1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA
9 Mark Alan Greenburg, No. CV-22-00122-PHX-DLR
10 Plaintiff, ORDER
11 v.
12 Amanda Wray, et al.,
13 Defendants. 14 15 16 Pending before the Court is Defendants Amanda Wray and Daniel Wray’s motion 17 to dismiss Plaintiff Mark Greenburg’s first amended complaint for failure to state a claim. 18 (Doc. 15, 16, 17.) For the following reasons, the Court denies the motion. 19 I. Background 20 Amanda Wray manages a 2,000-member Facebook group (the “Facebook Group”) 21 “dedicated to propagating anti-mask policies, anti-vaccine policies, anti-LGBTQ policies, 22 and anti-Critical Race Theory policies within the Scottsdale Unified School District.” 23 Daniel Wray is a member of the group. Plaintiff’s son serves on the Scottsdale Unified 24 No. 48 Governing Board, the elected governing body that manages Scottsdale Unified No. 25 48 School District (the “District”). (Doc. 9 at 3-4.) 26 In response to activities by Defendants and the Facebook Group, Plaintiff began 27 collecting information on them, including photographs, video footage, discussions with 28 third parties concerning them, personal comments and thoughts, and political memes. 1 Plaintiff stored these records on his personal “Google Drive” server. Plaintiff specifically 2 shared server access with three individuals (including Plaintiff’s son), who could access 3 the server by signing into their own password-protected Google accounts. Although 4 Plaintiff didn’t realize it at the time, the sharing settings on his Google Drive also allowed 5 anyone to access the server by typing in the exact URL. (Doc. 9 at 4-6.) 6 In 2021, Plaintiff’s son was accused of defamation. He responded to his accuser by 7 emailing “13 photographs of public Facebook comments, made by his accuser, some of 8 which were stored on the server.” One of the photographs displayed the URL to the Google 9 Drive, and that photograph made its way into Amanda’s possession, where she noticed the 10 URL and asked a third party to make a hyperlink for the URL. Once provided, she clicked 11 on it to access the Google Drive. She reviewed, downloaded, deleted, added, reorganized, 12 renamed, and publicly disclosed contents of the Google Drive. (Doc. 9 at 6-8.) 13 Plaintiff learned of the access and hired a forensic IT consultant team to conduct a 14 damage assessment. He then sued Defendants under the Computer Fraud and Abuse Act 15 (“CFAA”), 18 U.S.C.(a)(2), alleging a loss of at least $5,000. (Doc. 9 at 8.) 16 II. Analysis 17 To survive a Rule 12(b)(6) motion to dismiss, a complaint must contain factual 18 allegations sufficient to “raise a right to relief above the speculative level.” Bell Atl. Corp. 19 v. Twombly, 550 U.S. 544, 555 (2007). The task when ruling on a motion to dismiss “is to 20 evaluate whether the claims alleged [plausibly] can be asserted as a matter of law.” Adams 21 v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004); accord Ashcroft v. Iqbal, 556 U.S. 662, 22 678 (2009). When analyzing the sufficiency of a complaint, the well-pled factual 23 allegations are taken as true and construed in the light most favorable to the plaintiff. 24 Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). However, legal conclusions 25 couched as factual allegations are not entitled to the assumption of truth, Iqbal, 556 U.S. 26 at 680, and therefore are insufficient to defeat a motion to dismiss for failure to state a 27 claim, In re Cutera Sec. Litig., 610 F.3d 1103, 1108 (9th Cir. 2008). 28 1 To “bring an action successfully under 18 U.S.C. § 1030(g) based on a violation of 2 18 U.S.C. § 1030(a)(2),” Plaintiff must allege that Defendants: 3 (1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that he 4 (3) thereby obtained information (4) from any protected computer (if the conduct involved an interstate or foreign 5 communication), and that (5) there was loss to one or more persons during any one-year period aggregating at 6 least $5,000 in value. 7 LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). Defendants argue 8 that Plaintiff has not pled the second and fifth elements. 9 Citing hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), Defendants 10 argue that Plaintiff did not allege that Amanda accessed the Google Drive without 11 authorization. (Doc. 15.) In hiQ, a data analytics company, hiQ, was scraping data on 12 public LinkedIn profiles, data indexed by search engines. Id. at 1186-87. LinkedIn found 13 out, sent hiQ a cease-and desist-letter, and imposed technical measures to prevent scraping 14 data from public profile. Id. at 1187. But hiQ didn’t stop and instead sought a declaratory 15 judgment that LinkedIn “could not lawfully invoke the CFAA” against it for scraping the 16 data found on public LinkedIn profiles. Id. Ultimately, the Ninth Circuit determined that 17 hiQ’s data scraping did not fall within the CFAA because “anyone with a web browser” 18 could access the data. 19 On review, the Ninth Circuit reasoned that “the prohibition on unauthorized access 20 is properly understood to apply only to private information—information delineated as 21 private through use of a permission requirement of some sort.” Id. at 1197. Thus, for a 22 website to fall under CFAA protections, it must have erected “limitations on access.” Id. 23 at 1199. And if “anyone with a browser” could access the website, it had no limitations on 24 access. 25 This is a close call. Plaintiff acknowledges that the portion of the Google Drive 26 accessed by Amanda was not password protected; Plaintiff had inadvertently enabled the 27 setting that allowed anyone with the URL to access the site. But, Plaintiff alleges that this 28 setting did not per se render the Google Drive public, given that the URL was a string of 1 68 characters. What’s more, the Google Drive was not indexed by any search engines, 2 unlike the website in hiQ. Therefore, it wasn’t just “anyone with a browser” who could 3 stumble upon the Google Drive on a web search—the internet denizen wishing to access 4 the Google Drive needed to obtain the exact URL into the browser. By the Court’s eye, 5 Plaintiff alleges that the Google Drive had limitations and thus persons attempting to access 6 it needed authorization. 7 Plaintiff alleges that the disclosure of the URL—the limitation—did not grant 8 Amanda authorization to access the Google Drive. He asserts that the disclosure was 9 inadvertent. As the Ninth Circuit has recognized, inadvertent disclosure of the means 10 around a limitation on access does not per se grant authorization. See Theofel v. Farey 11 Jones, 359 F.3d 1066, 1074, 1078 (9th Cir. 2004). Plaintiff has sufficiently plead the 12 elements of a violation of 18 U.S.C. § 1030(a)(2). 13 Defendants next argue that Plaintiff’s allegations of $5,000 in damages are too 14 conclusory to state a claim. Not so.
Free access — add to your briefcase to read the full text and ask questions with AI
1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA
9 Mark Alan Greenburg, No. CV-22-00122-PHX-DLR
10 Plaintiff, ORDER
11 v.
12 Amanda Wray, et al.,
13 Defendants. 14 15 16 Pending before the Court is Defendants Amanda Wray and Daniel Wray’s motion 17 to dismiss Plaintiff Mark Greenburg’s first amended complaint for failure to state a claim. 18 (Doc. 15, 16, 17.) For the following reasons, the Court denies the motion. 19 I. Background 20 Amanda Wray manages a 2,000-member Facebook group (the “Facebook Group”) 21 “dedicated to propagating anti-mask policies, anti-vaccine policies, anti-LGBTQ policies, 22 and anti-Critical Race Theory policies within the Scottsdale Unified School District.” 23 Daniel Wray is a member of the group. Plaintiff’s son serves on the Scottsdale Unified 24 No. 48 Governing Board, the elected governing body that manages Scottsdale Unified No. 25 48 School District (the “District”). (Doc. 9 at 3-4.) 26 In response to activities by Defendants and the Facebook Group, Plaintiff began 27 collecting information on them, including photographs, video footage, discussions with 28 third parties concerning them, personal comments and thoughts, and political memes. 1 Plaintiff stored these records on his personal “Google Drive” server. Plaintiff specifically 2 shared server access with three individuals (including Plaintiff’s son), who could access 3 the server by signing into their own password-protected Google accounts. Although 4 Plaintiff didn’t realize it at the time, the sharing settings on his Google Drive also allowed 5 anyone to access the server by typing in the exact URL. (Doc. 9 at 4-6.) 6 In 2021, Plaintiff’s son was accused of defamation. He responded to his accuser by 7 emailing “13 photographs of public Facebook comments, made by his accuser, some of 8 which were stored on the server.” One of the photographs displayed the URL to the Google 9 Drive, and that photograph made its way into Amanda’s possession, where she noticed the 10 URL and asked a third party to make a hyperlink for the URL. Once provided, she clicked 11 on it to access the Google Drive. She reviewed, downloaded, deleted, added, reorganized, 12 renamed, and publicly disclosed contents of the Google Drive. (Doc. 9 at 6-8.) 13 Plaintiff learned of the access and hired a forensic IT consultant team to conduct a 14 damage assessment. He then sued Defendants under the Computer Fraud and Abuse Act 15 (“CFAA”), 18 U.S.C.(a)(2), alleging a loss of at least $5,000. (Doc. 9 at 8.) 16 II. Analysis 17 To survive a Rule 12(b)(6) motion to dismiss, a complaint must contain factual 18 allegations sufficient to “raise a right to relief above the speculative level.” Bell Atl. Corp. 19 v. Twombly, 550 U.S. 544, 555 (2007). The task when ruling on a motion to dismiss “is to 20 evaluate whether the claims alleged [plausibly] can be asserted as a matter of law.” Adams 21 v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004); accord Ashcroft v. Iqbal, 556 U.S. 662, 22 678 (2009). When analyzing the sufficiency of a complaint, the well-pled factual 23 allegations are taken as true and construed in the light most favorable to the plaintiff. 24 Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). However, legal conclusions 25 couched as factual allegations are not entitled to the assumption of truth, Iqbal, 556 U.S. 26 at 680, and therefore are insufficient to defeat a motion to dismiss for failure to state a 27 claim, In re Cutera Sec. Litig., 610 F.3d 1103, 1108 (9th Cir. 2008). 28 1 To “bring an action successfully under 18 U.S.C. § 1030(g) based on a violation of 2 18 U.S.C. § 1030(a)(2),” Plaintiff must allege that Defendants: 3 (1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that he 4 (3) thereby obtained information (4) from any protected computer (if the conduct involved an interstate or foreign 5 communication), and that (5) there was loss to one or more persons during any one-year period aggregating at 6 least $5,000 in value. 7 LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). Defendants argue 8 that Plaintiff has not pled the second and fifth elements. 9 Citing hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), Defendants 10 argue that Plaintiff did not allege that Amanda accessed the Google Drive without 11 authorization. (Doc. 15.) In hiQ, a data analytics company, hiQ, was scraping data on 12 public LinkedIn profiles, data indexed by search engines. Id. at 1186-87. LinkedIn found 13 out, sent hiQ a cease-and desist-letter, and imposed technical measures to prevent scraping 14 data from public profile. Id. at 1187. But hiQ didn’t stop and instead sought a declaratory 15 judgment that LinkedIn “could not lawfully invoke the CFAA” against it for scraping the 16 data found on public LinkedIn profiles. Id. Ultimately, the Ninth Circuit determined that 17 hiQ’s data scraping did not fall within the CFAA because “anyone with a web browser” 18 could access the data. 19 On review, the Ninth Circuit reasoned that “the prohibition on unauthorized access 20 is properly understood to apply only to private information—information delineated as 21 private through use of a permission requirement of some sort.” Id. at 1197. Thus, for a 22 website to fall under CFAA protections, it must have erected “limitations on access.” Id. 23 at 1199. And if “anyone with a browser” could access the website, it had no limitations on 24 access. 25 This is a close call. Plaintiff acknowledges that the portion of the Google Drive 26 accessed by Amanda was not password protected; Plaintiff had inadvertently enabled the 27 setting that allowed anyone with the URL to access the site. But, Plaintiff alleges that this 28 setting did not per se render the Google Drive public, given that the URL was a string of 1 68 characters. What’s more, the Google Drive was not indexed by any search engines, 2 unlike the website in hiQ. Therefore, it wasn’t just “anyone with a browser” who could 3 stumble upon the Google Drive on a web search—the internet denizen wishing to access 4 the Google Drive needed to obtain the exact URL into the browser. By the Court’s eye, 5 Plaintiff alleges that the Google Drive had limitations and thus persons attempting to access 6 it needed authorization. 7 Plaintiff alleges that the disclosure of the URL—the limitation—did not grant 8 Amanda authorization to access the Google Drive. He asserts that the disclosure was 9 inadvertent. As the Ninth Circuit has recognized, inadvertent disclosure of the means 10 around a limitation on access does not per se grant authorization. See Theofel v. Farey 11 Jones, 359 F.3d 1066, 1074, 1078 (9th Cir. 2004). Plaintiff has sufficiently plead the 12 elements of a violation of 18 U.S.C. § 1030(a)(2). 13 Defendants next argue that Plaintiff’s allegations of $5,000 in damages are too 14 conclusory to state a claim. Not so. Plaintiff alleges that Amanda accessed the Google 15 Drive without authorization, causing changes to the files saved there, and that he had to 16 hire a forensic IT team to determine the scope of the damage, all of which he alleges cost 17 at least $5,000. (Doc. 9 at 7-8.) Plaintiff is not obligated to provide itemized receipts at 18 the pleading stage. 19 Finally, Defendants argue that because the complaint includes no allegation that 20 Daniel accessed Plaintiff’s computer, he must be dismissed as a defendant. Plaintiff 21 maintains that if Amanda is liable under the CFAA, Daniel must be joined so that any 22 resulting judgment may be collected from the marital community. See A.R.S. § 25-215; 23 Spudnuts, Inc. v. Lane, 676 P.2d 669, 670 (Ariz. Ct. App. 1984) (“[I]f a plaintiff wants to 24 hold a marital community accountable for an obligation, both spouses must be sued jointly. 25 A judgment against one spouse does not bind the community.”). In reply, Defendants offer 26 no reason why Daniel’s joinder on this basis is improper. The Court notes, however, that 27 Plaintiff’s first amended complaint and response both are bereft of any argument or 28 allegation that Daniel accessed the Google Drive. Thus, the Court understands that Daniel is named solely for purposes of collecting any potential judgment from the marital || community. 3 Finally, Plaintiff asks the Court to strike portions of the motion to dismiss that 4|| contain matters outside the pleadings or else convert the motion to dismiss to a motion for 5 || summary judgment. Even if the matters fell outside the pleadings, they have no bearing □□ on the Court’s analysis here, and so the Court declines to grant Plaintiffs requested relief. 7 IT IS ORDERED that Defendants’ motion to dismiss (Doc. 15) is DENIED. 8 IT IS FURTHER ORDERED setting this matter for a Rule 16 scheduling conference on Thursday, July 7, 2022, at 11:00 a.m. The Court anticipates this hearing || will be held telephonically. The parties will be provided with call-in information via 11 || separate email. If the parties wish to submit a revised proposed discovery plan, the revised 12 || discovery plan shall be filed no later than June 30, 2022. 13 Dated this 16th day of June, 2022. 14 15 16 {Z, 17 _- Ch 18 Uatted States Dictric Judge 19 20 21 22 23 24 25 26 27 28
_5-