Enki Corporation v. Freedman et al
Filing
44
ORDER GRANTING-IN-PART MOTION TO DISMISS by Magistrate Judge Paul Singh Grewal granting in part and denying in part 32 Motion to Dismiss. (psglc3S, COURT STAFF) (Filed on 1/23/2014)
1
2
3
4
5
6
7
8
9
United States District Court
For the Northern District of California
10
UNITED STATES DISTRICT COURT
11
NORTHERN DISTRICT OF CALIFORNIA
12
SAN JOSE DIVISION
13
14
ENKI CORPORATION,
15
Plaintiff,
v.
16
17
KEITH FREEDMAN et al.,
Defendants.
18
19
20
)
)
)
)
)
)
)
)
)
)
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART
DEFENDANTS’ MOTION TO
DISMISS
(Re: Docket No. 32)
When a former employee uses a customer’s working log-in credentials to access his former
employer’s scripts, are he and the customer hackers? Plaintiff Enki Corporation says yes;
21
Defendant Keith Freedman, along with his current employer and co-defendant, Zuora, Inc., say no.
22
23
Freedman and Zuora now move to dismiss Enki’s claims under the Computer Fraud and Abuse
24
Act 1 and the California Computer Data Access And Fraud Act 2 for failure to state a claim upon
25
which relief may be granted and the remainder of Enki’s claims for lack of subject matter
26
1
18 U.S.C. § 1030.
2
Cal. Penal Code § 502.
27
28
1
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
1
jurisdiction. Having reviewed the papers and considered the arguments of counsel, the court
2
GRANTS Defendants’ motion.
3
I.
4
5
BACKGROUND
The court draws the following facts, taken as true for the purposes of the motion to dismiss,
from Enki’s First Amended Complaint.
6
From 2006-2011, Freedman was a 12% interest holding member of Enki. 3 Enki’s business
7
8
9
is to acquire, manage, develop, improve, and operate cloud computing and other IT services for
enterprises. 4 In May of 2011, Freedman resigned. 5 Under the terms of Freedman’s separation
United States District Court
For the Northern District of California
10
agreement with Enki, Enki bought out Freedman’s interest, neither party was to disparage the other
11
in any way, and Freedman was barred from soliciting Enki’s clients or competing with Enki for a
12
year. 6
13
14
Shortly after Freedman’s departure, Enki entered into a master service agreement with
Zuora under which Enki was to provide consulting, cloud computing services, and other IT
15
16
services. 7 As part of these services, and as set forth in various statements of work, Enki installed
17
“Nimsoft” on Zuora’s network. 8 Nimsoft is a “software based system monitor” used to monitor
18
computer resources and performance. 9 Although the software was installed on Zuora’s network,
19
20
21
22
23
24
25
26
27
28
3
See Docket No. 25 at ¶ 18.
4
See id. at ¶ 19.
5
See id. at ¶ 19.
6
See id. at ¶¶ 21-22.
7
See id. at ¶ 23.
8
See id. at ¶ 48.
9
Id.
2
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
1
2
under the terms of the agreement Enki was the sole administrator of the software and the only one
allowed to “write” Nimsoft scripts. 10
3
In order to fulfill this contract, Enki hired Freedman and retained his new company,
4
Freeform, as a contractor to provide certain services to Zuora. 11 Even though the separation
5
6
7
8
agreement remained in effect, Freedman proceeded to spread negative stories about Enki and its
work product throughout Zuora for several months, leading to the termination of his contract with
Enki. 12 Zuora then hired Freedman and retained Freeform’s services directly. 13
In February 2013, Zuora terminated its contract with Enki “for convenience.” 14 Before this
9
United States District Court
For the Northern District of California
10
termination, however, Freedman and Zuora accessed the Nimsoft servers on Zuora’s network
11
without authorization.15 Freedman and Zuora then copied Enki’s proprietary information,
12
including Enki’s Nimsoft scripts, in order to terminate the contract and receive the benefits of
13
Enki’s enterprise and technology without continuing to pay for Enki’s services. 16 Enki brings this
14
action to recover for various breaches of contract, as well as violations of state and federal anti15
16
hacking statutes.
II.
17
A complaint must contain “a short and plain statement of the claim showing that the pleader
18
19
LEGAL STANDARDS
is entitled to relief.” 17 If a plaintiff fails to proffer “enough facts to state a claim to relief that is
20
10
21
See id. at ¶ 50-53. Scripts are typically programs written for a particular runtime environment,
such as Unix.
22
11
See id.at ¶ 30.
23
12
See id. at ¶ 35.
24
13
See id.at ¶ 40.
25
14
Id. at ¶ 54.
26
15
See id at ¶ 56.
27
16
See id.
28
17
Fed. R. Civ. P. 8(a)(2).
3
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
1
plausible on its face,” the complaint may be dismissed for failure to state a claim upon which relief
2
may be granted. 18 A claim is facially plausible “when the pleaded factual content allows the court
3
to draw the reasonable inference that the defendant is liable for the misconduct alleged.” 19
4
Accordingly, under Fed. R. Civ. P. 12(b)(6), which tests the legal sufficiency of the claims alleged
5
6
7
8
in the complaint, “[d]ismissal can be based on the lack of a cognizable legal theory or the absence
of sufficient facts alleged under a cognizable legal theory.” 20 “A formulaic recitation of the
elements of a cause of action will not do.” 21
On a motion to dismiss, the court must accept all material allegations in the complaint as
9
United States District Court
For the Northern District of California
10
true and construe them in the light most favorable to the non-moving party. 22 The court’s review is
11
limited to the face of the complaint, materials incorporated into the complaint by reference, and
12
matters of which the court may take judicial notice. 23 However, the court need not accept as true
13
allegations that are conclusory, unwarranted deductions of fact, or unreasonable inferences. 24
14
“Dismissal with prejudice and without leave to amend is not appropriate unless it is clear…
15
16
that the complaint could not be saved by amendment.” 25
17
18
19
18
Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007).
19
Ashcroft v. Iqbal, 556 U.S. 662, 663 (2009).
20
Balistreri v. Pacifica Police Dep’t., 901 F.2d 696, 699 (9th Cir. 1990).
21
Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007).
22
See Metzler Inv. GMBH v. Corinthian Colls., Inc., 540 F.3d 1049, 1061 (9th Cir. 2008).
23
See id. at 1061.
20
21
22
23
24
25
24
26
27
See Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001); see also Twombly,
550 U.S. at 561 (“a wholly conclusory statement of [a] claim” will not survive a motion to
dismiss).
25
28
Eminence Capital, LLC v. Asopeon, Inc., 316 F.3d 1048, 1052 (9th Cir. 2003).
4
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
III.
1
A. Enki’s CFAA Claim Fails to Allege Sufficient “Unauthorized Access”
2
Zuora and Freedman put forth two main theories as to why Enki’s claim under the CFAA
3
4
5
6
DISCUSSION
should be dismissed: 1) the complaint fails to allege loss or damage within the meaning of the
statute; and 2) the complaint fails to allege unauthorized access within the Ninth Circuit’s
interpretation of the statue.
7
Regarding Defendants’ first argument, although the Ninth Circuit has not yet ruled on
8
9
whether costs of investigation may be included in the calculation of loss under the CFAA, this
United States District Court
For the Northern District of California
10
district and others within the circuit have long accepted that theory. 26 The statutory definition of
11
loss includes “the cost of responding to an offense, conducting a damage assessment, and restoring
12
the data, program, system, or information to its condition prior to the offense.” 27 Before the
13
14
incident at issue here, Enki’s proprietary information was secured, and afterward, it evidentially
was not. It therefore stands to reason that the cost of investigating the source of the breach and
15
16
remedying it would qualify as “loss” within that definition, as they would be required to return the
17
system to its secured state. The undersigned therefore joins with his colleagues in holding that the
18
costs of investigating a security breach may be included in the calculation of “loss” under
19
the CFAA.
20
21
Defendants’ second argument, however, carries more weight. The CFAA imposes liability
where the defendant commits certain acts on a “protected computer” either “without authorization”
22
23
26
24
25
26
27
See, e.g., Facebook, Inc. v. Power Ventures, Inc., 844 F. Supp. 2d 1025, 1039 (N.D. Cal. 2012)
(“Costs associated with investigating intrusions into a computer network and taking subsequent
remedial measures are losses within the meaning of the statute.”); Multiven, Inc. v. Cisco Sys., Inc.,
725 F. Supp. 2d 887, 895 (N.D. Cal. 2010); SuccessFactors, Inc. v. Softscape, Inc., 544 F. Supp. 2d
975, 981 (N.D. Cal. 2008) (holding that “where the offender has actually accessed protected
information, discovering who has that information and what information he or she has is essential
to remedying the harm” and therefore qualifies as loss under the CFAA).
27
28
18 U.S.C. § 1030 (emphasis added).
5
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
1
or in “exce[ss of his] authorization.” 28 The Ninth Circuit has held that to access a protected
2
computer “without authorization” is to do so “without any permission at all,” and to “exceed
3
authorized access” is to “access[] information on the computer that the person is not entitled to
4
access.” 29 It has further held that an individual does not “exceed authorized access” simply by
5
6
misusing information that he or she was entitled to view for some other purpose; the CFAA
regulates access to data, not its use by those entitled to access it. 30
7
Here, Enki alleges that Freedman and Zuora violated the CFAA by “unlawfully access[ing]
8
9
the Nimsoft servers and improperly cop[ying] Enki’s Proprietary Information,” 31 and in particular
United States District Court
For the Northern District of California
10
Enki’s Nimsoft scripts. However, the complaint does not allege that Defendants were unauthorized
11
to access the scripts in question. In fact, the Statement of Work submitted for the court’s
12
consideration specifically grants Zuora and its representatives “sudo access” to “non-shell root
13
commands” that would include the scripts at issue. 32 Enki instead hangs its hat on its repeated
14
refusals to grant Zuora or Freedman the authority to write or edit those scripts. 33 That argument,
15
16
however, speaks to misuse of the scripts, not unauthorized access, which under Nosal does not run
17
afoul of the CFAA. Because Enki’s complaint fails to allege that Defendants had no access rights
18
to Enki’s scripts, and indeed the documents upon which it relies reveal that Defendants had certain
19
access rights, 34 their CFAA claim must be DISMISSED for failure to state a claim.
20
21
22
28
Id.
23
29
LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009).
24
30
See United States v. Nosal, 676 F.3d 854, 863 (9th Cir. 2012).
25
31
Docket No. 25 at ¶¶ 56-61.
26
32
See Docket No. 35-1, Ex. B.
27
33
See id. at ¶¶ 50-53.
28
34
See Docket No. 35-1, Ex. B.
6
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
B. Enki’s CDAFA Claim Fails to Allege A Sufficient Technical Code or Barrier
1
The only other claim that Freedman and Zuora substantively address in their motion is the
2
3
CDAFA claim. With respect to that claim, they argue that because Enki’s complaint fails to allege
4
that either Freedman or Zuora overcame any technical barrier in order to view and copy its
5
proprietary information, the claim must be dismissed for failure to state a claim. 35 Enki, however,
6
maintains that a violation of the established terms of use is sufficient to create liability under
7
8
9
CDAFA, and because the complaint alleges that Freedman and Zuora copied the information when
they were not permitted to do so, they have sufficiently pled their claim.
The CDAFA imposes liability where an individual takes certain actions “without
United States District Court
For the Northern District of California
10
11
permission” on another’s computer, network, or website. 36 Enki relies on a single case, Craigslist
12
v. Naturemarket, Inc., 37 to argue that a simple violation of the terms of use meets the requirement
13
that the action be “without permission.” 38 Craigslist, however, appears to be an outlier. Just four
14
months after Craigslist, in Facebook v. Power Ventures, Inc., 39 this court held that to take an action
15
16
“without permission” under the CDAFA, a defendant must overcome some technical or code
17
barrier. 40 This has been the governing standard in this district since that time, 41 and it is the
18
standard that applies here. As Enki itself does not even argue that the complaint alleges a technical
19
obstacle, the court GRANTS Defendants’ motion as to the CDAFA claim.
20
35
See Docket No. 32 at 15.
36
Cal. Penal Code. § 502.
37
694 F.Supp.2d. 1039 (N.D. Cal. 2010).
38
See Docket No. 35 at 15-16.
39
Case No. 5:08-cv-05780-JW, 2010 WL 3291750 (N.D. Cal. July 20, 2010).
40
See id. at *11.
21
22
23
24
25
26
41
27
28
See, e.g., In re Google Android Consumer Privacy Litig., Case No. 11-md-02264-JSW, 2013
U.S. Dist. LEXIS 42724 (N.D. Cal. Mar. 26, 2013); In re Facebook Privacy Litig., 791 F. Supp. 2d
705, 716 (N.D. Cal. 2011); In re iPhone Application Litig., Case No. 5:11-md-02250-LHK, 2011
WL 4403963 (N.D. Cal. Sept. 20, 2011).
7
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
C. The Court Will Retain Subject Matter Jurisdiction Over the Remaining State Law
Claims
1
2
Because jurisdiction over state law claims under § 1367 generally requires a federal hook, a
3
court may choose to decline jurisdiction over any lingering state law claims where all federal
4
5
claims in the case have been dismissed before trial. 42 Further, in the Ninth Circuit, “[i]t is usually
6
appropriate to dismiss pendent state claims when federal claims are dismissed before trial,” 43
7
although in each case, a court must assess the values of “economy, convenience, fairness, and
8
comity” in deciding whether or not to retain jurisdiction. 44
9
United States District Court
For the Northern District of California
10
Here, although the remaining claims are all grounded in state law, the parties are already
eight months into litigation in this forum, and it would hardly serve the interests of economy or
11
convenience to require the parties to begin anew in state court. In addition, because Enki has leave
12
13
to amend its complaint to remedy the deficiencies identified in its pleadings, the federal claim may
14
yet move forward in another version of the complaint. The court therefore will retain jurisdiction
15
over the lingering state law claims.
16
IV.
17
18
CONCLUSION
Defendants’ motion to dismiss is GRANTED as to the CFAA and CDAFA claims, which
are dismissed without prejudice and with leave to amend. Any amended pleading shall be filed by
19
20
21
22
February 23, 2014.
IT IS SO ORDERED.
Dated: January 23, 2014
23
_________________________________
PAUL S. GREWAL
United States Magistrate Judge
24
25
42
See 28 U.S.C.A. § 1367(c)(3).
43
McCarthy v. Mayo, 827 F.2d 1310, 1317 (9th Cir. 1987).
44
Acri v. Varian Assocs., 114 F.3d 999, 1001 n.3 (9th Cir. 1994).
26
27
28
8
Case No.: 5:13-cv-02201-PSG
ORDER GRANTING-IN-PART MOTION TO DISMISS
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?