IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON
LORI BOKENFOHR, 3:17-cv-01870-BR
Plaintiff, OPINION AND ORDER
v. CYNTHIA GLADEN and CHRISTINE GUIDERA, Defendants. KRISTEN L. TRANETZKI EDWARD A. PIPER Angeli Law Group LLC 121 S.W. Morrison Street Suite 400 Portland, OR 97204 (503) 954-2232 Attorneys for Plaintiff JOHN J. DUNBAR Larkins Vacura LLP 121 S.W. Morrison St Suite 700 Portland, OR 97204 (503) 222-4424 Attorneys for Defendant Cynthia Gladen 1 - OPINION AND ORDER JEFFREY M. EDELSON HEATHER ST. CLAIR Markowitz Herbold PC 1211 S.W. Fifth Ave Suite 3000 Portland, OR 97204 (503) 295-3085 Attorneys for Defendant Christine Guidera BROWN, Senior Judge. This matter comes before the Court on Defendant Cynthia Gladen’s Motion (#121) for Partial Summary Judgment. The Court concludes the record is sufficiently developed, and, therefore, oral argument is not required to resolve this Motion. For the reasons that follow, the Court GRANTS Gladen’s Motion.
BACKGROUND Because the parties are familiar with the facts underlying this action, the Court sets forth only the facts taken from the parties’ filings related to Gladen’s Motion that are relevant to the pending Motion. In 2015 Defendant Cynthia Gladen was married to Kenneth Kolarsky.1 Kenneth Kolarsky was having an affair at that time with Plaintiff Lori Bokenfohr, an attorney who lived and practiced law in Canada. 1 Kolarsky is not a party to this action. 2 - OPINION AND ORDER Plaintiff alleges in her Complaint that in 2015 she owned a laptop computer on which she stored “a broad range of personal and confidential information” including her banking, financial, and tax records; her medical records and the medical records of her children; and her “private photo albums.” Compl. at ¶ 12. In July 2015 Kolarsky purchased two solid-state computer drives (SSD) or “flash drives.”2 Kolarsky purchased the SSDs with a “family credit card,” but he intended one of the SSDs to be a gift for Plaintiff. Plaintiff alleges she intended to use the SSD to create a back-up copy of the contents of her laptop. In mid-October 2015 Plaintiff asked Kolarsky to copy the information from Plaintiff’s laptop to the SSD. Kolarsky tried to do so, but his “attempt appeared to fail, following which Kolarsky reformatted the SSD.” Compl. at ¶ 14. Kolarsky and Plaintiff believed the reformatting process permanently deleted
any information that might have been copied from Plaintiff’s laptop to the SSD. Plaintiff and Kolarsky were mistaken, however, and “[a]lthough information was not readily accessible, the backup of [Plaintiff’s] computer on the [SSD], including the photos [at issue in this action] remained and could be recovered and restored by a computer vendor.” Am. Joint Statement of Agreed Facts at ¶ 4. Kolarsky retained possession 2 The parties also refer to the SSDs as flash drives. The Court refers to them as SSDs for purposes of this Opinion and Order. 3 - OPINION AND ORDER of the SSD after the attempted backup and kept the SSD at the home he shared with Gladen. The parties dispute precisely where and when Gladen found the SSD at issue. The record reflects Gladen found the SSD in either her family car or in her family home. This factual dispute, however, is immaterial to resolution of the Motion now before the Court. At some point Gladen attempted to open the SSD, but she could not open or read anything on the SSD on her personal computer. Gladen, therefore, took the SSD and her personal computer to Office Depot for technical assistance. The Office Depot employee was able to restore some of the information on the SSD. In late January 2016 Gladen returned to Office Depot to have the files restored, and “certain information was restored from the drive [and a] copy of the [SSD] was made onto an
external hard drive.” Am. Joint Statement of Agreed Facts at ¶ 8. On January 23, 2016, Home Depot “completed its restoration work” on the SSD. Am. Joint Statement of Agreed Facts at ¶ 11. As a result of the restoration “Gladen saw photographs and other data copied from the [SSD].” Am. Joint Statement of Agreed Facts at ¶ 11. On November 21, 2017, Plaintiff filed a Complaint in this Court against Gladen and Christine Guidera in which she brought 4 - OPINION AND ORDER claims against Gladen for violation of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030; against both Defendants for violation of Oregon Revised Statutes § 30.865(1)(d); against both Defendants for conversion; against both Defendants for replevin; and against both Defendants for “intrusion upon seclusion.” On February 21, 2019, Gladen filed a Motion for Partial Summary Judgment as to all of Plaintiff’s claims except for her First Claim for violation of CFAA against Gladen. Also on February 21, 2019, Guidera filed a Motion for Summary Judgment as to all of Plaintiff’s claims against her. On June 13, 2019, the Court issued an Opinion and Order in which it granted Guidera’s Motion for Summary Judgment, dismissed Plaintiff’s claims against Guidera, and granted in part and denied in part Gladen’s Motion for Partial Summary Judgment. On June 4, 2019, Gladen filed a Motion (#121) for Partial
Summary Judgment as to Plaintiff’s First Claim for violation of CFAA against Gladen. The Court took Gladen’s Motion under advisement on July 12, 2019.
STANDARDS Summary judgment is appropriate when “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Washington Mut. Ins. v. United States, 636 F.3d 1207, 1216 (9th Cir. 2011). See also Fed. R. 5 - OPINION AND ORDER Civ. P. 56(a). The moving party must show the absence of a genuine dispute as to a material fact. Emeldi v. Univ. of Or., 673 F.3d 1218, 1223 (9th Cir. 2012). In response to a properly supported motion for summary judgment, the nonmoving party must go beyond the pleadings and point to "specific facts demonstrating the existence of genuine issues for trial." In re Oracle Corp. Sec. Litig., 627 F.3d 376, 387 (9th Cir. 2010) "This burden is not a light one. . . . The non-moving party must do more than show there is some 'metaphysical doubt' as to the material facts at issue." Id. (citation omitted). A dispute as to a material fact is genuine "if the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Villiarimo v. Aloha Island Air, Inc., 281 F.3d 1054, 1061 (9th Cir. 2002)(quoting Anderson v. Liberty Lobby,
Inc., 477 U.S. 242, 248 (1986)). The court must draw all reasonable inferences in favor of the nonmoving party. Sluimer v. Verity, Inc., 606 F.3d 584, 587 (9th Cir. 2010). "Summary judgment cannot be granted where contrary inferences may be drawn from the evidence as to material issues." Easter v. Am. W. Fin., 381 F.3d 948, 957 (9th Cir. 2004)(citing Sherman Oaks Med. Arts Ctr., Ltd. v. Carpenters Local Union No. 1936, 680 F.2d 594, 598 (9th Cir. 1982)). "A non-movant's bald assertions or a mere scintilla of evidence in his favor are both insufficient to withstand summary 6 - OPINION AND ORDER judgment." F.T.C. v. Stefanchik, 559 F.3d 924, 929 (9th Cir. 2009)(citation omitted). When the nonmoving party's claims are factually implausible, that party must "come forward with more persuasive evidence than otherwise would be necessary." LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1137 (9th Cir. 2009) (citing Blue Ridge Ins. Co. v. Stanewich, 142 F.3d 1145, 1149 (9th Cir. 1998)). The substantive law governing a claim or a defense determines whether a fact is material. Miller v. Glenn Miller Prod., Inc., 454 F.3d 975, 987 (9th Cir. 2006). If the resolution of a factual dispute would not affect the outcome of the claim, the court may grant summary judgment. Id.
DISCUSSION In her First Claim Plaintiff alleges Gladen violated CFAA “[b]y directing the computer technician to recover, restore, and reformat data on the SSD, and by causing that data to be copied to her personal devices and accounts, and by subsequently accessing and disseminating that data . . . without authorization.” Compl. at ¶ 27. Plaintiff appears to bring her claim against Gladen pursuant to § 1030(a)(2)(C) of CFAA, which imposes civil and/or criminal liability on a person who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information 7 - OPINION AND ORDER from any protected computer.”3 CFAA defines a computer as an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device. 18 U.S.C. § 1030(e)(1). Plaintiff asserts the SSD is a “high speed data processing device performing logical, arithmetic, or storage functions.” Gladen, however, asserts Plaintiff’s claim for violation of CFAA fails as a matter of law because the SSD is not a “data- processing device,” and, therefore, it is not a “computer” within the meaning of CFAA. When interpreting terms in CFAA the Ninth Circuit explained: [W]e start with the plain language of the statute. See United States v. Blixt, 548 F.3d 882, 887 (9th Cir. 2008). [When] CFAA does not define [a term in the statute] it is a “fundamental canon of statutory construction . . . that, unless otherwise defined, words will be interpreted as taking their ordinary, contemporary, common meaning.” Perrin v. United States, 444 U.S. 37, 42 (1979). LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132–33 (9th Cir. 2009). Accordingly, the Ninth Circuit in Brekka looked to the 3 When it was enacted in 1984 CFAA was exclusively a criminal statute. Congress amended CFAA in 1994 to include a civil cause of action for conduct that involves any one of several factors. See 18 U.S.C. § 1030(g). 8 - OPINION AND ORDER dictionary definition of the term at issue and applied that “ordinary, contemporary, common meaning” to the term. Id. at 1133. CFAA does not define “data processing device” and neither the parties nor the Court could find any case defining the phrase. Accordingly, this Court’s “analysis begins with the ordinary meanings of [the words in the phrase at issue] at the time that [CFAA] was adopted.” United States v. Carter, 421 F.3d 909, 911 (9th Cir. 2005). To discover the ordinary meaning of the words at issue the Court “follow[s] the common practice of consulting dictionary definitions” of the terms. Id. The parties do not dispute the SSD is a device, but they disagree as to whether it is a “data-processing” device. Webster’s Dictionary has defined “data-processing” consistently
since 1976 as “the conversion and subsequent processing of raw data.” Webster’s Third New Int’l Dictionary (1976). See also Webster’s New Collegiate Dictionary (8th ed. 1977)(“the converting (as by computers) of crude information into usable or storable form); Webster’s New Collegiate Dictionary (9th ed. 1985)(“the converting of raw data to machine-readable form and its subsequent processing (as storing, updating, combining, rearranging, or printing out) by a computer”); Webster’s Third New Int’l Dictionary (1993)(“the conversion of raw data to machine-readable form and its subsequent processing (as 9 - OPINION AND ORDER storing, updating, combining, rearranging, or printing out) by a computer”); Webster’s Third New Int’l Dictionary (2002)(“the conversion of raw data to machine-readable form and its subsequent processing (as storing, updating, combining, rearranging, or printing out) by a computer”); Webster Online Dictionary, https://www.merriamwebster.com/dictionary/ data%20processing (“the conversion of raw data to machine-readable form and its subsequent processing (as storing, updating, combining, rearranging, or printing out) by a computer”). Thus, according to the “common meaning” of “data processing,” a data-processing device is one that converts raw data to machine-readable form and then processes the machine- readable data. Gladen’s expert explains the “input and output” of data from
the SSD at issue as follows: [T]he primary function of the controller [in the SSD] . . . is to control the input and output of data to and from the [SSD]. How the controller controls the input and output of the data is immaterial because the input and output of the data is always machine-readable data. . . . With [the] firmware [in the SSD at issue], the controller and the [SSD] do[] not convert raw data unto usable, storable, or machine-readable data. The controller does not convert raw data from any source. . . . The controller receives as input machine-readable data from the computer [that] the [SSD] is attached to and returns the same machine-readable data upon request. The [SSD] does not store, process, or convert raw data . . . . The [SSD] cannot convert raw data, cannot perform data processing, and is not a computer. 10 - OPINION AND ORDER Decl. of Gary Liao at ¶ 4. Plaintiff’s expert states in his Digital Forensics Examination Report that the SSD at issue is a computer because it contains a SandForce SF-2281 flash controller. The controller is the brains of the device and is an ASIC (Application Specific Integrated Circuit) which contains a CPU (Central Processing Unit) as well as its own internal memory according to the manufacturer’s specification sheet in Exhibit 10. The SSD also internally stores and runs firmware which acts as an OS (Operating System) for embedded systems like the SSD. Decl. of Joanna Perini-Abbott, Ex. 1 at 4. Plaintiff’s expert, however, does not assert the SSD at issue converts raw data to machine-readable form or that it is capable of doing so. In fact, Gladen’s expert notes in his Declaration that he has reviewed Plaintiff’s expert report, and “[t]he presence of this firmware does not change the primary function of the controller, which is to control the input and output of data to and from the [SSD]. . . . With that firmware, the controller and the [SSD] do[] not convert raw data unto usable, storable, or machine- readable data.” Liao Decl. at ¶ 4. Pursuant to the common meaning of data processing, therefore, the SSD does not perform that function, and, therefore, it is not a computer. This conclusion is supported by the few cases in which the use of SSD, flash, or thumb drives4 were involved in CFAA claims. For 4 Courts use the terms SSD, flash drive, and/or thumb drive to describe the same kind device as the one at issue here. 11 - OPINION AND ORDER example, in Lewis-Burke Associates, LLC v. Widder the plaintiff brought a claim for violation of CFAA on the ground that the defendant exceeded his authorized access when he copied certain files from a computer onto a flash drive. The court noted: In this case, there is no dispute that Widder was still an employee of Lewis–Burke when he allegedly copied certain files to a thumb drive. Plaintiff claims that some of the access occurred on defendant's very last day as an employee of plaintiff; however, it still occurred while he was in the employ of plaintiff, and plaintiff has not alleged to have terminated his authorization to access the computer before he left its employ. There is an allegation that the forensic exam demonstrated that certain files were accessed from the thumb drive after Widder was no longer employed by Lewis–Burke; however, there is no allegation that Widder accessed his Lewis–Burke computer or the server after his employment with it ended. The CFAA is concerned with access to a computer; Widder's alleged access to data on a thumb drive would fall outside of plaintiff's CFAA claim. 725 F. Supp. 2d 187, 193 (D.D.C. 2010)(emphasis added). The court, therefore, assumed, without evaluation of the definition of “computer,” that a thumb or flash drive is not a computer within the meaning of the CFAA. Similarly, in Dresser-Rand Company v. Jones an employer brought an action against two former managers alleging violation of CFAA on the ground that the defendants had “accessed their work laptops and downloaded thousands of documents to external [hard drives and flash drives].” 957 F. Supp. 2d 610, 620 (E.D. Pa. 2013). In evaluating the plaintiff’s claim the court noted: 12 - OPINION AND ORDER If [the defendants] were authorized to access their work laptops and to download files from them, they cannot be liable under the CFAA even if they subsequently misused those documents to compete against [the plaintiff]. * * * [The plaintiff’s] forensic computer expert noted that [the defendants] accessed [the plaintiff’s] files [that they had downloaded onto external hard drives and flash drives] after [the defendants] ceased their employment. . . . Because[, however,] the CFAA is based on unauthorized computer access — not file access, the fact that [the files that the defendants had downloaded onto external hard drives and flash drives] were accessed [later] on [the defendants’] computers is immaterial to the CFAA claim. Because [the defendants] had authorization to access their work computers, they did not hack into them when they downloaded the files. Their alleged [later] misuse of the [downloaded] files may have remedies under other laws, but not under the CFAA. Id. The court, therefore, assumed, without evaluating the definition of “computer,” that flash drives are not computers under CFAA. On this record the Court concludes the plain meaning of “computer” under CFAA does not include the SSD at issue here. The Court, therefore, concludes Plaintiff has not established a claim against Gladen for violation of CFAA. Accordingly, the Court grants Gladen’s Motion for Partial Summary Judgment as to Plaintiff’s First Claim for violation of CFAA against Gladen. 13 - OPINION AND ORDER CONCLUSION For these reasons, the Court GRANTS Gladen’s Motion (#121) for Partial Summary Judgment. The Court DIRECTS the parties to file a Joint Status Report no later than September 9, 2019, to include a proposed case- management schedule for moving this case forward as to all remaining issues.
IT IS SO ORDERED. DATED this 22nd day of August, 2019.
/s/ Anna J. Brown
ANNA J. BROWN United States Senior District Judge
14 - OPINION AND ORDER IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON
v. CYNTHIA GLADEN and CHRISTINE GUIDERA, Defendants. KRISTEN L. TRANETZKI EDWARD A. PIPER Angeli Law Group LLC 121 S.W. Morrison Street Suite 400 Portland, OR 97204 (503) 954-2232 Attorneys for Plaintiff JOHN J. DUNBAR Larkins Vacura LLP 121 S.W. Morrison St Suite 700 Portland, OR 97204 (503) 222-4424 Attorneys for Defendant Cynthia Gladen 1 - OPINION AND ORDER JEFFREY M. EDELSON HEATHER ST. CLAIR Markowitz Herbold PC 1211 S.W. Fifth Ave Suite 3000 Portland, OR 97204 (503) 295-3085 Attorneys for Defendant Christine Guidera BROWN, Senior Judge. This matter comes before the Court on Defendant Cynthia Gladen’s Motion (#121) for Partial Summary Judgment. The Court concludes the record is sufficiently developed, and, therefore, oral argument is not required to resolve this Motion. For the reasons that follow, the Court GRANTS Gladen’s Motion.
BACKGROUND Because the parties are familiar with the facts underlying this action, the Court sets forth only the facts taken from the parties’ filings related to Gladen’s Motion that are relevant to the pending Motion. In 2015 Defendant Cynthia Gladen was married to Kenneth Kolarsky.1 Kenneth Kolarsky was having an affair at that time with Plaintiff Lori Bokenfohr, an attorney who lived and practiced law in Canada. 1 Kolarsky is not a party to this action. 2 - OPINION AND ORDER Plaintiff alleges in her Complaint that in 2015 she owned a laptop computer on which she stored “a broad range of personal and confidential information” including her banking, financial, and tax records; her medical records and the medical records of her children; and her “private photo albums.” Compl. at ¶ 12. In July 2015 Kolarsky purchased two solid-state computer drives (SSD) or “flash drives.”2 Kolarsky purchased the SSDs with a “family credit card,” but he intended one of the SSDs to be a gift for Plaintiff. Plaintiff alleges she intended to use the SSD to create a back-up copy of the contents of her laptop. In mid-October 2015 Plaintiff asked Kolarsky to copy the information from Plaintiff’s laptop to the SSD. Kolarsky tried to do so, but his “attempt appeared to fail, following which Kolarsky reformatted the SSD.” Compl. at ¶ 14. Kolarsky and Plaintiff believed the reformatting process permanently deleted
any information that might have been copied from Plaintiff’s laptop to the SSD. Plaintiff and Kolarsky were mistaken, however, and “[a]lthough information was not readily accessible, the backup of [Plaintiff’s] computer on the [SSD], including the photos [at issue in this action] remained and could be recovered and restored by a computer vendor.” Am. Joint Statement of Agreed Facts at ¶ 4. Kolarsky retained possession 2 The parties also refer to the SSDs as flash drives. The Court refers to them as SSDs for purposes of this Opinion and Order. 3 - OPINION AND ORDER of the SSD after the attempted backup and kept the SSD at the home he shared with Gladen. The parties dispute precisely where and when Gladen found the SSD at issue. The record reflects Gladen found the SSD in either her family car or in her family home. This factual dispute, however, is immaterial to resolution of the Motion now before the Court. At some point Gladen attempted to open the SSD, but she could not open or read anything on the SSD on her personal computer. Gladen, therefore, took the SSD and her personal computer to Office Depot for technical assistance. The Office Depot employee was able to restore some of the information on the SSD. In late January 2016 Gladen returned to Office Depot to have the files restored, and “certain information was restored from the drive [and a] copy of the [SSD] was made onto an
external hard drive.” Am. Joint Statement of Agreed Facts at ¶ 8. On January 23, 2016, Home Depot “completed its restoration work” on the SSD. Am. Joint Statement of Agreed Facts at ¶ 11. As a result of the restoration “Gladen saw photographs and other data copied from the [SSD].” Am. Joint Statement of Agreed Facts at ¶ 11. On November 21, 2017, Plaintiff filed a Complaint in this Court against Gladen and Christine Guidera in which she brought 4 - OPINION AND ORDER claims against Gladen for violation of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030; against both Defendants for violation of Oregon Revised Statutes § 30.865(1)(d); against both Defendants for conversion; against both Defendants for replevin; and against both Defendants for “intrusion upon seclusion.” On February 21, 2019, Gladen filed a Motion for Partial Summary Judgment as to all of Plaintiff’s claims except for her First Claim for violation of CFAA against Gladen. Also on February 21, 2019, Guidera filed a Motion for Summary Judgment as to all of Plaintiff’s claims against her. On June 13, 2019, the Court issued an Opinion and Order in which it granted Guidera’s Motion for Summary Judgment, dismissed Plaintiff’s claims against Guidera, and granted in part and denied in part Gladen’s Motion for Partial Summary Judgment. On June 4, 2019, Gladen filed a Motion (#121) for Partial
Summary Judgment as to Plaintiff’s First Claim for violation of CFAA against Gladen. The Court took Gladen’s Motion under advisement on July 12, 2019.
STANDARDS Summary judgment is appropriate when “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Washington Mut. Ins. v. United States, 636 F.3d 1207, 1216 (9th Cir. 2011). See also Fed. R. 5 - OPINION AND ORDER Civ. P. 56(a). The moving party must show the absence of a genuine dispute as to a material fact. Emeldi v. Univ. of Or., 673 F.3d 1218, 1223 (9th Cir. 2012). In response to a properly supported motion for summary judgment, the nonmoving party must go beyond the pleadings and point to "specific facts demonstrating the existence of genuine issues for trial." In re Oracle Corp. Sec. Litig., 627 F.3d 376, 387 (9th Cir. 2010) "This burden is not a light one. . . . The non-moving party must do more than show there is some 'metaphysical doubt' as to the material facts at issue." Id. (citation omitted). A dispute as to a material fact is genuine "if the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Villiarimo v. Aloha Island Air, Inc., 281 F.3d 1054, 1061 (9th Cir. 2002)(quoting Anderson v. Liberty Lobby,
Inc., 477 U.S. 242, 248 (1986)). The court must draw all reasonable inferences in favor of the nonmoving party. Sluimer v. Verity, Inc., 606 F.3d 584, 587 (9th Cir. 2010). "Summary judgment cannot be granted where contrary inferences may be drawn from the evidence as to material issues." Easter v. Am. W. Fin., 381 F.3d 948, 957 (9th Cir. 2004)(citing Sherman Oaks Med. Arts Ctr., Ltd. v. Carpenters Local Union No. 1936, 680 F.2d 594, 598 (9th Cir. 1982)). "A non-movant's bald assertions or a mere scintilla of evidence in his favor are both insufficient to withstand summary 6 - OPINION AND ORDER judgment." F.T.C. v. Stefanchik, 559 F.3d 924, 929 (9th Cir. 2009)(citation omitted). When the nonmoving party's claims are factually implausible, that party must "come forward with more persuasive evidence than otherwise would be necessary." LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1137 (9th Cir. 2009) (citing Blue Ridge Ins. Co. v. Stanewich, 142 F.3d 1145, 1149 (9th Cir. 1998)). The substantive law governing a claim or a defense determines whether a fact is material. Miller v. Glenn Miller Prod., Inc., 454 F.3d 975, 987 (9th Cir. 2006). If the resolution of a factual dispute would not affect the outcome of the claim, the court may grant summary judgment. Id.
DISCUSSION In her First Claim Plaintiff alleges Gladen violated CFAA “[b]y directing the computer technician to recover, restore, and reformat data on the SSD, and by causing that data to be copied to her personal devices and accounts, and by subsequently accessing and disseminating that data . . . without authorization.” Compl. at ¶ 27. Plaintiff appears to bring her claim against Gladen pursuant to § 1030(a)(2)(C) of CFAA, which imposes civil and/or criminal liability on a person who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information 7 - OPINION AND ORDER from any protected computer.”3 CFAA defines a computer as an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device. 18 U.S.C. § 1030(e)(1). Plaintiff asserts the SSD is a “high speed data processing device performing logical, arithmetic, or storage functions.” Gladen, however, asserts Plaintiff’s claim for violation of CFAA fails as a matter of law because the SSD is not a “data- processing device,” and, therefore, it is not a “computer” within the meaning of CFAA. When interpreting terms in CFAA the Ninth Circuit explained: [W]e start with the plain language of the statute. See United States v. Blixt, 548 F.3d 882, 887 (9th Cir. 2008). [When] CFAA does not define [a term in the statute] it is a “fundamental canon of statutory construction . . . that, unless otherwise defined, words will be interpreted as taking their ordinary, contemporary, common meaning.” Perrin v. United States, 444 U.S. 37, 42 (1979). LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132–33 (9th Cir. 2009). Accordingly, the Ninth Circuit in Brekka looked to the 3 When it was enacted in 1984 CFAA was exclusively a criminal statute. Congress amended CFAA in 1994 to include a civil cause of action for conduct that involves any one of several factors. See 18 U.S.C. § 1030(g). 8 - OPINION AND ORDER dictionary definition of the term at issue and applied that “ordinary, contemporary, common meaning” to the term. Id. at 1133. CFAA does not define “data processing device” and neither the parties nor the Court could find any case defining the phrase. Accordingly, this Court’s “analysis begins with the ordinary meanings of [the words in the phrase at issue] at the time that [CFAA] was adopted.” United States v. Carter, 421 F.3d 909, 911 (9th Cir. 2005). To discover the ordinary meaning of the words at issue the Court “follow[s] the common practice of consulting dictionary definitions” of the terms. Id. The parties do not dispute the SSD is a device, but they disagree as to whether it is a “data-processing” device. Webster’s Dictionary has defined “data-processing” consistently
since 1976 as “the conversion and subsequent processing of raw data.” Webster’s Third New Int’l Dictionary (1976). See also Webster’s New Collegiate Dictionary (8th ed. 1977)(“the converting (as by computers) of crude information into usable or storable form); Webster’s New Collegiate Dictionary (9th ed. 1985)(“the converting of raw data to machine-readable form and its subsequent processing (as storing, updating, combining, rearranging, or printing out) by a computer”); Webster’s Third New Int’l Dictionary (1993)(“the conversion of raw data to machine-readable form and its subsequent processing (as 9 - OPINION AND ORDER storing, updating, combining, rearranging, or printing out) by a computer”); Webster’s Third New Int’l Dictionary (2002)(“the conversion of raw data to machine-readable form and its subsequent processing (as storing, updating, combining, rearranging, or printing out) by a computer”); Webster Online Dictionary, https://www.merriamwebster.com/dictionary/ data%20processing (“the conversion of raw data to machine-readable form and its subsequent processing (as storing, updating, combining, rearranging, or printing out) by a computer”). Thus, according to the “common meaning” of “data processing,” a data-processing device is one that converts raw data to machine-readable form and then processes the machine- readable data. Gladen’s expert explains the “input and output” of data from
the SSD at issue as follows: [T]he primary function of the controller [in the SSD] . . . is to control the input and output of data to and from the [SSD]. How the controller controls the input and output of the data is immaterial because the input and output of the data is always machine-readable data. . . . With [the] firmware [in the SSD at issue], the controller and the [SSD] do[] not convert raw data unto usable, storable, or machine-readable data. The controller does not convert raw data from any source. . . . The controller receives as input machine-readable data from the computer [that] the [SSD] is attached to and returns the same machine-readable data upon request. The [SSD] does not store, process, or convert raw data . . . . The [SSD] cannot convert raw data, cannot perform data processing, and is not a computer. 10 - OPINION AND ORDER Decl. of Gary Liao at ¶ 4. Plaintiff’s expert states in his Digital Forensics Examination Report that the SSD at issue is a computer because it contains a SandForce SF-2281 flash controller. The controller is the brains of the device and is an ASIC (Application Specific Integrated Circuit) which contains a CPU (Central Processing Unit) as well as its own internal memory according to the manufacturer’s specification sheet in Exhibit 10. The SSD also internally stores and runs firmware which acts as an OS (Operating System) for embedded systems like the SSD. Decl. of Joanna Perini-Abbott, Ex. 1 at 4. Plaintiff’s expert, however, does not assert the SSD at issue converts raw data to machine-readable form or that it is capable of doing so. In fact, Gladen’s expert notes in his Declaration that he has reviewed Plaintiff’s expert report, and “[t]he presence of this firmware does not change the primary function of the controller, which is to control the input and output of data to and from the [SSD]. . . . With that firmware, the controller and the [SSD] do[] not convert raw data unto usable, storable, or machine- readable data.” Liao Decl. at ¶ 4. Pursuant to the common meaning of data processing, therefore, the SSD does not perform that function, and, therefore, it is not a computer. This conclusion is supported by the few cases in which the use of SSD, flash, or thumb drives4 were involved in CFAA claims. For 4 Courts use the terms SSD, flash drive, and/or thumb drive to describe the same kind device as the one at issue here. 11 - OPINION AND ORDER example, in Lewis-Burke Associates, LLC v. Widder the plaintiff brought a claim for violation of CFAA on the ground that the defendant exceeded his authorized access when he copied certain files from a computer onto a flash drive. The court noted: In this case, there is no dispute that Widder was still an employee of Lewis–Burke when he allegedly copied certain files to a thumb drive. Plaintiff claims that some of the access occurred on defendant's very last day as an employee of plaintiff; however, it still occurred while he was in the employ of plaintiff, and plaintiff has not alleged to have terminated his authorization to access the computer before he left its employ. There is an allegation that the forensic exam demonstrated that certain files were accessed from the thumb drive after Widder was no longer employed by Lewis–Burke; however, there is no allegation that Widder accessed his Lewis–Burke computer or the server after his employment with it ended. The CFAA is concerned with access to a computer; Widder's alleged access to data on a thumb drive would fall outside of plaintiff's CFAA claim. 725 F. Supp. 2d 187, 193 (D.D.C. 2010)(emphasis added). The court, therefore, assumed, without evaluation of the definition of “computer,” that a thumb or flash drive is not a computer within the meaning of the CFAA. Similarly, in Dresser-Rand Company v. Jones an employer brought an action against two former managers alleging violation of CFAA on the ground that the defendants had “accessed their work laptops and downloaded thousands of documents to external [hard drives and flash drives].” 957 F. Supp. 2d 610, 620 (E.D. Pa. 2013). In evaluating the plaintiff’s claim the court noted: 12 - OPINION AND ORDER If [the defendants] were authorized to access their work laptops and to download files from them, they cannot be liable under the CFAA even if they subsequently misused those documents to compete against [the plaintiff]. * * * [The plaintiff’s] forensic computer expert noted that [the defendants] accessed [the plaintiff’s] files [that they had downloaded onto external hard drives and flash drives] after [the defendants] ceased their employment. . . . Because[, however,] the CFAA is based on unauthorized computer access — not file access, the fact that [the files that the defendants had downloaded onto external hard drives and flash drives] were accessed [later] on [the defendants’] computers is immaterial to the CFAA claim. Because [the defendants] had authorization to access their work computers, they did not hack into them when they downloaded the files. Their alleged [later] misuse of the [downloaded] files may have remedies under other laws, but not under the CFAA. Id. The court, therefore, assumed, without evaluating the definition of “computer,” that flash drives are not computers under CFAA. On this record the Court concludes the plain meaning of “computer” under CFAA does not include the SSD at issue here. The Court, therefore, concludes Plaintiff has not established a claim against Gladen for violation of CFAA. Accordingly, the Court grants Gladen’s Motion for Partial Summary Judgment as to Plaintiff’s First Claim for violation of CFAA against Gladen. 13 - OPINION AND ORDER CONCLUSION For these reasons, the Court GRANTS Gladen’s Motion (#121) for Partial Summary Judgment. The Court DIRECTS the parties to file a Joint Status Report no later than September 9, 2019, to include a proposed case- management schedule for moving this case forward as to all remaining issues.
14 - OPINION AND ORDER