Dow Corning Corporation v. Chaganti et al
Filing
8
Opinion and Order Granting In Part 7 Motion for Temporary Restraining Order, Temporarily Restraining and Enjoining Defendants, Directing Service, Scheduling Hearing on Motion for Preliminary Injunction, Directing Appearance, and Permitting Response. (Service due by 11/6/2015) (Motion Hearing set for 11/17/2015 at 03:00 PM before District Judge Thomas L. Ludington) Signed by District Judge Thomas L. Ludington. (Sian, M)
UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF MICHIGAN
NORTHERN DIVISION
DOW CORNING CORPORATION,
Plaintiff,
v.
Case No. 15-cv-13781
Honorable Thomas L. Ludington
ANJANEYULU CHAGANTI and
HOMI SYODIA,
Defendants.
_______________________________________/
OPINION AND ORDER GRANTING IN PART MOTION FOR TEMPORARY
RESTRAINING ORDER, TEMPORARILY RESTRAINING AND ENJOINING
DEFENDANTS, DIRECTING SERVICE, SCHEDULING HEARING ON MOTION FOR
PRELIMINARY INJUNCTION, DIRECTING APPEARANCE, AND PERMITTING
RESPONSE
Plaintiff Dow Corning Corporation filed a verified complaint against Defendants
Anjaneyulu Chaganti and Homi Syodia on October 26, 2015. See Pl.’s Compl., ECF No. 1. The
complaint alleges that Defendants exceeded their authorized access to Dow Corning’s computers
under the Master Agreement between Plaintiff and Defendants’ employer, HCL America, Inc.
The Master Agreement obligated HCL to meet certain data privacy standards. HCL is not,
however, an identified defendant. Plaintiff alleges three counts in its complaint: (1) violation of
the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030; (2) conversion; and (3) breach
of fiduciary duty. Id.
Dow Corning has moved for injunctive relief against Defendants. Dow Corning has titled
the motion “Plaitniff [sic] Dow Corning Corporation’s Verified Emergency Motion for
Injunctive Relief.” See Pl.’s Mot., ECF No. 7.1 In the motion Dow Corning seeks injunctive
relief under both Rule 65 and the Court’s power to do equity. Because Dow Corning desires the
motion to be addressed ex parte, only the request for a temporary restraining order may be
considered. See Fed. R. Civ. P. 65 (limiting any ex parte relief available to a temporary
restraining order).
I.
Dow Corning Corporation is a Michigan corporation located in Midland, Michigan. See
Pl.’s Compl. ¶ 1, ECF No. 1. Defendants are employees of HCL America, Inc. Id. at ¶ 6. HCL
contracted with Dow Corning in March, 2012 “to provide certain IT services” to Dow Corning.
Id. The agreement between the parties was memorialized in the Master Agreement attached to
Dow Corning’s complaint and motion. See Pl.’s Compl., Ex. A, ECF No. 1-1.
A.
The Master Agreement between Dow Corning and HCL governs the manner in which
HCL provides information technology (“IT”) services to Dow Corning. Part of HCL providing
IT services to Dow Corning involves being exposed to Dow Corning’s data. The Master
Agreement refers to this data as “Customer Data.” Master Agreement Section 12.01, Pl.’s Mot.,
Ex. A, ECF No. 7-2. HCL’s exposure to Customer Data is governed by Section 12.01 of the
Master Agreement, which provides:
As between the Parties, all Customer Data is and shall remain the property of
Customer. Without the prior approval of Customer, to be given in its sole
discretion, Customer Data shall not be (a) used by Supplier [(HCL)] other than as
required to perform the Services, (b) disclosed, sold, assigned, leased, licensed or
otherwise provided or made available in any manner to third parties by Supplier,
(c) monitored, analyzed, individualized, anonymized, aggregated, stored, or
copied by Supplier, or (d) commercially exploited in any form (including any
1
The motion was submitted in twelve-point font. The Local Rules require that papers be submitted in
fourteen point font. Dow Corning’s counsel should become familiar with the Local Rule’s practice requirements in
advance of further filings.
-2-
individualized, anonymized, or aggregated form) by or on behalf of Supplier. Any
archival tapes containing Customer Data shall be used by Supplier solely for
back-up purposes. Supplier hereby does, and shall cause its Affiliates and
Supplier Agents to, irrevocably, perpetually and unconditionally assign to
Customer without further consideration all rights, title, and interest each may have
in any Customer Data, including all intellectual property and other proprietary
rights. Such rights shall vest in Customer upon creation of the relevant Customer
Data.
Master Agreement Section 12.01, ECF No. 7-2.
The Master Agreement also establishes “General Confidentiality Obligations” between
the parties. Section 12.04, which sets forth these obligations, provides:
Each Party acknowledges and agrees that, as between the Parties, title to and
ownership and use rights of Confidential Information shall remain with the Party
that disclosed the Confidential Information, and that the Confidential Information
disclosed in connection with the Agreement is confidential and proprietary
information of the disclosing Party. Each Party shall use at least the same degree
of care as it employs to avoid unauthorized disclosure of and unauthorized access
to its own Confidential Information of like kind and import, but in any evnt no
less than a reasonable degree of care, to prevent disclosure of and unauthorized
access to the Confidential Information of the other Party in its possession. Neither
Customer nor Supplier shall disclose, publish, release, transfer or otherwise make
available Confidential Information of, or obtained from, the other in any form to,
or for the use or benefit of, any person or Entity without the disclosing Party’s
prior consent, to be given in the disclosing Party’s sole discretion. Each of
Customer and Supplier shall, however, be permitted to disclose relevant aspects
of the other’s Confidential Information to its officers, directors, employees,
agents, professional advisors (including attorneys, bankers and consultants),
contractors, subcontractors, suppliers, vendors and representatives, and to the
officers, directors, employees, agents, professional advisors, contractors,
subcontractors, suppliers, vendors and representatives of its Affiliates, in each
case on a need to know basis to the extent that such disclosure is not restricted
under any applicable agreements or any Laws and is necessary for the
performance of its duties and obligations under or with respect to the Agreement
or the determination, preservation or exercise of its rights and remedies under the
Agreement or under Law; provided, however, that the recipient shall take all
reasonable measures to ensure that Confidential Information of the disclosing
Party is not disclosed or duplicated in the contravention of the provisions of the
Agreement by such persons and Entities.
Master Agreement Section 12.04, ECF No. 7-2. The Master Agreement defines Confidential
Information as “all information (regardless of form) of Customer and Supplier, respectively,
-3-
whether disclosed to or accessed by Customer or Supplier in connection with the Agreement,
including with respect to Customer, the existence and provisions of the Agreement, all Customer
Data, and all information of Customer and Customer Agents[.]” Id. at Schedule 1, Defined
Terms, ECF No. 7-2 (emphasis added).
In situations where Confidential Information is in the possession of HCL or its “Supplier
Agents” (individuals like Defendants), the Master Agreement entitles Dow Corning to have that
information returned upon request. Section 12.05 provides that:
Upon request by Customer, Supplier shall (a) promptly provide to Customer, in
the format and on the media requested by Customer, all or any part of Customer’s
Confidential Information, and (b) securely and permanently erase or destroy all or
any part of Customer’s Confidential Information in Supplier’s or any Supplier
Agent’s possession or control, in each case to the extent so requested by
Customer.
Id. at Section 12.05.
The Master Agreement provides even further protections for certain types of Customer
Data that it defines as “Personal Data.” Id. at Section 12.06. Personal Data is defined as “any
Customer Data that identifies or is capable of identifying an individual, or is otherwise defined as
‘personal information,’ ‘personal data,’ ‘sensitive personal data,’ ‘personally identifiable
information,’ ‘personal health information,’ ‘non-public personal information’ or similar terms
under applicable Laws.” Id. at Schedule 1, Defined Terms. The Master Agreement limits the use
of Personal Data. Specifically:
(a)
Other than where expressly requested by an individual data subject,
Supplier shall not use or disclose Personal Data for any purpose other than
fulfilling its obligations under the Agreement without the prior approval of
Customer and, to the extent required by applicable Law, the individual data
subject. . . . Supplier shall promptly comply (which shall in no event be longer
than any time frame for compliance required by applicable Law) with any request
from Customer with respect to Personal Data that is necessary to allow Customer
to comply with applicable Law.
-4-
(b)
Supplier shall not disclose Personal Data to any Supplier Agent without
the prior approval of Customer and an agreement in writing from the Supplier
Agent to use and disclose such Personal Data only to the extent necessary to
fulfill Supplier’s obligations under the Agreement and for no other purposes.
...
(g)
If any unauthorized or impermissible disclosure, loss of or access to any
Personal Data occurs, Supplier shall (i) assist in the identification of affected
persons, (ii) allocate call center resources and training to manage inquiries from
affected persons, (iii) provide affected persons with credit monitoring services,
(iv) assist with the delivery of Customer-provided electronic, hard copy and/or
telephonic notifications to affected persons, and (v) take such other actions as
may be reasonably required by Customer.
Id. at Section 12.06. The section also sets forth limitations on the transportation of Personal Data
outside of certain jurisdictions and limits access to certain health information. Id.
It appears, on the face of the Master Agreement, that personal information (addresses,
social security numbers, financial information, etc.) of Dow Corning employees would constitute
Personal Data, Consumer Data, and Confidential Information. That information would then be
subject to the protections established for each type of information.
B.
Pursuant to the Master Agreement, prior to Defendants beginning on-site work they
entered into two different agreements with Dow Corning. The first was a “Contractor
Confidentiality and Inventions Agreement.” See Confidentiality Agreement, Pl.’s Mot., Ex. B,
ECF No. 7-3. Under the Confidentiality Agreement, each Defendant covenanted in pertinent
part, that:
I acknowledge that certain trade secrets and other confidential information may
become known to me during my assignment with Dow Corning.
1. During the term of my assignment with Dow Corning and after the termination
of this assignment, I will keep secret all Dow Corning technical and business
information and information received by Dow Corning under obligations of
confidence and will not reveal or divulge the same to third parties, or use or
-5-
publish it in a any [sic] manner, without prior written approval from Dow
Corning[.]
...
4. I understand and agree that I shall be liable to Dow Corning for any breach of
this agreement and that all of the obligations under this agreement are binding
upon my heirs, assigns and legal representatives.
Id.
The second agreement between Defendants and Dow Corning was a “Network Computer
Usage Agreement.” See Network Agreement, Pl.’s Mot., Ex. C, ECF No. 7-4. Under this
agreement, each Defendant agreed
. . . to the following conditions for use of any component of the Dow Corning
Information Network (DCIN):
1. All computer equipment, software, data and supplies that are the property of
Dow Corning will be used solely for approved Dow Corning business purposes.
2. I will protect information to which I have access from unauthorized disclosure
or misuse.
Id. The agreement lists further covenants not relevant to the present matter. It also requires that
Defendants agree to abide by certain information and security policies that have not been
attached to Dow Corning’s motion.
C.
On September 24, 2015, Defendants downloaded confidential information about Dow
Corning employees from Dow Corning computers and computer systems to personal drives. See
Pl.’s Compl. ¶ 9, ECF No. 1. Defendants were not authorized, under the term of their retention,
to download that information onto personal hardware. Id. at ¶ 11. The information in question
consisted of “over 4,000 confidential documents.” Id. at ¶ 10. The documents “contain highly
confidential information about [Dow Corning] employees, former employees, and their
dependents, including names, addresses, financial information (such as retirement calculations,
-6-
salary information, and bonus calculations), social security numbers, salary, and account
numbers.” Pl.’s Mot. 7, ECF No. 7.
In response to the download, Dow Corning initiated an investigation with HCL to
determine the scope of Defendants’ download. See Pl.’s Compl. ¶ 12. The investigation has
uncovered at least one download, but it is possible there are more. Id. Dow Corning has been
able to work with HCL to make requests that Defendants return the devices onto which they
downloaded the information. Defendants’ response to HCL has been “incomplete and evasive at
best.” Pl.’s Mot. 7, ECF No. 7. To this date, Defendants have not “turned over their laptops or
other electronic devices to [Dow Corning] and/or HCL for forensic analysis to determine the full
extent of the information taken and whether any or all of the information was further transferred .
. . to others.” Id. at 12. Defendants represented to HCL that they have turned over all USB drives
used to download the information. Id. But Dow Corning’s forensic analysis has revealed that
“[t]here is at least one other USB software drive that was used and not returned by
[D]efendants.” Id. For that reason, Dow Corning has sought injunctive relief to prevent
Defendants from disseminating any of this information and to compel Defendants to comply
with Dow Corning’s requests for production of devices.
II.
A.
Federal Rule of Civil Procedure 65 provides that a “court may issue a [TRO] without
written or oral notice to the adverse party or its attorney” if two requirements are satisfied: (1)
“specific facts in an affidavit or a verified complaint clearly show that immediate and irreparable
injury, loss, or damage will result to the movant before the adverse party can be heard in
-7-
opposition”; and (2) “the movant’s attorney certifies in writing any efforts made to give notice
and the reasons why it should not be required.” Fed. R. Civ. P. 65(b)(1).
Four factors govern whether the Court will issue a TRO (the same four factors governing
whether to issue a preliminary injunction): (1) whether the plaintiff has demonstrated a
substantial likelihood of success on the merits; (2) whether there is a threat of irreparable harm to
the plaintiff; (3) whether issuance of the injunction would harm others; and (4) whether the
public interest is served by granting injunctive relief. Hamilton’s Bogarts, Inc. v. Michigan, 501
F.3d 644, 649 (6th Cir. 2007) (citation omitted); see also Ne. Ohio Coal. for Homeless and Serv.
Emps. Intern. Union, Local 1199 v. Blackwell, 467 F.3d 999, 1009 (6th Cir. 2006). “These
factors are not prerequisites, but are factors that are to be balanced against each other.”
Overstreet v. Lexington-Fayette Urban Cnty. Gov’t, 305 F.3d 566, 573 (6th Cir. 2002) (citations
omitted).
B.
Dow Corning’s motion for a temporary restraining order does not comply in all respects
with Rule 65. Nowhere in the motion does Dow Corning’s “attorney certify[y] in writing any
efforts made to give notice and the reasons why it should not be required.” Fed. R. Civ. P.
65(b)(1). Because injunctive relief, particularly ex parte injunctive relief, is such an extreme
remedy, the Federal Rules of Civil Procedure require that the attorney for the party seeking such
relief attest, under penalty of sanction, why the movant should be relieved from normal notice
requirements. Heyman v. Kline, 456 F.2d 123, 127 n.2 (2d Cir. 1972) (explaining that it is the
rare case where even last minute notice would result in dire consequences requiring ex parte
hearing and admonishing attorney for not making certification). “[T]he Rule 65(b) restrictions on
the availability of ex parte temporary restraining orders reflect the fact that our entire
-8-
jurisprudence runs counter to the notion of court action taken before reasonable notice and an
opportunity to be heard has been granted both sides of a dispute.” First Tech. Safety Sys., Inc. v.
Depinet, 11 F.3d 641, 650 (6th Cir. 1993) (quoting Reed v. Cleveland Bd. of Educ., 581 F.2d
570, 573 (6th Cir. 1978)) (internal quotation marks omitted). Normally, a district court is
“justified in proceeding ex parte . . . where notice to the adverse party is impossible, as in the
cases where the adverse party is unknown or is unable to be found.” First Tech. Safety Sys., 11
F.3d at 650. A court may also proceed ex parte in another “limited circumstance . . . where notice
to the defendant would render fruitless further prosecution of the action.” Id.
Dow Corning’s attorney does not certify that either situation exists here. Dow Corning
does represent that there are open lines of communication between HCL and Defendants and
possibly even Dow Corning and Defendants. Dow Corning also represents that requests have
been made to recover the materials at issue without recourse to a legal proceeding and that those
efforts were partially successful but have reached a dead end. But despite this contact, no
mention of notice or lack thereof is made. Dow Corning’s attorney needs to certify to the Court
that it engaged in some discussion, albeit informal, with Defendants about the possibility of
seeking this relief or why they could not engage in such discussions. It appears from the face of
Dow Corning’s pleadings, however, that the circumstances present in this case may support a
certification that notice would be futile or harmful. This cannot be confirmed until a certification
is made. The absence of a certification is not presently fatal, but Dow Corning will be directed to
file a supplemental certification within 24 hours of this order. If Dow Corning does not, or if the
certification is insufficient, the temporary injunction will be lifted.
III.
-9-
Although each of the factors need not be conclusively found to favor the issuance of
injunctive relief, each will be analyzed in turn. Dow Corning argues that all four TRO factors
support the issuance of emergency injunctive relief.
A.
First, Dow Corning contends that it has a likelihood of succeeding on the merits. Dow
Corning’s complaint alleges three causes of action: violation of the Computer Fraud and Abuse
Act; Conversion; and Breach of Fiduciary Duty. See Pl.’s Compl., ECF No. 1. In its motion,
Dow Corning only analyzes its likelihood of success with respect to its CFAA claim.
Accordingly, analysis of Dow Corning’s entitlement to a TRO turns, at this juncture, only on the
likelihood of Dow Corning’s success on the merits of its CFAA claim. This analysis will proceed
in two steps. First, Dow Corning’s CFAA claim and its pleading deficiencies must be discussed.
This is an unwelcome, but necessary digression; necessary, in part, because of the state of the
law. After the initial statutory and pleading issues have been resolved, the likelihood of Dow
Corning succeeding on a CFAA claim will be examined. This step will also involve a digression
that addresses pleading problems. As with the prior digression, it is necessary to ensuring proper
adjudication of the dispute and assurance of a justiciable case or controversy.
1.
The CFAA was enacted in 1984. Pub. L. No. 98–473, 98 Stat. 2190. Its broad purpose is
to impose criminal liability for the misuse of computers and data stored thereon. In addition to
providing for broad criminal liability, the CFAA also provided a private right of action to certain
individuals harmed by acts made unlawful by the statute. See 18 U.S.C. § 1030(g). The civil
enforcement provision of the CFAA reads, in its entirety:
Any person who suffers damage or loss by reason of a violation of this section
may maintain a civil action against the violator to obtain compensatory damages
- 10 -
and injunctive relief or other equitable relief. A civil action for a violation of this
section may be brought only if the conduct involves 1 of the factors set forth in
subclauses4 (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a
violation involving only conduct described in subsection (c)(4)(A)(i)(I) are
limited to economic damages. No action may be brought under this subsection
unless such action is begun within 2 years of the date of the act complained of or
the date of the discovery of the damage. No action may be brought under this
subsection for the negligent design or manufacture of computer hardware,
computer software, or firmware.
Id.
From the face of the provision it appears that the scope of civil actions under the CFAA
is coextensive with the scope of criminal liability. The statute unambiguously states that “[a]ny
person who suffers damage or loss by reason of a violation of this section may maintain a civil
action against the violator to obtain compensatory damages and injunctive relief or other
equitable relief.” Id. Dow Corning cites to this provision in support of its claim for temporary
injunctive relief. But the statute goes on to qualify the circumstances under which civil actions
may be maintained, cutting back on the broad grant in the prior sentence: “A civil action for a
violation of this section may be brought only if the conduct involves 1 of the factors set forth in
subclause[] (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i).” Id. In turn, the subclause list at
subsection (c)(4)(A)(i) is as follows:
(I)
loss to 1 or more persons during any 1-year period (and, for purposes of an
investigation, prosecution, or other proceeding brought by the United
States only, loss resulting from a related course of conduct affecting 1 or
more other protected computers) aggregating at least $5,000 in value;
(II)
the modification or impairment, or potential modification or impairment,
of the medical examination, diagnosis, treatment, or care of 1 or more
individuals;
(III)
physical injury to any person;
(IV)
a threat to public health or safety;
- 11 -
(V)
damage affecting a computer used by or for an entity of the United States
Government in furtherance of the administration of justice, national
defense, or national security[.]
Id. at § 1030(c)(4)(A)(i)(I)-(V).
Finally, the civil enforcement grant includes another caveat: “Damages for a violation
involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages.”
Id. at § 1030(g).
The interplay between the broad civil enforcement grant in the first sentence and the two
subsequent limiting provisions poses difficulties for Dow Corning. First, Dow Corning does not
acknowledge the limiting provisos in the civil enforcement provision. It quotes only the first
sentence in support of its ability to maintain an action against Defendants under the CFAA.
Some courts have sub silentio conceded this liberal reading by ignoring the limiting clauses. See,
e.g., Sewell v. Bernardin, 795 F.3d 337, 339-40 (2d Cir. 2015) (holding that the CFAA allows a
civil cause of action to “any person who suffers damage or loss by reason of a violation of this
section” without any other limitation). But this reading cannot be correct since it would
necessarily nullify the subsequent limitations.
The question then, is what effect the limitations have on the seemingly broad civil
enforcement grant. Courts have not provided uniform solutions to this problem. The statute is
susceptible to two readings. First, a civil action for a violation of the statute may only be
maintained if it falls under one of the five numerated provisions listed in the first limiting clause.
Second, the civil action grant is coextensive with the criminal liability provisions, but the
conduct on which the civil action is based must include at least one of the five factors listed in
the first limiting clause. Courts have struggled with this question. Some courts have abided by
the first option and significantly limited civil actions under the CFAA to the five forms of
conduct listed at 18 U.S.C. § 1030(c)(4)(A)(i)(I)-(V). See, e.g., Jones v. Liberty Mut. Ins., Case
- 12 -
No. CV 15-02, 2015 WL 6511526, at *3 (E.D. Ky. Oct. 28, 2015) (holding that under the CFAA
“private plaintiffs may only bring suit . . . in a narrowly defined set of circumstances”).
The majority of circuit courts of appeals that have faced the issue, however, have decided
that the language of the statute more appropriately supports the second approach: that the civil
enforcement grant is broad and a civil action must merely include one of the five enumerated
forms of conduct. See, e.g., Fiber Sys. Int’l, Inc. v. Roehrs, 470 F.3d 1150, 1156-58 (5th Cir.
2006) (holding that a civil action under the CFAA need only include one of the enumerated
forms of conduct); P.C. Yonkers, Inc. v. Celebrations the Party & Seasonal Superstore, LLC.,
428 F.3d 504, 511-13 (3d Cir. 2005) (same); WEC Carolina Energy Solutions LLC v. Miller, 687
F.3d 199, 201 (4th Cir. 2012) (same); LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1130-32
(9th Cir. 2009) (same). But see Triad Consultants, Inc. v. Wiggins, 249 F. App’x 38, 39 n.1 (10th
Cir. 2007) (holding that a civil action may be maintained for exceeding authorized access but
only by someone who suffers from one of the forms of enumerated conduct). The Sixth Circuit
has not expressly adopted a reading of the statute, it has, in at least one instance, seemingly
applied the narrow reading of the civil enforcement grant. Yoder & Frey Auctioneers, Inc. v.
EquipmentFacts, LLC, 774 F.3d 1065, 1072-73 (6th Cir. 2014) (observing that “[t]he CFAA is
primarily a criminal statute, but it provides for a civil right of action and economic damages in
certain circumstances, such as when a violator causes “loss” of at least $5,000 in value to one or
more persons during any one-year period”).
The narrow reading of the statute is unpersuasive. To ignore the second clause of the civil
enforcement provision, as Dow Corning does, would render it a nullity. The clause must have
some limiting effect on the ability of parties to maintain civil actions under the act. Conversely,
to read the second clause to be the entirety of the civil enforcement grant would render the first
- 13 -
clause—the broad grant—redundant. A middle path is the most logical expression of the
drafters’ intent. Thus, the reasoning of the Third Circuit is persuasive:
We do not read section 1030(g)’s language that the claim must involve one or
more of the numbered subsections of subsection (a)(5)(B) as limiting relief to
claims that are entirely based only on subsection (a)(5), but, rather, as requiring
that claims brought under other sections must meet, in addition, one of the five
numbered (a)(5)(B) “tests.”
P.C. Yonkers, 428 F.3d at 512 (addressing a prior version of the statute before the five “tests”
were reorganized to subsection (c)(4)(A)(i)). That is, any violation of the CFAA may be subject
to civil enforcement as long as “the conduct [at issue] involves” one of the enumerated factors.
18 U.S.C. § 1030(g). The provision is not so stringent as to require that the conduct at issue be
one of the enumerated factors.
But this explication of the civil enforcement provision does not resolve any of the issues
presented by Dow Corning’s complaint and motion for injunctive relief. Rather, it focuses on the
most significant problem: that Dow Corning does not allege facts consistent with the
requirements of the CFAA’s civil enforcement provision. Nothing in Dow Corning’s complaint
alleges conduct involving one of the five enumerated “factors set forth in subclause[](I), (II),
(III), (IV), or (V) of subsection (c)(4)(A)(i).” 18 U.S.C. § 1030(g). Taking the complaint at its
face, it appears that only one of the factors would, in any event, be applicable: “loss to 1 or more
persons during any 1-year period . . . aggregating at least $5,000 in value[.]” 18 U.S.C. §
1030(c)(4)(A)(i)(I). But Dow Corning’s complaint must allege “loss . . . . aggregating at least
$5,000 in value” in connection with the conduct of Defendants. It does not do so.
The requirement for showing loss under the statute is not stringent. Loss is defined as:
“any reasonable cost to any victim, including the cost of responding to an offense, conducting a
damage assessment, and restoring the data, program, system, or information to its condition prior
to the offense, and any revenue lost, cost incurred, or other consequential damages incurred
- 14 -
because of interruption of service.” 18 U.S.C. § 1030(e)(11). Because of the broad definition of
loss in the statute, one may reasonably infer from Dow Corning’s complaint that its loss would
be in excess of $5,000. But the ability to infer as much does not excuse Dow Corning from basic
pleading requirements. See Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 439-40 (2d Cir. 2004)
(holding, consistent with the “(near) unanimous view”, that the plaintiff could not maintain a
cause of action under the CFAA because it did not plead “damages or losses of at least $5,000”).
Such a defective pleading is amenable to dismissal without prejudice. Dow Corning’s pleading
will need to be rectified prior to any further relief being granted in this case. Dow Corning will
be given 24 hours to file an amended pleading that comports with the requirements of the CFAA
Second, and finally, the significance of the second limiting proviso in the civil
enforcement grant must be discussed. The clause provides that “[d]amages for a violation
involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages.”
18 U.S.C. § 1030(g). This limitation on the civil enforcement grant creates at least some
ambiguity as to the remedies available in a civil enforcement action alleging only conduct under
subsection (c)(4)(A)(i)(I). The ambiguity would be mooted in this case but for the lack of
specificity in Dow Corning’s complaint. If conduct under subsection (c)(4)(A)(i)(I) makes up
only a portion of the alleged culpable conduct, the limitation would not apply. But, since there is
a possibility that all of the allegedly culpable conduct alleged by Dow Corning falls under
subsection (c)(4)(A)(i)(I), the limitation may apply.
Although the second limitation in the civil enforcement grant could be construed as
limiting all remedies available for conduct violating subsection (c)(4)(A)(i)(I) at least one court
has held that it only limits the type of monetary damages that may be recovered. P.C. Yonkers,
428 F.3d at 511-12 (determining that injunctive relief is permitted for violations of the $5,000
- 15 -
loss provision since the “economic damages” language only limits monetary damages available,
not forms of relief). This means that the limitation does not preclude injunctive relief. Although
this Court was only able to identify one court—the Third Circuit in P.C. Yonkers—that addresses
the issue, the reading of the second limitation in § 1030(g) is the most reasonable reading of the
statute. The clause specifies that economic damages are the only form of damages available. Not
the only form of relief available. Therefore, when read in conjunction with the first clause of the
civil enforcement grant (making available “compensatory damages and injunctive relief or other
equitable relief”) it is evident that it does not preclude the availability of equitable relief in an
action only alleging “loss to 1 or more persons during any 1-year period . . . aggregating at least
$5,000 in value[.]” 18 U.S.C. § 1030(c)(4)(A)(i)(I). If Dow Corning’s claim arises only under
subsection (c)(4)(A)(i)(I), then, equitable relief would still be available.
2.
Having considered the predicate issues of when civil enforcement is appropriate under
the CFAA, Dow Corning’s likelihood of success in its civil enforcement action must be
analyzed. What follows is a discussion of the merits of Dow Corning’s allegation that
Defendants violated the CFAA.2
Under the Computer Fraud and Abuse Act, “[w]hoever . . . intentionally accesses a
computer without authorization or exceeds authorized access and thereby obtains . . . information
from any protected computer . . . shall be punished as provided in [the Act.]” 18 U.S.C. §
2
Absent from the analysis is further discussion of the fact that Dow Corning has omitted any allegations that
Defendants caused “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value[.]”
18 U.S.C. § 1030(c)(4)(A)(i)(I). It is understood, based on the foregoing, see supra § III.A.1, that loss in excess of
$5,000 it is not alleged and that Dow Corning’s pleading is deficient as a result. Since the Court need only examine
the likelihood of success on the merits, not actual success, the fact that Dow Corning’s pleadings omit this allegation
is not fatal to Dow Corning’s request for injunctive relief at this stage. That the pleading can reasonably be read to
imply loss in excess of the $5,000 substantiality requirement suffices for the purposes of analyzing Dow Corning’s
likelihood of success on the merits. The pleading will still need to be rectified, as explained above.
- 16 -
1030(a)(2)(C). The CFAA defines a “protected computer” as “a computer . . . which is used in or
affecting interstate or foreign commerce or communication, including a computer located outside
the United States that is used in a manner that affects interstate or foreign commerce or
communication of the United States[.]” 18 U.S.C. § 1030(e)(2)(B). Dow Corning alleges that the
computers in the Dow Corning network are “protected computers” under the CFAA because they
are connected to the internet. Authority is split, and spare, concerning whether a computer or
network connected to the internet is a protected computer under the CFAA. But courts have held
that the internet is itself an instrumentality of interstate commerce. See, e.g., United States v.
Trotter, 478 F.3d 918, 921 (8th Cir. 2007); United States v. MacEwan, 445 F.3d 237, 245 (3d
Cir. 2006) (holding that downloading an image from the internet is “intertwined with the use of
the channels and instrumentalities of interstate commerce”); United States v. Hornaday, 392 F.3d
1306, 1311 (11th Cir. 2004) (holding that the internet is an instrumentality of interstate
commerce). As a result, a number of courts, including two in this circuit, have concluded that
computers and networks attached to the internet are protected computers under the CFAA. See,
e.g., Freedom Banc Mortgage Servs., Inc. v. O’Harra, Case No. 11-CV-01073, 2012 WL
3862209, at *6 (S.D. Ohio Sept. 5, 2012) (citing additional cases); Jole v. Apple, Case No. 11CV-0882, 2011 WL 6101553, at *3 (M.D. Tenn. Dec. 8, 2011) (same). These cases offer
compelling guidance and support the conclusion that Dow Corning’s network computers
constitute protected computers under the CFAA.
The CFAA goes on to define “exceeds authorized access” as “to access a computer with
authorization and to use such access to obtain or alter information in the computer that the
accesser is not entitled so to obtain or alter[.]” 18 U.S.C.A. § 1030(e)(6). The CFAA does not set
forth when and under what circumstances an accesser exceeds his or her authorized access. By
- 17 -
the plain language of the statute, an accesser exceeds authorized access by gaining access to
information or areas in a computer or network to which he or she is not permitted to access.
However, courts have held that individuals may also exceed authorized access by “exceeding the
purposes for which access is ‘authorized.’” United States v. John, 597 F.3d 263, 272 (5th Cir.
2010). See also EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 582-84 (1st Cir. 2001).
Thus, material to potential liability under the statute is the scope of an individual’s permissible
access to information and the scope of an individual’s ability to use that information. See John,
597 F.3d at 272 (determining liability on the basis of the defendant’s “confined” access to
Citigroup’s data that was not “for any and all purposes but for limited purposes”).
Here, Defendants’ scope of authorized access is defined and delineated by the Master
Agreement between Dow Corning and HCL. See Master Agreement, Ex. A, ECF No. 7-2. The
Master Agreement contains prohibitions on the ownership and use of Dow Corning’s data. Under
the Agreement, “all Customer Data is and shall remain the property of [Dow Corning].” Id. at
Section 12.01. Furthermore, the Agreement significantly restricts HCL’s use of Dow Corning’s
data “[w]ithout prior approval of [Dow Corning.]” Id.
The Master Agreement’s protections for Personal Data provide the most direct limitations
on the use of Personal Data by HCL. It prohibits HCL from “us[ing] or disclos[ing] Personal
Data for any purpose other than fulfilling its obligations under the Agreement without the prior
approval of [Dow Corning] and, to the extent required by applicable Law the individual data
subject[.]”Id. at Section 12.06. The Master Agreement further prohibits HCL from “disclosing
Personal Data to any Supplier Agent without the prior approval of Customer and an agreement in
writing from the Supplier Agent to use and disclose such Personal Data only to the extent
- 18 -
necessary to fulfill Supplier’s obligations under the Agreement and for no other purpose.” Id.
Defendants are Supplier Agents under the Agreement.
Nothing in the terms of the Master Agreement, however, imposes direct liability on
Defendants. Dow Corning does not explain how the fact that Defendants are Supplier Agents
means the Master Agreement imposes a limited scope of authorized access on Defendants, rather
than merely on HCL. Courts have recognized situations where an implied duty of loyalty
between an employer and employee would create a scope of reasonable access that should not be
exceeded. See Int’l Airport Centers, L.L.C. v. Citrin, 440 F.3d 418, 420-21 (7th Cir. 2006)
(holding that a breach of the duty of loyalty terminates agency relationship and scope of access).
That limitation would apply in this case but for the fact that Defendants were not employees of
Dow Corning but instead employees of HCL,3 a non-party that has not been joined by Dow
Corning. To the extent Dow Corning believes Defendants’ actions to be in violation of the
Master Agreement or in violation of the Master Agreement’s scope of access, HCL would likely
need to be joined in this action. HCL is the counterparty to the Master Agreement and all duties,
obligations, and liabilities for breach under the Agreement are imposed upon it and not its
contractors or Supplier Agents.
The absence of HCL from this matter, while potentially problematic at a later stage of
litigation, is not necessary to resolve Dow Corning’s motion. That is because Defendants entered
into separate agreements with Dow Corning that impose limitations on Defendants’ scope of
access to Dow Corning data independent of the Master Agreement. Specifically, the
Confidentiality Agreement and Network Computer Usage Agreement signed by both Defendants
leave no doubt that their activities were beyond the authorized scope of their computer and
3
In fact, Dow Corning alternatively identifies Defendants as independent contractors of HCL and employees
of HCL. It is undisputable, based on the Confidentiality Agreements that Defendants are independent contractors of
Dow Corning.
- 19 -
network access. See Confidentiality Agreement, Ex. B, ECF No. 7-3 and Network Agreement,
Ex. C, ECF No. 7-4.
Despite the problems present in Dow Corning’s predominant theory of recovery, it has
demonstrated a sufficient likelihood of success on the merits to warrant temporary injunctive
relief as to this factor. The agreements between Dow Corning and Defendants appear to
explicitly prohibit the downloading of employees’ personal information by Defendants in the
manner alleged. The weight of this factor is compelling due to the nature of Defendants’ actions
and the strength of Dow Corning’s CFAA claim. Nevertheless, the other TRO factors should be
analyzed and weighed.
B.
The second factor to consider when analyzing a request for a temporary restraining order
is “whether there is a threat of irreparable harm to the plaintiff[.]” Hamilton’s Bogarts, Inc. v.
Michigan, 501 F.3d 644, 649 (6th Cir. 2007). This factor needs little explication. It cannot be
reasonably debated that the unlawful download of the personal information of 4,000 employees
could irreparably harm Dow Corning. With respect to customer information, many courts have
held that such misuse of otherwise private data can lead to irreparable harm to the company. See,
e.g., Reliable Prop. Servs., LLC v. Capital Growth Partners, LLC, 1 F. Supp. 3d 961, 965 (D.
Minn. 2014). Dow Corning does not explain how the disclosure of employer information can and
should be analogized to customer information, but the Court is comfortable that the potential for
harm is significant.4 Furthermore, to the extent Dow Corning’s employees make up part of its
4
The only effort by Dow Corning to bridge the gap between cases addressing disclosure of customer
information and this case is a citation to a Fifth Circuit case, Deerfield Medical Center v. City of Deerfield Beach,
661 F.2d 328 (5th Cir. 1981). According to Dow Corning this case stands for the general proposition that “privacy
rights ‘must be carefully guarded for once an infringement has occurred it cannot be undone by monetary relief.’”
Pl.’s Mot. 16, ECF No. 7. This authority would certainly be powerful guidance, but Dow Corning does not explain
the context for which the proposition was advanced by the Fifth Circuit. In Deerfield Medical Center, the Fifth
- 20 -
corporate body and inform Dow Corning’s interests, the threat to employee welfare and privacy
is significant and also justifies injunctive relief.
C.
The third TRO factor is “whether issuance of the injunction would harm others[.]”
Hamilton’s Bogarts, 501 F.3d at 649. As with the previous factor, there can be little debate as to
how this factor should be weighted. In fact, it is likely that significant harm would be done to
others (Dow Corning employees) in the absence of a restraining order. Conversely, it is hard to
conceive of a party that would be truly harmed by the imposition of a restraining order. To the
extent Defendants acted unlawfully, their harm would only be in consistent measure with the
harm they have already inflicted upon Dow Corning employees.
D.
Lastly, the Court must consider “whether the public interest is served by granting
injunctive relief.” Hamilton’s Bogarts, 501 F.3d at 649. Once again, this factor permits little
dispute. The public has an overwhelming interest in the privacy of personal information and the
security of that information when it is provided to employers. While employees have little direct
control over the manner and means by which that information is secured by an employer, it is in
the interest of the public that an employer be able to swiftly and effectively take action to secure
that data when it is compromised. In addition, to the extent Dow Corning is currently the only
entity with the ability to safeguard the privacy rights of Dow Corning employees that may be
implicated by Defendants’ actions, injunctive relief, first initiated by a TRO, is an effective
means by which it may do so.
IV.
Circuit was specifically addressing the threat to the plaintiffs’ constitutional right to privacy. No allegation has been
made, nor does it appear one conceivably could, that the privacy issues at stake here are of constitutional dimension.
- 21 -
In accordance with the procedures outlined by Federal Rule of Civil Procedure 65, certain
procedural steps must be followed to ensure due process to all parties. First, notice must be
served upon Defendants. Dow Corning will be directed to serve its complaint, its motion for
injunctive relief, and this order on Defendants. Second, a hearing will be scheduled on Dow
Corning’s request for a preliminary injunction. The hearing will be scheduled before the
expiration of this order, which is 14 days from the hour it is issued. Defendants will have an
opportunity to respond to Dow Corning’s motion but must do so prior to the motion hearing.
Lastly, Dow Corning must provide the supplemental information discussed herein within 24
hours of this order being issued. That supplemental information must be served upon
Defendants.
V.
Accordingly, it is ORDERED that Dow Corning Corporation’s Motion for Injunctive
Relief is GRANTED in part.
It is further ORDERED that Defendants Anjaneyulu Chaganti and Homi Syodia are
TEMPORARILY RESTRAINED and ENJOINED as of 4:00 p.m. on November 4, 2015:
(i)
from transferring, disseminating, erasing, and/or otherwise destroying or altering
any information and/or data (including information and/or data in electronic form)
taken from Dow Corning’s computers and computer system, including
information about past or present employees.
(ii)
to take all reasonable measures, steps, and/or efforts to prevent future
unauthorized disclosure and/or dissemination of any information and/or data
(including information and/or data in electronic form) taken from Dow Corning’s
- 22 -
computers and computer system, including information about past or present
employees.
It is further ORDERED that Plaintiff Dow Corning Corporation is DIRECTED to file a
supplemental certification in accordance with the instructions set out herein, not to exceed five
pages, within 24 hours of the issuance of this order.
It is further ORDERED that Plaintiff Dow Corning Corporation is DIRECTED to
amend its complaint in accordance with the instructions set out herein within 24 hours of the
issuance of this order.
It is further ORDERED that Plaintiff Dow Corning Corporation is DIRECTED to serve
the complaint, ECF No. 1, its motion for a temporary restraining order, ECF No. 7, a copy of this
Order, and its supplemental filings on Defendants on or before November 6, 2015 and file a
certificate of service on the Court’s docket.
It is further ORDERED that a hearing on Plaintiff Dow Corning Corporation’s Motion
for a Preliminary Injunction, ECF No. 7, is SCHEDULED for November 17, 2015 at 3:00 p.m.
It is further ORDERED that the parties are DIRECTED to appear for the motion
hearing.
It is further ORDERED that Defendants are DIRECTED to file any response to
Plaintiff’s motion for a preliminary injunction that they wish to be considered on or before
November 16, 2015.
Dated: November 4, 2015
s/Thomas L. Ludington
THOMAS L. LUDINGTON
United States District Judge
- 23 -
PROOF OF SERVICE
The undersigned certifies that a copy of the foregoing order was served
upon each attorney or party of record herein by electronic means or first
class U.S. mail on November 4, 2015.
s/Michael A. Sian
MICHAEL A. SIAN, Case Manager
- 24 -
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?