ORDER GRANTING MOTION TO DISMISS
RICARDO S. MARTINEZ, District Judge.
I. INTRODUCTION
This matter comes before the Court on the individual Defendants' Motion to Dismiss Union Bank's Amended CFAA Claim. Dkt. #81. Defendants argue that Plaintiff continues to fail to state a claim for relief under the Computer Fraud and Abuse Act ("CFAA") against the individual Defendants. Id. Plaintiff responds that it has adequately pled facts to support its amended CFAA claim. Dkt. #82. For the reasons set forth below, the Court disagrees with Plaintiff and GRANTS Defendants' motion to dismiss.
II. BACKGROUND
The instant matter was filed in this Court on November 22, 2017. Dkt. #1. Plaintiff MUFG Union Bank, N.A. ("Union Bank") alleges that a group of its former employees resigned en masse after planning for several months to take trade secrets, documents and confidential information that they are now utilizing to take business from it and unfairly compete with it. Dkt. #79 at ¶ ¶ 8-22. Plaintiff further alleges that Defendant U.S. Bank knew of the individuals' actions and encouraged them. Id. at ¶ ¶ 19-22. Based on these allegations, Union Bank initially asserted six claims for relief against the Defendants: 1) breach of fiduciary duty of loyalty (against all Defendants); 2) intentional interference with business relationships (against all Defendants); 3) misappropriation of trade secrets under Washington's UTSA, RCW 19.108.010, et seq. (against all Defendants); 4) conversion (against all Defendants); 5) misappropriation of trade secrets under the Defend Trade Secrets Act ("DFSA"), 18 U.S.C. § 1831, et seq. (against all Defendants); and 6) violations of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030, et seq. (against the individual Defendants). Dkt. #1 at ¶ ¶ 23-56.1 All Defendants then moved to dismiss all claims. Dkts. #62 and #63.
On May 2, 2018, this Court granted in part Defendants' motions. Dkt. #78. Specifically, the Court dismissed with prejudice Plaintiff's First, Second and Fourth Claims for Relief, allowed Plaintiff's Third and Fifth Claims for trade misappropriation under state and federal law to proceed, and allowed Plaintiff leave to amend its CFAA claim only. Id. Plaintiff filed an Amended Complaint on May 11, 2018. Dkt. #79. The instant motion followed.
III. DISCUSSION
A. Legal Standard
In deciding a 12(b)(6) motion, this Court is limited to the allegations on the face of the Complaint (including documents attached thereto), matters which are properly judicially noticeable and other extrinsic documents when "the plaintiff's claim depends on the contents of a document, the defendant attaches the document to its motion to dismiss, and the parties do not dispute the authenticity of the document, even though the plaintiff does not explicitly allege the contents of that document in the complaint." Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005). The Court must construe the complaint in the light most favorable to the Plaintiff and must accept all factual allegations as true. Cahill v. Liberty Mutual Ins. Co., 80 F.3d 336, 337-38 (9th Cir. 1996). The Court must also accept as true all reasonable inferences to be drawn from the material allegations in the Complaint. See Brown v. Elec. Arts, Inc., 724 F.3d 1235, 1247-48 (9th Cir. 2013); Pareto v. F.D.I.C., 139 F.3d 696, 699 (9th Cir. 1998). However, the Court is not required to accept as true a "legal conclusion couched as a factual allegation." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)).
B. Amended CFAA Claim Against Individual Defendants
The individual Defendants now move for the dismissal of Plaintiff's amended CFAA claim against them. The CFAA was enacted in 1984 to enhance the government's ability to prosecute computer crimes. LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1130 (9th Cir. 2009). The Act was originally designed to target hackers who accessed computers to steal information or to disrupt or destroy computer functionality, as well as criminals who possessed the capacity to "access and control high technology processes vital to our everyday lives . . . ." Id. at 1130-31. The CFAA prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking specified forbidden actions, ranging from obtaining information to damaging a computer or computer data. Brekka, 581 F.3d at 1130-31 (citing 18 U.S.C. § 1030(a)(1)-(7) (2004).
In its Amended Complaint, Plaintiff alleges the following:
Employees knowingly, intentionally, and with the intent to defraud Union Bank accessed Union Bank's computer systems without authorization or beyond the scope of any authorization Employees had in an effort to download and transfer files containing Union Bank's confidential and proprietary files, trade secrets, and other confidential information. Employees transferred confidential and trade secret information, including confidential and sensitive customer information, which they misappropriated from Union Bank to dropbox.com and salesforce.com accounts under the control of Employees. Specifically, Employees exceeded any authorization they had to access customer information contained in Union Bank's computer systems by downloading, uploading, or otherwise taking and storing for later use Union Bank's customers' information, including but not limited to Union Bank's customers' email addresses. Employees were authorized to access such information only while employed by Union Bank and only to further Union Bank's efforts to service its customers. Employees' saving of that information for their own use or use by a competitor exceeded the authorization Union Bank gave to Employees to access customer information.
Dkt. #79 at ¶ 38.
As the Court previously noted, Plaintiff does not specify the subsection of the statute allegedly violated. See Dkt. #78 at ¶ 9. However, it appears that Plaintiff alleges a violation of 18 U.S.C. § 1030(a)(4), in that Plaintiff alleges the individual Defendants without authorization or exceeding authorized access, and with the intent to defraud, intentionally accessed and obtained information from a protected computer. Id. Through briefing, it appears that Plaintiff is focusing on the "exceeds authorized access" language of that subsection. Dkt. #82. The individual Defendants argue that the amended CFAA claim still fails to adequately allege that they exceeded their authorization to access Union Bank's computer system. Dkt. #81 at 3-5.
Plaintiff asserts that the individual Defendants exceeded their authorized access, thereby violating the CFAA, "by accessing websites they were not allowed to access, including Salesforce and Dropbox." Dkt. #82 at 1. However, that is not what Plaintiff actually alleges. Rather, Plaintiff alleges that Defendants "exceeded any authorization they had to access customer information contained in Union Bank's computer systems by downloading, uploading, or otherwise taking and storing for later use Union Bank's customers' information" on Dropbox and Salesforce. Dkt. #79 at ¶ 38. As Defendants note, this is simply another way of alleging misappropriation, which the Ninth Circuit, as well as this Court, has already held cannot sustain a CFAA claim. United States v. Nosal, 676 F.3d 854, 864 (9th Cir. 2012); LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1130 (9th Cir. 2009). "Under the CFAA, the activity that must be authorized is the `access,' not the use to which the information is later put." National City Bank, N.A. v. Republic Mortg. Home Loans, LLC, No. C09-1550RSL, 2010 WL 959925, at *3 (W.D. Wash. Mar. 12, 2010). "When an employer grants an employee access to a computer or to certain records on a computer system, access continues to be authorized until rescinded by the employer, even if the employee has become disloyal and is acting contrary to the employer's interest." Id. (emphasis added). Here, Plaintiff has not alleged in its amended claim, that the individual Defendants accessed information that was not within the scope of their authorization. Instead, Plaintiff focuses on "accessing" third-party websites. "A CFAA violation occurs only when an employee accesses information that was not within the scope of his or her authorization." Id. Accordingly, for the reasons discussed by the individual Defendants in their motion, the Court finds that Plaintiff has failed to adequately plead a claim that the individual Defendants exceeded their authorized access, and the Court will dismiss the amended CFAA claim.
C. Leave to Amend
Ordinarily, leave to amend a complaint should be freely given following an order of dismissal, "unless it is absolutely clear that the deficiencies of the complaint could not be cured by amendment." Noll v. Carlson, 809 F.2d 1446, 1448 (9th Cir. 1987); see also DeSoto v. Yellow Freight Sys., Inc., 957 F.2d 655, 658 (9th Cir. 1992) ("A district court does not err in denying leave to amend where the amendment would be futile." (citing Reddy v. Litton Indus., Inc., 912 F.2d 291, 296 (9th Cir. 1990)). With respect to Plaintiff's amended CFAA claim, the Court concludes that granting leave to amend that claim again would be futile. The Court can conceive of no possible cure for the deficiencies in Plaintiff's Amended Complaint as to that claim, particularly given the invalidity of Plaintiff's arguments as discussed above, and the fact that Plaintiff has had the opportunity to amend the claim already but has not been able to cure the identified deficiencies. Accordingly, leave to amend the CFAA claim will not be granted.
IV. CONCLUSION
Having reviewed the individual Defendants' motion, the opposition thereto and reply in support thereof, along with the remainder of the record, the Court hereby finds and ORDERS that the individual Defendants' Motion to Dismiss (Dkt. #81) is GRANTED, and Plaintiff's CFAA claim against them will be dismissed in its entirety with prejudice.
