Citcon USA, LLC v. RiverPay, Inc. et al

Filing 130

ORDER GRANTING DEFENDANTS' MOTION TO DISMISS; ORDERING CITCON TO FILE AN UPDATED THIRD AMENDED COMPLAINT. Re: Dkt. No. 109 . Citcon to submit an updated TAC within 7 days, by March 4, 2019. Signed by Judge Nathanael Cousins. (lmh, COURT STAFF) (Filed on 2/25/2019)

1
2
3
4
5
6
7

UNITED STATES DISTRICT COURT

8

NORTHERN DISTRICT OF CALIFORNIA

9
10

CITCON USA, LLC,
Plaintiff,

United States District Court
Northern District of California

11
12
13
14

v.
RIVERPAY INC., YUE “YORK” HUA,
and KENNY E. SHI,
Defendants.

Case No. 18-cv-02585-NC
ORDER GRANTING
DEFENDANTS’ MOTION TO
DISMISS; ORDERING CITCON TO
FILE AN UPDATED THIRD
AMENDED COMPLAINT
Re: Dkt. No. 109

15
16

In this trade secrets case, plaintiff Citcon brings 5 claims in its Third Amended

17

Complaint against defendants Yue “York” Hua, Kenny Shi, and RiverPay: (1) and (2)

18

trade secret misappropriation against Hua, Shi, and Riverpay; (3) conversion of funds

19

against Hua, Shi, and RiverPay; (4) conversion of a POS device against Hua and RiverPay;

20

and (5) unfair competition against Hua and Shi. Dkt. No. 103. Defendants move to

21

dismiss all claims for which Citcon was granted leave to amend: (1) and (2) trade secret

22

misappropriation against Hua, Shi, and RiverPay; (3) conversion of funds against Hua, Shi,

23

and RiverPay; and (4) conversion of a POS device against Riverpay. Dkt. No. 109. The

24

issue before the Court is whether Citcon has pled sufficient facts to raise facially plausible

25

claims that the defendants are liable for the conduct alleged. Because the Court finds that

26

Citcon has done so for all claims, the motion to dismiss is DENIED.

27
28

1

I.

BACKGROUND

2

A. The Pleading Stage

3

Citcon’s First Amended Complaint brought 11 claims against RiverPay, Hua, Shi,

4

and defendant Hang “Hank” Miao. Dkt. No. 8. Defendants moved to dismiss every count,

5

and the Court granted that motion as to all but one claim against one defendant, granting

6

Citcon leave to amend. Dkt. No. 52. Citcon’s Second Amended Complaint brought 12

7

claims against those same defendants. Dkt. No. 58. Defendants again moved to dismiss.

8

Dkt. Nos. 63, 64. The Court granted those motions to dismiss with leave to amend as to:

9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24

• Counts One and Two, trade secret misappropriation of:
o “business plans” against Hua, Shi and RiverPay
o “customer information” against Hua and RiverPay
o “transaction information” against Hua and RiverPay
o “source code” against Hua and RiverPay
o “POS designs” against Shi and RiverPay
• Count Ten (now Three): conversion of funds against Hua, Shi, and RiverPay
The Court granted the motions to dismiss without leave to amend as to:
•
•
•
•

Count Three: breach of duty of loyalty against Hua, Shi, and RiverPay
Count Four: defamation and trade libel against all defendants
Count Five: defamation against Miao, Shi, and RiverPay
Counts Six and Seven: computer fraud and abuse against Hua, Shi, and
RiverPay
• Counts Eight and Nine: intentional interference with contractual relations and
intentional interference with prospective economic relations against Hua, Shi,
and RiverPay
• Count Twelve: unfair competition against RiverPay
Finally, the Court denied the motions to dismiss as to:
• Counts One and Two:
o “customer information” against Shi
o “transaction information” against Shi
o “source code” against Shi
o “POS designs” against Hua
• Count Eleven: conversion of a POS device against Hua
• Count Twelve: unfair competition against Hua and Shi
Dkt. No. 98. No claims remained against defendant Hang “Hank” Miao. All claims

25
against RiverPay were dismissed, though many with leave to amend. Thus the following
26
claims comprise the Third Amended Complaint:
27
28

• Counts One and Two, against Hua, Shi, and RiverPay, for trade secret
misappropriation of:
2

1
2
3
4
5

o “business plans”
o “customer information”
o “transaction information”
o “source code”
o “POS designs”
• Count Three (formerly Ten): conversion of funds against Hua, Shi, and
RiverPay
• Count Four (formerly Eleven): conversion of a POS device against Hua
• Count Five (formerly Twelve): unfair competition against Hua and Shi
Citcon filed its Third Amended Complaint including the same twelve claims that appeared

6
in the Second. Dkt. No. 103. It states that it re-alleges those claims which were dismissed
7
without leave to amend for preservation on appeal; the Court will address this issue more
8
in Section III below. Next, the Court assesses only those claims for which it granted
9
Citcon leave to amend. Dkt. No. 98.
10
B. Factual Allegations of the Third Amended Complaint
11

United States District Court
Northern District of California

Citcon alleges the following in the Third Amended Complaint. Dkt. No. 103. In
12
deciding this motion, the Court assumes these allegations to be true and construes all facts
13
in the light most favorable to Citcon. See Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336,
14
337–38 (9th Cir. 1996).
15
Citcon provides services that allow merchants in the United States to accept
16
Chinese mobile system payments. Dkt. No. 103 at 2. RiverPay, founded in 2017, also
17
18

provides these services. Id. Hua was Citcon’s Head of Operations and Products until he
left to work at RiverPay in June 2017. Id. Shi was Citcon’s Vice President of Engineering

19
until he left in December 2017; he too now works at RiverPay. Id. at 3.
20
21
22

In September 2016, a Dropbox account was created using Shi’s email address to
back up Citcon’s customer transactions every day through keys embedded in Citcon’s
source code. Id. In September 2017, Shi told Citcon’s CEO Chuck Huang that he was

23
resigning, but Huang convinced him to withdraw his resignation. Id. at 3. That same
24
month, Shi created a shareable link to the Dropbox account that he had created the prior
25
year to allow authorization for access to it. Id.
26

In June 2017, Hua resigned from Citcon and took with him one of Citcon’s point-

27
of-sales (POS) devices. Id. Hua also downloaded the source code and POS designs from
28
3

1

Citcon’s computer at that time. Id. at 13. In December 2017, Shi resigned from Citcon.

2

Id. at 5. Before his departure, he downloaded documents including source code, POS

3

designs, client information, and transaction information. Id. at 7.
Citcon eventually discovered that the key to the Dropbox account created by Shi

4
5

was also embedded elsewhere in its source code. Id. Citcon deciphered the key and

6

gained access to the account, and thereby learned that it had been created using Shi’s email

7

address and that shareable links to it had been created. Id.
Citcon also discovered that Hua’s login to its MySQL database had never been

8
9

disabled when he left Citcon. Id. When Citcon disabled the login, its system crashed for a
week. Id. Shi was responsible for maintaining Hua’s login. Id. at 13. Using this login

11

United States District Court
Northern District of California

10

and the Dropbox account, Hua acquired Citcon’s transaction information and client

12

information. Id.
Hua and Shi then disclosed Citcon’s source code and POS designs to RiverPay for

13
14

use in RiverPay products, disclosed Citcon’s confidential transaction information to

15

RiverPay to unfairly compete with Citcon and harass its customers, and disclosed Citcon’s

16

client information to RiverPay to unfairly solicit Citcon’s customers. Id. at 14.
In early May 2018, a RiverPay executive proposed a merger between Citcon and

17
18

RiverPay while also making vague threats about a “bloody fight” between the companies.

19

Id. at 8. Citcon rejected the proposal and filed this lawsuit. Id. Three days after this suit

20

was filed, a cyberattack caused refunds to be fraudulently issued to some of Citcon’s

21

customers. Id. at 8–9. Citcon had to ask some customers to pay back the refunds. Id.

22

I.

23

LEGAL STANDARD
A motion to dismiss for failure to state a claim under Rule 12(b)(6) tests the legal

24

sufficiency of a complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). On a

25

motion to dismiss, all allegations of material fact are taken as true and construed in the

26

light most favorable to the non-movant. Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337–

27

38 (9th Cir. 1996). The Court, however, need not accept as true “allegations that are

28

merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re
4

1

Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). Although a complaint need

2

not allege detailed factual allegations, it must contain sufficient factual matter, accepted as

3

true, to “state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly,

4

550 U.S. 544, 570 (2007). A claim is facially plausible when it “allows the court to draw

5

the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft

6

v. Iqbal, 556 U.S. 662, 678 (2009).

7

II.

DISCUSSION
A. Counts One and Two: Trade Secret Misappropriation

9

Citcon alleges that Hua, Shi, and RiverPay misappropriated five categories of its

10

trade secrets under both 18 U.S.C § 1836 (the Defend Trade Secrets Act, or DTSA) and

11

United States District Court
Northern District of California

8

California Civil Code § 3426.1 (the California Uniform Trade Secrets Act, or CUTSA).

12

To plead trade secret misappropriation under both the DTSA and the CUTSA, a plaintiff

13

must plead (1) its ownership of the trade secret, (2) that the defendant acquired it through

14

improper means, and (3) that the defendants’ actions damaged the plaintiff. See Rockwell

15

Collins Inc. v. Wallace, Case No. 17-cv-1369 AG, 2017 WL 5502775, at *2 (C.D. Cal.

16

Nov. 10, 2017).

17

“Both the DTSA and the CUTSA define a trade secret as information that (1)

18

derives its economic value from not being generally known, and (2) is subject to

19

reasonable measures of secrecy by its owner.” Rockwell, 2017 WL 5502775, at *2. The

20

trade secret must be identified with “sufficient particularity to separate it from the matters

21

of general knowledge in the trade . . . and to permit the defendant to ascertain at least the

22

boundaries within which the secret lies.” See Space Data Corp. v. X, Case No. 16-cv-

23

3260-BLF, 2017 WL 5013363, at *2 (N.D. Cal. Feb. 16, 2017). However, “trade secrets

24

need not be disclosed in detail in a complaint alleging misappropriation for the simple

25

reason that such a requirement would result in public disclosure of the purported trade

26

secrets.” Autodesk, Inc. v. ZWCAD Software Co., Case No. 14-cv-1409-EJD, 2015 WL

27

2265479, at *6 (N.D. Cal. May 13, 2015) (quoting Leucadia, Inc. v. Applied Extrusion

28

Techs., Inc., 755 F. Supp. 635, 636 (D. Del. 1991)).
5

1

Here, Citcon claims that the defendants misappropriated five categories of trade
secrets: business plans, customer information, transaction information, POS designs, and

3

source code. Dkt. No. 103 at 10–11. The Court previously dismissed the “business plans”

4

claim because Citcon inadequately identified that alleged trade secret. Dkt. No. 98. In its

5

TAC, Citcon has supplied significantly more detail about this claim and the Court finds

6

that it now sufficiently gives notice to the defendants and the Court as to the boundaries of

7

that claim. See Space Data, 2017 WL 5013363, at *2. The Court has already found that

8

the other trade secrets categories were sufficiently pled. Dkt. No. 98. The instant Order

9

addresses those outstanding trade secrets claims for which the Court gave Citcon leave to

10

amend after the last round of motions to dismiss: Hua’s and RiverPay’s misappropriation

11

United States District Court
Northern District of California

2

of all five categories of trade secrets; and Shi’s misappropriation of business plans and

12

POS designs.

13

i. Pleading Standard: Trade Secret Acquisition and Use

14

Trade secret misappropriation can be established via wrongful acquisition or

15

wrongful use, i.e., use without consent. Autodesk, 2015 WL 2265479, at *5; see also Cal.

16

Civ. Code § 3426.1.

17

Citcon inaccurately relies on Autodesk to argue that it need not plead precisely how

18

the defendants acquired the trade secrets. There, the plaintiff did not make any specific

19

factual allegation about the method by which the defendant had obtained the trade secrets

20

at issue. Autodesk, 2015 WL 2265479, at *6. However, the plaintiff had instead pled with

21

great specificity facts to support an inference that the defendant had improperly used the

22

trade secrets. For example, Autodesk supplied multiple screenshots of each company’s

23

software product displaying highly unusual and idiosyncratic errors which would have

24

likely only resulted from substantially identical source code. Id. at *2. Because the

25

plaintiff had so thoroughly pled improper use, the Court found that it need not also plead

26

improper acquisition. Id. at *6.

27
28

Here, Citcon does not plead nearly such a robust factual basis to show that any of
the defendants improperly used any of its trade secrets. Instead, it uses vague terms to
6

1

describe that use (e.g. RiverPay misappropriated the transaction information “through

2

improper use . . . to unfairly compete with Citcon”). Dkt. 103 at 12. Meanwhile, Citcon

3

pleads some facts to suggest that the defendants improperly acquired the trade secrets,

4

which the Court will analyze as to each defendant separately below.

5

ii. Hua and Shi

6

Citcon states that Hua “took the Source Code and the POS designs when he

7

departed Citcon in June 2017, downloading them from Citcon’s computer systems.” Dkt.

8

No. 103 at 13. Citcon also alleges that Hua acquired its business plans, customer

9

information, and transaction information by repeatedly accessing Citcon’s computer
system via the Dropbox account and his MySQL login once his employment at Citcon had

11

United States District Court
Northern District of California

10

ended. Id. Hua allegedly next “wrongfully used and disclosed” the source code and POS

12

designs “by incorporating them into RiverPay’s competing products.” Id.

13

Likewise, Citcon alleges that Shi misappropriated its business plans and POS

14

designs by downloading them from Citcon’s computer system when he departed Citcon at

15

the end of 2017. Id. Shi then helped Hua with his alleged misappropriation through the

16

Dropbox and MySQL login. Id. Later, Shi used the trade secrets by incorporating them

17

into RiverPay’s products and unfairly competing with Citcon’s customers. Id.

18

Though the allegation that Hua and Shi “took” these secrets when they departed

19

Citcon is somewhat vague, the Court finds that, taken as true, the specific fact that Hua and

20

Shi downloaded those secrets from Citcon’s computers constitutes enough to plead

21

misappropriation via improper acquisition. See Cal. Code Civ. Proc. § 3426.1(a); 18

22

U.S.C. § 1839(6)(A). The Motion to Dismiss is DENIED as to Counts One and Two

23

against Hua and Shi.

24

iii.

RiverPay

25

Under the DTSA, the “improper means” used to acquire a trade secret may include

26

“theft, bribery, misrepresentations, breach or inducement of a breach of a duty to maintain

27

secrecy, or espionage through electronic or other means.” 18 U.S.C. § 1839(6). Citcon

28

pleads that “RiverPay directed Hua, and encouraged him with a promise of ‘co-founder’
7

1

status, to misappropriate Citcon’s trade secrets.” Dkt. No. 103 at 17. Citcon similarly

2

pleads that “Hua was directed to retain the POS device by RiverPay as a condition of his

3

receiving co-founder status as RiverPay.” Id. at 32.
The Court finds that this alleged direction is enough to plead RiverPay’s liability for

4
5

misappropriation of trade secrets as both bribery and inducement to breach a duty of

6

secrecy.1 Because the Court finds that Citcon has sufficiently pled that RiverPay

7

misappropriated its trade secrets, the Motion to Dismiss is DENIED as to Counts One and

8

Two against RiverPay.
B. Count Three (formerly Ten): Conversion of Funds

9

To plead a claim for conversion, a plaintiff must allege (1) ownership or right to

10

United States District Court
Northern District of California

11

possession, (2) defendants’ conversion by a wrongful act or disposition of property rights;

12

and (3) damages. Lee v. Hamley, 354 P.3d 334, 344 (Cal. 2015). Citcon pleads that the

13

defendants converted its funds through what it calls the “Refund Attack,” wherein the

14

defendants allegedly issued fraudulent refunds to Citcon’s customers. Dkt. No. 103 at 3.1

15

i. Hua and Shi

16

Citcon pleads that Hua and Shi used specific confidential information to issue the

17

refunds. Id. The details of the attack indicate that someone with expertise on Citcon’s

18

systems perpetrated it; Hua and Shi have that knowledge. Id. Citcon states that “[t]he

19

attack required significant insider knowledge” of particular confidential information about

20

Citcon’s “merchant tokens” known to both Hua and Shi. Id. Some of this information was

21

allegedly downloaded when Hua and Shi took trade secrets when they left Citcon. Id.

22

These facts are sufficient to plausibly allege that Hua and Shi are liable for the fraudulent

23

refund attack. The Motion to Dismiss is DENIED as to Count Three against Hua and Shi.

24

ii. RiverPay

25

Citcon has two theories of RiverPay’s liability for trade secret misappropriation:

26

direct liability and vicarious liability.

27
28

Because the Court finds that Citcon has sufficiently pled RiverPay’s liability, it does not
discuss Citcon’s aiding and abetting or conspiracy theories.
8
1

1

As to direct liability, Citcon pleads virtually no facts; it only argues that RiverPay

2

had the motive to launch the attack as “Citcon’s only close competitor” and points out that

3

the attack preceded RiverPay’s CEO making a vague threat to Citcon about a “bloody

4

fight” between the companies. Id. at 8. The Court previously dismissed this claim against

5

RiverPay on the grounds that these vague threats did not show that RiverPay was liable for

6

the refund attack. Dkt. No. 98 at 18. Nothing has changed.

7

As to vicarious liability, Citcon argues that RiverPay is liable for the conversion
committed by Hua and Shi as their employer. Employers are liable for torts committed by

9

their employees within the scope of their employment. Lisa M. v. Henry Mayo Mewhall

10

Mem. Hosp., 12 Cal.4th 291, 296 (1995). If an employee’s tort is willful, malicious, or

11

United States District Court
Northern District of California

8

criminal, the employer may be liable whether or not it authorized the tort. Id. The tort,

12

though, must have a causal nexus to the employee’s work. Id. at 297; see also Carr v.

13

Wm. C. Crowell Co., 28 Cal.2d 652 (1956). The tort must be engendered by or arise from

14

the work. Id. One test for whether an employer should be held liable for its employees’

15

tort is the foreseeability test from Rodgers v. Kemper Constr. Co., which asks whether the

16

tort was a generally foreseeable consequence of the employer’s activity, so that losses

17

fairly attributable to an enterprise should be allocated to the enterprise as a cost of doing

18

business. 50 Cal. App. 3d 608, 618 (1975).

19

Here, Citcon has pled that by the time of the refund attack in May 2018, Hua was an

20

employee of RiverPay. Dkt. No. 103 at 2–3 (Hua left Citcon “to join RiverPay” in June

21

2017). However, Citcon never pleads in its TAC if or when Shi began work at RiverPay,

22

except to state that Shi “left Citcon as the end of 2017 and is currently working for

23

RiverPay.” Id. at 3. Citcon cannot claim RiverPay’s vicarious liability over any of Shi’s

24

actions without establishing when Shi worked for RiverPay.

25

But Hua’s alleged actions are enough. Citcon has pled sufficient facts to raise a

26

plausible inference that Hua was behind the refund attack. The attack would constitute a

27

willful, malicious, or criminal tort. See Lisa M., 12 Cal.4th at 296. The tort had a causal

28

nexus to Hua’s employment at RiverPay, because the companies are competitors in the
9

1

same field and create similar products targeting similar customers. Dkt. No. 103 at 2.

2

That an employee might misappropriate trade secrets of a former employee and competitor

3

to commit tortious acts against that competitor is a generally foreseeable consequence of

4

RiverPay’s business. See Rodgers, 50 Cal. App. 3d at 618. Citcon has pled sufficiently

5

that RiverPay is vicariously liable for Hua’s alleged refund attack.

6

The Motion to Dismiss is DENIED as to Count Three against RiverPay.

7

C. Count Four (formerly Eleven): Conversion of a POS Device as to RiverPay

8

To plead a claim for conversion, a plaintiff must allege (1) ownership or right to
possession, (2) defendants’ conversion by a wrongful act or disposition of property rights;

10

and (3) damages. Lee v. Hamley, 254 P.3d 334, 344 (Cal. 2015). To plead a conspiracy, a

11

United States District Court
Northern District of California

9

plaintiff must show (1) the existence of an underlying tort, (2) an agreement to commit an

12

unlawful act, (3) wrongful acts committed in furtherance of the common agreement, and

13

(4) injury. Young v. Hamilton, 92 Fed. Appx. 389, 393 (9th Cir. 2003).

14

Citcon alleges that Hua stole a POS device when he left the company and brought

15

the device to RiverPay. Dkt. No. 103 at 32. Citcon argues that RiverPay is liable for this

16

conversion under a conspiracy theory. Specifically, Citcon alleges that RiverPay induced

17

Hua to steal the device with a promise of co-founder status at RiverPay. Id. Defendants

18

argue that this promise does not constitute an agreement under Twombly. 500 U.S. at 556–

19

57. But the Court finds that, if true, the promise to reward Hua with co-founder status if he

20

brought the device to RiverPay is sufficient to show an agreement to commit an unlawful

21

act. Young, 92 Fed. Appx. at 393. This pleading is more robust than a simple formulaic

22

accusation that a conspiracy existed, like in Twombly. 550 U.S. at 557.

23
24
25

The motion to dismiss is DENIED as to Count Four against RiverPay.
III. CITCON’S TAC VIOLATES THE COURT’S PREVIOUS ORDERS
Citcon’s TAC includes the claims and defendant that the Court dismissed from this

26

case without leave to amend in its previous orders. See Dkt. No. 103. Defendants have

27

requested through meet and confer efforts and through motions to the Court that Citcon

28

remove the dismissed claims and defendant from the TAC. See Dkt. Nos. 109, 119, 125.
10

1

Citcon argues that it includes these counts for preservation on appeal, indicating such via

2

footnotes in the TAC, and that doing so is not prohibited. Dkt. No. 119. Ninth Circuit law

3

is clear that dismissed claims are preserved on appeal regardless of their inclusion in later

4

amended complaints. Lacey v. Maricopa Cty., 693 F.3d 896, 928 (9th Cir. 2012).

5

Continuing to plead dismissed claims and name a dismissed defendant is in violation of the

6

Court’s orders on the motions to dismiss.

7

The Court finds that an updated complaint containing only the remaining claims and
defendants would aid the parties in the future of this litigation by simplifying and

9

clarifying which claims move forward out of the pleading stage. Thus the Court ORDERS

10

Citcon to file a new TAC excluding those claims that the Court dismissed without leave to

11

United States District Court
Northern District of California

8

amend, and excluding former defendant Hang “Hank” Miao who is no longer a party to

12

this action. Citcon may use the new numbering provided for the Court in this Order to

13

identify its claims and the parties may use these numbers moving forward.

14

IV. CONCLUSION

15
16
17
18
19
20
21
22
23

The motion to dismiss the Third Amended Complaint is DENIED. The Court has not
granted leave to further amend any claims it has dismissed. The following claims remain:
• Counts One and Two, against Hua, Shi, and RiverPay for trade secret
misappropriation of:
o “business plans”
o “customer information”
o “transaction information”
o “source code”
o “POS designs”
• Count Three (formerly Ten): conversion of funds against Hua, Shi, and
RiverPay
• Count Four (formerly Eleven): conversion of a POS device against Hua and
RiverPay
• Count Five (formerly Twelve): unfair competition against Hua and Shi
Citcon is ORDERED to submit an updated TAC within 7 days, by March 4, 2019.

24
Defendants must answer within 14 days of service of the updated TAC.
25
IT IS SO ORDERED.
26
Dated: February 25, 2019
27
28

_____________________________________
NATHANAEL M. COUSINS
United States Magistrate Judge
11