Facebook, Inc. v. Power Ventures, Inc.

Filing 66

Reply Memorandum re 56 MOTION for Summary Judgment Notice of Motion, Motion and Memorandum of Points and Authorities for Judgment on the Pleadings Pursuant to Fed. R. Civ. P. 12(c) or, in the Alternative Partial Summary Judgment of Liability Under California Penal Code S MOTION for Summary Judgment 62 Notice of Motion, Motion and Memorandum of Points and Authorities for Judgment on the Pleadings Pursuant to Fed. R. Civ. P. 12(c) or, in the Alternative Partial Summary Judgment of Liability Under California Penal Code S filed byFacebook, Inc.. (Gray, Thomas) (Filed on 1/29/2010) Modified on 2/1/2010 (gm, COURT STAFF).

Facebook, Inc. v. Power Ventures, Inc.

Doc. 66

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page1 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

I. NEEL CHATTERJEE (STATE BAR NO. 173985) [e-mail] THOMAS J. GRAY (STATE BAR NO. 191411) [e-mail] JULIO C. AVALOS (STATE BAR NO. 255350) [e-mail] ORRICK, HERRINGTON & SUTCLIFFE LLP 1000 Marsh Road Menlo Park, CA 94025 Telephone: [phone] Facsimile: [phone] Attorneys for Plaintiff FACEBOOK, INC. UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

FACEBOOK, INC., Plaintiff, v. POWER VENTURES, INC. a Cayman Island Corporation; STEVE VACHANI, an individual; DOE 1, d/b/a POWER.COM, DOES 2-25, inclusive, Defendants.

Case No. 5:08-cv-05780 JF (HRL) FACEBOOK INC.'S REPLY BRIEF IN SUPPORT OF ITS MOTION FOR JUDGMENT ON THE PLEADINGS OR, IN THE ALTERNATIVE, PARTIAL SUMMARY JUDGMENT OF LIABILITY UNDER CALIFORNIA PENAL CODE SECTION 502 AND OPPOSITION TO DEFENDANTS' MOTION FOR SUMMARY JUDGMENT Date: Time: Judge: Courtroom: February 26, 2010 9:00 a.m. Hon. Jeremy D. Fogel 3

FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Dockets.Justia.com

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page2 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 IV. I. II. III.

TABLE OF CONTENTS Page INTRODUCTION .............................................................................................................. 1 STATEMENT OF UNDISPUTED MATERIAL FACTS.................................................. 1 ARGUMENT ...................................................................................................................... 2 A. Power Misunderstands the Aim and Scope of California Penal Code Section 502 .............................................................................................................. 2 1. Penal Code 502 Was Expressly Enacted To Protect The "Integrity" Of Computer Systems and Networks From "Unauthorized Access" Regardless Of Tampering, Alterations, or Deletions .................................. 2 2. Power Misrepresents The Standing Requirements For Civil Litigants ...................................................................................................... 3 B. Power Has Violated Penal Code Sections 502(c)(2), (3) and (7) ........................... 4 1. Power "Used," "Caused To Be Used," "Made Use Of" and "Accessed or Caused to Be Accessed" Facebook's Computer Services ....................................................................................................... 4 2. Power's "Use," Or "Access" Was "Knowing" ........................................... 5 3. Power Acted Without Permission ............................................................... 5 a. Permission From Users Is Irrelevant ............................................... 5 b. A "Good Faith Belief" Of Authorization Is Irrelevant.................... 7 C. Facebook Has Expended Resources Tracking, Blocking and Investigating Power's Attacks ..................................................................................................... 8 CONCLUSION ................................................................................................................. 10

-i-

FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ Case No. 5:08-cv-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page3 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

TABLE OF AUTHORITIES Page FEDERAL CASES Ebay, Inc. v. Bidder's Edge, 100 F. Supp. 2d 1058 (N.D. Cal. 2002) .................................................................................... 7 Facebook, Inc. v. ConnectU LLC, 489 F. Supp. 2d 1087 (N.D. Cal. 2007) ................................................................................ 6, 8 Gozlon-Pertez v. United States, 498 U.S. 395 (1991) .................................................................................................................. 2 STATE CASES Hale v. Morgan, 22 Cal. 3d 388 (1978) ............................................................................................................... 8 People v. Cole, 156 Cal. App. 4th 452 (2007).................................................................................................... 8 People v. Hawkins, 98 Cal. App. 4th 1428 (2002)................................................................................................ 7, 8 STATE STATUTES Cal. Penal Code § 502(a) ............................................................................................................ 2, 3 Cal. Penal Code § 502(b)(8) ....................................................................................................... 3, 4 Cal. Penal Code § 502(c) ...................................................................................... 1, 2, 3, 4, 7, 8, 10 Cal. Penal Code § 502(c)(1) ............................................................................................................ 7 Cal. Penal Code § 502(c)(2) ................................................................................................ 3, 4, 5, 8 Cal. Penal Code § 502(c)(3) .................................................................................................... 3, 4, 5 Cal. Penal Code § 502(c)(7) .................................................................................................... 3, 4, 5 Cal. Penal Code § 502(d) ................................................................................................................ 3 Cal. Penal Code § 502(d)(3)(A) ...................................................................................................... 4 Cal. Penal Code § 502(e) .......................................................................................................... 9, 10 Cal. Penal Code § 502(e)(1) .......................................................................................... 1, 3, 4, 9, 10

- ii -

FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ Case No. 5:08-cv-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page4 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

I.

INTRODUCTION This case is about one simple issue: whether the owner and operator of a private computer

system may lawfully regulate third-party access to that system. The three motions currently pending before the Court merely present variations on that single question. Defendants Power Ventures, Inc. and Steven Vachani ("Power") believe that they are entitled to unfettered access to Facebook, Inc.'s ("Facebook") computer networks and that Facebook's efforts to regulate that access are anticompetitive. Because Facebook's computers are private property, Facebook is well within its rights to prohibit unauthorized access; implementing measures to prevent such access cannot plausibly be considered anticompetitive or unfair. As a consequence, Facebook's motion for judgment on the pleadings relating to its Penal Code 502(c) claim should be granted ­ and its motion to dismiss Power's antitrust counterclaims should be granted as well.1 As Power's cross-motion for summary judgment confirms, there is no factual dispute about Power's trespass to Facebook's systems. The record before the Court establishes that Power has violated Section 502(c). Power's main defenses--that it received permission to access Facebook from Facebook users and that Facebook did not expend sufficient resources investigating and combating Power's trespasses to have suffered damage--are unavailing. Permission from users is irrelevant and 502(e)(1) requires only that resources be expended, not that those resources meet Power's standards. 2 II. STATEMENT OF UNDISPUTED MATERIAL FACTS Both parties have filed motions for summary judgment on Facebook's Penal Code Section 502(c) claim. Accordingly, the parties appear to agree that there are no disputed material facts with respect to that claim.

1

Facebook has submitted a separate Reply Brief in connection with its Motion to Dismiss Power's Counterclaims and Strike its Affirmative Defenses. Due to the intertwined nature of the motions, if the Court finds Power's unauthorized access to Facebook's servers to be unlawful, it should also dismiss Power's antitrust and unfair competition claims. Facebook's efforts to protect itself from Power's attacks cannot constitute "predatory" behavior required to state a claim under Section 2 of the Sherman Act and cannot be an unfair practice under the UCL. 2 Facebook has other meritorious claims pending against Power. However, a judgment on this 502(c) claim will provide Facebook with a sufficient remedy. Accordingly, Facebook would be willing to dismiss the remainder of its claims if the Court grants this motion. -1FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page5 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

III.

ARGUMENT A. Power Misunderstands the Aim and Scope of California Penal Code Section 502

Throughout its Opposition and supporting Declaration of Steven Vachani, Power argues that Power.com's functionality "does not provide any capability to cause the alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data." Dkt. 65 at ¶ 10. This, Power concludes, saves it from violating Section 502(c). Power misunderstands the aim and scope of California Penal Code Section 502. 1. Penal Code 502 Was Expressly Enacted To Protect The "Integrity" Of Computer Systems and Networks From "Unauthorized Access" Regardless Of Tampering, Alterations, or Deletions

In determining the meaning of a statute, the Court must "look not only to the particular statutory language, but to the design of the statute as a whole and to its object and policy." Gozlon-Pertez v. United States, 498 U.S. 395, 407 (1991). When it enacted Penal Code 502, the California State Legislature obviously intended to address garden variety hackers, spammers, and malware. However, the Legislature also sought to prevent "unlawful access" to computer systems and enacted a separate and distinct cause of action--beyond straightforward computer hacking or tampering--to deal with that problem. Thus, in Section 502's preamble, the Legislature wrote: "It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and government agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems." Penal Code § 502(a) (emphasis added). The statute continues: "The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize computers, computer systems, and data." Id. (emphasis added). By its plain language, Section 502 was thus expressly enacted, in relevant part, to protect the integrity and "well-being" not just of computer data but of whole commercial computer -2FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page6 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

systems from "unauthorized access," with "access" broadly defined to mean "gain entry to, instruct, or communicate with the logical, arithmetical, or memory function resources of a computer, computer system, or computer network." Penal Code § 502(b)(1). In other words, in addition to being an anti-hacking statute, Section 502 was designed as an anti-trespass statute that criminalizes unauthorized "communication" with a computer system. Accordingly, when enumerating the particular acts that would constitute "public offenses" in Section 502(c), the Legislature went to great lengths to include several predicate acts that focused on "access" and "use" as opposed to alteration, damage, deletion, or destruction. Section 502(c)(2), for instance, declares it a public offense to "knowingly access[] and without permission take[], cop[y] or make[] use of any data from a computer, computer system, or computer network." Section 502(c)(3) similarly criminalizes those who "[k]nowingly and without permission use[] or cause[] to be used computer services." Finally, under Section 502(c)(7), any person who "[k]nowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network" can be guilty of a public offense and civilly liable. 2. Power Misrepresents The Standing Requirements For Civil Litigants

Power's Opposition mistakenly insists that Section 502 "creates a private right of action only in very limited circumstances." Dkt. 64 at 2:15-16. To the contrary, consistent with the Legislature's desire to protect the integrity and well-being of computer systems owned by private individuals and businesses, Section 502(e)(1) broadly provides civil remedies to any "owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation of any of [the nine] provisions of subdivision (c)." Power incorrectly claims that Section 502(b)(8), which defines the term "injury," "further defines the types of damage or loss recognized by" 502(e)(1). Dkt. 64 at 2:18-23; see also id. at p 3:1-3 (claiming that "[a] party asserting a private civil claim under § 502 must establish that it suffered `injury' to its data or computers"). However, the term "injury" never appears anywhere in Sections 502(a), (c) or (e)(1). The word is found only in Section 502(d) (inapplicable here), and is used exclusively to help categorize criminal punishments for 502(c) violations. See, e.g., -3FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page7 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Section 502(d)(3)(A) ("For a first violation that does not result in injury, an infraction punishable by a fine not exceeding one thousand dollars ($1,000)") (emphasis added). There is no statutory support for the proposition that "injury," as defined in section 502(b)(8), should be imported into 502(e)(1) nor does Power provide any. In fact, the plain language of Section 502(e)(1) allows a party to bring a civil action for violations of 502(c) if the party has suffered "damage" or "loss," which "shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access." Penal Code § 502(e)(1) (emphasis added). As explained in greater detail below, Facebook reasonably and necessarily expended resources investigating Power's unlawful access to its servers, blocking that access, conferring with Power and Mr. Vachani to determine why they were impermissibly scraping data from Facebook's servers, hiring outside counsel to get Power to stop their access, investigating Power's subsequent circumvention of its technological blocking measures, as well as re-blocking Power's access to Facebook. All of these expenditures qualify as damage or loss under Section 502(e)(1). Consequently, Facebook has pled sufficient grounds for standing to assert its Penal Code Section 502(c) claims against Power. B. Power Has Violated Penal Code Sections 502(c)(2), (3) and (7)

Power ignores the 502(c) subdivisions that do not require the destruction of data. Again, a defendant violates 502(c)(2) when he "knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network." The defendant violates Section 502(c)(3) if he "knowingly and without permission uses or causes to be used computer services." And he violates 502(c)(7) when he "knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or network." None of these provisions requires, or even mentions, the destruction of data. 1. Power "Used," "Caused To Be Used," "Made Use Of" and "Accessed or Caused to Be Accessed" Facebook's Computer Services

Power has not disputed that it "used," "caused to be used," "made use of" or "accessed or caused to be accessed" Facebook's computer services. Indeed, it has repeatedly confirmed these -4FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page8 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

facts. See, e.g., Dkt. No. 54 ¶ 18 (Power admits that it "permits users to enter their account information to access the Facebook site through Power.com"); Id. ¶¶ 45, 50 (same); Id. ¶ 74 (Power admits that it has "developed computer software and other automated devices and programs to access and obtain information from the Facebook website for aggregating services"); Dkt. No. 65 ¶ 2 ("Power offered Facebook users a different and potentially superior browser through which they could access their Facebook accounts to copy, updated, and/or port their own `User Content.'"). Consequently, there is no factual dispute as to this element. 2. Power's "Use," Or "Access" Was "Knowing"

Power has also admitted that it "knowingly" "used or caused to be used" Facebook's computer services, (502(c)(3)), "knowingly" "access[ed]" Facebook's computer services, (502(c)(2)), or "knowingly" accessed or "caused to be accessed" Facebook's computer network, (502(c)(7)). See Dkt. 54 ¶¶ 5,18, 45, 50, 63, 64, 66, 74, and 75. 3. Power Acted Without Permission a. Permission From Users Is Irrelevant

Nor is there any dispute that Power's actions were done "without permission" from Facebook. Facebook has never given Power permission to access or use its network. In fact, the record demonstrates (and Power has admitted) that on December 1, 2008 Facebook notified Power that "Power.com's access of Facebook's website and servers was unauthorized and violated Facebook's rights." Dkt. 9 at ¶ 57; Dkt. 54 ¶ 57 ("Defendants admit that Facebook has communicated such claims to Mr. Vachani."). It is also undisputed that because Power refused to stop, Facebook was required to implement technical blocks to keep Power from accessing the Facebook network and that Power intentionally circumvented those blocking measures in order to keep accessing Facebook.com without permission. See Dkt. 54 ¶¶ 63 ("Defendants admit that Facebook implemented technical measures to block users from accessing Facebook through Power.com") and 64 (admitting that despite Facebook's technical blocks, "Defendants admit that Power provided users with tools necessary to access Facebook through Power.com"). Despite these contrary admissions, Power argues that it was permitted to access and use the Facebook network. Power's arguments are unconvincing. First, Power argues that its access -5FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page9 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

to Facebook's network was done with the permission of Facebook users. This theory has already been rejected by this Court, as well as another Court in this District. See Dkt. 38 at 7:21-28; and Facebook, Inc. v. ConnectU LLC, 489 F.Supp.2d 1087, 1091 (N.D. Cal. 2007). In ConnectU, the ConnectU defendants took the same position that Power espouses here, arguing that their access to Facebook had been undertaken "with permission" because ConnectU "accessed information on the Facebook website that ordinarily would be accessible only to registered users by using log-in information voluntarily supplied by registered users." ConnectU, 489 F.Supp.2d at 1091. The Court was unmoved by this argument, holding that "notwithstanding the reference in the title to `unauthorized access,' Penal Code section 502 prohibits knowing access, followed by unauthorized (i.e., `without permission') taking, copying, or use of data." Id. Accordingly, Judge Seeborg denied ConnectU's motion to dismiss Facebook's 502(c) claims because Facebook had adequately alleged that ConnectU had knowingly accessed Facebook's website "in a manner not authorized or permitted by Facebook." Id. (emphasis added). Power attempts to distinguish ConnectU by arguing that its procedural posture renders it "not a useful precedent." Dkt. 64 at 12:26, fn 2. But Judge Seeborg's holding on this point had nothing to do with the procedural posture of the case. Indeed, in reaching his decision, Judge Seeborg interpreted the code and made the legal finding that only Facebook could grant permission, not Facebook users. Clearly, a user cannot grant a third-party permission that is not the user's to grant in the first place. This is precisely the argument that Power is trying to make in this case. In fact, in this case the Court has already observed that Facebook users may not grant authorization to third-parties to use the Facebook service without Facebook's permission. See Dkt. 38 at 7:24-28 ("[t]his argument relies on an assumption that Facebook users are authorized to use Power.com or similar services to access their user accounts. The Terms of Use negate this argument . . . Users may have the right to access their own content, but conditions have been placed on that access."). Under Power's logic, a bank would have no cause of action against a person who broke into the bank in the middle of the night if one of the bank's depositors had given permission to the thief to retrieve its deposit. This makes no sense in logic or law. -6FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page10 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

In sum, Power cannot successfully argue that it acted "with permission" because Facebook users allegedly gave it permission to access and use Facebook's servers. Facebook's computer servers are Facebook's private property. See Ebay, Inc. v. Bidder's Edge, 100 F. Supp. 2d 1058, 1070 (N.D. Cal. 2002) ("eBay's servers are private property, conditional access to which eBay grants the public."). Accordingly, and under the plain meaning of Penal Code 502, it was Facebook's permission--and not that of its users--that Power was required to obtain and it is undisputed that Power did not have that permission. b. A "Good Faith Belief" Of Authorization Is Irrelevant

Power's second theory is that the 502(c) subsections impute a mens rea requirement not only as to the "knowing" access or use of the Facebook network, but also to the fact that the access was "without permission." Accordingly, Power believes that even if the Court finds that Power was required to obtain Facebook's permission in order to access the Facebook site and that it accessed the site without that permission, Power would still not be liable under 502(c) because it had a "good faith belief" that the users' permission was sufficient. Dkt. 64 at 12:3-19. For starters, this argument is contradicted by Power's own concession that on December 1, 2008, Facebook notified it that "Power.com's access of Facebook's website and servers was unauthorized and violated Facebook's rights." Dkt. 54 ¶ 57. In response, instead of reevaluating its "good faith belief," Power admits that it not only chose to keep accessing Facebook, but went so far as to circumvent Facebook's technological blocking measures in order to keep scraping data from Facebook's network. Dkt. ¶¶ 63-64. In light of these admissions, Power's post-hoc claims of ignorance and "good faith" are not credible. Regardless, Power's argument is contrary to the plain meaning of 502(c) as well as this Court's prior precedent. As support for its proposition, Power cites only People v. Hawkins, 98 Cal.App.4th 1428, 1439 (2002), a criminal trade secrets misappropriation case that is wholly inapposite here. Power claims that Hawkins "rejected the assertion that `knowingly' only modifies `accesses' and not the rest of the crime." Dkt. 64 at 12:4-6. Going even further, Power claims that Hawkins "require[s] [that Facebook] establish that Power `knowingly' committed every element of an offense under § 501(c)(1)." Id. Power misrepresents Hawkins, which made -7FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page11 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

neither of these holdings. The Hawkins defendant argued that 502(c) was unconstitutional on its face because a person could be found guilty of a felony under it for knowingly accessing a computer and then copying something off that computer by accident. See 98 Cal.App.4th at 1439. The Court rejected this argument with the unsurprising observation that "[e]vidence of accidental copying would negate the mental element of section 502, subdivision (c)(2)." The Court never even mentioned the issue of "permission." Hawkins does not help Power. Moreover, this District's previous readings of Section 502 establish that the plain reading of the statute is that "knowingly" does not modify "without permission." For example, in ConnectU, Judge Seeborg found that "Penal code section 502 prohibits knowing access, followed by unauthorized (i.e., "without permission") taking, copying, or use of data." ConnectU, 489 F.Supp.2d at 1091. Finally, Power's defense that it should be excused from impermissibly accessing Facebook's servers either because it mistakenly believed that Facebook users could give it legal permission or because it had a "good faith belief that Facebook's Terms of Use were legally unenforceable or otherwise violative of the copyright and unfair competition laws" is a mistake of law that does not excuse illegal behavior. See People v. Cole, 156 Cal.App.4th 452, 483 (2007) ("Ignorance of the law is no excuse"). "In the absence of specific language to the contrary, ignorance of a law is not a defense to a charge of violation." Hale v. Morgan, 22 Cal.3d 388, 396 (1978); see also 1 Witkin & Epstein, Cal. Criminal Law, Defenses § 36, p. 367 (3d ed. 2000) ("If the act itself is punishable when knowingly done, it is immaterial that the defendant thought it was lawful."). Power's claims of ignorance or mistaken "good faith beliefs" are immaterial. Accordingly, Power's actions were plainly "without permission." C. Facebook Has Expended Resources Tracking, Blocking and Investigating Power's Attacks

Power claims that "the sole injury alleged in Facebook's complaint is the supposed injury to Facebook's `reputation and goodwill' caused by users accessing their Facebook accounts through the Power browser." Dkt. No. 64 at 2:6-8 (quoting First Amended Complaint, Dkt. No. 9 ("FAC"), ¶ 119)). This is false. Power ignores paragraph 118 of Facebook's FAC, which states -8FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page12 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

that "Facebook suffered and continues to suffer damage as a result of Defendants' violations" and paragraph 121 in which Facebook specifically alleges, among other things, "compensatory damages" pursuant to section 502(e). Importantly, Power has conceded the facts that establish that Facebook has suffered "damages" or "losses" pursuant to Section 502(e). Specifically, 502(e)(1) provides that a plaintiff may satisfy the "damage" or "loss" requirement by demonstrating any "expenditure reasonably and necessarily incurred . . . to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access." (Emphasis added). The record demonstrates that Facebook has reasonably and necessarily expended resources verifying, investigating and counteracting the impact of Power's unlawful access to its servers. For instance, Facebook was forced to retain outside counsel to investigate Power's acts and to get Power to terminate its access. Dkt. No. 9 ¶ 57; Dkt. No. 54 ¶ 57. Facebook expended further resources meeting and conferring with Power and Mr. Vachani to determine the nature of Power's access and the impact of that access on Facebook's systems. Id. ¶¶ 57-58, 60. Facebook was also required to expend resources to block Power from further accessing Facebook's servers. See Dkt. 54 ¶¶ 63 and 64. Power has admitted that it circumvented these blocks, requiring even further actions and expenditures by Facebook to verify that Power would not continue accessing or altering Facebook's systems. Id. ¶ 63 ("Defendants admit that Facebook implemented technical measures to block users from accessing Facebook through Power.com"). Despite these blocking measures, Power admits that it continued to "provide[] [its] users with tools necessary to access Facebook through Power.com." Id. ¶ 64. Power's response to these expenditures is two-fold. First, Power claims that the court should ignore these measures because Power's actions are allegedly "commonplace in the industry." Dkt. 64 at 7:6-8. But Section 502(e)(1) does not contain any safe harbors for commonplace unlawful access to computer servers. Second, Power argues that the Court should ignore Facebook's expenditures because they were "quite simple." Id. at 7:17. According to Power, "[t]he blocking of an IP address is a simple feature that can be implemented with pushbutton ease by virtually any web host. The `expenditure' of `corporate resources' to accomplish -9FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page13 of 14

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

this `technical measure' would involve, essentially, a few clicks of a mouse to access the IP blocking feature of the web host, and ten keystrokes to enter Power.com's IP address among those to be blocked." Id. at 7:20-27. Of course, even if true, which it is not, Power ignores the obvious facts that Facebook must first monitor and verify Power's conduct before the mouse is clicked and the keys stroked. Power also ignores the fact that it did not stop attacking Facebook's servers once Facebook initially blocked Power's IP address. Importantly, there is no requirement in 502(e)(1) that expenditures must be "big" to satisfy the statute. All that is required is that Facebook has suffered some level of compensatory damages ­ which is not disputed. The amount of compensatory damages available to Facebook is irrelevant to the issue of liability under Penal Code Section 502(c). Penal Code 502 is an antitrespass statute; the duration or impact of the trespass does not determine if the trespass occurred in the first place. Facebook has alleged, and Power has conceded, that Facebook has expended effort to verify and block Power's activities on Facebook's computer system and servers. That is all that is required to satisfy Section 502(e). If needed, the parties can argue about the amount of compensatory damages at a later date. IV. CONCLUSION Power has violated California Penal Code Section 502. Accordingly, Facebook respectfully requests that the Court grant Facebook judgment on the pleadings with respect to that claim. For the same reasons stated above, Power's Motion for Summary Judgment as to Facebook's Section 502 claim should be denied. Dated: January 29, 2010 ORRICK, HERRINGTON & SUTCLIFFE LLP

/s/ Thomas J. Gray THOMAS J. GRAY Attorneys for Plaintiff FACEBOOK, INC.

- 10 -

FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF

Case5:08-cv-05780-JF Document66

Filed01/29/10 Page14 of 14

1 2 3 4 5 6 7 8 9 10
OHS West:260817691.6

CERTIFICATE OF SERVICE I hereby certify that this document(s) filed through the ECF system will be sent electronically to the registered participants as identified on the Notice of Electronic Filing (NEF) and paper copies will be sent to those indicated as non registered participants on January 29, 2010. Dated: January 29, 2010 Respectfully submitted, /s/ Thomas J. Gray THOMAS J. GRAY

11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 - 11 FACEBOOK'S REPLY ISO MOT. FOR JUDGMENT ON PLEADINGS OR PARTIAL SJ AND OPP. TO MOTION FOR SJ CASE NO. 5:08-CV-05780 JF