be denied ............... 14 A mandatory injunction requiring an "accounting" of TD AMERITRADE's systems and the implementation of protective measures determined by Plaintiffs' counsel should be denied ............... 17 A mandatory injunction requiring TD AMERITRADE to amend its Privacy Statement to make a disclosure concerning e-mails being leaked from the Company's computer systems should be denied. .................................................................................... 19 The prohibitory injunctions requested by Plaintiffs should be denied as unnecessary. ............................................................................ 21

THE COURT SHOULD DENY CLASS CERTIFICATION. ....................................... 21 A. Class Certification Is Unnecessary. .................................................................... 21 -iOPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 3 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 B.

TABLE OF CONTENTS (Continued) Page Class Certification Is Inappropriate. ................................................................... 22

CONCLUSION ........................................................................................................................... 24

- ii OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 4 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Cases

TABLE OF AUTHORITIES Page(s)

Abercrombie & Fitch Co. v. Moose Creek, Inc., 486 F.3d 629 (9th Cir. 2007) ........................... 5 Alaska v. Suburban Propane Gas Corp., 123 F.3d 1317 (9th Cir. 1997) ................................... 22 Alsup v. Montgomery Ward & Co., 57 F.R.D. 89 (N.D. Cal. 1972)) ......................................... 21 Atari Corp. v. Sega of Am., Inc., 869 F. Supp. 783 (N.D. Cal. 1994)................................... 16, 21 Beardslee v. Woodford, 395 F.3d 1064 (9th Cir. 2005)................................................................ 5 Cal. Ass'n of Dispensing Opticians v. Pearle Vision Ctr., Inc., 143 Cal. App. 3d 419 (4th Dist. 1983)............................................................................ 10 Caribbean Marine Servs. Co. v. Baldrige, 844 F.2d 668 (9th Cir. 1988) .................................... 9 Churchill Vill., L.L.C. v. Gen. Elec. Co., 169 F. Supp. 2d 1119 (N.D. Cal. 2000)............. 5, 6, 14 Cobell v. Kempthorne, 455 F.3d 301 (D.C. Cir. 2006) ................................................. 3, 6, 11, 12 Cobell v. Norton, 391 F.3d 251 (D.C. Cir. 2004) ....................................................................... 18 Colgan v. Leatherman Tool Group, Inc., 135 Cal. App. 4th 663 (2d Dist. 2006) ............ 9, 14, 19 County of Santa Clara v. Astra USA, Inc., 401 F. Supp. 2d 1022 (N.D. Cal. 2005) .................. 18 Credit Suisse First Boston Corp. v. Grunwald, 400 F.3d 1119 (9th Cir. 2005) ......................... 15 DeSciose v. Chiles, Heider & Co., 239 Neb. 195 (1991) ............................................................. 8 Duffy v. Cavalier, 215 Cal. App. 3d 1517 (1st Dist. 1989) .......................................................... 8 Forbes v. Wells Fargo Bank, N.A., 420 F. Supp. 2d 1018 (D. Minn. 2006)............................... 11 Geier v. Am. Honda Motor Co., 529 U.S. 861 (2000) ................................................................ 15 Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147 (1982) ................................................................. 22 Hanon v. Dataproducts Corp., 976 F.2d 497 (9th Cir. 1992)............................................... 22, 23 Hellon & Assocs., Inc. v. Phoenix Resort Corp., 958 F.2d 295 (9th Cir. 1992) ..................... 7, 20 Kamm v. Cal. City Dev. Co., 509 F.2d 205 (9th Cir. 1975)........................................................ 22 Key v. DSW, Inc., 454 F. Supp. 2d 684 (S.D. Ohio 2006) .......................................................... 11 L.A. Mem'l Coliseum Comm'n v. NFL, 634 F.2d 1197 (9th Cir. 1980) ................................. 5, 13 Leach v. City of San Marcos, 213 Cal. App. 648 (4th Dist. 1989) ............................................. 10 - iii OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 5 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Statutes and Rules Cases

TABLE OF AUTHORITIES (Continued) Page(s)

LGS Architects, Inc. v. Concordia Homes of Nev., 434 F.3d 1150 (9th Cir. 2006)...................... 6 Litton Indus., Inc. v. Chesapeake & Ohio Ry. Co., 129 F.R.D. 528 (E.D. Wis. 1990) ............... 17 Michaels v. Internet Entm't Group, Inc., 5 F. Supp. 2d 823 (C.D. Cal. 1998) ........................... 16 Preminger v. Principi, 422 F.3d 815 (9th Cir. 2005) ................................................................... 9 Quon v. Stans, 309 F. Supp. 604 (N.D. Cal. 1970) ....................................................................... 9 Randolph v. ING Life Ins. & Annuity Co., 486 F. Supp. 2d 1 (D.D.C. 2007) ...................... 11, 12 Remsburg v. Docusearch, Inc., 816 A.2d 1001 (N.H. 2003) ........................................................ 7 Rosenthal v. Great W. Fin. Sec. Corp., 14 Cal. 4th 394 (1996) ................................................... 8 Shields v. Smith, No. C-90-0349, 1991 WL 319032 (N.D. Cal. Nov. 4, 1991) .......................... 23 Smith v. Univ. of Wash. Law Sch., 2 F. Supp. 2d 1324 (W.D. Wash. 1998) .............................. 23 Stanley v. Univ. of S. Cal., 13 F.3d 1313 (9th Cir. 1994) ......................................................... 5, 9 Suzuki v. Hitachi Global Storage Techs., Inc., No. C 06-07289, 2007 WL 2070263 (N.D. Cal. July 17, 2007) ................................................................. 23 Twomey v. Mithcum, Jones & Templeton, Inc., 262 Cal. App. 2d 690 (1st Dist. 1968)............... 8 Univ. of Tex. V. Camenisch, 451 U.S. 390 (1981) ........................................................................ 6 Walker v. Woodford, 454 F. Supp. 2d 1007 (S.D. Cal. 2006) .................................................... 13 Woods v. Young, 53 Cal. 3d 315 (1991) ................................................................................. 7, 20 Zepeda v. INS, 753 F.2d 719 (9th Cir. 1985) .............................................................................. 22

Page(s)

17 C.F.R. § 248.1 et seq. ............................................................................................................... 4 15 U.S.C. § 78i............................................................................................................................ 15 15 U.S.C. § 78j............................................................................................................................ 15 15 U.S.C. § 78l(k) ....................................................................................................................... 15 15 U.S.C. § 78u ........................................................................................................................... 15 - iv OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 6 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Other Authorities Statutes and Rules

TABLE OF AUTHORITIES (Continued) Page(s)

15 U.S.C. § 78w .......................................................................................................................... 15 15 U.S.C. § 6801(b) ...................................................................................................................... 4 15 U.S.C. § 7706(g)(1) ............................................................................................................... 24 Cal. Bus. & Prof. Code § 17200 et seq. ........................................................................................ 7 Cal. Civ. Code § 1750 et seq......................................................................................................... 7 Cal. Civ. Code § 1798.82 .............................................................................................................. 7 Cal. Civ. Code § 1798.82(a) ......................................................................................... 2, 7, 19, 20 Cal. Civ. Code § 1798.82(e) ............................................................................................. 2, 19, 20 Fed. R. Civ. P. 23(a)(3) ......................................................................................................... 22, 24 Fed. R. Civ. P. 23(c)(1)(c), 2003 advisory committee note ........................................................ 22 Fed. R. Civ. P. 65 ........................................................................................................................ 18

Page(s)

Cal. Dep't of Consumer Affairs, Recommended Practices on Notice of Security Breach Involving Personal Information 12 (2007), available at http://privacyprotection.ca.gov/recommendations/secbreach.pdf .................................. 20 Petition for Commission Action to Protect the Investing Public from Unlawful and Deceptive Securities Promotions (Apr. 24, 2006), available at http://sec.gov/rules/petitions/petn4-519.pdf ................................................................... 15 Press Release, SEC Suspends Trading of 35 Companies Touted in Spam Email Campaign (Mar. 8, 2007), available at http://sec.gov/news/press/2007/2007-34.htm ............................................................. 5, 15 SEC, Be Alert When You Receive Spam E-mail or Faxes, www.sec.gov/answers/unsolicitedquotations.htm .......................................................... 16 SEC, The Investor's Advocate: How the SEC Protects Investors, www.sec.gov/about/whatwedo.shtml ............................................................................. 15

-vOPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 7 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

INTRODUCTION Plaintiffs' motion for preliminary injunction goes well beyond simply maintaining the status quo until the merits of this controversy can be decided. In effect Plaintiffs seek a

mandatory injunction, which would impose sweeping new obligations on TD AMERITRADE, Inc. ("TD AMERITRADE" or "the Company") without Plaintiffs having to prove their case. It is not surprising that Plaintiffs have attempted to side step the merits because the law and facts do not support the injunctive relief they seek. Plaintiffs have not cited a single analogous case from any jurisdiction in which a court has granted the type of injunction that Plaintiffs have requested here. Furthermore, Plaintiffs' argument for the necessity of a preliminary injunction is disingenuous. According to their complaint, they were aware of spamming events in October 2006. They waited more than seven months to even file this suit. Plaintiffs completely fail to satisfy their demanding burden to obtain a preliminary injunction. As discussed below, such an injunction requires proof of likely success on the merits, imminent irreparable injury, and hardships that outweigh those the injunction would impose on the respondent and third parties. Strong proof on one of these requirements can compensate for weaker proof on another. However, a plaintiff must establish at least a fair chance of success on the merits and at least the threat of imminent irreparable injury. In addition, where, as here, the bulk of Plaintiffs' requests for preliminary relief seek mandatory injunctive relief, Plaintiffs must show that the facts and the law clearly favor their position. Plaintiffs fail to make even the minimal showings of a fair chance of success and a threat of irreparable injury, much less meet the heightened standard required to obtain a mandatory injunction. First, Plaintiffs cannot demonstrate probable success on the merits of their claims. As discussed in the Company's Motion to Dismiss, none of those claims even state a cause of action. To take just one example, the claims on which Plaintiffs seek preliminary relief all allege that the Company's Privacy Statement misrepresented and omitted facts regarding the possibility of security breaches affecting customer personal information. But the Privacy Statement

expressly advises that "no security system is absolutely impenetrable." Hale Decl., Ex. 2. The -1OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 8 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Privacy Statement further advises that the Company has "made a significant investment in leading-edge security software, systems, and procedures to offer [its customers] a safe and secure trading environment and protect [its customers'] personal, financial and trading information" (id.), and Plaintiffs can demonstrate no evidence to the contrary. Plaintiffs simply have no cognizable claim that TD AMERITRADE made misleading representations or omissions or otherwise owed and breached any fiduciary duty. The utter lack of merit to Plaintiffs' claims, by itself, requires denial of the preliminary injunction Plaintiffs seek. Nor can Plaintiffs show imminent and irreparable injury required to obtain a preliminary injunction. All of their alleged injuries are too speculative, too insubstantial, or too unlikely in the immediate future to warrant a preliminary injunction, or could be addressed, if necessary, through money damages. For instance, Plaintiffs argue that they face the threat of irreparable injury due to identity theft. However, Plaintiffs offer no evidence, and the Company has no information, that any unauthorized person acquired "Sensitive Personal Information" from the Company that could give rise to identity theft, such as names linked to social security numbers ("SSN") or credit card numbers.1 Moreover, courts have uniformly held that where plaintiffs can only point to a speculative increased risk of future injury from identity theft, they do not state a claim as a matter of law, let alone have a sufficient basis for a preliminary injunction. Finally, the hardships the requested injunction would impose on TD AMERITRADE and third parties significantly outweigh the speculative and insubstantial injuries that Plaintiffs could suffer absent an injunction. For example, Plaintiffs offer no factual basis for proposing that the
1

Section 1798.82 of the California Civil Code provides that when certain specified personal information "was, or is reasonably believed to have been, acquired by an unauthorized person" a company must give notice to California resident customers to enable them to take steps to avoid identity theft if they deem it appropriate. Cal. Civ. Code § 1798.82(a). The specified information that triggers the notice requirement does not include customer e-mail addresses, which are the principal subject of Plaintiffs' motion. Instead, the sensitive personal information includes: "an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: (1) Social security number. (2) Driver's license number or California Identification Card number. (3) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account." Cal. Civ. Code § 1798.82(e). TD AMERITRADE intends to refer to the personal information that would trigger the notice requirement under California law when it uses the term "Sensitive Personal Information" in this brief. -2OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 9 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Company give notice to customers that the Company cannot assure the security of customer personal information and that, as a result, its customers are at risk of becoming victims of identity theft. Such notice, however, could seriously damage the Company's business and reputation. There is no evidence that Sensitive Personal Information that could give rise to identity theft has been acquired by unauthorized third parties. Furthermore, the public report on all aspects of the Company's information security systems that Plaintiffs demand would only increase the risk of future security breaches and place the Company at a significant competitive disadvantage since it would require that the Company reveal sensitive, confidential proprietary information to potential hackers and competitors. In addition, the Court should not enter a mandatory preliminary injunction ordering the Company to implement costly unspecified additional security measures, especially when such measures could actually degrade the Company's systems or unnecessarily interfere with the service it provides to customers. For each and all of these reasons, Plaintiffs' motion for preliminary injunction should be denied. STATEMENT OF FACTS In accord with the advice in TD AMERITRADE's Privacy Statement that "no security system is absolutely impenetrable," it is generally understood and courts have recognized that even a well-designed information security system is not immune to security breach. Indeed, the U.S. Court of Appeals for the D.C. Circuit recently observed, in vacating a preliminary injunction in a case involving an allegedly deficient information security system, that "`it is generally considered impossible to create a perfectly secure IT environment.'" Kempthorne, 455 F.3d 301, 315 (D.C. Cir. 2006). Nevertheless, federal securities regulators have developed standards to guide brokerage firms like TD AMERITRADE in their efforts to protect customer information. The GrammLeach-Bliley Act ("GLB Act") instructed financial institution regulators to "establish appropriate standards . . . relating to administrative, technical, and physical safeguards-- (1) to insure the security and confidentiality of customer records and information; (2) to protect against any -3OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Cobell v.

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 10 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

anticipated threats or hazards to the security or integrity of such records; and (3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer." 15 U.S.C. § 6801(b). Pursuant to the GLB Act, the Securities and Exchange Commission ("SEC") has promulgated Regulation S-P to guide broker-dealer efforts to ensure the security and confidentiality of customer information. 17 C.F.R. § 248.1 et seq. The SEC and the Financial Industry Regulatory Authority ("FINRA")2 examined TD AMERITRADE's information security systems in 2006 and 2007 and did not report any failures to comply with regulatory standards. Hale Decl. ¶¶ 3-4. After learning that unauthorized persons may have acquired some number of customer email addresses, TD AMERITRADE began an investigation to determine whether and how such information had been acquired. Id. ¶ 5. The Company is currently in the midst of evaluating newly discovered information and intends to confer further with its regulators regarding the matter. Id. ¶ 6.3 At this point in its investigation, the Company has found no evidence that an unauthorized person has acquired Sensitive Personal Information from its information systems that the Company believes could be used to commit identity theft. Id. ¶ 7. The Company has seen no pattern of increasing numbers of requests to restrict accounts due to identity theft from unknown sources. Id. ¶ 8. Furthermore, a stock spamming scheme is inconsistent with an identity theft scheme. Identity theft is a clandestine operation that depends on keeping the theft undiscovered, while stock spamming necessarily involves communicating with a potential trader or investor, thereby alerting recipients to possible theft of their information. Finally, although Plaintiffs have offered in connection with their motion customer complaints drawn from the Internet concerning stock spam, Plaintiffs have not submitted any evidence of identity theft linked in any way to the
2

FINRA is a self-regulatory organization that oversees its broker-dealer members. FINRA was formed in July 2007 through the consolidation of National Association of Securities Dealers ("NASD") and the member regulation, enforcement, and arbitration functions of the New York Stock Exchange. For the sake of consistency, this brief uses FINRA to refer to both FINRA and its NASD predecessor. 3 After the Company further evaluates its recent discoveries and has the opportunity to consult with its regulators, it anticipates seeking leave to file an updated statement of its position before the hearing of Plaintiffs' motion for preliminary injunction. -4OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 11 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Company, although it has been nearly one year since Plaintiffs claim that they began receiving stock spam. Turning to Plaintiffs' stock spam allegations, in the past, when the SEC has concluded that stock spam was being employed to artificially inflate the prices of a security, it has directed TD AMERITRADE to stop processing orders to trade that security and the Company has done so. Hale Decl. ¶ 9; Press Release, SEC Suspends Trading of 35 Companies Touted in Spam Email Campaign (Mar. 8, 2007), available at http://sec.gov/news/press/2007/2007-34.htm (last visited Aug. 17, 2007). ARGUMENT I. PLAINTIFFS ARE NOT ENTITLED TO INJUNCTIVE RELIEF. "A preliminary injunction is an extraordinary and drastic remedy, one that should not be granted unless the movant, by a clear showing, carries the burden of persuasion." Churchill Vill., L.L.C. v. Gen. Elec. Co., 169 F. Supp. 2d 1119, 1125 (N.D. Cal. 2000). To obtain a preliminary injunction, a movant must show either (1) a likelihood of success on the merits and the possibility of irreparable injury or (2) the existence of serious questions going to the merits and the balance of hardships tipping in the movant's favor. Abercrombie & Fitch Co. v. Moose Creek, Inc., 486 F.3d 629, 633 (9th Cir. 2007). "These two alternatives represent extremes of a single continuum, rather than two separate tests." Beardslee v. Woodford, 395 F.3d 1064, 1067 (9th Cir. 2005) (internal quotation marks omitted). Nonetheless, the movant must make the "irreducible minimum" showing "that there is a fair chance of success on the merits." Stanley v. Univ. of S. Cal., 13 F.3d 1313, 1319 (9th Cir. 1994) (internal quotation marks omitted). A failure to show a threatened imminent irreparable injury likewise precludes injunctive relief. L.A. Mem'l Coliseum Comm'n v. NFL, 634 F.2d 1197, 1202 (9th Cir. 1980) (finding that lower court "erred in issuing a preliminary injunction because there was no showing of irreparable injury"). A movant's effort to meet this already substantial burden is subject to "heightened scrutiny" where, as here, the movant seeks a "mandatory" injunction ordering the respondent to -5OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 12 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

affirmatively undertake certain conduct. Churchill Vill., 169 F. Supp. 2d at 1125. A mandatory preliminary injunction may not be granted "unless the facts and law clearly favor the moving party." Id. (internal quotation marks omitted). Indeed, mandatory preliminary relief is

"particularly disfavored" because the relief "goes well beyond simply maintaining the status quo"--the purpose of a preliminary injunction. LGS Architects, Inc. v. Concordia Homes of Nev., 434 F.3d 1150, 1158 (9th Cir. 2006); see also Univ. of Tex. v. Camenisch, 451 U.S. 390, 395 (1981) ("The purpose of a preliminary injunction is merely to preserve the relative positions of the parties until a trial on the merits can be held."). Plaintiffs cannot meet their burden under the conventional preliminary injunction standard, much less under the heightened standard for mandatory preliminary relief. A. Plaintiffs Have Failed To Show That There Is Even A Fair Chance That They Will Succeed On The Merits.

Plaintiffs argue that they are likely to prevail on the merits of their claims that TD AMERITRADE allegedly violated California's Consumer Legal Remedies Act ("CLRA"), California's Unfair Competition Law ("UCL"), and the Company's fiduciary duties to accountholders through various alleged misrepresentations and omissions in the Company's Privacy Statement. Pls.' Mot. at 4-7. The Company's Motion to Dismiss demonstrated, in detail, why Plaintiffs cannot prevail on those claims. Here, we only summarize the key points in that motion and further show that the factual record is devoid of support for Plaintiffs' claims. 1. CLRA claim.

Consider first Plaintiffs' CLRA claim. There has been no actionable misrepresentation or omission. Mot. to Dismiss at 11-13, 15. The Privacy Statement expressly states that "no security system is absolutely impenetrable." Hale Decl., Ex. 2. This statement is consistent with the generally accepted view that information security systems cannot be made perfectly secure. See, e.g., Cobell, 455 F.3d 315 ("it is generally considered impossible to create a perfectly secure IT environment"). No one could have reasonably thought that the Company was representing that customer data never could be acquired or used without authorization. -6OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Furthermore,

Plaintiffs offer no evidence that the Company has not carried through with its Privacy Statement

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 13 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

representation to have "made a significant investment in leading-edge security software, systems, and procedures to offer [its customers] a safe and secure trading environment and protect [its customers'] personal, financial and trading information." Hale Decl., Ex. 2. Accordingly, the unauthorized acquisition of customer e-mail information about which Plaintiffs complain does not render any aspect of the Company's Privacy Statement false or misleading. Nor does the CLRA impose an independent duty to disclose any such unauthorized acquisition of customer e-mail information. First, the Privacy Statement contains no statement or promise that the Company will notify customers of any and all unauthorized acquisition of customer information. Second, as discussed above, section 1798.82 of the California Civil Code does not require notice based upon the unauthorized acquisition of customer e-mail addresses or other information that does not constitute Sensitive Personal Information. Section 1798.82, as the more specific and more recent statute, controls over the CLRA.4 Cal. Civ. Code

§ 1798.82(a); Woods v. Young, 53 Cal. 3d 315, 324 (1991) ("a later, more specific statute controls over an earlier, general statute"); Hellon & Assocs., Inc. v. Phoenix Resort Corp., 958 F.2d 295, 297 (9th Cir. 1992) (when two statutes are inconsistent, generally, the later and more specific statute prevails). Notably, Plaintiffs have not pursued a claim under section 1798.82.5 Furthermore, to the extent the claim is directed at so-called "pump and dump" securities fraud schemes, federal law expressly and impliedly preempts Plaintiffs' CLRA claim because it alleges fraud in connection with securities transactions and would interfere with ongoing SEC efforts to combat spam-based pump-and-dump schemes. Mot. to Dismiss at 6-8. Likewise, the choice-of-law provision in the Client Agreements governing Plaintiffs' relationship with the Company requires that Nebraska law govern any dispute between the parties, foreclosing the CLRA claim. Mot. to Dismiss at 4-6. Finally, Plaintiffs have not even alleged, much less
4

Section 1798.82 was enacted in 2002 (Cal. Civ. Code § 1798.82), while the CLRA was enacted in 1970 (Cal. Civ. Code § 1750 et seq.) and the UCL was enacted in 1977 (Cal. Bus. & Prof. Code § 17200 et seq.). 5 Plaintiffs' passing reference to the duty of care that the New Hampshire Supreme Court placed on parties that sell personal information (in Remsburg v. Docusearch, Inc., 816 A.2d 1001 (N.H. 2003)) has no relevance here, where the Company did not sell any of the customer information at issue and Plaintiffs have made no showing that California follows New Hampshire law on this subject. -7OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 14 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

established, sufficient damage to satisfy the strict standing requirements of the CLRA. Mot. to Dismiss at 9-10. As we explain below, their alleged injuries are non-existent, thoroughly

speculative, or de minimis. See pp. 10-13, infra. 2. UCL claim.

Every one of the legal and factual infirmities of Plaintiffs' CLRA claim equally dooms Plaintiffs' UCL claim. There is no actionable misrepresentation or omission, federal law and the choice of law provision preempt the claim, and Plaintiffs lack standing to assert the claim. Mot. to Dismiss at 4-8, 13-15. In addition, Plaintiffs cannot pursue their UCL claim because the claim is based in part on an alleged scheme to manipulate securities prices and the UCL does not apply to securities transactions. Mot. to Dismiss at 15. 3. Fiduciary duty claim.

Like their CLRA and UCL claims, Plaintiffs' fiduciary duty claim fails because federal law preempts the claim and the Company simply did not make the misrepresentations and omissions through which Plaintiffs claim it breached its fiduciary duties Mot. to Dismiss at 6-8, 16. Furthermore, Plaintiffs simply have not established that they had the type of relationship with TD AMERITRADE that could give rise to a breach of fiduciary duty claim. Mot. to Dismiss at 16-18. A fiduciary relationship does not arise where a broker-dealer, such as TD AMERITRADE, simply processes unsolicited orders and does not provide advice to its accountholders regarding stocks. DeSciose v. Chiles, Heider & Co., 239 Neb. 195, 206 (1991). Even the California cases that Plaintiffs cite find that the scope of a broker's fiduciary duties are limited where it only processes orders. See Duffy v. Cavalier, 215 Cal. App. 3d 1517, 1535 (1st Dist. 1989) (noting scope of brokerage fiduciary duties limited where plaintiff simply placed unsolicited order); Rosenthal v. Great W. Fin. Sec. Corp., 14 Cal. 4th 394, 425-26 (1996) (finding no authority for extending fiduciary obligations of broker who just sold mutual funds to oral disclosure of arbitration provision); Twomey v. Mithcum, Jones & Templeton, Inc., 262 Cal. App. 2d 690 (1st Dist. 1968) (distinguishing between fiduciary duty owed where broker only processes unsolicited orders and duty owed where broker provides advice to customer). It is -8OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 15 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

undisputed that the Company's relationship with Plaintiffs extended no further than processing unsolicited orders. * * *

Plaintiffs have offered no evidence in support of their preliminary injunction motion that overcomes TD AMERITRADE's dismissal arguments or its factual showing that the Company has not made any misrepresentations or actionable omissions with respect to the protection and use of customer information or the promotion of stock through spam e-mails. Plaintiffs thus have failed to make even the "irreducible minimum" showing necessary to obtain a preliminary injunction: "that there is a fair chance of success on the merits." Stanley, 13 F.3d at 1319. And they certainly have not met their burden to prove that the facts and the law bearing on the merits of their claims clearly favor them, as required to obtain mandatory relief. Accordingly, the Court should deny their preliminary injunction motion for this reason alone. See id. at 1326 (district court properly denied mandatory relief where plaintiff did not make clear showing of success on the merits). B. Plaintiffs Have Not Established An Irreparable Injury.

"At a minimum, a plaintiff seeking preliminary injunctive relief must demonstrate that it will be exposed to irreparable harm." Caribbean Marine Servs. Co. v. Baldrige, 844 F.2d 668, 674 (9th Cir. 1988). "Speculative injury does not constitute irreparable injury sufficient to warrant granting a preliminary injunction." Id. The same is true of injury that is less than substantial. Preminger v. Principi, 422 F.3d 815, 826 (9th Cir. 2005) (preliminary injunctive relief unwarranted where plaintiffs failed to demonstrate "significant irreparable harm"); Quon v. Stans, 309 F. Supp. 604, 607 (N.D. Cal. 1970) (denying preliminary injunction where irreparable harm claimed by plaintiff was "speculative at best and probably de minimis."). And the requisite injury must be one likely to occur in the immediate future. Caribbean Marine, 844 F.2d at 674 (moving party must demonstrate immediate threatened injury); Colgan v. Leatherman Tool Group, Inc., 135 Cal. App. 4th 663, 702 (2d Dist. 2006) ("[I]n order to grant injunctive relief under [the UCL], there must be a threat that the wrongful conduct will continue."). -9OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 16 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Plaintiffs claim three injuries in support of their requests for injunctive relief: (1) "the risk of identify theft" (2) "e-mail addresses [being] leaked to spammers"; and (3) "damage caused by Ameritrade's failure to disclose that particular stocks were manipulated by spammers." Pls.' Mot. at 8-11.6 None of these alleged injuries are irreparable, nonspeculative, substantial, and immediately threatened, as required to meet the irreparable injury requirement for issuing a preliminary injunction. 1. Fear of future identity theft is too speculative to warrant injunctive relief.

Plaintiffs maintain that they will suffer "grave irreparable harm" from the "risk of identity theft" (Pls.' Mot. at 8-9), but they fail to make any factual showing of such imminent harm. Instead, they simply assert, without any support, that, because stock spammers may have acquired e-mail addresses without authorization, it is likely that identity theft operators acquired Sensitive Personal Information. Plaintiff Elvey also disingenuously points to the fact that he was the victim of identity theft, but his declaration reveals that the instances of identity theft occurred before he began receiving stock spam. Elvey Decl. ¶¶ 1, 4; FAC ¶¶ 22-24. In addition, although Plaintiffs offer hearsay evidence from the Internet of TD AMERITRADE customers complaining about receiving stock spam as a result of information allegedly acquired from the Company, Plaintiffs have not offered any evidence of TD AMERITRADE customers contending that they also were victims of identity theft as a result of the Company's conduct. Finally, as discussed above, the Company has seen no indication that Sensitive Personal Information that could result in identity theft has been acquired by unauthorized persons. Furthermore, courts around the country have uniformly held that a speculative increased risk of future injury from identity theft is insufficient to sustain a cause of action ­ either because there is no legally cognizable injury sufficient to confer standing to sue or because the plaintiff
6

Plaintiffs claim that irreparable harm must be presumed on their CLRA and UCL claims. Pls.' Mot. at 7. But the case on which they rely for that proposition, Cal. Ass'n of Dispensing Opticians v. Pearle Vision Ctr., Inc., 143 Cal. App. 3d 419, 434 (4th Dist. 1983), has been limited by subsequent authority to cases in which a government entity seeks an injunction or a statute provides that a showing of irreparable harm is unnecessary. Leach v. City of San Marcos, 213 Cal. App. 3d 648, 661-62 (4th Dist. 1989) (affirming denial of preliminary injunction on statutory claim, where movant failed to demonstrate irreparable harm). -10OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 17 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

cannot establish the injury element of the cause of action. Courts have dismissed various types of claims based upon alleged breaches of information security systems in circumstances where the risk of identity theft was far more likely and immediate than it is on this record. In one recent decision, for instance, a district court dismissed claims against a defendant from which unauthorized persons acquired confidential financial information (including credit card, debit card, and checking account numbers) for the defendant's customers, where the only alleged injury was a "substantial increased risk of identity theft or other related financial crimes." Key v. DSW, Inc., 454 F. Supp. 2d 684, 688-89 (S.D. Ohio 2006). Noting that "[i]n the identity theft context, courts have embraced the general rule that an alleged increase in risk of future injury is not an `actual or imminent' injury," the Key court applied that general rule in concluding that the plaintiff lacked standing because her claims were "based on nothing more than speculation that she will be the victim of wrongdoing at some unidentified point in the indefinite future." Id. at 689-90; see also Randolph v. ING Life Ins. & Annuity Co., 486 F. Supp. 2d 1, 7 (D.D.C. 2007) (where names, addresses, and Social Security numbers of clients of investment advisor were stolen, finding that "mere speculation that at some unspecified point in the indefinite future [the plaintiffs] will be the victims of identity theft" is insufficient injury to support a claim); Forbes v. Wells Fargo Bank, N.A., 420 F. Supp. 2d 1018, 1021 (D. Minn. 2006) (where unencrypted customer information including names, addresses, Social Security numbers and account numbers of bank customers were stolen, finding that "the plaintiffs' injuries are solely the result of a perceived risk of future harm. Plaintiffs have shown no present injury or reasonably certain future injury to support damages for any alleged increased risk of harm."). Significantly, moreover, the D.C. Circuit has overturned a preliminary injunction where the plaintiffs offered only the threat of a future security breach as their irreparable harm. Cobell, 455 F.3d 301. In Cobell, the Department of the Interior appealed a district court order of injunctive relief requiring many of the Department's computer systems to be disconnected from the Internet and internal computer networks because the systems housed or provided access to individual Indian trust data ("IITD"). Id. at 303. The appellate court ruled that the class -11OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 18 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

members had not demonstrated that they would "necessarily suffer harm without t[he] injunction," even though "the evidence of flaws in Interior's IT security [was] extensive." Id. at 315. The court stated: We do not mean to understate the dangers of lax IT security, but as the district court acknowledged, `it is generally considered impossible to create a perfectly secure IT environment.' The inherently imperfect nature of IT security means that if we granted injunctive relief here, based only on Interior's security vulnerabilities and not on a showing of some imminent threat or specific reason to be concerned that IITD is a target, we would essentially be justifying perpetual judicial oversight of Interior's computer systems. In order to return to normal operations, Interior would be faced with the nearly impossible task of ensuring that its systems have no exploitable weaknesses whatsoever, rather than addressing a more specific danger to IITD. Id. Essentially, the court found that the speculative injury alleged was insufficient to support the mandatory relief the plaintiffs sought. Here, Plaintiffs offer nothing more than conjecture and speculation that they face an increased risk of identity theft. Indeed, there is no evidence that an unauthorized person has

acquired Sensitive Personal Information, much less that such information was actually targeted for use in an identity theft scheme. Under the relevant authorities, Plaintiffs' "mere speculation that at some unspecified point in the indefinite future [they] will be the victims of identity theft" (Randolph, 486 F. Supp. 2d at 7) consequently falls short of the required showing to obtain mandatory injunctive relief. 2. Any injury from the receipt of spam e-mails is de minimis, at most.

Plaintiffs further claim that leaked e-mail addresses threaten irreparable injury in the form of spam e-mail. But any injury from the receipt of spam e-mail is de minimis, at most. Plaintiff Elvey alleges that he received 80 spam e-mails at two e-mails addresses over the course of nine months. FAC ¶¶ 23-24. That volume of spam results in no substantial loss of time or computing resources. Indeed, Plaintiffs can simply delete any spam e-mail with a click of the mouse. All the more, Plaintiffs could discontinue using their unique e-mail addresses, which they only created for the purposes of obtaining evidence for this litigation. Elvey Decl. ¶ 2; Griffiths Decl. ¶ 2. Or Plaintiffs could use a spam filter to block receipt of unwanted spam. A minor and easily -12OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 19 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

avoided inconvenience is not a substantial injury warranting the injunctive relief Plaintiffs seek. See, e.g., Walker v. Woodford, 454 F. Supp. 2d 1007, 1031 (S.D. Cal. 2006) ("The question is not whether Plaintiffs will suffer inconvenience during the pendency of the lawsuit, but whether they will suffer irreparable injury, such as serious, permanent physical or mental damage, if they are not immediately granted the relief they seek."). 3. Injury caused by spam-based securities manipulation is neither irreparable nor immediately threatened.

Plaintiffs finally claim that they will suffer injury warranting injunctive relief as a result of the Company's failure to disclose that spammers may be manipulating the prices of certain securities. But any such injury from purchasing manipulated securities certainly is not

irreparable. If accountholders could satisfy the elements of a securities fraud or other cause of action based upon the purchase or sale of securities in reliance upon anonymous spam e-mails touting stocks (which would be subject to dispute), they could seek full compensation in the form of money damages. And where money damages are possible, an injury is not irreparable. L.A. Mem'l Coliseum, 634 F.2d at 1202 ("It is well established, however, that such monetary injury is not normally considered irreparable."). Moreover, Plaintiffs, who allege that they are typical of purported class members, do not allege that they were ever deceived by stock spam in buying or selling securities. And Plaintiffs offer absolutely no evidence suggesting that any measurable number of purported class members have been injured by acting upon anonymous stock tips in spam e-mail. Accordingly, there is no reason to think that any such injury is imminent. Since it is neither irreparable nor immediately threatened, the possibility of injury from spam-based securities manipulation does not warrant the injunction Plaintiffs seek. * * *

In short, Plaintiffs have failed to show even the possibility of irreparable injury required for preliminary injunctive relief. It follows that they have not met their burden to show that the law and facts clearly establish the imminent threat of such an injury. On that basis alone, Plaintiffs are not entitled to an injunction. See L.A. Mem'l Coliseum, 634 F.2d at 1202 (finding -13OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 20 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

that lower court "erred in issuing a preliminary injunction because there was no showing of irreparable injury"). C. Plaintiffs Have Not Shown A Need For The Preliminary Injunction Sought.

The injunction that Plaintiffs request is unprecedented and unwarranted. It would impose hardships on TD AMERITRADE far greater than any that Plaintiffs would suffer in its absence. And it is detrimental to the public interest. Thus, even if Plaintiffs had shown that they had a likelihood of success on the merits and faced an imminent irreparable injury (which they have not done and cannot do), equitable factors still would preclude the preliminary injunctive relief they seek. 1. A mandatory injunction requiring TD AMERITRADE to detect, identify, and disclose stock touted by spam should be denied.

Plaintiffs ask the Court to order TD AMERITRADE to detect spam sent to its accountholders, identify stocks touted by such spam, and display a disclosure to California accountholders attempting to purchase the stock reading: THIS STOCK SHOULD BE PURCHASED ONLY WITH EXTREME CAUTION. THIS STOCK HAS RECENTLY BEEN TOUTED IN UNSOLICITED COMMERCIAL EMAIL. IT IS LIKELY THAT THE PERSONS SENDING THESE EMAILS ARE MANIPULATING THE VALUE OF THIS STOCK AS PART OF A FRAUDULENT INVESTMENT SCHEME. THIS SCHEME MAY CAUSE ANY INVESTMENT IN THIS STOCK TO LOSE ITS VALUE NOTWITHSTANDING THE COMPANY'S FINANCIAL PERFORMANCE. Pls.' Mot. at iii. On top of that, the injunction Plaintiffs seek would order the Company to provide a means to require each purchaser to affirmatively indicate that they have read the warning before executing the transaction. Id. Plaintiffs offer no authority for this extraordinary mandatory preliminary injunction, aside from a factually unrelated case affirming a final injunction under the UCL that required a limited disclosure correcting prior representations that the defendant's products were made in the United States. See Colgan, 135 Cal. App. 4th at 701-02. That is hardly the clear showing of fact and law that plaintiffs must make in order to obtain relief. See Churchill Vill., 169 F. Supp. 2d at -14OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 21 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1125. The facts and the law on the subject actually show that the injunction directed at spambased manipulation that Plaintiffs seek would be wholly inappropriate. Most significantly, the requested injunction would effectively thrust the Court and TD AMERITRADE into the roles of federal securities regulators. If the Court granted Plaintiffs' requested relief, the Company would have the obligation to pronounce that the price of certain securities is likely being manipulated. This type of securities market oversight, however, is the province of the SEC (and other market regulators), not a broker-dealer such as TD AMERITRADE. See 15 U.S.C. §§ 78i, 78j, 78l(k), 78u, 78w; SEC, The Investor's Advocate: How the SEC Protects Investors, www.sec.gov/about/whatwedo.shtml (last visited Aug. 16, 2007). Indeed, spam-based pump-and-dump schemes are the focus of ongoing SEC regulatory and enforcement efforts. The SEC has before it a proposal to regulate stock promotion. Petition for Commission Action to Protect the Investing Public from Unlawful and Deceptive Securities Promotions (Apr. 24, 2006), available at http://sec.gov/rules/petitions/petn4-519.pdf (last visited Aug. 19, 2007). The Commission also recently suspending trading in 35 stocks subject to spambased pump-and-dump schemes. Press Release, SEC Suspends Trading of 35 Companies Touted in Spam Email Campaign (Mar. 8, 2007), available at http://sec.gov/news/press/2007/200734.htm. (last visited Aug. 17, 2007). And the SEC has periodically directed brokerage firms to stop processing orders to trade certain stocks that the regulators believe are the subject of spam messages that may be intended to artificially inflate stock prices. Hale Decl. ¶ 9. The conflict between Plaintiffs' requested injunction and the regime of securities regulation is palpable. An order that the Company start telling its customers that certain stock prices are manipulated undoubtedly would frustrate the orderly functioning of the nation's securities markets, a central objective of federal securities regulation. The federal securities laws, therefore, preempt any such relief. Geier v. Am. Honda Motor Co., 529 U.S. 861, 869-74 (2000) (frustration of federal objective gives rise to implied conflict preemption); Credit Suisse First Boston Corp. v. Grunwald, 400 F.3d 1119, 1134-36 (9th Cir. 2005) (same, finding preemption by SEC-approved NASD rules). -15OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 22 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

For TD AMERITRADE, the burden of detecting, identifying, and disclosing spam-based manipulation would be enormous. The Company would not only have to institute procedures to ascertain what stocks are being touted by spam and reconfigure its systems to provide the required disclosure (which is burdensome enough), it would also have to alter its basic relationship with the vast majority of its customers. The Company's customer accounts are "self-directed," and the Company ordinarily does not provide investment advice to its customers. Hale Decl., Ex. 1. The injunction requested by Plaintiffs in this regard would effectively put the Company in the position of providing such advice to its customers. Plus, a spammed stock's price may not in fact have been manipulated. And once spammers understand that TD

AMERITRADE has been compelled to disparage spammed stocks, they undoubtedly will try to use the Company as a means to effect manipulation schemes designed to drive downward the prices of stocks. Certainly the $1,000 bond Plaintiffs propose will offer the Company scant protection from the damages that the Company is likely to suffer as a result of the injunction.7 We have already shown that Plaintiffs themselves face no hardship in the absence of a requested disclosure regarding spam-based manipulation, because--like the many investors who follow the SEC's advice on the subject, see SEC, Be Alert When You Receive Spam E-mail or Faxes, www.sec.gov/answers/unsolicitedquotations.htm (last visited Aug. 16, 2007)--they do not trade spam-touted stocks and they know all about the dangers of spam-based manipulation. The balance of hardships thus plainly tips against a preliminary injunction. See Atari Corp. v. Sega of Am., Inc., 869 F. Supp. 783, 792 (N.D. Cal. 1994) ("[W]eighing the certainty of harm to [the defendant] and the non-party retailers, software developers and peripheral manufacturers against the speculative possibility of irreparable harm to [the plaintiff], the balance tips against issuance of a preliminary injunction"). So does the public interest. An order effectively making
7

This case is not remotely like the civil rights and public interest cases against government entities and officials that Plaintiffs cite (at 14) in support of their minimal bond offer. Where serious commercial damages are threatened by a preliminary injunction, a substantial bond is in order. See Michaels v. Internet Entm't Group, Inc., 5 F. Supp. 2d 823, 842-43 (C.D. Cal. 1998) (rejecting request for minimal bond). Although the size of any bond here would depend on the precise relief ordered--if the Court found any injunction were appropriate in the first place (which it is not)--the bond would certainly need to be very substantial. -16OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 23 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

TD AMERITRADE a securities regulator would interfere with the anti-manipulation and brokerdealer regulatory efforts of the SEC and other market regulators, and it could adversely affect many issuer companies whose stock may be subject to the proposed manipulation disclosures. 2. A mandatory injunction requiring an "accounting" of TD AMERITRADE's systems and the implementation of protective measures determined by Plaintiffs' counsel should be denied.

Plaintiffs ask the Court to order that TD AMERITRADE provide them (and their counsel) with an "accounting" of the Company's "record systems" containing the personal information of California accountholders. Pls.' Mot. at iii. Plaintiffs plan to use the accounting for two purposes: (1) to prepare a report they want the Court to order the Company to distribute to all current and former accountholders; and (2) to develop unspecified security measures they want the Court to order the Company to implement. Id. at iv. This extraordinary injunctive relief is completely improper. First, as discussed above, Plaintiffs have not produced any evidence indicating that the representations in the Privacy Statement are false or misleading or that the Company has an affirmative duty to supply additional information to Plaintiffs. For that reason alone, they should not be granted this relief. Second, Plaintiffs seek information on all aspects of the Company's security systems even though the only evidence they offer in support of their position involves the unauthorized acquisition of customer e-mail addresses. There is no evidence that Sensitive Personal Information has been acquired by an unauthorized person. Accordingly, there is no basis for ordering a system-wide accounting. If Plaintiffs' claims are not dismissed, any need for additional information can be satisfied through discovery, subject to an appropriate protective order to protect confidential information about the Company's security systems and also limited in scope to the information that is necessary to resolve whatever issues remain.8
8

Even if the Company were required to provide detailed information regarding its security systems to Plaintiffs and their counsel under protective order, there would still be a serious risk of harm. Courts have recognized that protective orders are imperfect at best and have limited discovery to only the most essential confidential information, even where a protective order is in effect. See, e.g., Litton Indus., Inc. v. Chesapeake & Ohio Ry. Co., 129 F.R.D. 528, 531 (E.D. Wis. 1990) ("There is a constant danger inherent in disclosure of confidential information pursuant to a protective order. Therefore, the party requesting disclosure must make a strong showing of need . . . ."). The highly sensitive nature of the information that would be involved in -17(cont'd)

OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 24 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Third, an "accounting" relates to a statement of financial accounts or transactions. See County of Santa Clara v. Astra USA, Inc., 401 F. Supp. 2d 1022, 1032 (N.D. Cal. 2005) ("An accounting is an equitable remedy by which a party opens its books so that the other side may calculate amounts owed."). We are not aware of any case in which a court has ordered an "accounting" of a company's information security system. The lone authority Plaintiffs cite in support of their request for such an accounting is not to the contrary. The accounting ordered in the Cobell case was an accounting of money in Indian trust accounts, the accurate completion of which the court tried to ensure by requiring the Interior Department to establish written computer and business system architecture policies. Cobell v. Norton, 391 F.3d 251, 254 (D.C. Cir. 2004). The court did not order an "accounting" of information security systems. Plaintiffs' requested accounting is literally unprecedented. Fourth, the proposed injunction is also impermissibly vague regarding TD AMERITRADE's obligations. There is no description of what particular information would be required by the requested accounting of records systems. And, of course, no one knows what yet-to-be-developed information security changes Plaintiffs want the Court to force the Company to implement. This lack of detail is inconsistent with Fed. R. Civ. P. 65, which requires that injunctions state their terms "specifically" and "describe in reasonable detail" the acts required. Finally, presenting a public report that contains information concerning the Company's proprietary and confidential security systems would only encourage future attempts by hackers to gain access to the Company's computers as well as expose proprietary and confidential information to competitors, contrary to the interests of the Company, its customers, and stockholders. In addition, this injunction would be extremely burdensome for TD AMERITRADE. The Company's computer systems are extensive and, depending upon its scope, an "accounting" could require extraordinary time and expense to complete. Then, the Company would presumably have to expend significant time and effort complying with whatever an accounting, combined with the practical limitations on a Court's ability to ensure strict compliance by parties (or their experts) with a protective order, constitutes a separate and independent reason to deny Plaintiffs' request for an accounting of the Company's elaborate information security systems. -18OPPOSITION TO PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND MOTION FOR CLASS CERTIFICATION CASE NO. C 07 2852 MJJ

Case 3:07-cv-02852-MJJ

Document 26

Filed 08/23/2007

Page 25 of 30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

security measures Plaintiffs and their counsel concoct. Again, Plaintiffs' offer to post a $1,000 bond is cold comfort. 3. A mandatory injunction requiring TD AMERITRADE to amend its Privacy Statement to make a disclosure concerning e-mails being leaked from the Company's computer systems should be denied.

Plaintiffs request that the Court require TD AMERITRADE to amend its Private Statement and any other communications with accountholders to include a five-paragraph statement that begins: ALERT: AMERITRADE'S INFORMATION SYSTEMS ARE NOT NECESSARILY SECURE AND WE CANNOT ASSURE THE SECURITY OF YOUR PERSONAL INFORMATION. THERE IS EVIDENCE THAT SOME ACCOUNTHOLDERS' EMAIL ADDRESSES HAVE LEAKED FROM AMERITRADE'S COMPUTER SYSTEMS TO SPAMMERS. AMERITRADE HAS AN ONGOING INVESTIGATION INTO THIS SITUATION. YOUR NAME, SOCIAL SECURITY NUMBER, AND YOUR EMAIL ADDRESS MAY HAVE BEEN LEAKED AS WELL. Pls.' Mot. at iv. The proposed statement goes on to recommend that accountholders take a variety of steps to protect themselves from identity theft. Id. Once again, the only basis Plaintiffs offer for this extraordinary relief is the Colgan court's approval of a final injunction requiring a "corrective disclosure." 135 Cal. App. 4th at 701-02. That ruling does not remotely support a preliminary injunction requiring a corrective disclosure in this case. A corrective disclosure simply is not appropriate at the preliminary injunction stage when there has been no determination that the defendant made a misrepresentation or omission in violation of the UCL or CLRA or otherwise breached any duty. And that is particularly true here, given that Plaintiffs cannot show even a likelihood that they will eventually succeed