MEMORANDUM OPINION AND ORDER

LEONARD T. STRAND, Chief District Judge.

I. INTRODUCTION

This case is before me on a motion (Doc. No. 20) to dismiss by defendant Travis Hoekstra and a motion (Doc. No. 23) to dismiss by defendant Michael Rozeboom. Plaintiff Ozone Solutions, Inc. (Ozone) has filed resistances (Doc. Nos. 24, 25). I find that oral argument is not necessary. See Local Rule 7(c).

II. FACTUAL ALLEGATIONS AND PROCEDURAL HISTORY

Ozone filed its complaint (Doc. No. 1) and a motion (Doc. No. 2) for temporary restraining order (TRO) and preliminary injunction on March 14, 2019. The complaint invokes federal question jurisdiction pursuant to 28 U.S.C. § 1331, alleging claims arising under the Computer Fraud and Abuse Act (CFAA) and supplemental jurisdiction pursuant to 28 U.S.C. § 1367 over state law claims. See Doc. No. 1 at 1.

Ozone alleges that Hoekstra was employed by Ozone as an IT Network Administrator and Ozone Application Specialist from approximately January 2014 until January 10, 2019. Id. at 2. He was responsible for managing and maintaining Ozone's server systems and backups; planning and building its computer network infrastructure; managing and maintaining workstations, laptops, tablets and software; engaged in sales and customer service; and worked with customer installations of Ozone's equipment. Id. Ozone alleges that its computers and networks utilize log-in credentials and passwords to protect information contained on its computers and servers. Employee access to confidential and proprietary information is limited by virtue of the permissions that are associated with their log-in credentials. Id. As IT Network Administrator, Hoekstra had access to the entirety of Ozone's computer network, computers and servers. Id. at 3.

Rozeboom was employed by Ozone as a Sales Application Engineer from approximately 2008 through November 2018. Id. He signed a Noncompete, Nonsolicitation and Confidentiality Agreement (Agreement) with Ozone.1 Ozone has records reflecting ongoing communications and solicitations between Rozeboom and Ozone customers. Id.

In the days leading up to Hoekstra's final day of employment, Ozone alleges that Hoekstra downloaded numerous files and sent himself numerous emails containing confidential and proprietary customer information, product plans and specifications, product cost and pricing information and vendor information. Id. On his final day of employment, Ozone alleges Hoekstra took a laptop computer belonging to Ozone, which is believed to contain files downloaded from Ozone's network and server. Id.

Hoekstra later obtained employment with Global Aquaculture Supply Company, LLC (Global). Global manufactures and provides various aquacultural products, including, but not limited to, ozone equipment with application relating to aquaculture. Id. Ozone alleges that Hoekstra has disclosed to employees of Ozone that he and Rozeboom have met with customers of Ozone with the intention of diverting business to entities other than Ozone. Id. at 4.

Ozone alleges the following claims:

See Doc No. 1.

I held a hearing on the motion for TRO and preliminary injunction on March 21, 2019. I orally granted Ozone's motion for a TRO at the hearing and memorialized it in an order (Doc. No. 14) the following day. I reserved ruling on the preliminary injunction. See Doc. No. 14. The parties later agreed to extend the term of the TRO and continue the hearing on the motion for preliminary injunction to a later date if necessary. See Doc. No. 22.

III. ANALYSIS

Hoekstra and Rozeboom move to dismiss the action for lack of subject matter jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(1). Hoekstra alternatively moves to dismiss Count I for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6). I will address the jurisdictional arguments first.

A. Is There Subject Matter Jurisdiction?

Rule 12(b)(1) provides for a pre-answer motion to dismiss "for lack of subject-matter jurisdiction." Fed. R. Civ. P. 12(b)(1). As the Eighth Circuit Court of Appeals has explained:

Jones v. United States, 727 F.3d 844, 846 (8th Cir. 2013); accord Key Med. Supply, Inc. v. Burwell, 764 F.3d 955, 961 (8th Cir. 2014) (review is de novo). Dismissal for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) may be permissible on the basis of a defense or exception to jurisdiction. See, e.g., Herden v. United States, 726 F.3d 1042, 1046 (8th Cir. 2013).

Where a party limits its attack to the face of the complaint, the attack is a "facial challenge" to subject matter jurisdiction. Jones, 727 F.3d at 846 (citing BP Chems. Ltd. v. Jiangsu Sopo Corp., 285 F.3d 677, 680 (8th Cir. 2002)). On a "facial challenge," "`the court restricts itself to the face of the pleadings, and the non-moving party receives the same protections as it would defending against a motion brought under Rule 12(b)(6).'" Id. (quoting Osborn v. United States, 918 F.2d 724, 729 n.6 (8th Cir. 1990)). Those protections include treating the complainant's factual allegations as true and dismissing only if it appears beyond doubt that the complainant can prove no set of facts in support of its claim that would entitle it to relief. Osborn, 918 F.2d at 729 & n.6.

By contrast, on a "factual challenge," a party makes a factual challenge to the district court's jurisdiction pursuant to Rule 12(b)(1), "`no presumptive truthfulness attaches to the [complainant's] allegations, and the existence of disputed material facts will not preclude [the court] from evaluating . . . the merits of the jurisdictional claims.'" Iowa League of Cities v. EPA, 711 F.3d 844, 861 (8th Cir. 2013) (quoting Osborn, 918 F.2d at 729-30 & n. 6). Where the challenge is factual, "the district court is entitled to decide disputed issues of fact with respect to subject matter jurisdiction." Kerns v. United States, 585 F.3d 187, 192 (4th Cir. 2009). "[T]he court may look beyond the pleadings and `the jurisdictional allegations of the complaint and view whatever evidence has been submitted on the issue to determine whether in fact subject matter jurisdiction exists.'" Khoury v. Meserve, 268 F.Supp.2d 600, 606 (D. Md. 2003) (emphases added) (citation omitted). The court "may regard the pleadings as mere evidence on the issue and may consider evidence outside the pleadings without converting the proceeding to one for summary judgment." Velasco v. Gov't of Indon., 370 F.3d 392, 398 (4th Cir. 2004). A plaintiff carries the burden of establishing subject matter jurisdiction. Jones v. Gale, 470 F.3d 1261, 1265 (8th Cir. 2006); Hoekel v. Plumbing Planning Corp., 20 F.3d 839, 840 (8th Cir. 1994) (per curiam), Nucor Corp. v. Neb. Pub. Power Dist., 891 F.2d 1343, 1346 (8th Cir. 1989).

Hoekstra appears to be making a factual challenge, as he references exhibits offered on the motion for a TRO and preliminary injunction. See Doc. No. 20-1 at 2. He argues this court lacks subject matter jurisdiction because the alleged violations of the CFAA2 must involve a "protected computer." See Doc. No. 20-1 at 4. A "protected computer" is defined in relevant part as a computer "which is used in or affecting interstate or foreign commerce or communication." 18 U.S.C. § 1030(e)(2)(B). Hoekstra argues the complaint and affidavits submitted at the hearing on the TRO allege that two computers are involved. Id. The first is a work computer at the job site and the second is a laptop that Hoekstra allegedly kept.

Hoekstra argues the only alleged transmission of information was from a work computer at Ozone's facility in Sioux County, Iowa, to Hoekstra's personal computer in Sioux County, Iowa. Id. He contends that the merely transmitting an email via the Internet cannot satisfy the "interstate or foreign commerce or communication" element, especially when both the originating and receiving computers are in the same state. Id. at 4-5. He cites a Senate Report stating the following:

Id. at 5 (quoting S. Rep. 99-432, 4, 1986 U.S.C.C.A.N. 2479, 2482). Hoekstra argues that all of the alleged actions took place in Iowa and the only arguable "interstate" element is the transmission of information via the Internet. See Doc. No. 20-1 at 5. He contends this is unsatisfactory to satisfy the "compelling federal interest" requirement articulated above.

Ozone argues that Hoekstra misconstrues the statute and that the Eighth Circuit has addressed the issue of what constitutes a "protected computer." See Doc. No. 24-1 at 4. In United States v. Trotter, 478 F.3d 918 (8th Cir. 2007), an employee accessed his employer's work computers from home and engaged in unauthorized activity. Id. at 919-20. Both the home and work computers were located in Missouri. Each was connected to the Internet and used to communicate with computers outside Missouri. Id. at 921. The court found the computers fell within the statutory definition of a "protected computer," stating:

Trotter, 478 F.3d at 921.

Ozone also cites NCMIC Finance Corp. v. Artino, 638 F.Supp.2d 1042 (S.D. Iowa 2009), in which the court stated:

NCMIC Fin. Corp., 638 F. Supp. 2d at 1060.

As Ozone points out, the focus is not on the action for which the computers were used, but on the computers themselves. See Doc. No. 24-1 at 6; United States v. Mitra, 405 F.3d 492, 496 (7th Cir. 2005) ("[T]he statute does not ask whether the person who caused the damage acted in interstate commerce; it protects computers (and computerized communication systems) used in such commerce, no matter how the harm is inflicted."). The complaint alleges that Hoekstra downloaded numerous files from Ozone's computer and network and sent himself numerous emails containing confidential and proprietary information. Doc. No. 1 at 3. It also alleges that he took a laptop believed to contain files downloaded from Ozone's network and server. Id. While the complaint does not explicitly allege these computers were connected to the Internet, Hoekstra does not dispute this fact. See Doc. No. 20-1 at 5 ("The only contact with anything remotely `interstate' in these events is that transmission of the message took place via the internet.").

Connection to the Internet is sufficient to establish the computers at issue were "protected computers" under the CFAA. See Trotter, 478 F.3d at 921; NCMIC Fin. Corp., 638 F. Supp. 2d at 1060; Credential Plus, LLC v. Calderone, 230 F.Supp.2d 890, 906 (N.D. Ind. 2002) ("Plaintiff's computer was used to send and receive email to customers throughout the country and therefore qualifies as a protected computer under the CFAA"). Because Hoekstra makes no other challenge to subject matter jurisdiction, his motion to dismiss pursuant to Rule 12(b)(1) will be denied.

B. Has Ozone Stated a Plausible Claim Under the CFAA?

Hoekstra alternatively argues, pursuant to Rule 12(b)(6), that Ozone has failed to state a claim for a CFAA violation because the transmission in question was from one Iowa computer to another and thus, "no interstate or foreign communication" was involved. Doc. No. 20-1 at 6. Section 1030(a)(2)(C) states, in relevant part:

18 U.S.C. § 1030(a)(2)(C).3

Ozone must prove three elements, by a preponderance of the evidence, to establish a cause of action under § 1030(a)(2)(C): (1) Hoekstra's conduct involved interstate or foreign communication; (2) Hoekstra used a "protected computer" in that it was used for interstate or foreign communication; and (3) Hoekstra used Ozone's computer to obtain information without authorization or exceeded his authorized access. See NCMIC Fin. Corp., 638 F. Supp. 2d at 1059-60. Ozone must also prove that it suffered losses compensable under § 1030(c)(4)(A)(i). Id. Hoekstra challenges only the first element.

The Federal Rules of Civil Procedure authorize a pre-answer motion to dismiss for "failure to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). The Supreme Court has provided the following guidance in considering whether a pleading properly states a claim:

Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009).

Courts assess "plausibility" by "`draw[ing] on [their own] judicial experience and common sense.'" Whitney v. Guys, Inc., 700 F.3d 1118, 1128 (8th Cir. 2012) (quoting Iqbal, 556 U.S. at 679). Also, courts "`review the plausibility of the plaintiff's claim as a whole, not the plausibility of each individual allegation.'" Id. (quoting Zoltek Corp. v. Structural Polymer Grp., 592 F.3d 893, 896 n. 4 (8th Cir. 2010)). While factual "plausibility" is typically the focus of a Rule 12(b)(6) motion to dismiss, federal courts may dismiss a claim that lacks a cognizable legal theory. See, e.g., Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013); Ball v. Famiglio, 726 F.3d 448, 469 (3d Cir. 2013); Commonwealth Prop. Advocates, L.L.C. v. Mortg. Elec. Registration Sys., Inc., 680 F.3d 1194, 1202 (10th Cir. 2011); accord Target Training Intern., Ltd. v. Lee, 1 F.Supp.3d 927 (N.D. Iowa 2014).

When a complaint does not state a claim for relief that is plausible on its face, the court must consider whether it is appropriate to grant the pleader an opportunity to replead. The rules of procedure permit a party to respond to a motion to dismiss by amending the challenged pleading "as a matter of course" within 21 days. See Fed. R. Civ. P. 15(a)(1)(B). Thus, when a motion to dismiss highlights deficiencies in a pleading that can be cured by amendment, the pleader has an automatic opportunity to do so. When the pleader fails to take advantage of this opportunity, the question of whether to permit an amendment depends on considerations that include:

Meighan v. TransGuard Ins. Co. of Am., Inc., 978 F.Supp.2d 974, 982 (N.D. Iowa 2013).

The issue of whether the conduct involves an interstate or foreign communication is very similar to the issue of whether the computer is "protected" for purposes of subject matter jurisdiction, as both involve an "interstate" element. The fact that the communications at issue were sent from a computer in Iowa and received by a computer in Iowa does not mean that Hoekstra's conduct did not involve interstate or foreign communication. As noted above, the complaint alleges that Hoekstra downloaded files from Ozone's network and server and emailed files to himself. Hoekstra admits this was done via the Internet. See Doc. No. 20-1 at 4-5 ("The only contact with anything remotely `interstate' in these events is that transmission of the message took place via the internet."). The Internet is "an instrumentality and channel of interstate commerce." Trotter, 478 F.3d at 921. See also NCMIC Fin. Corp., 638 F. Supp. 2d at 1060 ("The fact that Artino's communications may have been limited to intrastate communications is not material to whether Artino accessed a protected computer."); Freedom Banc Mortg. Servs., Inc. v. O'Hara, No. 2:11-cv-01073, 2012 WL 3862209, at *6 (S.D. Ohio Sept. 5, 2012) ("A computer that is connected to the internet therefore satisfies § 1030(e)(2)'s interstate commerce requirement even if the plaintiff used that connection to engage in only intrastate communications."); Becker v. Toca, Civil Action No. 07-7202, 2008 WL 4443050, at *5 (E.D. La. Sept. 26, 2008) (concluding the fact that computers were connected to the Internet satisfies the statutory requirement that the computer must be "used in interstate . . . commerce or communication"). Ozone's CFAA claim does not fail at the pleadings stage based on the first element (conduct involving interstate or foreign communication). Hoekstra's motion to dismiss Count I on Rule 12(b)(6) grounds will be denied.

C. Is There Supplemental Jurisdiction?

Rozeboom argues that because Count I is not alleged against him, there is no subject matter jurisdiction as applies to him. See Doc. No. 25-1. Ozone alleges there is supplemental jurisdiction pursuant to 28 U.S.C. § 1367. This statute provides:

28 U.S.C. § 1367. Ozone cites Travelers Insurance Co. v. Intraco, Inc., in which the court stated that "[s]upplemental jurisdiction exists where the claims against the pendent and nonpendent parties `derive from a common nucleus of operative facts." Travelers Ins. Co. v. Intraco, Inc., 163 F.R.D. 554, 557 (S.D. Iowa 1995) (quoting Ammerman v. Sween, 54 F.3d 423, 424 (7th Cir. 1995)). The court concluded the "essential question is whether the claims are so related that the parties would ordinarily be expected to resolve them in one judicial proceeding" and that "[a] loose factual connection between the claims is generally sufficient." Id.

Ozone argues that the allegations against Rozeboom "derive from a common nucleus of operative facts" that apply to Hoekstra and establish subject matter jurisdiction. Doc. No. 25-1 at 4. It contends both defendants are former employees of Ozone and are alleged to have engaged in similar behavior by competing with and soliciting former clients of Ozone. They are both alleged to have disclosed confidential and proprietary information to competitors. Ozone also alleges they worked together to lure customers away from Ozone, interfering with Ozone's customer contracts. Id. at 4-5. Ozone contends these allegations establish more than a "loose factual connection" between the federal and state claims asserted.

I agree with Ozone that based on the allegations in its complaint, its claims against Rozeboom "are so related to claims in the action within such original jurisdiction that they form part of the same case or controversy." 28 U.S.C. § 1367(a). Because I have found that Count I establishes subject matter jurisdiction and should not be dismissed, this court has supplemental jurisdiction over the state law claims against both Hoekstra and Rozeboom.

IV. CONCLUSION

For the reasons stated herein, defendant Hoekstra's motion (Doc. No. 20) to dismiss and defendant Rozeboom's motion (Doc. No. 23) to dismiss are both denied.

IT IS SO ORDERED.