JACK B. WEINSTEIN, Senior District Judge.
I. Introduction .............................................................. 478II. Facts and Procedural History .............................................. 478III. Contentions of the Parties, Law, and Application to Facts ................. 479A. Motion to Dismiss Standard ............................................. 479B. Propriety of Emporos' Motion to Dismiss Under the Federal Rules ........ 4791. Contentions of the Parties .......................................... 4792. Law ................................................................. 4803. Application to Facts ................................................ 480C. Arguments to Dismiss Each of Plaintiffs' Counts ........................ 4801. Gross Negligence .................................................... 480a. Contentions of the Parties ....................................... 480b. Law and Application to Facts ..................................... 4812. Negligent Supervision ............................................... 482a. Contentions of the Parties ....................................... 482b. Law and Application to Facts ..................................... 4823. Conversion .......................................................... 482a. Contentions of the Parties ....................................... 482b. Law and Application to Facts ..................................... 483i. Choice of Law ............................................... 483ii. New York Conversion Law ..................................... 484iii. Application of New York Conversion Law ...................... 4844. Breach of Contract .................................................. 484a. Contentions of Parties ........................................... 484b. Law and Application to Facts ..................................... 4855. Violation of Computer Fraud and Abuse Act ........................... 485
a. Contentions of the Parties ....................................... 485b. Law and Application to Facts ..................................... 486i. Generally ................................................... 486ii. Two-Year Statute of Limitations ............................. 486iii. Responsibility for Emporos' Employees ....................... 486iv. Misuse of Information vs. Improper and Unauthorized Access .................................................... 4876. Declaratory Judgment ................................................ 487a. Contentions of the Parties ....................................... 487b. Law and Application to Facts ..................................... 488IV. Conclusion ................................................................ 488
This case rests on serious charges that the defendant and its employees breached plaintiffs' electronic credit and sales system (supplied largely by defendant), resulting in the stealing of credit card information and losses to plaintiffs' customers, and ultimately, to plaintiffs. In view of the large damage that can be done by such thievery and negligence this case must be taken seriously. See, e.g., James Verini, The Great Cyberheist, N.Y. Times Mag., Nov. 10, 2010 (detailing the vast damage caused by online credit card frauds). A jury could find that the defendant—an expert selling computer secrecy protections—did not act appropriately.
Clark Street Wine and Spirits and 88 Seventh Avenue Inc. ("Plaintiffs") sue Emporos Systems Corporation ("Emporos") alleging violations of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 ("CFAA"), and common law claims of gross negligence, negligent supervision, conversion, and breach of contract. It is alleged that a current or former employee of Emporos, which installed credit card processing services for Plaintiffs, misappropriated customers' information. Sought are compensatory and punitive damages. Also requested is a declaratory judgment finding that any fines, penalties, or other judgments against Plaintiffs resulting from this delict are the legal responsibility of Emporos.
Emporos moves to dismiss the First Amended Complaint and Jury Demand for failure to state a claim upon which relief may be granted. Fed. R. Civ. Proc. 12(b)(6).
For the reasons set out below, the motion to dismiss is denied. A motion for sanctions based on Rule 11(c) was denied for reasons stated orally on the record.
For purposes of this motion, the plaintiffs factual allegations are accepted as true, with all reasonable inferences drawn in plaintiffs favor. Bernheim v. Litt, 79 F.3d 318, 321 (2d Cir.1996). Further discovery is required, particularly to determine if the culprit who stole Plaintiffs' customers' credit card information was an employee of Emporos. By separate order, the magistrate judge was respectfully requested to expedite discovery so that the case can be set for trial in May, 2011.
Emporos is a North Carolina corporation that provides credit card processing services to businesses. Amended Complaint ("Am. Compl.") at ¶ 3. In January 2004, Plaintiffs, New York corporations that sell wine and spirits, entered into Software License Agreements with Emporos to provide credit card software hardware and services. Together, these features are known as a "point-of-sale" system. Am. Compl. at ¶¶ 18, 20; Emporos' Motion to Dismiss ("Def.'s Mot. Dismiss") at Ex. B. As part of this system,
During the course of 2007, through communications with American Express, Visa, MasterCard, and Cynergydata (Seventh Avenue's credit card processor), Plaintiffs learned that a consumer fraud had been traced to their stores. Am. Compl. at ¶¶ 30-46. Consumers' credit card information was compromised and fraudulent purchases were made on their accounts. Am. Compl. at ¶¶ 30, 33. They were assessed fines and penalties from credit card companies for non-compliance with security protocols; eventually they replaced the proprietary system installed by Emporos. Am. Compl. at ¶¶ 41, 67, 69. To determine the cause of the breach, Plaintiffs employed various information technology services and consultants.
The complaint was filed on March 29, 2010. Plaintiffs' Complaint and Jury Demand ("Original Complaint") ("Orig. Compl."). On May 13, 2010, Emporos moved to dismiss the Original Complaint on numerous grounds: (1) Plaintiffs' failure to allege their capacity to sue as required under Federal Rule of Civil Procedure 9(a); (2) failure to allege subject matter jurisdiction; and (3) with respect to the alleged violation of the CFAA, failure to state a claim upon which relief may be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). Emporos' Motion to Dismiss Plaintiffs' Complaint ("Original Motion to Dismiss") ("Orig. Mot. Dismiss"), at 3-5. On May 28, 2010, Plaintiffs' Amended Complaint added allegations regarding Plaintiffs' corporate status and the elements of a private CFAA claim. Am. Compl. at ¶ 1, 2, 105. Emporos thereafter filed the present Motion to Dismiss.
Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss for "failure to state a claim upon which relief may be granted." In reviewing a Rule 12(b)(6) motion, the task of the court "is merely to assess the legal feasibility of the complaint, not to assay the weight of the evidence which might be offered in support thereof." Geisler v. Petrocelli, 616 F.2d 636, 639 (2d Cir.1980). "The issue is not whether a plaintiff will ultimately prevail but whether the claimant is entitled to offer evidence to support the claims." Scheuer v. Rhodes, 416 U.S. 232, 236, 94 S.Ct. 1683, 40 L.Ed.2d 90 (1974). A court must accept the plaintiffs factual allegations as true, drawing all reasonable inferences in plaintiffs favor. Bernheim v. Litt, 79 F.3d 318, 321 (2d Cir.1996); see also Ashcroft v. Iqbal, ___ U.S. ___, 129 S.Ct. 1937, 1949, 173 L.Ed.2d 868 (2009) ("To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to `state a claim to relief that is plausible on its face.'" (citation omitted)); Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 556, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ("Asking for plausible grounds to infer an agreement does not impose a probability requirement at the pleading stage....").
Plaintiffs argue that because Emporos already filed a motion to dismiss that sought to dismiss one of Plaintiffs' claims pursuant to Federal Rule of Civil Procedure
Emporos maintains that this court still has discretion to entertain the 12(b)(6) motion, citing cases which allowed multiple 12(b)(6) motions where the second motion was "not interposed for delay, and its consideration will expedite the disposition of the case on the merits." Def.'s Mot. Dismiss at n. 1. It asserts that the current motion was not interposed for delay. Id. It is contended that even if Plaintiffs' position were correct, Emporos may file an answer and convert the current motion to dismiss into a motion for judgment on the pleadings under Rule 12(c), because the defense of failure to state a claim is not waivable under Rule 12(h). Id.
Federal Rule of Civil Procedure Rule 12(g) generally provides that "a party that makes a motion under this rule must not make another motion under this rule raising a defense or objection that was available to the party but omitted from its earlier motion." The defense provided by Rule 12(b)(6) for failure to state a claim upon which relief may be granted is not waivable, but if not raised in an initial 12(b)(6) motion, it can only be raised (1) in any pleading allowed or ordered under Rule 7(a); (2) by a motion under Rule 12(c); or (3) at trial. See Fed.R.Civ.P. 12(h)(2). But successive 12(b)(6) motions may be allowed if the pending motion is not interposed for delay and its consideration will expedite the disposition of the case on the merits. See, e.g., Sharma v. Skaarup Ship. Mgmt. Corp., 699 F.Supp. 440, 444 (S.D.N.Y.1988); Thorn v. New York City Dept. of Social Servs., 523 F.Supp. 1193, 1196 n. 1 (S.D.N.Y.1981).
Emporos' current motion is neither frivolous nor filed to improperly delay the proceedings. It puts forth reasonable and cogent arguments to dismiss each of Plaintiffs' claims. See Orig. Mot. Dis. at 3-5. Also, as Emporos points out, this motion may be considered in tandem with its answer as a motion for judgment on the pleadings under Rule 12(c), pursuant to which the same standards apply. See Ziemba v. Wezner, 366 F.3d 161, 163 (2d Cir.2004). In any event, the issues now raised can be decided pursuant to Rule 16(c)(2)(A) and (B) in order to expedite discovery and trial and reduce further motions directed at the pleadings.
In their Amended Complaint, Plaintiffs first claim that Emporos committed gross negligence ("Count I"). They contend that Emporos owed Plaintiffs two distinct duties: (1) to ensure that its service and devices meet industry standards; and (2) to protect the information needed to access Plaintiffs' computers through the remote access program, the LogMeln utility. Am. Compl. at ¶¶ 75, 76; Pl. Mem. L. Opp. at 10. Specifically, it is alleged that a current or former employee of Emporos used the LogMeIn software to commit the fraud complained of. Am. Compl. at ¶¶ 47-48. Emporos, it is charged, improperly caused customers' credit card magnetic data to be stored on Plaintiffs' systems, was aware of the flaws in its security system, and improperly left the LogMeln information "in the open." Id. at ¶¶ 42, 49.
In response, it is maintained that Emporos owed Plaintiffs duties outside the contract, and thus they have properly alleged gross negligence causes of action. Pl. Mem. L. Opp. at 13-14. They point to Emporos' interpretation of its own duty under the Software License Agreements to provide "a non-exclusive and non-transferable license" to use the computer software programs, not to offer technical support. Id.; Def.'s Mot. Dismiss at 12. Thus, it is alleged, the duty to properly maintain access to Plaintiffs' computers through the LogMeln utility arises outside the contract and is subject to recovery under tort. Emporos' reliance on 532 Madison Avenue is misplaced, it is argued, as this limit on recovery of economic damages applies only where liability might extend to a large, indeterminate class of persons. Pl. Mem. L. Opp. at 14-15.
The contract calls for application of North Carolina law in interpreting the contract for contract law purposes. But New York tort law controls the negligence claim. See Curley v. AMR Corp., 153 F.3d 5,12 (2d Cir.1998).
To state a claim for gross negligence, Plaintiffs must allege that Emporos breached a duty owed to Plaintiffs that proximately caused Plaintiffs' damages, and that "the act or omission [is] of an aggravated character." Id. at 13 (2d Cir. 1998) (detailing New York common law); Schultz v. Boy Scouts of America, Inc., 65 N.Y.2d 189, 195, 491 N.Y.S.2d 90, 480 N.E.2d 679 (1985) ("[W]hen the defendant's negligent conduct occurs in one jurisdiction and the plaintiff's injuries are suffered in another, the place of the wrong is considered to be ... where the plaintiffs' injuries occurred."). Determining whether acts or omissions constitute gross negligence is reserved to the jury. Travelers Indemnity Co. of Connecticut v. The Losco Group, 136 F.Supp.2d 253, 256, 257 (S.D.N.Y.2001).
Emporos' argument is belied by its own interpretation of its contracts. It maintains that its only duty under the Agreements was to provide a "non-exclusive and non-transferable license to use the object code to the computer software program(s) identified and described" in the Agreements. Def.'s Mot. Dismiss at 12. Plaintiffs' allegations that Emporos routinely supported its product by accessing Plaintiffs' computers and that a current or former employee utilized this access to break into Plaintiffs' computers, construed liberally, provide evidence of an independent duty that may support an action in tort. See Am. Compl. at ¶¶ 28, 41. Plaintiff has alleged that Emporos failed to notify Plaintiffs of the security flaws in its system. See id. at ¶¶ 52, 54. "Whether these failures rise to the level of reckless disregard for the rights of others is a question properly reserved for a jury." Travelers Indem. Co. of Conn. v. Losco Group, Inc., 136 F.Supp.2d 253, 257 (S.D.N.Y.2001); see also Charter Oak Fire Ins. Co. v. Trio Realty Co., 2002 WL 123506, at *5 (S.D.N.Y. Jan. 31, 2002) ("The issue of gross negligence is ordinarily a question of fact for a jury to determine."). In view of great damage to customers and business that breaches of a computer system may cause, a jury may
Plaintiffs argue that Emporos breached its duty to supervise its employees to ensure that they did not use their access to the computers for improper purposes ("Count II"). Am. Compl. at ¶¶ 80-81. Because of this failure to supervise, their customers' credit card information was allegedly stolen, resulting in fines imposed by credit card companies and loss of "consumer good will." Id. at ¶¶ 82-83.
Emporos argues that Count II should be dismissed, in part, for the same reasons it seeks to dismiss Count I. It maintains that this duty to supervise its employees arises out of the Software License Agreements and thus Plaintiffs cannot recover in tort. Def.'s Mot. Dismiss at 8-9. It also argues that under New York law, an employer can be liable for negligent supervision only if the employer knew or should have known of the employee's propensity for the illegal conduct. Id. at 9 n. 7.
It is Plaintiffs' position that the duty to ensure that employees and former employees with knowledge of the LogMeIn information necessary to access Plaintiffs' computers arises outside the contract, as interpreted by Emporos, and thus supports this cause of action. Pl. Mem. L. Opp. at 13.
"A necessary element of a cause of action alleging negligent supervision or negligent retention is that `the employer knew or should have known of the employee's propensity for the conduct which caused the injury.'" Well v. Rambam, 300 A.D.2d 580, 753 N.Y.S.2d 512, 514 (2d Dep't 2002) (quoting Kenneth R. v. Roman Catholic Diocese of Brooklyn, 229 A.D.2d 159, 654 N.Y.S.2d 791, 793 (2d Dep't 1997) cert. denied by 522 U.S. 967, 118 S.Ct. 413, 139 L.Ed.2d 316 (1997)); see also Bouchard v. New York Archdiocese, 719 F.Supp.2d 255, 261 (S.D.N.Y.2010) (stating that an element of negligent supervision is "that the employer `knew or should have known of the employee's propensity for the conduct which caused the injury'" (citations omitted)). This element is in addition to the standard elements of negligence. Bouchard, 719 F.Supp.2d at 260-61.
Although plaintiffs do not allege that Emporos knew or should have known that its employee had a propensity for any improper conduct, cf. Am. Compl. at ¶¶ 80-84, discovery into the remaining claims may very well unearth this information. In the interest of judicial and party economy, Count II is not dismissed.
Plaintiffs' third cause of action alleges that Emporos, or those in its employ, unlawfully converted plaintiffs' property without legal justification ("Count III"). Am. Compl. at ¶¶ 86-87. Emporos converted their customers' credit card information, Plaintiffs argue, resulting in fines imposed by credit card companies and loss of business.
In its motion to dismiss, Emporos claims that North Carolina law governs Count III. Under New York's "interest analysis" choice-of-law doctrine, Emporos argues the locus of a conversion claim is "the state where the Emporos' acts respecting the allegedly converted property are committed." Def.'s Mot. Dismiss at 8 (citing Pentagen Techs. Int'l, Ltd. v. CACI Int'l Inc., No. 93 Civ. 8512, 1996 WL 435157, at *12 (S.D.N.Y. Aug. 2, 1996)). Since North
The locus of the harm is the most important factor in determining which law applies to a conversion claim, Plaintiffs contend. Pl. Mem. L. Opp. at 33-34. They assert that their penalties and loss of business are located in New York. Id. Second, they argue that credit card information, though intangible, is a "specific identifiable thing" subject to recovery under New York conversion law. Id. at 34-36 (citing Thyroff v. Nationwide Mut. Ins. Co., 8 N.Y.3d 283, 832 N.Y.S.2d 873, 864 N.E.2d 1272 (2007)). Finally, Plaintiffs maintain that they have a superior possessory right to its customers' credit card information, sufficient to support its conversion claim. Id.
In a diversity action, the jurisdiction in which the court sits determines the choice of law principles, except, where as here, the contract calls for application of North Carolina law to Plaintiffs' breach of contract theory. See Krock v. Lipsay, 97 F.3d 640, 645 (2d Cir.1996). "New York applies an `interest analysis' to its choice of law, under which the law of the jurisdiction having the greatest interest in the litigation controls." Softel, Inc. v. Dragon Med. and Scientific Comms., Inc., 118 F.3d 955, 967 (2d Cir.1997); see also, e.g., Bakalar v. Vavra and Fischer, 619 F.3d 136, 139 (2d Cir.2010).
In evaluating which law applies to conversion claims, New York courts (or courts applying New York law) have not been uniform in their rationales. Some courts hold that the locus of the defendant's allegedly wrongful acts determines the applicable law. See, e.g., Pentagen Techs. Int'l, Ltd. v. CACI Int'l Inc., No. 93 Civ. 8512, 1996 WL 435157, at *12 (S.D.N.Y. Aug. 2, 1996) ("[T]he state where the defendant's acts respecting the allegedly converted property are committed" determines applicable law.); Hacohen v. Bolliger Ltd., 108 A.D.2d 357, 489 N.Y.S.2d 75, 78 (1st Dep't 1985) (deciding that since in a conversion claim it is "the defendant's standard of conduct that is to be judged," the location of the alleged acts determines applicable law). Others hold that the location of the alleged injury is determinative. See, e.g., Hoelzer v. City of Stamford, Conn., 722 F.Supp. 1106, 1112 (S.D.N.Y.1989) ("Absent `special circumstances,' the law of the place of the injury applies [to a conversion claim].").
New York has a greater interest in the conversion issue. Although the parties are domiciled in different states—Plaintiffs in New York, Emporos in North Carolina—the alleged injury suffered by Plaintiffs is entirely in New York where the equipment was installed. New York has a strong interest in seeing that those doing business in New York and customers in New York are not cheated. See Bakalar, 619 F.3d at 144-45. Emporos' alleged wrongful acts may have taken place anywhere in the world. See Am. Compl. at ¶ 50. Absent further factual development, the locus of Plaintiffs' injury indicates that New York's law should be applied.
"To establish a cause of action to recover damages for conversion, `the plaintiff must show legal ownership or an immediate superior right of possession to a specific identifiable thing and must show that the defendant exercised an unauthorized dominion over the thing in question... to the exclusion of the plaintiff's rights.'" Eight In One Pet Products v. Janco Press, Inc., 37 A.D.3d 402, 828 N.Y.S.2d 899, 899 (2d Dep't 2007) (citation omitted). Electronic information suffices. See Thyroff v. Nationwide Mut. Ins. Co., 8 N.Y.3d 283, 292-293, 832 N.Y.S.2d 873, 864 N.E.2d 1272 (2007) ("[E]lectronic records that were stored on a computer and were indistinguishable from printed documents [are] subject to a claim of conversion in New York."). "The basis of an action for conversion is the denial or violation of the plaintiff's dominion over, rights to, or possession of property." Mirvish v. Mott, 75 A.D.3d 269, 901 N.Y.S.2d 603 (1st Dep't 2010) (citing Sporn v. MCA Records, 58 N.Y.2d 482, 487, 462 N.Y.S.2d 413, 448 N.E.2d 1324 (1983)). Electronic records are valuable property.
Plaintiffs' possession of their customers' credit card information was adversely affected and its value attenuated by Emporos' alleged misconduct. It seriously diluted its value and became a disincentive rather than a reason for customers and the business to use the system. Cf. Thyroff, 8 N.Y.3d at 285, 832 N.Y.S.2d 873, 864 N.E.2d 1272 (plaintiff alleged that he was "unable to retrieve his customer information and other personal information"). Count III is not dismissed.
Plaintiffs fourth claim ("Count IV") asserts that Emporos breached the "valid and binding contracts" between the two parties, in which Emporos agreed to provide and support the point of service system. Am. Compl. at ¶ 90. They allege Emporos supplied a defective product, failed to properly monitor the point-of-sale system, failed to notify Plaintiffs of security breaches, and used its access to the computer system to steal its customers' credit card information. Id. at ¶¶ 90-92. They contend that Emporos, in effect, improperly repudiated its contracts, forcing Plaintiffs to overhaul their point-of-sale systems, resulting in fines and lost business. Id. at ¶¶ 93-98.
In its motion to dismiss, Emporos argues that under the Software License Agreements, its only duty was to provide a "non-exclusive and non-transferable license to use the object code," not to "support" or "monitor" Plaintiffs' systems. Def.'s Mot. Dismiss at 12. The Software License Agreements, it argues, allocate responsibility for the "supervision, management, and control of [the] use of the Program Product" to the Plaintiffs, and thus the only potentially viable claim is for providing a defective product. Id. Since the Agreements exclude Emporos' liability under the contract from "indirect, consequential, exemplary, punitive or incidental damages, or loss [sic] profits," it contends that Plaintiffs' purported damages are not recoverable. Id. at 12-13.
Even if Emporos was not required to support the point-of-sale system under the Software License Agreements, Plaintiffs maintain, it did so in practice. Am. Compl. at ¶¶ 27-29; Pl. Mem. L. Opp. at 16-17. They contend that this past practice altered the terms of its contracts. Pl. Mem. L. Opp. at 17-18. They also argue that Emporos breached the inherent duty of good faith, the liability limitations within the Software License Agreements are unenforceable, and Emporos improperly terminated
Under North Carolina law, which both Plaintiffs and Emporos agree apply to Count IV, the "elements of a claim for breach of contract are (1) existence of a valid contract and (2) breach of the terms of that contract." Ahmadi v. Triangle Rent A Car, Inc., 691 S.E.2d 101, 103 (N.C.App.2010). The terms of a written contract, however, do not necessarily define the scope of the parties' duties. See Son-Shine Grading, Inc. v. ADC Const. Co., 68 N.C. App. 417, 422, 315 S.E.2d 346 (N.C.App.1984) ("The provisions of a written contract may be modified or waived... by conduct which naturally and justly leads the other party to believe the provisions of the contract have been modified or waived. ...").
Here, Emporos contends that its only duty under the Software License Agreements was to provide a "non-exclusive and non-transferable license." Def.'s Mot. Dismiss. at 12. Emporos also maintains that the Agreements allocated "exclusive[] responsibility for the supervision, management, and control of its use" of the services Emporos provided to Plaintiffs. Id. Plaintiffs, however, specifically allege in their complaint that Emporos required Plaintiffs to install the LogMeIn utility and that Emporos "routinely" corrected the problems associated with its product. Am. Compl. at ¶¶ 27-28. Taking these allegations as true, Emporos' conduct may be found by a jury to have effectively modified or interpreted the Software License Agreements' terms. Further factual development is required to determine the scope of Emporos' duties. Dismissal of Count IV is not appropriate.
Plaintiffs allege that Emporos (or Emporos' employees) deliberately and impermissibly exceeded the scope of authorized access to Plaintiffs' computers in violation of the CFAA ("Count V").
Emporos first maintains that Count V is time-barred by 18 U.S.C. § 1030(g), which states that "[n]o action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage." Def.'s Mot. Dismiss at 16. It cites Plaintiffs' allegation that on December 18, 2007, it received a letter from its credit card processor, Cynergydata, indicating that MasterCard had identified the liquor store as a "source of significant fraud activity" in 2007. Id.; see Am. Compl. at ¶ 39. Emporos also claims that it is not responsible for the criminal actions of its employees. Def.'s Mot. Dismiss at 17. It argues that Plaintiff alleges only misuse of information that it properly accessed, not improper access itself, Def.'s Mot. Dismiss at 18, which is not prohibited by the CFAA. Emporos also contends that Plaintiffs fail to allege intent to defraud and damage, as required by the CFAA.
In response, Plaintiffs contend that an employee's criminal actions may be attributable to its employer if it is within the scope of his or her employment, an issue for the jury. Pl. Mem. L. Opp. at 23-27. Their claims are not barred by the statute of limitations, they maintain, because they were only told that their stores were the source of the fraud in December of 2007. Id. at 32. Since "damage" is defined by the CFAA "as any impairment to the integrity or availability of data, a program, a system, or information," 18 U.S.C. § 1030(e)(8), they argue that they were not
The Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(4), prohibits, among other things, anyone from "intentionally access[ing] a computer without authorization or exceed[ing] unauthorized access" and thereby obtains "information from any protected computer." 18 U.S.C. §§ 1030(a)(1), (2)(C). The CFAA also provides a limited private right of action against violators of this section for "any person who suffers damage or loss" of, among other things, "1 or more persons during any 1-year period ... aggregating at least $5,000 in value." Id. §§ 1030(g) (detailing private right of action), (c)(4)(A)(i)(I). "Damage" is defined as "any impairment to the integrity or availability of data, a program, a system, or information." Id. § 1030(e)(8). "Loss" is defined as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred." Id. § 1030(e)(11).
Section 1030(g), the sole source of a private claim, states that "[n]o action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage." Id. § 1030(g). Thus, in order to proceed, a plaintiff must file suit within two years of discovering "any impairment to the integrity or availability of data, a program, a system, or information." Id. § 1030(e)(8). It was conceded by Plaintiffs on argument that this limitation period did not preempt state limitations on other causes of action.
Accepting Plaintiffs' allegations as true, Emporos' motion to dismiss Count V on this ground must fail. Emporos' reliance on paragraph 39 of the Amended Complaint is insufficient. See Def.'s Mot. Dismiss at 16. This paragraph alleges that on "December 18, 2007, Plaintiff Seventh Avenue received a letter ... stating that Seventh Avenue had been identified by MasterCard as a significant fraud activity." Am. Compl. at ¶ 39. This statement does not indicate that Plaintiffs' computer system was compromised. Plaintiffs were not necessarily aware of any "impairment to the integrity or availability of data, a program, a system, or information." As Plaintiffs imply in their Amended Complaint, one of their own employees could have simply misappropriated the information without any access to a computer. See id. at ¶ 40 (alleging that Seventh Avenue was asked to perform a background check on every employee). Emporos' statute of limitations theory fails.
"[A]n employer is responsible for an employee's intentional tort only when the employee was acting within the scope of his or her employment when he or she committed the tort." Girden v. Sandals Intern., 262 F.3d 195, 205 (2d Cir. 2001). Whether an employee was acting within that scope is "heavily dependent on factual considerations," and "ordinarily [a question] for the jury." Riviello v. Waldron, 47 N.Y.2d 297, 303, 418 N.Y.S.2d 300, 391 N.E.2d 1278 (1979). Still, this determination "can be made as a matter of law in some instances." Girden, 262 F.3d at 205 (citing New York cases).
Numerous factors are relevant to a determination of whether an employee's
More evidence is needed to determine the Emporos' employees' scope of employment. Plaintiffs allege that their customers' information was misappropriated via Emporos' LogMeln application. Am. Compl. at ¶¶ 47, 51. Emporos provided informational security services, and misappropriation by its employees may reasonably have been anticipated. Plaintiffs also allege that Emporos was aware of similar breaches, supporting the view that this employee conduct should have been prevented. Id. at ¶ 47. Further factual development is needed to define the scope of employment.
The Computer Fraud and Abuse Act proscribes conduct that exceeds authorized access to a protected computer. See 18 U.S.C. § 1030(a)(2). The Court of Appeals for the Second Circuit has not precisely defined the meaning of "exceeds authorized access." See United States v. Aleynikov, No. 10 Cr. 96, 737 F.Supp.2d 173, 192-93, 2010 WL 3489383, at *16 (S.D.N.Y. Sep. 3, 2010) (noting this fact). Some courts have interpreted this statute to prevent any misuse of accessed information. See, e.g., United States v. John, 597 F.3d 263, 271 (5th Cir.2010); Mktg. Tech. Solutions, Inc. v. Medizine LLC, No. 09 Civ. 8122, 2010 WL 2034404, at *7 (S.D.N.Y. May 18, 2010). Others have held that "an employee with authority to access his employer's computer system does not violate the CFAA by using his access privileges to misappropriate information." Aleynikov, 737 F.Supp.2d at 192, 2010 WL 3489383, at *16; see also LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1130-31 (9th Cir. 2009).
This issue requires some factual development. If Emporos employees had permission to access Plaintiffs' computers, but not their customers' credit card information, Count V might survive even a strict interpretation. See Aleynikov, 737 F.Supp.2d at 191-92, 2010 WL 3489383, at *15 ("[A] person who `exceeds authorized access' has permission to access the computer, but not the particular information on the computer that is at issue.").
It seems unlikely that the federal statute applies to the instant case. Emporos' motion to dismiss Count V is denied, with leave to renew at pretrial conferences before trial when the issues can be simplified.
Plaintiffs request a declaratory judgment that states that any fines, penalties or other judgments against Plaintiffs as a result of the theft of their consumers' credit card information are the legal responsibility
The Declaratory Judgment Act vests a district court with discretion to determine whether it will exert jurisdiction over a proposed declaratory action: "In a case of actual controversy ... any court of the United States may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought." 28 U.S.C. § 2201(a) (emphasis added); see also Wilton v. Seven Falls Co., 515 U.S. 277, 282-83, 115 S.Ct. 2137, 132 L.Ed.2d 214 (1995) (interpreting this language as permissive). "The fact that a lawsuit has been filed that will necessarily settle the issues for which the declaratory judgment is sought suggests that the declaratory judgment will serve `no useful purpose.'" Amusement Indus., Inc. v. Stern, 693 F.Supp.2d 301, 311 (S.D.N.Y.2010) (citations omitted).
Here, Plaintiffs seek a declaratory judgment stating that "any fines, penalties, or other judgments against Plaintiffs as a result of the theft of the credit card information are the legal responsibility of Emporos." Am. Compl. at ¶ 113. They seek to recover these same damages under Counts I-V, see id. at ¶¶ 77, 83, 87, 97, 105, for past losses; the declaratory judgment covers future, as yet undiscovered loss. This was not the case in Sofi Classic S.A. de C.V. v. Hurowitz, where, "the [declaratory judgment] claim [was] duplicative in that it [sought] no relief that [was] not implicitly sought in the other causes of action." 444 F.Supp.2d 231, 249-50 (S.D.N.Y.2006). The only added judgments Plaintiffs proffer are future fines levied against Plaintiffs. Pl. Mem. L. Opp. at 38.
A declaratory judgment will not be granted. Since these possible and hypothetical future claims depend on particular facts, peculiar to each incident, a declaratory judgment is denied.
The motion to dismiss is denied.
A trial date will be set for early May, 2011. On consent, the jury will be chosen by the magistrate judge. A pretrial hearing before the court will be set one week before the trial. The parties will provide lists of witnesses, exhibits, and proposed charges one week before this pretrial hearing. All in limine motions will be heard at that time.
SO ORDERED.
