DFND Security, Inc. v. CrowdStrike, Inc.

Opinion

DFND SECURITY, INC., Case No. 22-cv-04542-AMO Petitioner, ORDER GRANTING MOTION TO v. DISMISS CROWDSTRIKE, INC., et al., Re: Dkt. No. 13 Respondents. Before the Court is Respondents’ motion to dismiss. The matter is fully briefed and suitable for decision without oral argument. Accordingly, the hearing set for March 24, 2025, is VACATED. See Civil L.R. 7-6. Having read the parties’ papers and carefully considered the arguments made therein and the relevant legal authority, the Court hereby GRANTS Respondents’ motion for the following reasons. On August 5, 2022, Petitioner DFND Security, Inc. (“DFND”) filed a petition to vacate an arbitration award that was issued on August 2, 2022.1 ECF 1. On August 12, 2022, Respondents CrowdStrike, Inc., and James Sheridan (together, “Respondents”) filed a motion to dismiss for lack of subject matter jurisdiction. ECF 13. Briefing concluded on September 9, 2022, see ECF 18, and on October 6, 2022, the Court heard the motion, ECF 19. The parties disputed CrowdStrike’s principal place of business, and the Court determined that discovery for purposes of determining subject matter jurisdiction was appropriate. Id. On April 20, 2023, the Court denied DFND’s requests to compel further discovery and ordered supplemental briefing. ECF 40. On June 5, 2023, Petitioner DFND filed its supplemental brief, ECF 47, and on June 26, 2023, Respondents filed theirs, ECF 52. Under Federal Rule of Civil Procedure 12(b)(1), dismissal is appropriate if the court lacks subject matter jurisdiction. Two bases exist for federal subject matter jurisdiction: federal question jurisdiction and diversity jurisdiction. See 28 U.S.C. §§ 1331, 1332(a). Relevant here, diversity jurisdiction requires that the amount in controversy exceed $75,000 and that “each of the plaintiffs . . . be a citizen of a different state than each of the defendants.” Morris v. Princess Cruises, Inc., 236 F.3d 1061, 1067 (9th Cir. 2001). An attack on subject matter jurisdiction “may be facial or factual.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). A facial attack asserts that “the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction[,]” while a factual attack “disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Id. Allegations of jurisdictional facts “are not afforded presumptive truthfulness; on a motion to dismiss for lack of subject matter jurisdiction, the court may hear evidence of those facts and resolve factual disputes where necessary.” Young v. United States, 769 F.3d 1047, 1052 (9th Cir. 2014) (quotations and citation omitted). “Once the moving party has converted the motion to dismiss into a factual motion by presenting affidavits or other evidence properly brought before the court, the party opposing the motion must furnish affidavits or other evidence necessary to satisfy its burden of establishing subject matter jurisdiction.” Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cnty., 343 F.3d 1036, 1040 n.2 (9th Cir. 2003); see also Oster v. California, No. 20-CV-07828-BLF, 2021 WL 1615341, at *2 (N.D. Cal. Apr. 26, 2021) (noting that on a motion to dismiss under Rule 12(b)(1), “the burden is on . . . the party asserting jurisdiction to establish that subject matter jurisdiction exists”) (citing Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994)). Respondents move to dismiss this action, arguing the only basis for jurisdiction that DFND California citizen because its principal place of business is Irvine, California, and they agree that Respondent James Sheridan is a citizen of St. Louis, Missouri. They similarly concur that the amount in controversy exceeds $75,000. The sole dispute is whether CrowdStrike is also a citizen of California, thus destroying diversity. Respondents argue CrowdStrike is a California citizen because its principal place of business is Sunnyvale, California. A corporation is “deemed to be a citizen of every State and foreign state by which it has been incorporated and of the State or foreign state where it has its principal place of business.” 28 U.S.C. § 1332(c)(1). A corporation’s principal place of business is the location of its “nerve center” – the place “from which its officers direct, control, and coordinate the corporation’s activities.” Hertz Corp. v. Friend, 559 U.S. 77, 78 (2010). Most of CrowdStrike’s operational, administrative, and executive functions are directed from California. ECF 13 at 5. Five of CrowdStrike’s 13 chief officers – its Chief Financial Officer, Chief Accounting Officer, Chief Legal Officer, Chief Human Resources Officer, and Chief Information Officer – work from the Sunnyvale office, and the remaining officers work remotely from their homes around the country (two of which are in California, and the other six are each in a different state). ECF 18 at 4. Moreover, two of CrowdStrike’s four board members work from the Sunnyvale office. ECF 52 at 6. These facts alone strongly suggest Sunnyvale is the company’s principal place of business. See Colmenares v. Paedae, Inc., No. CV 21-5221- DMG (KSX), 2021 WL 4934976, at *4 (C.D. Cal. Oct. 22, 2021) (holding the principal place of business was the location that was “home to a plurality of [a company’s] officers” and “the only single place home to more than one of them”). This is so despite DFND’s assertions that CrowdStrike, as a “remote first” company with many remote employees, cannot be “shorehorn[ed]” into the nerve center analysis. ECF 47 at 2. DFND’s accounting of CrowdStrike executives’ time spent in the Sunnyvale office further fails to refute Respondents’ evidence. See ECF 47 at 4-5. True, some officers have only been to the Sunnyvale office a few dozen times in the two years prior, but that does not change the fact that Sunnyvale is the location with the greatest executive presence, and the number of days executives November 2022 – when remote work was common because of the COVID-19 pandemic. See ECF 51-2 at 4, 13; ECF 51-3 at 9. Indeed, the Supreme Court contemplated in Hertz that “in this era of telecommuting, some corporations may divide their command and coordinating functions among officers who work at several different locations,” but that, nevertheless, the “nerve center” test “points courts in a single direction, toward the center of overall direction, control, and coordination.” Hertz, 559 U.S. at 95-96. That center is Sunnyvale. The Court thus concludes DFND has not rebutted Respondents’ evidence that Sunnyvale is CrowdStrike’s principal place of business, and consequently, DFND has not carried its burden to demonstrate that Crowdstrike’s principal place of business falls in a separate state. Savage, 343 F.3d at 1040 n.2. Nor has it convinced the Court that any other location may be CrowdStrike’s principal place of business. DFND argues that Austin, Texas, may be CrowdStrike’s principal place of business because CrowdStrike’s parent company – CrowdStrike Holdings, Inc. (“CHI”) – designated Austin as its “principal executive office” with the Securities and Exchange Commission. ECF 47 at 6-8.2 Based on that designation, DFND argues that “on December 28, 2021, CrowdStrike announced it moved its principal place of business from California to Austin, Texas.” ECF 15 at 1. However, the press release DFND cites makes clear it was CHI, not CrowdStrike, that made the designation. ECF 15-1 (Exhibit A). In cases “involving a subsidiary corporation, the court looks to the state of incorporation and principal place of business of the subsidiary, and not its parent.” Danjaq, S.A. v. Pathe Commc’ns Corp., 979 F.2d 772, 775 (9th Cir. 1992). “The only recognized exception to this rule is when the subsidiary is the alter ego of the parent corporation.” Id. An alter ego relationship exists where there is “such a unity of interest and ownership between the corporation and its equitable owner that the separate personalities of the corporation and the shareholder do not in

2 To the extent DFND argues Austin, Texas, is CrowdStrike’s principal place of business independent of CHI, that is not supported by the evidence. See, e.g., ECF 52 at 8 (citing depositions explaining that the Austin office is comprised largely of junior sales staff and only reality exist.” Sonora Diamond Corp. v. Superior Ct., 83 Cal. App. 4th 523, 539 (2000). This theory of liability is “an extreme remedy, sparingly used.” Id. Despite the Court’s explicit instruction that DFND’s supplemental briefing address “whether there is an alter ego relationship between CrowdStrike, Inc. and CrowdStrike Holdings, Inc.,” ECF 19 at 1, DFND has neither alleged CrowdStrike is an alter ego of CHI nor engaged the legal standard, and thus concedes this argument. Even had DFND complied with the Court’s instruction, this argument would fail. While there is overlapping management between the companies, they are separate entities. “Total ownership and shared management personnel are alone insufficient to establish the requisite level of control” necessary to establish an alter ego relationship. Ranza v. Nike, Inc., 793 F.3d 1059, 1073 (9th Cir. 2015); see also Corcoran v. CVS Health Corp., 169 F. Supp. 3d 970, 984 (N.D. Cal. 2016) (finding no alter ego relationship despite “overlapping officers and directors” between a holding company and its subsidiary and the former’s total ownership of the latter). DFND further suggests CrowdStrike’s principal place of business might be Paradise Valley, Arizona, where CrowdStrike’s CEO resides and, consequently, “the place where the buck stops.” ECF 47 at 9. However, a CEO’s residence is just one factor in the nerve center test, and DFND provides no authority supporting its request for the Court to determine CrowdStrike’s CEO’s home office is CrowdStrike’s nerve center.3 See Clemons v. Element Materials Tech. Huntington Beach LLC, No. CV-21-8581-DMG (EX), 2022 WL 1203096, at *3 (C.D. Cal. Apr. 22, 2022) (“[Defendant] has shown only that its CEO works in Florida. This alone is insufficient to make Florida its principal place of business.”). DFND also contends that CrowdStrike’s

3 DFND’s reliance on Pharmatec Sols., Inc. v. Shasta Techs., LLC, 2015 WL 1802764 (N.D. Cal. Apr. 20, 2015), is misplaced. There, the court found a company’s principal place of business was the California city where the CEO resided and where one of the company’s two offices was located, because the CEO spent “only a few days a month at the [Pennsylvania] location.” Id. at *4. However, the company’s six or seven employees all worked in the California office, and no one but the CEO ever worked in the Pennsylvania office. The Pennsylvania office, therefore, constituted a “bare office with a computer” – precisely the type of location Hertz instructs cannot constitute a principal place of business. Id. Here, in contrast, Crowdstrike’s CEO, Kurtz, lives and works from his home in Arizona, and there is no evidence of any office in Arizona nor any 1 principal place of business may be Delaware, its place of incorporation. ECF 47 at 10-11. 2 However, in support of its proposition, it cites a student law review note suggesting that the place 3 of incorporation should be the principal place of business for a “fully distributed” corporation, 4 defined as a corporation with only remote employees.* Jd. CrowdStrike is not a fully distributed 5 company, and even if it were, DFND has provided no reason for this Court to diverge from 6 Hertz’s clear instruction that a company’s principal place of business is “a place within a State”; 7 “[ijt is not the State itself.” Hertz, 559 U.S. at 93 (emphasis added). Accordingly, DFND has not 8 met its burden of establishing subject matter jurisdiction. Savage, 343 F.3d at 1040 n.2 (9th Cir. 9 } 2003). 10 Iv. CONCLUSION 11 Because DFND has failed to establish subject matter jurisdiction despite jurisdictional 12 discovery and supplemental briefing, the Court finds that further amendment would be futile. See

13 Leadsinger, Inc. v. BMG Music Pub., 512 F.3d 522, 532 (9th Cir. 2008); St. Andrews Links Ltd. v.

v 14 Source & Design Int’l (UK) Ltd., No. 21-CV-06470-JST, 2022 WL 11902199, at *5 (N.D. Cal.

15 Oct. 20, 2022). The action is therefore DISMISSED with prejudice. 16

= 17 IT IS SO ORDERED.

18 Dated: March 13, 2025 19 - 1. 20 ARACELI MARTINEZ-OLGUIN 21 United States District Judge 22 {| ————_______ * Again, DFND’s cited case is inapposite. In In re Hydroxycut Mktg. & Sales Pracs. Litig., No. 09MD2087-BTM(AJB), 2010 WL 2998855, at *4 (S.D. Cal. July 29, 2010), the defendant was 25 incorporated in Delaware, and the court found its principal place of business was Ontario, Canada. The court thus determined that “[flor the purposes of diversity jurisdiction, when a corporation is 26 incorporated in the United States has its principal place of business outside the United States, the corporation is only considered a citizen of the state in which it is incorporated.” Thus, for the 27 purposes of diversity jurisdiction, the defendant was only a citizen of Delaware. Id. Here, 28 however, there is no suggestion that CrowdStrike’s principal place of business is outside of the United States.