Monson v. Whitby School, Inc.

Filing 80

Ruling and ORDER denying 77 Motion to Dismiss. Signed by Judge Mark R. Kravitz on 8/2/10. (Brown, S.)

Monson v. Whitby School, Inc.

Doc. 80

UNITED STATES DISTRICT COURT DISTRICT OF CONNECTICUT MICHELE MONSON, Plaintiff, v. THE WHITBY SCHOOL, INC., Defendant. : : : : : : : : :

NO. 3:09CV1096 (MRK)

RULING AND ORDER Dr. Michelle Monson has brought suit against her former employer, The Whitby School, Inc. ("Whitby"), where she worked as the Head of School from 2000 until her termination in March 2008. See Compl. [doc. # 1] ¶ 7. Dr. Monson asserts claims of sex discrimination, in violation of Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e et seq. and the Connecticut Fair Employment Act, Conn. Gen. Stat. § 46a-60 et seq., as well as breach of contract. See Compl. [doc. # 1]. Defendant Whitby, for its part, has asserted six counterclaims, see Def.'s Counterclaims [doc. # 67] ¶¶ 66-110, three of which Dr. Monson has moved to dismiss under Rule 12(b)(6) of the Federal Rules of Civil Procedure, see Pl.'s Mot. to Dismiss Counterclaims Two through Four [doc. # 77]. The three counterclaims that Dr. Monson seeks to dismiss allege violations of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a); Title II of the Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2701 (governing unauthorized access to stored communications); and Conn. Gen. Stat. §52-570b, which provides a civil cause of action for violations § 53a-251 (defining certain computer crimes).1 See Def.'s Counterclaims [doc. # 67] ¶¶ 72-95. For the reasons that follow, Dr. Monson's Motion to

Whitby's other counterclaims, not subject to the Motion to Dismiss, allege a breach of contract, breach of fiduciary duty, and breach of the covenant of good faith and fair dealing. See Def.'s Counterclaims [doc. # 67] ¶¶ 66-71, 96-110. 1
Dockets.Justia.com

1

Dismiss Counterclaims Two through Four [doc. # 77] is DENIED, but without prejudice to renewal in the context of a motion for summary judgment. I. The function of a motion to dismiss under Rule 12(b)(6) is to determine whether the plaintiff ­ or here, the counter-claimant ­ has stated a legally-cognizable claim that, if proven, would entitle it to relief. Due to this circumscribed purpose, when considering a motion to dismiss, the Court accepts as true all factual allegations in the counter-claims and draws all inferences from these allegations in the light most favorable to the counter-claimant. See Hemi Group, LLC v. City of New York, N. Y., ___ U.S. ___, 130 S.Ct. 983, 987 (2010); Boykin v. KeyCorp, 521 F.3d 202, 214 (2d Cir. 2008). To survive a motion to dismiss, "a [counter-claim] must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, ___ U.S. ___, 129 S.Ct. 1937, 1949 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)); see also Selevan v. N.Y. Thruway Auth., 584 F.3d 82, 95 (2d Cir. 2009). Two working principles underlie the Supreme Court's plausibility standard. See Iqbal, 129 S.Ct. at 1949. "First, although 'a court must accept as true all of the allegations contained in a [counter-claim],' that 'tenet' 'is inapplicable to legal conclusions' and 'threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.'" Harris v. Mills, 572 F.3d 66, 72 (2d Cir. 2009) (quoting Iqbal, 129 S.Ct. at 1949). That said, the Rule 8 pleading threshold "does not require 'detailed factual allegations,' [though] it demands more than an unadorned, the-[counter]-defendant-unlawfully-harmed-me accusation." Iqbal, 129 S.Ct. at 1949. "'Second, only a [counter-claim] that states a plausible claim for relief survives a motion to dismiss' and 'determining whether a [counter-claim] states a plausible claim for relief will . . .

2

be a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.'" Id. (quoting Iqbal, 129 S.Ct. at 1950); see also Austen v. Catterton Partners V, LP, ___ F. Supp. 2d ___, No. 3:09CV1257, 2010 WL 625389, at *2 (D. Conn. Feb. 17, 2010) (discussing the importance of "[c]ontext, good judgment and common sense" in deciding motions to dismiss). Additionally, while some may have interpreted Twombly and Iqbal as imposing a heightened pleading standard beyond what is required by Rule 8 of the Federal Rules of Civil Procedure, that interpretation has been explicitly rejected by the Second Circuit. See Arista Records LLC v. Doe, 604 F.3d 110 (2d Cir. 2010). As the court stated in Arista Records, "[A]lthough Twombly and Iqbal require 'factual amplification [where] needed to render a claim plausible,' we reject [the] contention that Twombly and Iqbal require the pleading of specific evidence or extra facts beyond what is needed to make the claim plausible." Id. at 120-21 (quoting Turkmen v. Ashcroft, 589 F.3d 542, 546 (2d Cir. 2009) (alteration in original)). II. The factual allegations underlying the three counterclaims subject to the Motion to Dismiss are simple and straightforward, and the Court will not belabor them here. In short, Whitby alleges that during her employment with the school, Dr. Monson gained unauthorized access to the Whitby email server to unlawfully view and delete email messages contained in the email accounts of other Whitby employees. See, e.g., Def.'s Counterclaims [doc. # 67] ¶¶ 58-64. Upon learning of her impending termination, Whitby alleges, Dr. Monson used this unauthorized access to delete more than 1,500 email messages. See id. ¶ 64. Further, Whitby alleges that after she was terminated, Dr. Monson intentionally deleted data and software programs that resided on her school-issued computers before she returned them to the school. See id. ¶ 65. According to

3

Whitby, it is spent in excess of $5,000 attempting to restore data and programs that were lost as a consequence of Dr. Monson's unauthorized actions. See id. ¶¶ 80-81, 88-89, 94-95. III. Dr. Monson argues that the aforementioned factual allegations do not state a plausible claim for relief under any of the three contested counterclaims. At this early stage of the case, the Court disagrees, although whether Whitby will be able to prove its counterclaims is certainly a different matter. A. The Fourth Counterclaim asserts a claim based on the CFAA. See Def.'s Counterclaims [doc. # 67] ¶¶ 90-95. The CFAA prohibits, inter alia, "intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected computer." 18 U.S.C. § 1030(a)(2)(C). A "protected computer" is one that "is used in or affecting interstate or foreign commerce or communication," id. § 1030(e)(2)(B), and "the term 'exceeds authorized access' means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter," id. § 1030(e)(6). To bring a civil action under the CFAA, the party asserting the claim must plead and ultimately prove one or more particular injuries. See id. § 1030(g). The only such injury relevant to Whitby's counterclaim requires "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." Id. § 1030(c)(4)(A)(i)(I); see also id. § 1030(g) ("Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages."). Losses that may be included to meet this threshold include "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or

4

information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." Id. § 1030(e)(11). See also Nexans Wires S.A. v. Sark-USA, Inc., 166 Fed. Appx. 559, 561-62 (2d Cir. 2006) (summary order); Cenveo, Inc. v. Rao, 659 F. Supp. 2d 312, 315-17 (D. Conn. 2008). Thus, to state a valid claim under the provisions of the CFAA that it has invoked, Whitby must allege that (1) Dr. Monson intentionally accessed a protected computer (2) without authorization or in excess of her authorized access, and that (3) she obtained information from the protected computer by virtue of that access, thereby (4) causing Whitby monetary losses, broadly construed, in excess of $5,000. This Whitby has done. See Def.'s Counterclaims [doc. # 67] ¶¶ 90-95. In arguing that the CFAA claim should be dismissed, Dr. Monson principally attacks the second element described above, regarding whether Dr. Monson's alleged actions ­ deleting her own emails before and after her termination; accessing and deleting the emails of other Whitby employees; and deleting data and programs from her school-issued computers after her termination but before returning them to Whitby ­ were, in fact, authorized. See Pl.'s Mem. in Supp. of Mot. to Dismiss Second Through Fourth Counterclaims ("Pl.'s Mem.") [doc. # 77-1] at 16-22. Dr. Monson assails Whitby's allegations regarding the extent of her authorization as "conclusory" and "talismanic," arguing that they wholly fail to state a claim for relief "that is plausible on its face." Id. at 16 (quoting Twombly, 550 U.S. at 570). The Court disagrees. While it may not be "plausible" that Dr. Monson was not authorized to delete emails from her own work-provided inbox while she was employed by Whitby, see, e.g., Penrose Computer Marketgroup, Inc. v. Camin, 682 F. Supp. 2d 202, 211-12 (N.D.N.Y. 2010) (finding that an employee's deletion of his own email cannot support a claim under Title II of the ECPA), there

5

is nothing implausible about the allegations that she was not permitted to access her subordinate's email accounts ­ much less to delete emails therein ­ or that she was not permitted to delete software programs, data, and even emails in her own email account once her employment was terminated, see, e.g., id. at 210 (accessing other employee's email accounts can support such a claim); Dedalus Foundation v. Banach, No. 09CV2842, 2009 WL 3398595, at *4 (S.D.N.Y. Oct. 16, 2009); Calyon v. Mizuho Securities USA, Inc., No. 07CV2241, 2007 WL 2618658, at *1 (S.D.N.Y. July 24, 2004) ("[T]he plain language of [the CFAA] seems to contemplate that, whatever else, 'without access' and 'exceeds authorized access' would include an employee who is accessing documents on a computer system which that employee had to know was in contravention of the wishes and interests of his employer."). Moreover, while Dr. Monson argues that Whitby's allegation that her actions were "unauthorized" is too "conclusory" to state a viable claim, it is difficult to imagine how else Whitby could plead this necessary element. The purpose of Rule 8 is to provide a defendant notice of what they are alleged to have done that the plaintiff claims was unlawful. See Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 319 (2007). Rule 8 does not, and never has, required a plaintiff to resort to thesauruses or to set forth a dissertation when the context makes it apparent that a single, appropriately-precise word will suffice "to give the defendant fair notice of what the plaintiff's claim is and the grounds upon which it rests." Id. (citation and quotation marks omitted). Nothing in either Twombly or Iqbal altered this common-sense approach to pleading standards. See Arista Records, 604 F.3d at 120-21; Austen, 2010 WL 625389, at *2 ("Context, good judgment and common sense mattered long before the Supreme Court decided Twombly and Iqbal, and they remain significant in deciding Rule 12(b)(6) motions even after those decisions.").

6

In the context of its claim under the CFAA ­ and, for that matter, the other two challenged counterclaims, as discussed below ­ Whitby need only allege that Dr. Monson's actions were taken beyond the scope of whatever authorization she had been granted. This is precisely what Whitby has done. See Def.'s Counterclaims [doc. # 67] ¶ 91 ("Dr. Monson intentionally accessed Whitby's protected computers used in interstate commerce and on the Internet by exceeding her authorization."); id. ¶ 92 ("Dr. Monson intentionally obtained information and altered and destroyed computer data and programs from Whitby's protected computers."); see also Banach, 2009 WL 3398595, at *4 ("[Plaintiff] has alleged facts sufficient to put [Defendant] on notice of the CFAA claim. A plaintiff asserting a CFAA claim, must only allege the required elements pursuant to Rule 8(a)(2)'s notice pleading standard, not Rule 9(b)'s heightened pleading standard."). Notably, Dr. Monson never argues that she cannot discern "what [Whitby's] claim is and the grounds upon which it rests." Tellabs, 551 U.S. at 319. Instead, she argues that Whitby's contention that she exceeded her authority in deleting emails is factually incorrect, based upon the authority she purportedly enjoyed as the Head of School. See, e.g., Pl.'s Mem. [doc. # 77-1] at 17-18. Dr. Monson may be right, and she may, of course, present this argument on a motion for summary judgment. But on a motion to dismiss, the Court must accept as true Whitby's allegations, including that Dr. Monson's actions in deleting data were in excess of her delegated authority. See Cohen v. Gerson Lehrman Group, Inc., 686 F. Supp. 2d 317, 325 (S.D.N.Y. 2010) ("Evidence that purported to contradict or support the content of pleadings is more properly considered at summary judgment or at trial, and has no place in a Rule 12(b)(6) motion."). The only other argument that Dr. Monson asserts in support of the dismissal of the CFAA claim is that even though she may have deleted data from her school-issued computers prior to

7

returning them to Whitby, she only permanently deleted personal data, and provided Whitby with all of its data on removable storage. See id. at 21 ("Plaintiff is prepared to present evidence that, when these computers were returned, they were accompanied by substantial numbers of disks or memory sticks containing operating systems and data files belonging to Whitby and that she returned to Whitby all operating systems that belonged to the school and all non-personal (i.e., Whitby-related) data files."). Here again, Dr. Monson may be correct, but a motion to dismiss is not the proper procedural vehicle to present such evidence. See Cohen, 686 F. Supp. 2d at 325. For the foregoing reasons, Dr. Monson's Motion to Dismiss [doc. # 77] the Fourth Counterclaim is DENIED, but without prejudice to renewal in the context of a motion for summary judgment. B. The Third Counterclaim is premised on Title II of the ECPA. See Def.'s Counterclaims [doc. # 67] ¶¶ 82-89. Section 2707(a) of Title 18 of the U.S. Code provides a private right of action for anyone "aggrieved by any violation of [Title II of the ECPA] in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind." 18 U.S.C. § 2707(a). The substantive provisions of Title II of the ECPA, in turn, state that: Except as provided in subsection (c) of this section whoever­ (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system [violates Title II of the ECPA]. 18 U.S.C. § 2701(a). Subsection (c), in relevant part, provides an affirmative defense if the conduct at issue was "authorized (1) by the person or entity providing a wire or electronic 8

communications service; [or] (2) by a user of that service with respect to a communication of or intended for that user." Id. § 2701(c); see also, e.g., Organizacion JD LTDA v. United States DOJ, 124 F.3d 354, 357 (2d Cir. 1997); Camin, 682 F. Supp. 2d at 208-12; Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, LLC, 587 F. Supp. 2d 548, 555-56 (S.D.N.Y. 2008). Therefore, to state a claim under Title II of the ECPA, Whitby is required to allege that (1) Dr. Monson intentionally or knowingly (2)(a) accessed without authorization a facility providing electronic communication service, or (2)(b) exceeded her access to a facility and thereby obtained access to or prevented authorized access to a stored communication. Here again, Whitby has done so. See Def.'s Counterclaims [doc. # 67] ¶¶ 82-89. Dr. Monson's sole argument in support of her motion to dismiss this counterclaim is that Whitby's "conclusory" and "formulaic repetition that Dr. Monson 'exceeded her authority' is insufficient to establish a plausible claim of unauthorized access." Pl.'s Mem. [doc. # 77] at 23. For the reasons previously discussed with regard to the CFAA counterclaim, the Court disagrees. Whitby has sufficiently pleaded that Dr. Monson's actions were beyond her authority. See Def.'s Counterclaims [doc. # 67] ¶ 83 ("Dr. Monson intentionally exceeded her authority by accessing Whitby's electronic information without authorization, deleting computer data, programs and files from her Whitby issued computers, and deleting emails from other employee's email boxes."). Here, too, Dr. Monson attempts to argue that her role as Head of School entitled her to take the actions that she did; and once more, Dr. Monson may be correct, but this is not the proper context to raise that fact-intensive argument. See, e.g., Camin, 682 F. Supp. 2d at 210 (denying a motion to dismiss a claim under Title II of the ECPA because even "[a]ccepting, arguendo, that Defendant had full access to the Plaintiff's computer system, this does not support the conclusion that Defendant had authorization to access another employee's email account.").

9

C. Finally, the Second Counterclaim asserts a claim for relief under Connecticut law. See Def.'s Counterclaims [doc. # 67] ¶¶ 72-81. Conn. Gen. Stat. § 52-570b provides a private right of action to "any person who suffers an injury to person, business or property . . . against a person who is alleged to have violated any provision of section 53a-251." Section 53a-251, in turn, defines various computer crimes ­ though a litigant can bring a claim under § 52-570b even absent criminal proceedings. See Conn. Gen. Stat. § 52-570b. Whitby alleges that Dr. Monson violated §§ 53a-251(e)(2)(A) and (e)(2)(B), which provide that: A person is guilty of the computer crime of misuse of computer system information when: . . . (2) he intentionally or recklessly and without authorization (A) alters, deletes, tampers with, damages, destroys or takes data intended for use by a computer system, whether residing within or external to a computer system, or (B) intercepts or adds data to data residing within a computer system; . . . . Conn. Gen. Stat. § 53a-251(e)(2); see also, e.g., News Am. Mktg. In-Store, Inc. v. Marquis, 86 Conn. App. 527, 546-48 (2004); Charter Oak Lending Group, Inc. v. August, No. X01CV054009529S, 2009 WL 2450734, at *4-5 (Conn. Super. Ct. July 8, 2009). Thus, to state a viable claim under Conn. Gen. Stat. § 53a-251(e)(2)(A), Whitby must plead factual content alleging that (1) Dr. Monson intentionally or recklessly and (2) without authorization, (3) altered, in some sense, data intended for use by a computer system, thereby (4) causing injury to Whitby's business or property. A claim under § 53a-251(e)(2)(B) requires the first two and the last elements, but replaces (3) with the requirement that Dr. Monson intercepted or added data to a computer system. Whitby has adequately pleaded a claim under both

subsections of § 53a-251. See Def.'s Counterclaims [doc. # 67] ¶¶ 72-81. Dr. Monson makes two arguments for dismissal of the Second Counterclaim. First, she claims that Whitby's "factual allegations concerning Dr. Monson's access to the Whitby

10

computer network while she was still employed as Head of School are insufficient to establish a plausible claim." Pl.'s Mem. [doc. # 77] at 25. For the reasons already discussed, the Court disagrees, as Whitby has sufficiently alleged that Dr. Monson exceeded her authority. Compare Def.'s Counterclaims [doc. # 67] ¶ 73-77 (alleging that Dr. Monson took various actions without authorization or in excess of her authority) with Miron v. McNeil, No. CV095021085S, 2010 WL 1508511, at *5 (Conn. Super. Ct. Mar. 12, 2010) (granting a motion to strike a claim under § 53a-251 because "plaintiff has failed to allege that actions of the defendant . . . were unauthorized."). Dr. Monson can renew her argument that the evidence establishes that she acted within her authority within the proper context ­ a motion for summary judgment. See, e.g., Charter Oak Lending Group, 2009 WL 2450734, at *5 ("The crucial element in the violation of this statutory framework is that the individual defendant had to know that access was unauthorized at the time such access was made. It was never established by credible evidence from the plaintiff that the access by the various defendants was not authorized.") (emphasis added); Delcath Systems, Inc. v. Foltz, 2007 WL 196518, at *6 ("[T]he evidence establishes that the defendant's use of his home computer with respect to the plaintiff's files was authorized. Accordingly, plaintiff's allegation of a violation of General Statutes § 53a-251 based on such conduct must fail.") (emphasis added). Dr. Monson's second argument is similar to one already discussed; she argues that: Defendant's factual allegations that Dr. Monson deleted programs and data on the desktop and laptop which she subsequently returned to the school likewise fall short of stating a cognizable claim for relief . . . because defendant (almost certainly deliberately) fails to allege that any data missing from Dr. Monson's computers was not otherwise in defendant's possession. Pl.'s Mem. [doc. # 77] at 25. There are several problems with this argument. First, Whitby is not required to allege that the deleted data was not otherwise in its possession. It only needed to

11

allege that it suffered an "injury," such as "actual damages, unjust enrichment, actual loss or pecuniary loss," Marquis, 86 Conn. App. at 547, which Whitby has done. See Def.'s

Counterclaims [doc. # 67] ¶ 78 ("Whitby incurred actual financial losses due to the cost of recovery of the computer data, programs and software."); id. ¶ 80 ("Dr. Monson's actions caused Whitby damage including . . . the cost of attempting to restore Whitby's data, programs, systems, and information to its condition prior to Dr. Monson's actions . . . ."); id. ¶ 81 ("The cost of computer data recovery has been and will continue to be well over $5,000 and is continuing as Whitby tries to restore data and programs that have been lost as a result of Dr. Monson's actions."). The allegations of the counterclaims are thus sufficient to state a claim under Conn Gen. Stat. § 53a-251. See Marquis, 86 Conn. App. at 547. Second, Dr. Monson's suggestion that she only deleted data that was otherwise in Whitby's possession is essentially an affirmative defense, and it relies on factual contentions that are simply not considered on a motion to dismiss. See, e.g., Cohen, 686 F. Supp. 2d at 325 ("In support of his motion, the plaintiff . . . sets forth assertions of fact as to whether items of information were, in fact, permanently deleted from [plaintiff's] computers. Issues of fact are not resolvable on a Rule 12(b)(6) motion.") (citation and quotation marks omitted). Like her other arguments, this one is better suited to a motion for summary judgment, where she will be free to present the evidence she believes supports her contention. See, e.g., Foltz, 2007 WL 196518, at *6 ("No evidence was presented to show that the computer used by the defendant at the plaintiff's office was damaged or that any files or materials, not otherwise in the plaintiff's possession, were missing from the hard drive of that computer."). For the foregoing reasons, Dr. Monson's Motion to Dismiss [doc. # 77] the Second Counterclaim is DENIED, but without prejudice to renewal at the summary judgment stage.

12

IV. As explained above, Dr. Monson's Motion to Dismiss Counterclaims Two through Four [doc. # 77] is DENIED, but without prejudice to renewal in the context of a motion for summary judgment.

IT IS SO ORDERED.

/s/ Mark R. Kravitz United States District Judge Dated at New Haven, Connecticut: August 2, 2010.

13