IN THE COURT OF CHANCERY OF THE STATE OF DELAWARE
ALIXPARTNERS, LLP, and ) ALIXPARTNERS HOLDINGS, ) LLP, ) Plaintiffs, ) ) v. ) C.A. No. 2018-0600-KSJM ) DAVID BENICHOU, ) ) Defendant. )
OPINION Date Submitted: January 31, 2019 Date Decided: May 10, 2019 Bradley R. Aronstam, Eric D. Selden, R. Garrett Rice, ROSS ARONSTAM & MORITZ LLP, Wilmington, Delaware; Robert S. Berezin, Nicholas J. Pappas, WEIL, GOTSHAL & MANGES LLP, New York, New York; Counsel for Plaintiffs AlixPartners, LLP and AlixPartners Holdings, LLP. John P. DiTomo, Matthew R. Clark, Barnaby Grzaslewicz, MORRIS, NICHOLS, ARSHT & TUNNELL LLP, Wilmington, Delaware; Counsel for Defendant David Benichou.
McCORMICK, V.C. The plaintiffs operate a global corporate restructuring advisory firm. The
defendant was the managing partner of the plaintiffs’ Paris office. As a partner, the
defendant had access to the plaintiffs’ confidential information. When he became a
partner, the defendant also became party to a limited liability partnership agreement
that contained confidentiality obligations. The defendant resigned from his position
in early 2017. Shortly before his resignation, the defendant connected a personal
data drive to his work-issued computer and accessed the plaintiffs’ business files.
Shortly after his resignation, the defendant repeated this act.
After his resignation, the defendant began working for one of the plaintiffs’
competitors. Concerned that defendant may use their confidential information to
benefit the competitor, the plaintiffs sought assurances from the competitor
regarding the defendant’s confidentiality obligations. The plaintiffs were
dissatisfied with the competitor’s response and initiated an investigative proceeding
in Paris courts seeking targeted data searches of certain devices. The plaintiffs then
sued in this court for breach of the confidentiality provisions of the limited liability
partnership agreement. They also asserted three non-contractual claims for relief:
for violating the Delaware Uniform Trade Secrets Act (or “DUTSA”), for common
law conversion, and for violating the federal Computer Fraud and Abuse Act (or the
“CFAA”). The defendant moved to dismiss each of the non-contractual claims.
The defendant’s motion to dismiss the CFAA claim raises an issue of first impression for this Court. The provision of the CFAA on which the plaintiffs rely
renders liable a person who “intentionally accesses a computer without
authorization, or exceeds authorized access, and thereby obtains . . . information
from any protected computer[.]” 1 The plaintiffs argue that the defendant “exceeded
authorized access” by using information in violation of the plaintiffs’ limited
partnership agreement and policies. The defendant argues that this language
provides a narrow cause of action under which he can be liable for unauthorized
access of protected computers only, not for misuse of information that he was
authorized to access.
Federal courts split on the interpretation of the CFAA disputed by the parties,
the Third Circuit has not weighed in, and district courts in the Third Circuit diverge.
Relying on principles of statutory construction, this decision adopts the narrow
approach first set forth by the Ninth Circuit in LVRC Holdings LLC v. Brekka.2
Under the narrow approach, the defendant’s actions while he was employed by the
plaintiffs and had authorized access to the plaintiffs’ confidential information do not
support a claim under the CFAA. By contrast, it is reasonably conceivable that the
defendant did not have authorized access to the documents he allegedly transferred
after his resignation. As to the defendant’s post-resignation conduct, the plaintiffs’
1 18 U.S.C. § 1030(a)(2)(C) (emphasis added). 2 581 F.3d 1127 (9th Cir. 2009). 2 CFAA claim is legally viable. The motion to dismiss the CFAA claims is thus
granted, but only in part.
The Court denies dismissal for the remainder of the plaintiffs’ non-contractual
claims. Because all of the alleged acts of misappropriation occurred in France, the
defendant moves to dismiss the plaintiffs’ claim under DUTSA based on the
presumption against extraterritoriality. The parties’ extraterritoriality analysis
involves a fact-intensive inquiry. Nearly all states have adopted the Uniform Trade
Secrets Act. It is reasonably conceivable that some state’s Uniform Trade Secrets
Act applies given the plaintiffs’ global brand. Under Delaware’s liberal pleading
standard, the plaintiffs need not identify which law applies at the pleadings stage.
The defendant’s other dismissal arguments likewise fail. The defendant
argues that the plaintiffs have not adequately alleged the elements of a trade secrets
claim, but the complaint easily meets the plaintiff-friendly pleading standard. The
defendant argues that the plaintiffs’ conversion claim is duplicative of the
contractual claim, but those claims arise from different obligations and appropriately
stand alone. The defendant argues that DUTSA preempts the plaintiffs’ conversion
claim, but that conclusion depends on which state’s trade secrets laws—if any—
apply. Such a determination is premature and as a result, dismissal of the plaintiffs’
conversion claim is inappropriate.
3 I. FACTUAL BACKGROUND The facts are drawn from the complaint 3 and matters not subject to reasonable
dispute.
A. Defendant’s Employment by Plaintiffs AlixPartners, LLP and AlixPartners Holdings, LLP (collectively,
“Plaintiffs”), are a corporate restructuring advisory firm and its holding company
parent, respectively. Both entities are organized as Delaware limited liability
partnerships. Plaintiffs were founded in 1981 and now have a “global reputation”
built through work with “multinational clients” in a range of industries.4
Defendant David Benichou (“Defendant”) joined Plaintiffs on February 27,
2006. He served as Managing Director in Plaintiffs’ Paris offices from January 1,
2013 to October 25, 2017. In that position, Defendant was responsible for: building
and maintaining client relationships; leading complex engagements; recruiting top
talent; and developing intellectual property for the firm. In carrying out these
responsibilities, Defendant had access to Plaintiffs’ confidential and proprietary
information.
When Defendant became a Partner, he signed as a party to Plaintiffs’
January 12, 2017 Second Amended and Restated LLP Agreement (the “LLP
3 C.A. No. 2018-0600-KSJM Docket (“Dkt.”) 1, Verified Compl. (“Compl.”). 4 Compl. ¶ 13. 4 Agreement”). The LLP Agreement includes confidentiality requirements protecting
Plaintiffs’ non-public information. Plaintiffs also have a written data policy on the
acceptable use of Plaintiffs’ “data, networks, systems, devices, and applications.”5
B. Defendant Accesses Plaintiffs’ Confidential Information During his employment with Plaintiffs, Defendant kept thousands of
Plaintiffs’ confidential documents on the local C drive of his work-issued computer
in a folder titled “BatDocuments.” 6 These documents included “numerous
PowerPoint presentations related to Defendant’s work on behalf of [Plaintiffs],
reports, revenue assessments, studies prepared by [Plaintiffs], notes from meetings,
pricing analyses, and other strategic documents,” Plaintiffs allege. 7
The complaint sets out in granular detail facts from which this Court can infer
that Defendant transferred these confidential documents to a personal data device
before and after his resignation. The complaint alleges that, around March 8, 2017,
“Defendant connected a Western Digital 250 GB personal external hard drive to his
Computer.” 8 Then,
[a]t approximately 7:31 AM CEST (Paris local time), Defendant accessed the subfolder “Presentation” within a matter-named subfolder in the “BatDocuments” folder on the C drive of Defendant’s Computer with the pathname
5 Id. ¶ 18. 6 Id. ¶ 45. 7 Id. ¶ 50. 8 Id. ¶ 46. 5 C:\Users\dbenichou\Documents\Batdocuments\39- [Matter Name]\Presentation.
. . . [O]ne minute later, at 7:32 AM CEST, Defendant accessed a subfolder on his personal external hard drive, with the identically named pathname D:\Batdocuments\39-[Matter Name]\Presentation.9
Defendant resigned from his position with Plaintiffs in 2017, providing notice
on May 1, 2017. Plaintiffs dismissed Defendant from his duties on July 25, 2017,
and he stopped performing work for Plaintiffs around that time. Three days later,
on July 28, 2017, “Defendant again connected his personal external hard drive to his
Computer.”10 The complaint alleges:
At 8:22 AM (CEST) on July 28, 2017, [Defendant] created the folder entitled “Personnel et confidentiel 2” on the local C drive of his Computer. Defendant then copied folders containing hundreds of files from the “BatDocuments” folder on the C drive of his Computer into the “Personnel et confidentiel 2” folder on his Computer. At or around 10:54 AM local time, Defendant cut and pasted the “Personnel et confidentiel 2” folder— which then contained those hundreds of files—from his Computer onto his personal external hard drive. Defendant proceeded to review other files on his Computer, and placed some files in the Recycle Bin on the Computer.
. . . Defendant also accessed another folder on his Computer entitled “Personnel et confidentiel,” which he had created on or around April 13, 2017 and accessed a number of times between then and July 28, 2017. He
9 Id. ¶¶ 46–47 (footnotes omitted). 10 Id. ¶ 51. 6 deleted the “Personnel et confidentiel” folder at or after 12:40 PM CEST on July 28, 2017.11
Defendant never informed Plaintiffs of his personal data drive, disclosed that
he had transferred these documents to it, or returned any confidential information it
contained.
Defendant started working for the corporate restructuring division of Boston
Consulting Group (“BCG”) around October 2017. BCG’s restructuring division
directly competes with Plaintiffs, according to the complaint.
Plaintiffs allege that BCG employees contacted Defendant in early 2017
before he resigned. Plaintiffs also allege that Defendant disclosed Plaintiffs’
confidential information to BCG employees in the first half of 2017, and that
Defendant “decided to take [Plaintiffs’] confidential information with him when he
left in order to use that confidential information at [BCG] for his benefit and for the
benefit of BCG . . . .” 12
C. Procedural Posture On August 10, 2018, Plaintiffs initiated this action. The complaint asserts
four causes of action. Count I alleges that Defendant breached the confidentiality
provisions of the LLP Agreement. Count II alleges that Defendant breached the
Delaware Uniform Trade Secrets Act. Count III alleges that Defendant committed
11 Id. ¶¶ 51–52. 12 Id. ¶ 22. 7 common law conversion. Count IV alleges that Defendant violated the federal
CFAA.
On September 28, 2018, Defendant responded by moving to dismiss Counts II
through IV of the complaint. The parties completed briefing on the motion on
January 22, 2019, 13 and the Court heard oral argument on January 31, 2019.14
II. LEGAL ANALYSIS Defendant moves to dismiss pursuant to Court of Chancery Rule 12(b)(6). On
a Rule 12(b)(6) motion, the Court “accept[s] all well-pleaded factual allegations in
the [c]omplaint as true,” and “draw[s] all reasonable inferences in favor of the
plaintiff . . . .” 15 The Court denies the motion “unless the plaintiff could not recover
under any reasonably conceivable set of circumstances susceptible of proof.” 16 The
Court neither “accept[s] conclusory allegations unsupported by specific facts, Court
13 Dkt. 14, Def.’s Opening Br. in Supp. of His Mot. to Stay or in the Alternative Dismiss the Verified Compl. (“Def.’s Opening Br.”); Dkt. 18, Pls.’ Answering Br. in Opp’n to Defendant’s Mot. to Dismiss the Verified Compl. (“Pls.’ Ans. Br.”); Dkt. 23, Def.’s Reply Br. in Supp. of His Mot. to Stay or in the Alt. Dismiss the Verified Compl. and Mot. to Stay Disc.; Dkt. 26, Pls.’ Sur-Reply in Opp’n to Def.’s Mot. to Dismiss the Verified Compl. 14 Dkt. 30, Oral Arg. on Mot. to Dismiss and Mot. to Stay before V.C. McCormick. In the alternative to his dismissal arguments, Defendant sought to dismiss or stay the Delaware proceedings pursuant to McWane Cast Iron Pipe Corp. v. McDowell-Wellman Eng’g Co., 263 A.2d 281, 283 (Del. 1970), pending resolution of the French proceedings. The Court denied the motion by an Order issued on February 7, 2018. Dkt. 31, Order Addressing Def.’s McWane Mot. to Dismiss or Stay. 15 Cent. Mortg. Co. v. Morgan Stanley Mortg. Capital Hldgs. LLC, 27 A.3d 531, 536 (Del. 2011) (citing Savor, Inc. v. FMR Corp., 812 A.2d 894, 896–97 (Del. 2002)). 16 Id. 8 neither “accept[s] conclusory allegations unsupported by specific facts,
nor . . . draw[s] unreasonable inferences in the plaintiff’s favor.”17
A. Count II—Delaware Uniform Trade Secrets Act Count II asserts that Defendant misappropriated hundreds of Plaintiffs’
documents, some of which contained trade secrets, in violation of the Delaware
Uniform Trade Secrets Act (or “DUTSA”). Defendant argues that Count II should
be dismissed because the complaint fails to plead a DUTSA claim, and because
DUTSA does not apply extraterritorially to conduct alleged to have occurred solely
in France.
1. Plaintiffs adequately allege the elements of a trade secrets claim.
A claim for misappropriation of trade secrets under DUTSA requires
allegations sufficient to show: (1) the existence of a trade secret (i.e., information
with commercial utility arising from its secrecy and reasonable steps to maintain this
secrecy); (2) which the plaintiff communicated to the defendant; (3) under an
express or implied understanding that the defendant would respect the secrecy of the
matter; and that (4) the defendant used or disclosed the secret information in breach
of that understanding to the injury of the plaintiff. 18
17 Clinton v. Enter. Rent-A-Car Co., 977 A.2d 892, 895 (Del. 2009). 18 Wilm. Tr. Co. v. Consistent Asset Mgmt. Co., Inc., 1987 WL 8459, at *3 (Del. Ch. Mar. 25, 1987). 9 Defendant argues that Plaintiffs have not adequately pled the first element, the
existence of a trade secret. To show the existence of a trade secret, a plaintiff must
allege that the information “[d]erives independent economic value, actual or
potential, from not being generally known to, and not being readily ascertainable by
proper means by, other persons who can obtain economic value from its disclosure
or use” and that the information is “the subject of efforts that are reasonable under
the circumstances to maintain its secrecy.” 19 “Trade secrets should be given an
expansive meaning and interpretation.” 20
The complaint sufficiently alleges the existence of a trade secret. According
to the complaint, Plaintiffs have “developed numerous methods, techniques, and
processes for conducting and marketing its consulting business that derive
independent economic value from not being generally known to others who might
use or disclose them for economic gain.” 21 That information includes documents
like “revenue assessments, studies prepared by [Plaintiffs], notes from meetings,
pricing analyses, and other strategic documents.”22 The alleged categories of
19 6 Del. C. § 2001(4). 20 Sanirab Corp. v. Sunroc Corp., 2002 WL 1288732, at *3 (Del. Super. Apr. 29, 2002) (emphasis omitted). 21 Compl. ¶ 67. 22 Id. ¶ 50. 10 documents are not overly vague or so broad as to be meaningless. 23 It is reasonably
conceivable that these documents have independent economic value. 24
Plaintiffs also took reasonable steps to guard the secrecy of these documents.
Under Delaware law, the existence of a confidentiality agreement satisfies this
requirement. 25 The acceptable use policy provided an added layer of protection.
Plaintiffs also protect their confidential information with passwords, restrict rights
and access to those employees with a need to know, and include confidentiality
provisions in their employment agreements. 26
Next, Defendant argues that Plaintiffs have not adequately pled the fourth
element, that Defendant used or disclosed the trade secrets. It is the rare
misappropriation case in which Plaintiffs have first-hand knowledge of this element
23 Compare id. ¶¶ 45, 50 (describing the organization and nature of the documents containing trade secrets) with MHS Capital LLC v. Goggin, 2018 WL 2149718, at *14 (Del. Ch. May 10, 2018) (dismissing trade secret claim where complaint vaguely referred to “potential returns” and “strategies”). 24 GWO Litig. Tr. v. Sprint Sols., Inc., 2018 WL 5309477, at *9–10 (Del. Super. Oct. 25, 2018) (A DUTSA claim will survive a motion to dismiss where the documents in question are “conceivably of independent economic value.” (emphasis added)). 25 See GWO Litig., 2018 WL 5309477, at *10 (holding that the “reasonable efforts” prong “is not a high bar” and that “confidentiality provisions or policies intended to prevent unauthorized disclosure are sufficient”). 26 Compare Compl. ¶ 68 (describing minimum necessary rights and access provided only to employees “with a need to know”) with Goggin, 2018 WL 2149718, at *14 (granting a motion to dismiss a trade secrets claim on where the complaint simply repeated as an allegation and in conclusory form the language of the statute, that “ECM took reasonable steps to maintain secrecy”). 11 at the pleadings stage. 27 Typically, the Complaint must rely on inferences or
circumstantial evidence. Here, the Complaint alleges the following facts. Defendant
transferred documents containing confidential information and trade secrets onto a
personal hard drive right before and after he left to work for a competitor. Defendant
never disclosed the hard drive to Plaintiffs. Defendant never accounted for the
documents he transferred onto the hard drive when he began working at BCG. And
Defendant refused to confirm his compliance with his contractual obligations despite
Plaintiffs’ requests. It is reasonable to infer, based on the facts alleged, and under a
plaintiff-friendly standard, that Defendant has used or disclosed these documents.
2. Defendant’s extraterritoriality argument is not appropriately addressed at the pleadings stage.
In the alternative, Defendant argues that Count II should be dismissed because
DUTSA does not apply on its face to actions taken outside Delaware, and each of
Defendant’s alleged actions occurred in France.28 Plaintiffs respond that “this case
does not . . . require consideration of extraterritoriality,” 29 that the extraterritorial
application of DUTSA is more appropriately framed as a choice-of-law question,30
27 See Accenture Glob. Servs. GMBH v. Guidewire Software Inc., 581 F. Supp. 2d 654, 662 (D. Del. 2008) (“It is not common for a trade secret misappropriation plaintiff to know, prior to discovery, the details surrounding the purported theft.”). 28 Def.’s Opening Br. at 30. 29 Pls.’ Ans. Br. at 32. 30 Id. at 32–33. 12 and that such an analysis is necessarily fact intensive so the Court should not conduct
it on the pleadings. If the Court does conduct the choice-of-law analysis, Plaintiffs
argue that the analysis should focus on the place of Plaintiffs’ injury, which Plaintiffs
say favors applying Delaware law, and not Defendant’s conduct.
This decision assumes that the presumption against extraterritoriality analysis
applies, and that it precludes applying the DUTSA to the conduct at issue, as
Defendant argues. Even assuming these premises, Count III survives Defendant’s
motion to dismiss. Delaware’s liberal notice pleading rules require only “a short and
plain statement of the claim showing that the pleader is entitled to relief[.]”31
Consequently, a plaintiff need not identify the precise law on which it relies.32
Plaintiffs operate in a global market, and nearly all of the states have adopted the
Uniform Trade Secrets Act. The standard is “reasonable conceivability.” 33 It is
reasonably conceivable that the law of Plaintiffs’ principal place of business
(Michigan) or another state’s law applies.
B. Count III—Conversion Count III alleges that if any of the documents taken by Defendant do not rise
to the level of a trade secret, they still constitute confidential and proprietary
31 Ct. Ch. R. 8(a)(1). 32 Dow Chem. Co. v. Organik Kimya Hldg. A.S., 2018 WL 2382802, at *4 (Del. Ch. May 25, 2018). 33 Cent. Mortg., 27 A.3d at 537 (citation and internal quotation marks omitted). 13 information.34 Plaintiffs contend that Defendant took possession of these documents
and never returned them. 35
As with Count II, Count III hinges on issues that are inappropriate to decide
on a motion to dismiss. For example, Defendant argues that Count III should be
dismissed because the DUTSA preempts Plaintiffs’ conversion claim. 36 Some
states interpret the Uniform Trade Secrets Act as preempting all common law claims
for conversion of confidential information;37 other states do not. 38 Whether
Plaintiffs’ trade secrets claim preempts the conversion claim will depend on what
law applies. As discussed above, what law applies is not a pleadings-stage issue.
Neither, therefore, is preemption. 39
34 Compl. ¶ 75. 35 Id. ¶ 76. 36 See generally 6 Del. C. § 2007(a) (“[T]his chapter displaces conflicting tort, restitutionary and other law of this State providing civil remedies for misappropriation of a trade secret.”); Alarm.com Hldgs. Inc. v. ABS Capital P’rs, 2018 WL 3006118, at *9–11 (Del. Ch. June 15, 2018), aff’d on other grounds, 204 A.3d 113 (Del. 2019). 37 See generally Alarm.com, 2018 WL 3006118, at *11 n.67. 38 See, e.g., Am. Biomedical Gp., Inc. v. Techtrol, Inc., 374 P.3d 820, 827 (Okla. 2016) (“By its unambiguous language, Section 92(A) of the [Oklahoma Uniform Trade Secrets Act] displaces conflicting tort claims only for ‘misappropriation of a trade secret.’ It does not displace tort claims for information not meeting this definition.”); Int’l Paper Co. v. Gilliam, 2003 WL 23573613, at *4 (Va. Cir. Ct. Dec. 23, 2003) (“The [Virginia Uniform Trade Secrets Act] does not preempt alternative tort recovery unless it is clear that the [confidential information at issue] falls within the confines of the Act.”). 39 Plaintiffs have identified a potentially applicable French law, which they describe as the French Civil Code equivalent to Delaware’s common law claim of conversion. See Pls.’ Ans. Br. at 45–47. This decision does not resolve whether Plaintiffs have or must state a claim under French law. 14 As an independent basis for dismissal, Defendant argues that Count III should
be dismissed because it is duplicative of Count I’s breach of contract claim. 40 It is
not clear that the “only confidentiality obligation” pleaded derives from the LLP
Agreement, as Defendant contends.41 It is reasonably conceivable that Plaintiffs
have a separate property interest in the confidential information. 42 The Counts were
asserted in the alternative, as permitted under Delaware law. 43
For these reasons, Defendant’s motion to dismiss Count III is denied.
C. Count IV—Computer Fraud and Abuse Act Count IV alleges that Defendant violated the CFAA. 44 Congress passed the
CFAA in 1984 as the first piece of federal legislation directed solely at computer
40 Def.’s Opening Br. at 46–47. 41 Id. at 47. 42 See, e.g., Rockwell Automation, Inc. v. Kall, 2004 WL 2965427, at *4 (Del. Ch. Dec. 15, 2004) (observing that the plaintiff “has a property interest in its confidential information”); Sustainable Energy Generation Gp., LLC v. Photon Energy Projects BV, 2014 WL 2433096, at *14 (Del. Ch. May 30, 2014) (holding that it was reasonably conceivable that plaintiff could prove a property interest in confidential information); Overdrive, Inc. v. Baker & Taylor, Inc., 2011 WL 2448209, at *5 (Del. Ch. June 17, 2011) (allowing a claim based on conversion of confidential information to survive a motion to dismiss along with a separate claim for breach of a contractual confidentiality obligation). 43 Israel Disc. Bank of New York v. First State Depository Co., LLC, 2012 WL 4459802, at *13 (Del. Ch. Sept. 27, 2012), aff’d, 86 A.3d 1118 (Del. 2014) (“I note that [p]laintiff is permitted under [Court of Chancery] Rule 8(e)(2) to plead claims in the alternative. Therefore, even if [the plaintiff’s] breach of contract and conversion claims were mutually exclusive, that would not preclude [the plaintiff] from pursuing both claims in the alternative.”). 44 18 U.S.C. § 1030(a)(2)(C). 15 crime. 45 Originally, the CFAA was a criminal statute intended to protect a limited
set of federal computers and financial institutions. 46 It was later expanded to include
a broad category of computers “used in or affecting interstate or foreign commerce
of communication”47 and amended to add a civil cause of action. 48 As a result,
violations of the statute expose offenders to both civil and criminal liability.
Plaintiffs allege that Defendant violated Section 1030(a)(2)(C) of the CFAA
by misappropriating information stored on Defendant’s work-issued computer.
Section 1030(a)(2)(C) renders liable a person who “intentionally accesses a
45 H.R. Rep. No. 98–894, at 6 (1984), reprinted in 1984 U.S.C.C.A.N. 3689, 3691 (“There is [n]o specific federal legislation in the area of computer crime.”). 46 Brekka, 581 F.3d at 1130 (“The CFAA was enacted . . . to enhance the government’s ability to prosecute computer crimes.”); Shawn E. Tuma, What Does CFAA Mean and Why Should I Care?, 63 S.C. L. Rev. 141, 155 (2011) (“This first statute was very narrow. This statute was limited to ‘three specific scenarios: computer misuse to obtain national security secrets, computer misuse to obtain personal financial records, and hacking into U.S. Government computers’ . . . . The CFAA’s general purpose, originally, was to address the growing problems of computer crime and hacking directed at government interest computers.” (citations and footnotes omitted)). 47 Economic Espionage Act, Pub. L. No. 104–294, 110 Stat. 3488 (1996); 18 U.S.C. § 1030(e)(2). 48 Proof of one of five additional factors is necessary to maintain a civil action. 18 U.S.C. § 1030(g) (“Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief.”); S. Rep. No. 104–357, at 11–12, 14 (1996) (“The amendment to section 1030(g) provides that victims of computer abuse can maintain a civil action against the violator to obtain compensatory damages, injunctive relief, or other equitable relief.”); Catherine M. Sharkey, Trespass Torts and Self-Help for an Electronic Age, 44 Tulsa L. Rev. 677, 693 (2009) (“Originally enacted exclusively as a criminal statute, the CFAA was amended in 1994 to add a private civil cause of action with fairly broad jurisdictional reach.” (citations and footnote omitted)). 16 computer without authorization, or exceeds authorized access, and thereby
obtains . . . information from any protected computer.”49
Defendant’s motion to dismiss Count IV focuses on the meaning of the words
emphasized above—“without authorization” and “exceeds authorized access.”
Defendant argues that the CFAA provides a narrow cause of action under which
Plaintiffs can hold Defendant liable for unauthorized access of protected
computers.50 Defendant argues that the CFAA does not protect against misuse of
information by a person otherwise authorized to access the information at issue.
Plaintiffs respond that the CFAA creates liability for misusing information obtained
through authorized access to a protected computer. 51
1. The split in federal authority: the broad and narrow approaches.
The parties’ dispute parallels a nationwide split of federal authority over the
proper interpretation of the terms “without authorization” and “exceeds authorized
access” in the CFAA.
The first line of cases interprets “accesses a computer without authorization”
and “exceeds authorized access” broadly. First promulgated by the First Circuit in
EF Cultural Travel BV v. Explorica, Inc., and advanced by Plaintiffs here, the broad
49 18 U.S.C. § 1030(a)(2)(C) (emphasis added). 50 Def.’s Opening Br. at 49. 51 Pls.’ Ans. Br. at 51–52. 17 interpretation holds that accessing a computer or information in violation of one’s
use obligations can give rise to liability under the “exceeds authorized access”
provision.52 In EF Cultural, the Court held that the complaint states a claim that the
defendant violated the CFAA by disclosing proprietary information in breach of a
confidentiality agreement and policy. 53 Later, in Citrin, the Seventh Circuit adopted
the First Circuit’s broad interpretation, but framed the analysis as an agency
relationship issue. 54 The Court reasoned when an employee uses information in a
manner adverse to his employer, the employee violates loyalty duties, thereby
implicitly terminating the agency relationship, and losing any authority to access the
computer or any information on it.55 Appellate courts in the Fifth and Eleventh
Circuits have also adopted a broad interpretation of the CFAA. 56
The second line of cases interprets “accesses a computer without
authorization” and “exceeds authorized access” narrowly. First adopted by the Ninth
Circuit in Brekka, the narrow approach does not consider an individual’s intended
52 274 F.3d 577, 582–83 (1st Cir. 2001). 53 Id. (“[The plaintiff] is likely to prove . . . excessive access based on the confidentiality agreement between [a defendant] and [the plaintiff].”). 54 Int’l Airport Ctrs., LLC v. Citrin, 440 F.3d 418, 420–21 (7th Cir. 2006). 55 Id. 56 United States v. John, 597 F.3d 263, 272 (5th Cir. 2010); United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010). 18 or actual misuse of accessed information. 57 Appellate courts in the Second and
Fourth Circuits have adopted the narrow approach.58
2. This decision adopts the narrow approach.
The meaning of “accesses a computer without authorization” and “exceeds
authorized access” as used in the CFAA is an issue of first impression for Delaware
courts. No authority that binds this Court has addressed the issue. No Delaware
state court has encountered the question presented.59 In interpreting federal statutes
absent binding precedent, this Court gives great weight to the rulings of the Third
Circuit and Delaware district court.60 But neither the Third Circuit nor the Delaware
57 581 F.3d 1127. See also United States v. Nosal, 676 F.3d 854, 863 (9th Cir. 2012) (applying Brekka). 58 United States v. Valle, 807 F.3d 508, 527–28 (2d Cir. 2015); WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199, 204 (4th Cir. 2012). 59 Delaware has a statutory counterparty to the CFAA—the Misuse of Computer System Information Statute, 11 Del. C. § 935 et seq. Unlike the CFAA, that statute expressly prohibits “unauthorized use.” 11 Del. C. § 935(1) (“A person is guilty of the computer crime of misuse of computer system information when . . . [a]s a result of accessing or causing to be accessed a computer system, the person intentionally makes or causes to be made an unauthorized display, use, disclosure or copy . . . .”). Given its distinguishable language, cases interpreting Section 935(1) are not instructive to the issue at hand. 60 See, e.g., Johnson v. State, 983 A.2d 904, 917 (Del. 2009) (“After reviewing the varied approaches taken by the Circuit courts in light of somewhat unclear United States Supreme Court precedents, we adopt the approach taken by the Third Circuit[.]”); Cosby v. Correct Care Sols., LLC, 2016 WL 7103387, at *6 (Del. Super. Dec. 6, 2016) (“The language of the DDEA is virtually identical to 42 U.S.C. § 2000(e) of the federal Civil Rights Act of 1964 (Title VII). Accordingly, when construing the DDEA, Delaware courts look to how the federal courts in the Third Circuit and the District of Delaware have construed Title VII cases.”); Fusco v. Dauphin, 75 A.2d 701, 702 (Del. Super. 1950) (“[O]ur own Federal District Court has held that a party is not required to admit facts not within his personal knowledge. . . . While not actually binding upon me, this decision is entitled to the utmost 19 district court has ruled on the matter. And non-Delaware district courts within the
Third Circuit diverge in their approach. 61
Without clear guidance from state or federal authorities, this Court looks to
principles of statutory interpretation to discern the CFAA’s meaning, and concludes
that the narrow approach is best supported. The analysis starts with the plain
language of the statute.62 If the plain language is clear and unambiguous, the
respect.” (citation omitted)). See also Red Maple Props. v. Zoning Comm’n of Town of Brookfield, 610 A.2d 1238, 1242 n.7 (Conn. 1992) (“‘The decisions of the federal circuit in which a state court is located are entitled to great weight in the interpretation of a federal statute.’” (alteration omitted)); Pignato v. Great W. Bank, 664 So. 2d 1011, 1015 (Fla. Dist. Ct. App. 1995) (“[A]ccording unusual weight to a decision on an issue rendered by a federal circuit in which the state is located is an appropriate method for deciding federal questions where there is no Supreme Court authority[.]”); Littlefield v. State, 480 A.2d 731, 737 (Me. 1984) (“[I]n the interests of existing harmonious federal-state relationships, it is a wise policy that a state court of last resort accept, so far as reasonably possible, a decision of its federal circuit court on . . . a federal question.”); Abbott v. Goodwin, 804 P.2d 485, 490 (Or. Ct. App. 1991) (stating that although not bound by lower federal court decisions, “under principles of federalism, we not only defer to federal court precedents, we should give weight to those of the Ninth Circuit, in which Oregon lies”), modified on other grounds, 809 P.2d 716 (Or. 1991). 61 Compare Beauty Plus Trading, Co. v. Adamo, 2018 WL 846918, at *1–2 (D.N.J. Feb. 13, 2018) (adopting narrow approach), Teva Pharm. USA, Inc. v. Sandhu, 291 F. Supp. 3d 659, 669–70 (E.D. Pa. 2018) (same), Tactical Pers. Leasing, Inc. v. Hajduk, 2018 WL 4740195, *2–3 (W.D. Pa. Oct. 2, 2018) (same), and Adv. Fluid Sys., Inc. v. Huber, 28 F. Supp. 3d 306, 329 (M.D. Pa. 2014) (same) with Chubb Ina Hldgs. Inc. v. Chang, 2017 WL 499682, at *6–7 (D.N.J. Feb. 7, 2017) (denying dismissal of CFAA claims and citing Citrin favorably) and Spinello Cos. v. Silva, 2014 WL 4896530, at *3–4 (D.N.J. Sept. 30, 2014) (same). 62 Jimenez v. Quarterman, 555 U.S. 113, 118 (2009) (“As with any question of statutory interpretation, our analysis begins with the plain language of the statute.”); Zhurbin v. State, 104 A.3d 108, 110 (Del. 2014) (“Our analysis of the parties’ arguments begins with the plain language of the statute[.]”). 20 analysis ends.63 If the plain language is susceptible to multiple meanings, the Court
ascertains the meaning of the statute by reviewing the statute’s purpose and
legislative history. 64 When a statute has both civil and criminal applications, the
rule of lenity applies. 65 That rule requires this Court to construe criminal statutes
strictly to avoid interpretations not “clearly warranted by the text.”66 The concept
behind it is that the legislature should not decree punishment without making clear
what conduct incurs that punishment. 67
63 See Nat’l Ass’n of Mfrs. v. Dep’t of Def., 138 S. Ct. 617, 631 (2018); see also BedRoc Ltd., LLC v. United States, 541 U.S. 176, 183 (2004) (plurality opinion) (“The preeminent canon of statutory interpretation requires us to presume that the legislature says in a statute what it means and means in a statute what it says there. Thus, our inquiry begins with the statutory text, and ends there as well if the text is unambiguous.” (internal quotation marks, alteration, and citation omitted)); Zhurbin, 104 A.3d at 110 (“Where a statute contains unambiguous language that clearly reflects the intent of the legislature, then the language of the statute controls.” (citing Hoover v. State, 958 A.2d 816, 820 (Del. 2008))); Bd. of Adjustment of Sussex Cty. v. Verleysen, 36 A.3d 326, 331 (Del. 2012) (“[W]hen a statute is clear and unambiguous there is no need for statutory interpretation.” (citing State v. Skinner, 632 A.2d 82, 85 (Del. 1993))). 64 Parker v. NutriSys., Inc., 620 F.3d 274, 277 (3d Cir. 2010); Clark v. State, 184 A.3d 1292 (Del. 2018) (TABLE) (“When a statute is ambiguous, a court may refer to the legislative history to interpret the statute.” (citing Arnold v. Soc’y for Sav. Bancorp, Inc., 650 A.2d 1270, 1287 (Del. 1994))). 65 U.S. v. Thompson/Ctr. Arms Co., 504 U.S. 505, 518 n.10 (1992) (observing that the rule of lenity applies to statutes having both criminal and civil applications, even where the application at issue is civil in nature); Miller, 687 F.3d at 203–04 (applying rule of lenity in interpreting the CFAA); Dixon v. State, 673 A.2d 1220, 1225 n.3 (Del. 1996) (analyzing the “general rule” that “ambiguous penal statutes should be strictly construed against the State”). 66 Crandon v. United States, 494 U.S. 152, 160 (1990). 67 Russello v. United States, 464 U.S. 16, 29 (1983) (“The rule of lenity, which this Court has recognized in certain situations of statutory ambiguity . . . has no application here. That rule comes into operation at the end of the process of construing what Congress has 21 Turning to the plain language of the statute, the CFAA distinguishes between
“without authorization” and “exceeds authorized access.”68 The former is not
defined by the statute; the latter is defined as “access to a computer with
authorization and to use such access to obtain or alter information in the computer
that the accesser is not entitled so to obtain or alter.”69 The concepts are closely
related; their distinction is “paper thin.” 70 The concepts hinge on the words “access”
and “authorization.” Because the CFAA does not define those terms specifically,
the terms must be interpreted in accordance with their “ordinary, contemporary,
common meaning.”71
expressed, not at the beginning as an overriding consideration of being lenient to wrong- doers. . . . Here, the language of the RICO forfeiture provision is clear, and the rule of lenity does not come into play.” (internal quotation marks and citations omitted)); see also Moskal v. United States, 498 U.S. 103, 107 (1990) (“We have repeatedly emphasized that the touchstone of the rule of lenity is statutory ambiguity.” (citation and internal quotation marks omitted)); United States v. Bass, 404 U.S. 336, 348 (1971) (suggesting that the rule of lenity derives from constitutional requirements of fair notice and separation of powers: “[B]ecause of the seriousness of criminal penalties, and because criminal punishment usually represents the moral condemnation of the community, legislatures and not courts should define criminal activity.”). 68 18 U.S.C. § 1030(a). 69 18 U.S.C. § 1030(e)(6). 70 Citrin, 440 F.3d at 420 (citation omitted). In Citrin, the Court explained that an employee exceeded authorized ac6cess to a public website by using his programming knowledge to obtain confidential information from the public portal. Id. 71 Perrin v. United States, 444 U.S. 37, 42 (1979); French v. State, 38 A.3d 289, 291 (Del. 2012) (“[I]f the words [of the statute] are not defined, they are given their commonly understood, plain meaning.” (citing Dickerson v. State, 975 A.2d 791, 798 (Del. 2009))). 22 Dictionary definitions define “authorizing” as granting permission, 72 and
“accessing” as “to obtain or acquire” or “to gain admission to.”73 Putting the
definitions together, an employee “accesses a computer ‘without authorization’
when he gains admission to a computer without approval.” 74 An employee
72 Authorization, Black’s Law Dictionary (10th ed. 2014) (“Official permission to do something; sanction or warrant.”); QVC, Inc. v. Resultly, LLC, 159 F. Supp. 3d 576, 595 (E.D. Pa. 2016) (“The Oxford English Dictionary defines ‘Authorization’ as ‘the action of authorizing a person or thing’ or ‘formal permission or approval.’ The term, ‘to authorize,’ in turn, ordinarily means ‘to give official permission for or formal approval to (an action, undertaking, etc.).’ Therefore, based on the ordinary meaning of the word, to act ‘without authorization’ is to act without formal permission or approval.” (citations omitted)); Valle, 807 F.3d at 524 (“The dictionary defines ‘authorization’ as ‘permission or power granted by authority.’ Thus, common usage of ‘authorization’ suggests that one ‘accesses a computer without authorization’ if he accesses a computer without permission to do so at all.” (quoting Random House Unabridged Dictionary 139 (2001))); Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d 295, 303–04 (6th Cir. 2011) (“The plain meaning of ‘authorization’ is ‘[t]he conferment of legality; . . . sanction.’” (quoting 1 Oxford English Dictionary 798 (2d ed. 1989)); United States v. Aleynikov, 737 F. Supp. 2d 173, 191–92 (S.D.N.Y. 2010) (“‘Authorization’ is generally defined as the ‘act of authorizing’ or ‘permission or power granted by an authority.’ . . . Based on the ordinary meaning of ‘authorization,’ then, a person who ‘accesses a computer without authorization’ does so without any permission at all. By contrast, a person who ‘exceeds authorized access’ has permission to access the computer, but not the particular information on the computer that is at issue.” (quoting The Random House Dictionary of the English Language 100 (Unabridged ed. 1970))). 73 Access, Black’s Law Dictionary (10th ed. 2014) (“A right, opportunity, or ability to enter, approach, pass to and from, or communicate with.”); Miller, 687 F.3d at 204 (“Thus, we note at the outset that ‘access’ means ‘[t]o obtain, acquire,’ or ‘[t]o gain admission to.’” (quoting Oxford English Dictionary (3d ed. 2011))); Synthes, Inc. v. Emerge Med., Inc., 2012 WL 4205476, at *17 (E.D. Pa. Sept. 19, 2012) (“[O]ther courts have used the common meaning of the word ‘access’ and defined it as ‘gaining admission to.’” (citing Miller, 687 F.3d at 204)); Sw. Airlines Co. v. BoardFirst, LLC, 2007 WL 4823761, at *12 (N.D. Tex. Sept. 12, 2007) (using the “dictionary definition” of “access” as “mean[ing] ‘to get at’ or ‘gain access to’” (quoting Merriam-Webster’s Collegiate Dictionary 6 (10th ed. 1998))). 74 Miller, 687 F.3d at 204 (citing Brekka, 581 F.3d at 1133). 23 “‘exceeds authorized access’ when he has approval to access a computer, but uses
his access to obtain or alter information that falls outside the bounds of his approved
access.”75 Under these definitions, an employee does not exceed authorized access
by misusing the information the employee had a right to access. This definition
accords with the narrow interpretation.
Although dictionary definitions favor the narrow interpretation, the federal
split suggests that the CFAA’s plain language is susceptible to multiple meanings.76
This decision therefore reviews the CFAA’s purpose and legislative history.
Turning to a review of statutory purpose and history, Congress adopted the
CFAA to combat computer hacking, as discussed above. In Citrin, the Seventh
Circuit speculated that this purpose targeted not just “long-distance attacks” from
outsiders without authorized access to a system, but also “inside attack[s]” by
“disgruntled programmers who decide to trash the employer’s data system on the
way out . . . .”77 To reach the disgruntled programmer, the statute must be interpreted
broadly, according to the Seventh Circuit. In Miller, however, the Fourth Circuit set
forth a compelling counterargument interpreting Congressional intent in favor of the
75 Id. 76 See, e.g., Valle, 807 F.3d at 524–25 (“If this sharp division means anything, it is that the statute is readily susceptible to different interpretations.”). 77 Citrin, 440 F.3d at 420. 24 narrow interpretation. 78 The Court did so by positing the following example: An
employee downloads information from her work computer in violation of office
policy, for the commendable purpose of progressing on a project from home. 79
Under the Seventh Circuit’s interpretation of the CFAA, by violating the corporate
use policy, the employee “exceeded her authorized access,” implicitly terminated
her agency relationship, and exposed herself to civil and as well as criminal liability.
This is an extreme outcome that criminalizes banal moments of misuse common in
the modern work force. These “far-reaching effects” seem “unintended by
Congress.” 80 To avoid these clearly unintended consequences, a court must follow
the narrow approach.
Last, the rule of lenity tips decidedly in favor of the narrow approach. As
illustrated by the Fourth Circuit’s example, the broad interpretation of the CFAA
creates criminal liability in multiple common scenarios. The narrow interpretation
avoids that result. Given the criminal application of the CFAA, and the expansive
potential criminal liability created by the broad interpretation, “authorized access”
and “exceeds authorized access” must be narrowly construed.81
78 Miller, 687 F.3d at 206. 79 Id. 80 Id. 81 See, e.g., Valle, 807 F.3d at 528 (adopting narrow approach to avoid “‘unintentionally turn[ing] ordinary citizens into criminals’” (citing Nosal, 676 F.3d at 863)); Miller, 687 F.3d at 204 (adopting narrow approach and observing “[w]here, as here, our analysis 25 In sum, principles of statutory interpretation weigh in favor of adopting the
narrow view of “without authorization” and “exceeds authorized access.” That
language applies only when an individual accesses a computer or information on that
involves a statute whose provisions have both civil and criminal application, our task merits special attention because our interpretation applies uniformly in both contexts.” (citations omitted)); Brekka, 581 F.3d at 1134 (adopting narrow approach and observing that although the case arose in the civil context, the court’s interpretation is equally applicable in the criminal context, and recognizing that ambiguity must be resolved in favor of lenity); Mathey Dearman, Inc. v. H&M Pipe Beveling Mach. Co., 2018 WL 4224897, at *5 (N.D. Okla. Sept. 5, 2018) (adopting narrow approach, citing the discussion Brekka for its discussion of the rule of lenity); Hedgeye Risk Mgmt., LLC v. Heldman, 271 F. Supp. 3d 181, 195 (D.D.C. 2017) (adopting narrow approach, citing Valle for its discussion of the rule of lenity); Giles Const., LLC v. Tooele Inventory Sol., Inc., 2015 WL 3755863, at *3 (D. Utah June 16, 2015) (adopting narrow approach and reasoning that “[i]n the CFAA, Congress has not clearly criminalized the misuse of lawfully obtained computer information. And if that conduct is not criminal under the statute, the conduct cannot provide a basis for a civil cause of action.” (emphasis original)); Enhanced Recovery Co., LLC v. Frady, 2015 WL 1470852, at *8 (M.D. Fla. Mar. 31, 2015) (adopting narrow approach “‘so that Congress will not unintentionally turn ordinary citizens into criminals.’” (citing Nosal, 676 F.3d at 863)); JBCHldgs. NY, LLC v. Pakter, 931 F. Supp. 2d 514, 524 (S.D.N.Y. 2013) (adopting narrow approach and observing that “the broad reading of ‘exceeds authorized access’ has breathtaking implications. It would federalize, and potentially subject to federal criminal law, quotidian abuses by employees that have historically been the sole ambit of state employment and criminal law.” (citation omitted)); Sebrite Agency, Inc. v. Platt, 884 F. Supp. 2d 912, 918 (D. Minn. 2012) (adopting narrow approach and observing that “the broader interpretation would . . . expose employees who violate their employers’ computer-use restrictions to criminal liability . . .” (citations omitted)); Wentworth-Douglass Hosp. v. Young & Novis Prof’l Ass’n, 2012 WL 2522963, at *3 (D.N.H. June 29, 2012) (adopting narrow approach and observing that “[b]asing criminal liability on violations of private computer use policies can transform whole categories of otherwise innocuous behavior into federal crimes simply because a computer is involved.” (citation omitted)). See also Brand Energy & Infrastructure Servs., Inc. v. Irex Contr. Gp., 2017 WL 1105648, at *15 (E.D. Pa. Mar. 24, 2017) (rejecting the broad view in part based on the scope of persons who might be subject to liability, observing “the [broad] view would subject too wide a class of individuals—such as family members of employees—to CFAA liability . . . . This was not the intent of the CFAA.” (citations omitted)). 26 computer without permission. The statute does not impose liability for misusing
information to which the individual had authorized access.
In adopting the narrow approach, this Court acts consistently with the current
trend. The majority of courts deciding this issue since Brekka have adopted the
narrow approach. Since 2009, district courts in the Sixth,82 Eighth,83 Tenth, 84 and
D.C. Circuits 85 have applied Defendant’s “narrow” interpretation of the Act. Within
circuits that initially adopted the broad approach, support for that view is eroding.86
82 Cranel Inc. v. Pro Image Consultants Gp., LLC, 57 F. Supp. 3d 838, 845 (S.D. Ohio 2014) (“The Court agrees with these courts that the narrow interpretation is proper under the CFAA.”); see also Ajuba Int’l v. Saharia, 871 F. Supp. 2d 671, 687 (E.D. Mich. 2012); ReMedPar, Inc. v. AllParts Med., LLC, 683 F. Supp. 2d 605, 613, 615 (M.D. Tenn. 2010); Black & Decker (U.S.), Inc. v. Smith, 568 F. Supp. 2d 929, 934–35 (W.D. Tenn. 2008). 83 Sebrite, 884 F. Supp. 2d at 917–18 (“The Court continues to believe that the narrower interpretation of the CFAA is more consistent with statutory text, legislative history, and the rule of lenity.”). 84 Mathey Dearman, Inc. v. H&M Pipe Beveling Mach. Co., 2018 WL 4224897, *5 (N.D. Okla. Sept. 5, 2018) (“[D]istrict courts in this Circuit uniformly apply the narrow inquiry . . . .”); accord Tank Connc’n, LLC v. Haight, 161 F. Supp. 3d 957, 969 (D. Kan. 2016), appeal dismissed (10th Cir. July 18, 2016); Cloudpath Networks v. SecureW2 BV, 157 F. Supp. 3d 961, 983–984 (D. Colo. 2016); Cent. Bank & Tr. v. Smith, 215 F. Supp. 3d 1226, 1232–33 (D. Wyo. 2016); Giles, 2015 WL 3755863, at *3. 85 Hedgeye, 271 F. Supp. 3d at 194–95 (“Although the Court recognizes that the statutory definition of ‘exceeds authorized access’ is not crystal clear, the Second, Fourth and Ninth Circuits have identified the more persuasive reading of that phrase. . . . Thus, the CFAA prohibits the authorized computer user from accessing ‘information’ that he is not ‘authorized’ to obtain or alter. The statute says nothing about the misuse of information that the user was authorized to access.” (emphasis original)); see also Lewis-Burke Assocs., LLC v. Widder, 725 F. Supp. 2d 187, 193–94 (D.D.C. 2010). 86 Some district courts in the First Circuit treat the relevant appellate court language as dicta. Advanced Micro Devices, Inc. v. Feldstein, 951 F. Supp. 2d 212, 218–19 (D. Mass. 2013) (“At the time of this order, the First Circuit has not clearly articulated its position on this issue. Some district judges have read [EF Cultural] as an endorsement of the broader 27 Although this decision does not rest on the national trend as a basis for adopting the
narrow approach, the fact that the country appears to be moving toward a narrow
approach does provide some assurance of its wisdom.
3. Applying the narrow approach leads to partial dismissal of the CFAA claim.
Applying the narrow approach requires denying part of Plaintiffs’ CFAA
claim.
The Complaint alleges that, before his termination, Defendant was authorized
interpretation . . . . Others have read [EF Cultural] as supporting a broad interpretation only in dicta, and have adopted a narrower interpretation. . . . It is not clear to me that [EF Cultural] is a plain endorsement of a broad interpretation.” (citations omitted)). Some district courts in the Eleventh Circuit reject the relevant precedent. See, e.g., Frady, 2015 WL 1470852, at *6 (“Other courts, including the majority of district courts in this Circuit that have considered the question, have adopted a narrower definition of ‘exceeds authorized access.’”); Power Equip. Maint., Inc. v. AIRCO Power Servs., Inc., 953 F. Supp. 2d 1290, 1296 (S.D. Ga. 2013) (“exceeds authorized access simply means that, while an employee’s initial access was permitted, the employee accessed information for which the employer had not provided permission”); Bell Aerospace Servs., Inc. v. U.S. Aero Servs., Inc., 690 F. Supp. 2d 1267, 1272 (M.D. Ala. 2010) (finding that the broad interpretation “ignores the plain language of the statute” and the narrow interpretation “is buoyed by the nature of the statute itself . . . Because the seven employees who resigned had valid permission to utilize the Bell Aerospace computers, they were acting with authorization when they accessed the computers up until the time they each were escorted from the facility.”); but see Aquent LLC v. Stapleton, 65 F. Supp. 3d 1339, 1346 (M.D. Fla. 2014) (“In 2010, the Eleventh Circuit joined circuits that take a broader view, holding that when the employer had a policy limiting an employee’s computer access to that done for business purposes, an employee who accessed a database for an improper purpose exceeded authorized access. . . . Accordingly, under Rodriguez [the plaintiff] sufficiently stated a cause of action . . . .” (citation omitted)). The Eleventh Circuit has observed this trend, noting the broad interpretation’s “lack of acceptance” and that “several of our sister circuits have roundly criticized [broad interpretation] decisions . . . .” EarthCam, Inc. v. OxBlue Corp., 703 Fed. Appx. 803, 808 n.2 (11th Cir. 2017). 28 to access the information at issue. Plaintiffs expressly allege that “[i]n carrying out
[his] responsibilities, Defendant had access to AlixPartners’ trade secrets and other
confidential and proprietary information.” 87 Plaintiffs describe the information
accessed on a “laptop used by Defendant during his employment,” and they describe
“thousands of his work-related files in a folder.”88 Plaintiffs describe how Defendant
“organized his files containing confidential information into subfolders entitled with
the names of sensitive matters related to AlixPartners from the time of his
employment on behalf of AlixPartners.”89 They explain that the “folders generally
contain additional subfolders relevant to the work Defendant performed for
AlixPartners.”90 These allegations reveal that Defendant was authorized to fully
access the computer’s contents. Thus, Plaintiffs’ CFAA claim relating to
Defendant’s March 8, 2017 access is dismissed.
Plaintiffs also allege that Defendant accessed his work computer and its
contents on July 28, 2017, “after AlixPartners provided Defendant notice of his
dismissal by registered letter on July 25, 2017 and after he had ceased to perform
work on behalf of AlixPartners.”91 It is reasonably conceivable that Defendant was
87 Compl. ¶ 14 (emphasis added). 88 Id. ¶ 45 (emphasis added). 89 Id. (emphasis added). 90 Id. (emphasis added). 91 Id. ¶ 51 (emphasis added). 29 not authorized to access that information after his resignation. Thus, Defendant’s
motion to dismiss Count IV as to alleged conduct that occurred after Defendant’s
departure from the Company is dismissed. 92
III. CONCLUSION For these reasons, Defendant’s motion to dismiss Count IV is GRANTED IN
PART. The remainder of Defendant’s motion is DENIED.
IT IS SO ORDERED.
92 See Bro-Tech Corp. v. Thermax, Inc., 651 F. Supp. 2d 378, 407–08 (E.D. Pa. 2009) (“It also appears that after leaving the company, [a defendant] retained [the plaintiff’s] computer for several weeks and accessed its contents, transferring some or all of them to a [the corporate defendant’s] computer. Some of the information she transferred was allegedly proprietary customer data. There is, at the very least, a genuine issue of material fact as to whether she was authorized to access [the plaintiff’s] computer at this time in this fashion, which precludes summary judgment as to the CFAA claim against her. Because questions of fact exist regarding the nature and extent of [the individual defendants’] authorization to alter or access the [plaintiff’s] information they allegedly accessed, summary judgment will be denied on Plaintiffs’ CFAA claim.”).