DFND Security, Inc. v. CrowdStrike, Inc.

• Court: District Court, N.D. California
• Decided: March 13, 2025
• Docket: 3:22-cv-04542
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 DFND SECURITY, INC., Case No. 22-cv-04542-AMO Petitioner, 8 ORDER GRANTING MOTION TO 9 v. DISMISS 10 CROWDSTRIKE, INC., et al., Re: Dkt. No. 13 Respondents. 11 12 13 Before the Court is Respondents’ motion to dismiss. The matter is fully briefed and 14 suitable for decision without oral argument. Accordingly, the hearing set for March 24, 2025, is 15 VACATED. See Civil L.R. 7-6. Having read the parties’ papers and carefully considered the 16 arguments made therein and the relevant legal authority, the Court hereby GRANTS 17 Respondents’ motion for the following reasons. 18 I. BACKGROUND 19 On August 5, 2022, Petitioner DFND Security, Inc. (“DFND”) filed a petition to vacate an 20 arbitration award that was issued on August 2, 2022.1 ECF 1. On August 12, 2022, Respondents 21 CrowdStrike, Inc., and James Sheridan (together, “Respondents”) filed a motion to dismiss for 22 lack of subject matter jurisdiction. ECF 13. Briefing concluded on September 9, 2022, see ECF 23 18, and on October 6, 2022, the Court heard the motion, ECF 19. The parties disputed 24 CrowdStrike’s principal place of business, and the Court determined that discovery for purposes 25 of determining subject matter jurisdiction was appropriate. Id. On April 20, 2023, the Court 26 denied DFND’s requests to compel further discovery and ordered supplemental briefing. ECF 40. 27 1 On June 5, 2023, Petitioner DFND filed its supplemental brief, ECF 47, and on June 26, 2023, 2 Respondents filed theirs, ECF 52. 3 II. LEGAL STANDARD 4 Under Federal Rule of Civil Procedure 12(b)(1), dismissal is appropriate if the court lacks 5 subject matter jurisdiction. Two bases exist for federal subject matter jurisdiction: federal 6 question jurisdiction and diversity jurisdiction. See 28 U.S.C. §§ 1331, 1332(a). Relevant here, 7 diversity jurisdiction requires that the amount in controversy exceed $75,000 and that “each of the 8 plaintiffs . . . be a citizen of a different state than each of the defendants.” Morris v. Princess 9 Cruises, Inc., 236 F.3d 1061, 1067 (9th Cir. 2001). 10 An attack on subject matter jurisdiction “may be facial or factual.” Safe Air for Everyone 11 v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). A facial attack asserts that “the allegations 12 contained in a complaint are insufficient on their face to invoke federal jurisdiction[,]” while a 13 factual attack “disputes the truth of the allegations that, by themselves, would otherwise invoke 14 federal jurisdiction.” Id. Allegations of jurisdictional facts “are not afforded presumptive 15 truthfulness; on a motion to dismiss for lack of subject matter jurisdiction, the court may hear 16 evidence of those facts and resolve factual disputes where necessary.” Young v. United States, 769 17 F.3d 1047, 1052 (9th Cir. 2014) (quotations and citation omitted). “Once the moving party has 18 converted the motion to dismiss into a factual motion by presenting affidavits or other evidence 19 properly brought before the court, the party opposing the motion must furnish affidavits or other 20 evidence necessary to satisfy its burden of establishing subject matter jurisdiction.” Savage v. 21 Glendale Union High Sch., Dist. No. 205, Maricopa Cnty., 343 F.3d 1036, 1040 n.2 (9th Cir. 22 2003); see also Oster v. California, No. 20-CV-07828-BLF, 2021 WL 1615341, at *2 (N.D. Cal. 23 Apr. 26, 2021) (noting that on a motion to dismiss under Rule 12(b)(1), “the burden is on . . . the 24 party asserting jurisdiction to establish that subject matter jurisdiction exists”) (citing Kokkonen v. 25 Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994)). 26 III. DISCUSSION 27 Respondents move to dismiss this action, arguing the only basis for jurisdiction that DFND 1 California citizen because its principal place of business is Irvine, California, and they agree that 2 Respondent James Sheridan is a citizen of St. Louis, Missouri. They similarly concur that the 3 amount in controversy exceeds $75,000. The sole dispute is whether CrowdStrike is also a citizen 4 of California, thus destroying diversity. 5 Respondents argue CrowdStrike is a California citizen because its principal place of 6 business is Sunnyvale, California. A corporation is “deemed to be a citizen of every State and 7 foreign state by which it has been incorporated and of the State or foreign state where it has its 8 principal place of business.” 28 U.S.C. § 1332(c)(1). A corporation’s principal place of business 9 is the location of its “nerve center” – the place “from which its officers direct, control, and 10 coordinate the corporation’s activities.” Hertz Corp. v. Friend, 559 U.S. 77, 78 (2010). 11 Most of CrowdStrike’s operational, administrative, and executive functions are directed 12 from California. ECF 13 at 5. Five of CrowdStrike’s 13 chief officers – its Chief Financial 13 Officer, Chief Accounting Officer, Chief Legal Officer, Chief Human Resources Officer, and 14 Chief Information Officer – work from the Sunnyvale office, and the remaining officers work 15 remotely from their homes around the country (two of which are in California, and the other six 16 are each in a different state). ECF 18 at 4. Moreover, two of CrowdStrike’s four board members 17 work from the Sunnyvale office. ECF 52 at 6. These facts alone strongly suggest Sunnyvale is 18 the company’s principal place of business. See Colmenares v. Paedae, Inc., No. CV 21-5221- 19 DMG (KSX), 2021 WL 4934976, at *4 (C.D. Cal. Oct. 22, 2021) (holding the principal place of 20 business was the location that was “home to a plurality of [a company’s] officers” and “the only 21 single place home to more than one of them”). 22 This is so despite DFND’s assertions that CrowdStrike, as a “remote first” company with 23 many remote employees, cannot be “shorehorn[ed]” into the nerve center analysis. ECF 47 at 2. 24 DFND’s accounting of CrowdStrike executives’ time spent in the Sunnyvale office further fails to 25 refute Respondents’ evidence. See ECF 47 at 4-5. True, some officers have only been to the 26 Sunnyvale office a few dozen times in the two years prior, but that does not change the fact that 27 Sunnyvale is the location with the greatest executive presence, and the number of days executives 1 November 2022 – when remote work was common because of the COVID-19 pandemic. See 2 ECF 51-2 at 4, 13; ECF 51-3 at 9. Indeed, the Supreme Court contemplated in Hertz that “in this 3 era of telecommuting, some corporations may divide their command and coordinating functions 4 among officers who work at several different locations,” but that, nevertheless, the “nerve center” 5 test “points courts in a single direction, toward the center of overall direction, control, and 6 coordination.” Hertz, 559 U.S. at 95-96. That center is Sunnyvale. 7 The Court thus concludes DFND has not rebutted Respondents’ evidence that Sunnyvale is 8 CrowdStrike’s principal place of business, and consequently, DFND has not carried its burden to 9 demonstrate that Crowdstrike’s principal place of business falls in a separate state. Savage, 343 10 F.3d at 1040 n.2. Nor has it convinced the Court that any other location may be CrowdStrike’s 11 principal place of business. DFND argues that Austin, Texas, may be CrowdStrike’s principal 12 place of business because CrowdStrike’s parent company – CrowdStrike Holdings, Inc. (“CHI”) – 13 designated Austin as its “principal executive office” with the Securities and Exchange 14 Commission. ECF 47 at 6-8.2 Based on that designation, DFND argues that “on December 28, 15 2021, CrowdStrike announced it moved its principal place of business from California to Austin, 16 Texas.” ECF 15 at 1. However, the press release DFND cites makes clear it was CHI, not 17 CrowdStrike, that made the designation. ECF 15-1 (Exhibit A). 18 In cases “involving a subsidiary corporation, the court looks to the state of incorporation 19 and principal place of business of the subsidiary, and not its parent.” Danjaq, S.A. v. Pathe 20 Commc’ns Corp., 979 F.2d 772, 775 (9th Cir. 1992). “The only recognized exception to this rule 21 is when the subsidiary is the alter ego of the parent corporation.” Id. An alter ego relationship 22 exists where there is “such a unity of interest and ownership between the corporation and its 23 equitable owner that the separate personalities of the corporation and the shareholder do not in 24 25

26 2 To the extent DFND argues Austin, Texas, is CrowdStrike’s principal place of business independent of CHI, that is not supported by the evidence. See, e.g., ECF 52 at 8 (citing 27 depositions explaining that the Austin office is comprised largely of junior sales staff and only 1 reality exist.” Sonora Diamond Corp. v. Superior Ct., 83 Cal. App. 4th 523, 539 (2000). This 2 theory of liability is “an extreme remedy, sparingly used.” Id. 3 Despite the Court’s explicit instruction that DFND’s supplemental briefing address 4 “whether there is an alter ego relationship between CrowdStrike, Inc. and CrowdStrike Holdings, 5 Inc.,” ECF 19 at 1, DFND has neither alleged CrowdStrike is an alter ego of CHI nor engaged the 6 legal standard, and thus concedes this argument. Even had DFND complied with the Court’s 7 instruction, this argument would fail. While there is overlapping management between the 8 companies, they are separate entities. “Total ownership and shared management personnel are 9 alone insufficient to establish the requisite level of control” necessary to establish an alter ego 10 relationship. Ranza v. Nike, Inc., 793 F.3d 1059, 1073 (9th Cir. 2015); see also Corcoran v. CVS 11 Health Corp., 169 F. Supp. 3d 970, 984 (N.D. Cal. 2016) (finding no alter ego relationship despite 12 “overlapping officers and directors” between a holding company and its subsidiary and the 13 former’s total ownership of the latter). 14 DFND further suggests CrowdStrike’s principal place of business might be Paradise 15 Valley, Arizona, where CrowdStrike’s CEO resides and, consequently, “the place where the buck 16 stops.” ECF 47 at 9. However, a CEO’s residence is just one factor in the nerve center test, and 17 DFND provides no authority supporting its request for the Court to determine CrowdStrike’s 18 CEO’s home office is CrowdStrike’s nerve center.3 See Clemons v. Element Materials Tech. 19 Huntington Beach LLC, No. CV-21-8581-DMG (EX), 2022 WL 1203096, at *3 (C.D. Cal. Apr. 20 22, 2022) (“[Defendant] has shown only that its CEO works in Florida. This alone is insufficient 21 to make Florida its principal place of business.”). DFND also contends that CrowdStrike’s 22

23 3 DFND’s reliance on Pharmatec Sols., Inc. v. Shasta Techs., LLC, 2015 WL 1802764 (N.D. Cal. Apr. 20, 2015), is misplaced. There, the court found a company’s principal place of business was 24 the California city where the CEO resided and where one of the company’s two offices was located, because the CEO spent “only a few days a month at the [Pennsylvania] location.” Id. at 25 *4. However, the company’s six or seven employees all worked in the California office, and no one but the CEO ever worked in the Pennsylvania office. The Pennsylvania office, therefore, 26 constituted a “bare office with a computer” – precisely the type of location Hertz instructs cannot constitute a principal place of business. Id. Here, in contrast, Crowdstrike’s CEO, Kurtz, lives 27 and works from his home in Arizona, and there is no evidence of any office in Arizona nor any 1 principal place of business may be Delaware, its place of incorporation. ECF 47 at 10-11. 2 || However, in support of its proposition, it cites a student law review note suggesting that the place 3 || of incorporation should be the principal place of business for a “fully distributed” corporation, 4 || defined as a corporation with only remote employees.* Jd. CrowdStrike is not a fully distributed 5 company, and even if it were, DFND has provided no reason for this Court to diverge from 6 || Hertz’s clear instruction that a company’s principal place of business is “a place within a State”; 7 “[ijt is not the State itself.” Hertz, 559 U.S. at 93 (emphasis added). Accordingly, DFND has not 8 met its burden of establishing subject matter jurisdiction. Savage, 343 F.3d at 1040 n.2 (9th Cir. 9 |} 2003). 10 || Iv. CONCLUSION 11 Because DFND has failed to establish subject matter jurisdiction despite jurisdictional 12 || discovery and supplemental briefing, the Court finds that further amendment would be futile. See

13 Leadsinger, Inc. v. BMG Music Pub., 512 F.3d 522, 532 (9th Cir. 2008); St. Andrews Links Ltd. v.

v 14 Source & Design Int’l (UK) Ltd., No. 21-CV-06470-JST, 2022 WL 11902199, at *5 (N.D. Cal.

15 Oct. 20, 2022). The action is therefore DISMISSED with prejudice. 16

= 17 IT IS SO ORDERED.

18 || Dated: March 13, 2025 19 - 1. 20 ARACELI MARTINEZ-OLGUIN 21 United States District Judge 22 {| ————_______ * Again, DFND’s cited case is inapposite. In In re Hydroxycut Mktg. & Sales Pracs. Litig., No. 09MD2087-BTM(AJB), 2010 WL 2998855, at *4 (S.D. Cal. July 29, 2010), the defendant was 25 incorporated in Delaware, and the court found its principal place of business was Ontario, Canada. The court thus determined that “[flor the purposes of diversity jurisdiction, when a corporation is 26 || incorporated in the United States has its principal place of business outside the United States, the corporation is only considered a citizen of the state in which it is incorporated.” Thus, for the 27 purposes of diversity jurisdiction, the defendant was only a citizen of Delaware. Id. Here, 28 however, there is no suggestion that CrowdStrike’s principal place of business is outside of the United States.