Steinbach v. Does

Filing 120

AMENDED MEMORANDUM Opinion and Order. Signed on 8/25/2009.Mailed notice(drw, )

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION THERESA STEINBACH, Plaintiff, v. VILLAGE OF FOREST PARK, an Illinois municipal corporation, CRAIG LUNDT, in his official and individual capacity, ANTHONY CALDERONE, in his official and individual capacity, and JOHN DOE 3, in his official and individual capacity, Defendants. AMENDED MEMORANDUM OPINION AND ORDER I. INTRODUCTION Plaintiff Theresa Steinbach ("Steinbach") is suing Defendant Anthony Calderone ("Calderone"), Mayor of the Village of Forest Park, Craig Lundt, a city employee, and the Village of Forest Park itself ("Forest Park"). Steinbach is the Commissioner of Forest Park and also a city employee. She alleges that Defendants violated her privacy, and in the process, violated federal and state laws, by reading and forwarding emails from her professional email account to Calderone's account without authorization. Steinbach alleges a total of fourteen counts against Defendants. Defendant Forest Park moves to dismiss the complaint, in its entirety, under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. For the following reasons, Defendant's Motion to Dismiss will be granted in part and denied in part. II. STANDARD OF REVIEW A Motion to Dismiss under Rule 12(b)(6) requires that I analyze the legal sufficiency of the No. 06 C 4215 Judge James B. Zagel

complaint, and not the factual merits of the case. Autry v. Northwest Premium Servs., Inc., 144 F.3d 1037, 1039 (7th Cir. 1998). I must take all facts alleged in Plaintiff's complaint as true and draw all reasonable inferences from those facts in favor of the Plaintiff. Caldwell v. City of Elmwood, 959 F.2d 670, 671 (7th Cir. 1992). Plaintiff, for her part, must do more than solely recite the elements for a violation; she must plead with sufficient particularity so that her right to relief is more than a mere conjecture. Bell Atl., Corp. v. Twombly, 550 U.S. 544, 555 (2007). Plaintiff must plead her facts so that, when accepted as true, they show the plausibility of her claim for relief. Ashcroft v. Iqbal, 129 S. Ct. 1937, 1949 (2009). Plaintiff must do more than plead facts that are "consistent with Defendants' liability" because that only shows the possibility, not the plausibility, of her entitlement to relief. Id. (internal quotations omitted). III. STATEMENT OF RELEVANT FACTS Steinbach was elected to the position of Commissioner of Forest Park in 2003, while Defendant Anthony Calderone was the elected Mayor of Forest Park. Upon her election, Forest Park provided her with an email account. Steinbach contacted Defendant Craig Lundt, an IT technician employed by Forest Park, to configure her Forest Park email to be forwarded to her personal email account, which was not associated with Forest Park. In 2006, Steinbach ran for mayor against Calderone, but lost the election. Around May, 2006, Steinbach contacted Lundt because she was not receiving all of her Forest Park email in her personal account. To resolve the problem, Lundt gave Steinbach direct access to her Forest Park email account through Hostway Corporation ("Hostway"), a third party webmail server. To use Hostway, Lundt gave Steinbach a username and password. On July 7, 2006, Steinbach accessed her Forest Park email via Hostway for the first time. She was surprised to notice that her 2

"sent" folder contained emails from her Forest Park account which were forwarded to Calderone. These forwarded emails included private emails from Steinbach's constituents. There were a total of eleven emails forwarded from Steinbach's account to Calderone's account. When news of the scandal broke, local papers interviewed Calderone. His official comment was that he was not involved. On August 4, 2006, Steinbach filed her original complaint. After filing two amended complaints, she filed her final Verified Third Amended Complaint on March 26, 2009 containing fourteen counts against Calderone, Lundt, and the Village of Forest Park. Plaintiff voluntarily dismissed Count 1 in its entirety. Count 2 is brought against Lundt and Forest Park for a violation of the federal Wiretap Act. Counts 3 and 4 are brought against Forest Park, Calderone, and John Doe, alleging violations of the federal Wiretap Act. Counts 5, 6, and 7 alleging violations of 720 ILL. COMP. STAT. 5/14, the Illinois eavesdropping statute, and brought against all Defendants have been voluntarily dismissed. Count 8, against all Defendants, alleges a violation of the tort of intrusion upon seclusion. Count 9, also against all Defendants, alleges a violation of the federal Computer Fraud and Abuse Act. Count 10 holds Forest Park liable for the actions of its employees through the doctrine of respondeat superior. Plaintiff has failed to allege a Count 11. Counts 12, 13 and 14, brought against the Defendants individually and Forest Park, each allege a violation of the Stored Communications Act. Counts 3, 4, 8, 9, 12, and 14 have been dismissed as to Defendant Calderone. Defendant Forest Park now moves to dismiss the counts against it. For the following reasons, Defendant's Motion to Dismiss is granted in part, and denied in part.

3

IV. DISCUSSION Counts 1-4: Federal Wiretap Act Counts 1-4 against Forest Park involve alleged violations of the Federal Wiretap Act. 18 U.S.C. §§ 2511, 2520. Plaintiff has voluntarily dismissed Count 1 against Forest Park. Count 4 has been dismissed against the only other remaining defendant, Calderone, and as a result, must also be dismissed against Forest Park, since liability was premised on the doctrine of respondeat superior. Therefore, my discussion is limited to Counts 2 and 3. Plaintiff alleges that Defendant Lundt and John Doe violated the Electronic Communications Privacy Act ("ECPA"), 18 U.S.C. §§ 2511(1)(a)(b)(c) and (d), and that Forest Park is liable for the acts of its employees under the doctrine of respondeat superior. She seeks statutory damages pursuant to 18 U.S.C. § 2520(c)(2). Defendant argues that the ECPA does not apply to municipalities and should therefore be dismissed against Forest Park, however, Plaintiff maintains that a 2001 amendment of § 2520 makes it clear that it applies to municipalities. For the following reasons, Count 2 and 3 are dismissed against Forest Park. The Federal Wiretap Act provides that "any person who-(a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral or electronic communication" shall be found in violation of the statute and subject to civil or criminal penalties. 18 U.S.C. § 2511(1)(a). Section 2520 provides for a private right of action against any "person or entity" who violates the Act. The Seventh Circuit has held that neither section allows for the liability of municipalities. Abbott v. Village of Winthrop Harbor, 205 F.3d 976, 980 (7th Cir. 2000). "Person" is defined as "any employee, or agent of the United States or any State or political subdivision thereof, and any individual, partnership, association, 4

joint stock company, trust or corporation." 18 U.S.C. § 2510(6). Municipalities are not included in this definition, and the Seventh Circuit found no legislative intent to the contrary. Abbott, 205 F.3d at 980. The legislative history is also silent as to the purpose of the addition of the word "entity" to section 2520 in 1986. Id. The Court was "persuaded that municipalities are immune from suit, not only because of the corroborating testimony in the legislative history, but simply because Congress has never amended the definition of `person' in § 2510(6)." Id. Plaintiff argues that the PATRIOT ACT's 2001 amendment to § 2520, which added the phrase "other than the United States" after the word "entity," clarified that municipalities are subject to liability under this section. Plaintiff quotes the following comment from Representative Frank: The current statute, as it has been pointed out by the Justice Department, also does allow you to sue if some of your information is released but not others. We gather information in various ways. There has also been some ambiguity indeed about whether or not someone whom that information has been appropriately released; i.e., outside the statutory scheme, can sue the government. Most of the courts have said yes. It has to do with an interpretation of the word `entity.' I think we want to clear that up. H. Rept. 107-236. Plaintiff also points to section 223 of the PATRIOT ACT, 18 U.S.C. § 2712, which does provide for a cause of action against the United States for violations of certain sections, including section 2511. Plaintiff cites the comments of the Honorable Bob Barr, who was involved with the drafting of the PATRIOT ACT. Barr commented that section 223 of the Act, 18 U.S.C. § 2712, "provides a civil remedy for victims of unlawful government surveillance." Implementation of the USA Patriot Act: Sections 201, 202, 223 of the Act that Address Criminal

5

Wiretaps, and Section 213 of the Act that Addresses Delayed Notice Before the Subcommittee on Crime, Terrorism, and Homeland Security of the House Committee on the Judiciary, 109th Cong., 1st Sess. 4-5, Serial No. 109-20 (May 3, 2005). The PATRIOT ACT's amendment to 18 U.S.C. § 2520 clarifies that the federal government cannot be liable under this section, and section 2712 provides for a cause of action against the federal government. Plaintiff asks the court to infer that because "other than the United States," was added after "entity," Congress made it clear that municipalities could be sued under § 2520. Moreover, Plaintiff suggests, since Congress provided a remedy against the federal government in § 2712, it must surely have intended to provide a remedy against municipalities under § 2520. However, neither the amendment, nor § 2712 addresses the liability of municipalities, and Plaintiff points no portion of the legislative history that does so. Furthermore, Congress has yet to amend the definition of "person" in 18 U.S.C. § 2510. These are the same reasons the Seventh Circuit set forth in Abbott for finding that municipalities are not liable under § 2520, and Plaintiff suggests nothing that changes the calculus. In 2005, the Seventh Circuit reaffirmed its holding in Abbott that "a municipality cannot be held liable under the Federal Wiretapping Act." Franklin v. City of Chicago Police Dept., 175 Fed. Appx. 740, 741 (7th Cir. 2005) (citing Abbott, 205 F.3d at 980 and Amati v. City of Woodstock, 176 F.3d 952, 956 (7th Cir. 1999)). Even after the enactment of the PATRIOT ACT, Abbott remains good law in this Circuit and must be followed.1 For these reasons, Defendant's Motion to Dismiss Counts 2 and 3 is granted.

In support of her position, Plaintiff points to Adams v. City of Battle Creek, 250 F.3d 980, 985 (6th Cir. 2001), in which the Sixth Circuit explicitly rejected the Seventh Circuit's analysis in Amati v. City of Woodstock, 176 F.3d 952, 956 (7th Cir.), cert. denied, 528 U.S. 985 (1999), and held that municipalities are subject to civil liability under the Federal Wiretapping Act. The 1986 amendment of section 2520 which added the words "or entity" to those who may be held liable under the Act necessarily meant governmental entity, since the definition "person" already included business entities. Adams, 250 F.3d at 985. The Court also cited the Senate Committee Report summarizing section 2707, the parallel section for liability under the Stored Communications Act, which specifically states that the word "entity" includes governmental entities. Adams, 250 F.3d 980, 985 (citing S.Rep. No. 541, 99th Cong., 2d Sess. 43 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3597). Persuasive as this might be, it is not for the district court to overturn good law in this circuit, and Plaintiff points to nothing since the Court's ruling in Franklin that suggests that Abbott is no longer good law. 6

1

Count 8 ­ Intrusion Upon Seclusion Defendant first argues that the Illinois Supreme Court has not recognized the tort of intrusion upon seclusion, and as such, Plaintiff's claim must be dismissed.2 While it is true that the Illinois Supreme Court has not explicitly recognized the tort of intrusion upon seclusion, this Court has found that the tort does exist. Ludemo v. Klein, 771 F. Supp. 260 (N.D. Ill. 1991) (Zagel, J.). When state tort law is unclear, a federal district court can follow the decisions of the state appellate court governing the geographical area where the alleged tort took place, unless there is reason to believe the Supreme Court of Illinois would decide the question differently. Id. at 261-62. In diversity cases it is the determination of what the highest court of the state would do that is the key question. Forest Park is located in Cook County, which is in the First District, case law from First District Appellate Court governs. The First District formally recognized the existence of the tort in Illinois. Busse v. Motorola, Inc., 813 N.E.2d 1013 (Ill. App. Ct. 2004). Therefore, this Court recognizes the existence of the tort under the First District ruling, since there is no hint of contrary reasoning from the highest court in Illinois.3 Defendant next argues that Plaintiff's allegations fail to satisfy the required elements of the tort. Under Busse, all four elements of the tort must be satisfied. Id. at 1017. These This count has been dismissed as to Defendant Calderone, but still stands against Defendant Lundt and John Doe. 3 An alternative method for determining state law, especially when there is a conflict among state appellate courts, allows a federal district court to decide according to what it believes the state supreme court would decide. Ludemo, 771 F. Supp. at 261. In 1989, the Illinois Supreme Court decided Lovgren v. Citizens First National Bank, finding that the defendant's actions did not constitute an unlawful intrusion upon seclusion. 534 N.E.2d 987 (Ill. 1989). While the Court declined to formally recognize the tort in Illinois, it is difficult to measure conduct against a tort which does not exist. Ludemo, 771 F. Supp. at 261. Therefore, the Court must have implicitly recognized that the tort exists in Illinois. Id. Thus, under either method of determining state law, the tort of intrusion upon seclusion exists in Illinois. 7
2

elements are: (1) defendant committed an unauthorized prying into the plaintiff's seclusion; (2) the intrusion would be highly offensive to the reasonable person; (3) the matter intruded upon was private; and (4) the intrusion caused the plaintiff to suffer. Id. Defendant specifically argues that Plaintiff fails to allege the manner in which the emails allegedly accessed were private. First, according to Defendant, Plaintiff has not alleged inherently private facts such as her financial, medical or sexual life, or a peculiarly private fact of an intimate personal nature. The court in Acosta v. Scott Labor LLC, cited these examples of inherently "private facts" that would satisfy the tort's third element. 377 F. Supp. 2d 647, 650 (N.D. Ill. 2005) (citing Green v. Chicago Tribune Co., 675 N.E.2d 249, 260 (Ill. App. 1996)). However, this list is not exhaustive. Plaintiff maintains that email communications from her constituents are private, and her assertion is not unreasonable. See Denver Pub. Co. v. Board of County Com'rs, 121 P.3d 190, 198 (Colo. 2005) (discussing the Colorado Open Records Act, which excludes "confidential communications" from constituents to elected officials from the definition of "public records" that are subject to disclosure). Whether the emails are actually private is a matter of fact which cannot be determined at this stage. Next, Defendant argues that Plaintiff has failed to allege that she attempted to keep her private facts private, citing Acosta, 377 F. Supp. 2d at 650. However, in context, this requirement is not applicable here. In Acosta, the counter-plaintiff was videotaped at work without his consent, intruding upon the private matter of his employment. Id. at 649. The court noted that people "cannot reasonably maintain an exception of privacy in that which they display openly." Id. Counter-plaintiff's employment was not a private matter, nor did he plead that he had an expectation of privacy in the area videotaped. In this case, Defendant fails to explain how 8

Plaintiff displayed anything openly. Plaintiff does claim that she has an expectation of privacy in her Forest Park email, and Defendant cites no authority to the contrary. Drawing all inferences in Plaintiff's favor, her complaint alleges sufficient facts to satisfy the privacy element. Finally, Defendant maintains that Plaintiff cannot establish an unauthorized intrusion or prying into her seclusion because the Village provided her electronic communication service and is thereby excluded from liability under the Federal Wiretap Act, 18 U.SC. 2511(2)(a)(i) (no violation where the communications are intercepted by an agent "of a provider of wire or electronic communication service, whose facilities are used in the transmission of a wire or electronic communication"), and Stored Communication Act, 18 U.S.C. 2701(c)(1) (no violation where the communications are accessed by "the person or entity providing a wire or electronic communications service"). In other words, any intrusion by Forest Park was "authorized." However, the Village is not a "provider of electronic communication service" as defined by the statute. In In re Jet Blue Airways Corp. Privacy Litigation., 379 F. Supp. 2d 299, 307-08 (E.D.N.Y. 2005), a company that sold air travel over the Internet, but that was not in the business of selling Internet access itself was not providing an "electronic communication service." Such a service is one that "provides users with the capacity to transmit electronic communications," typically Internet service providers such as America Online. Id. at 307 & n.7. While Forest Park provided the email address name to Steinbach, Hostway, a third party, provided the email service. Similar to the company in Jet Blue, Forest Park purchases Internet access from a thirdparty provider, and does not itself provide Internet service for the purposes of the exception. The alleged invasion, therefore, is not authorized by statute, as Defendant suggests, and Plaintiff has

9

properly alleged an unauthorized intrusion. For these reasons, Defendant's Motion to Dismiss Count 8 is denied. Count 9 ­ Computer Fraud and Abuse Act In Steinbach's Verified Third Complaint, she alleges against all defendants a violation of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030(a)(4) (2006).4 This count was dismissed as to Defendant Calderone because it was barred by the statute of limitations. Defendant now argues that Plaintiff has failed to state a claim under the CFAA because she failed to allege damage to a protected computer, and that the claim should be dismissed. For the following reasons, Defendant's motion as to this claim is denied. In 2006, the CFAA allowed a plaintiff to seek civil remedy "only if the [alleged] conduct involves one of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B). Damages for a violation involving only conduct described in subsection (a)(5)(B)(i) are limited to economic damages." 18 U.S.C. § 1030(g). Section 1030 (a)(5) states as follows:

[Whoever] (A)(i) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; (ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (iii) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage; and (B) by conduct described in clause (i), (ii), or (iii) of subparagraph (A), caused (or, in the case of an attempted offense, would, if completed, have caused)-(i) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct

4

There is no dispute among the parties that the 2006 version of the statute applies here. 10

affecting 1 or more other protected computers) aggregating at least $5,000 in value; (ii) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (iii) physical injury to any person; (iv) a threat to public health or safety; or (v) damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security; The lead-in to § 1030 (a)(5)(B) references subparagraph § 1030 (a)(5)(A), and seems to suggest that to state a claim pursuant to section 1030(g), a plaintiff is required to allege one of the factors set forth in § 1030(a)(5)(B) as well as a violation of § 1030(a)(5)(A), which requires damage to a "protected computer." Indeed, the Seventh Circuit has footnoted that a violation of the CFAA can occur only where there is damage to a "protected computer." Kathrein v. McGrath, 166 Fed. Appx. 858, 863 n.4 (7th Cir. 2006). However, this court in Motorola, Inc. v Lemko Corp., 609 F. Supp. 2d 760, 766-67 (N.D.Ill., 2009), recently concluded, in agreement with the Third, Fifth, and Ninth Circuits, that "when section 1030(g) refers to the factors set forth in the clauses under section 1030(a)(5)(B), it does not also require a plaintiff to establish a violation of section 1030(a)(5)(A), even though the lead-in language in section 1030(a)(5)(B) refers to that subparagraph." I agree with the Motorola court's conclusion, and find that Plaintiff need not allege damage to a protected computer to properly state a claim.5 Plaintiff need only allege one of the factors set forth in subsection (a)(5)(B). Here, Plaintiff has alleged economic loss aggregating in more than $5,000 in a one-year period including, but not limited to, the loss

This is a departure from the position I articulated in my opinion on Defendant Calderone's motion to dismiss, but it is warranted in light of arguments made by Plaintiff in response to Village's motion to dismiss. This departure does not affect the dismissal of the claim against Defendant Calderone, since it was barred by the statute of limitations. 11

5

of salary, income and opportunity as an elected official for Forest Park. This is sufficient to satisfy subsection (a)(5)(B)(i), and Defendant's motion to dismiss this claim is denied. Count 10 ­ Respondeat Superior In Count 10, Plaintiff alleges liability against the Village under the doctrine respondeat superior. Defendant argues that this claim should be dismissed as there is respondeat superior liability against a municipality pursuant to 42 U.S.C. § 1983. However, Plaintiff brings neither her claim against the Village nor against the individual defendants pursuant to § 1983. She alleges instead that the Village may be liable for its employees' tortious acts. "Under the doctrine of respondeat superior, an employer may be liable for the negligent, willful, malicious or even criminal acts of its employees when such acts are committed in the course of employment and in furtherance of the business of the employer[.]" Webb v. Jewel Cos., 485 N.E.2d 409, 411 (1985). Plaintiff has sufficiently pled her claim under the doctrine and the Village is not immune from liability. Counts 12-14 ­ Stored Communications Act Count 12 has been dismissed against Defendant Calderone, and as a result, must also be dismissed against the Village, since liability was premised on the doctrine of respondeat superior. I will therefore limit my discussion to Counts 13-14. Defendant argues this is time-barred because it appeared for the first time in Plaintiff's third amended complaint. The Stored Communications Act states that "a civil action under this section may not be commenced later than two years after the date upon which the claimant first had reasonable opportunity to discover the violation." 18 U.S.C. 2707(f). It is true that Plaintiff did not bring this claim until the third amended complaint, 12

more than two years after she first discovered the violations. But here, Plaintiff's allegations are all part and parcel of the conduct alleged in her original complaint ­ that Plaintiff's email account was accessed without authorization. Defendant was on notice of the facts underlying these claims since the time the original complaint was filed. Where the amended pleading asserts a claim that arose out of the conduct set out in the original pleading, the amended pleading relates back to the original pleading. Fed. R. Civ. Pr. 15(c)(1)(B). Defendant maintains that Plaintiff cannot assert that these claims relate back to the original complaint because she is acting in bad faith. However, this is not the case. Plaintiff argues that she did not learn of the June 2, 2006 invasion complained of until July 2008. Although I previously held that Plaintiff had reasonable opportunity to discover this particular violation, and that it was not a separate violation for the purposes of the statute of limitations with regard to Defendant Calderone, I do not believe Plaintiff acted in bad faith by amending her complaint to include these allegations. She was not withholding facts "clearly known" to her prior to the filing of the complaint, nor does Defendant claim that Plaintiff moved to amend the complaint with any ulterior purpose. See GSS Properties, Inc. v. Kendale Shopping Center, Inc., 119 F.R.D. 379, 381 (M.D.N.C. 1988) (finding bad faith where plaintiff withheld "facts clearly known to it prior to the filing of the complaint" and then moved to amend the complaint "where the evidence suggests that plaintiff had an ulterior purpose of either attempting to force defendant to settle or punishing defendant for failing to settle.") While Plaintiff might have had reasonable opportunity to discover the June 2nd violation, the fact of the violation was not something "clearly known" to her at the time her complaint was filed. 13

Defendant was on notice of the conduct underlying the claims, and because they relate back to the wrongful conduct alleged in the initial complaint, they need not be dismissed for their untimeliness. Defendant also argues that Plaintiff's claims against Forest Park under the Stored Communications Act fail because the Act "does not apply with respect to conduct authorized by the person or entity providing a wire or electronic communication service." 18 U.S.C. 2701(c)(1). However, as discussed supra with respect to Count 8, Forest Park purchases Internet access from a third-party provider, and does not itself provide Internet service for the purposes of the exception. For these reasons, Defendant's motion to dismiss counts 13 and 14 is denied. Punitive damages Both parties agree that the Illinois Tort Immunity Act protects the Village from liability for punitive damages arising from state claims. However, Plaintiff maintains that the Village is liable for punitive damages pursuant to the ECPA. Because Counts 2, 3, and 4, Plaintiff's ECPA claims were dismissed as to the Village, I need not address the issue of the Village's liability for punitive damages under the act. V. CONCLUSION For the foregoing reasons, Defendant's motion to dismiss is granted as to Counts 2, 3, 4, and 12, and denied as to Counts 8, 9, 10, 13, and 14. ENTER:

James B. Zagel United States District Judge DATE: August 25, 2009 14