1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA
9 Mark Alan Greenburg, No. CV-22-00122-PHX-DLR
10 Plaintiff, ORDER
11 v.
12 Amanda Wray, et al.,
13 Defendants. 14 15 Before the Court is a motion to dismiss Plaintiff Mark Greenburg’s second amended 16 complaint (“SAC”) for failure to state a claim, brought by Defendants Amanda Wray, 17 Daniel Wray, Edmond Richard, Kimberly Stafford, John Stafford, Lindsay Alvey, and 18 Taylor Alvey. (Doc. 73.) For reasons explained below, the motion will be granted in part 19 and denied in part.1 20 I. Background 21 Amanda manages a 2,000-member Facebook group called “SUSD-CAN,” where 22 she posts anti-mask, anti-vaccine, anti-LGTBQ, and anti-Critical Race Theory policies 23 concerning Scottsdale Unified School District (“SUSD”). (Doc. 61 at 5.) Kimberly, 24 Edmond, and Lindsay are members of Amanda’s group. (Id. at 6-8.) The remaining 25 defendants are spouses named to bind their respective marital communities. (Id.) 26 1 Because of the nature of the issues presented, the Court finds that oral argument is 27 not necessary or useful. Accordingly, the request for oral argument is denied. See Mahon v. Credit Bur. of Placer County, Inc., 171 F.3d 1197, 1200 (9th Cir. 1999); Vasquez v. City 28 of Phoenix, Nos. CV-04-481-PHX-DGC, CV-05-608-PHX-DGC, 2006 WL 1147716, at *1 n. 1 (D. Ariz. May 1, 2006). 1 Greenburg resides in Scottsdale, and during the relevant time his son was a SUSD 2 board member. (Id. at 4.) Prior to this lawsuit, Greenburg collected records on Defendants, 3 including photographs, video footage, background checks, and social media posts, along 4 with Greenburg’s own political and private commentary. (Id. at 8-9.) Greenburg housed 5 the documents in his personal Google Drive in a folder called “CAN Folder,” to which he 6 shared access with three other individuals, including his son. (Id.) 7 In 2021, Kimberly accused Greenburg’s son of defamation. (Id. at 10.) His son 8 responded via email with 13 screenshots stored in the CAN Folder. (Id.) However, 9 unknown to Greenburg’s son, the folder’s unique, 68-charcter uniform resource locator 10 (“URL”) was visible in a photograph. (Id. at 10-11.) Greenburg was further unaware of a 11 setting which enabled third parties to access the folder by re-typing the URL into an internet 12 browser. (Id. at 10.) Prior to the inadvertent disclosure, Greenburg and three others 13 accessed the folder by logging into their password-protected Google accounts, and the URL 14 was otherwise not searchable or guessable. (Id. at 9-10.) 15 Defendants accessed the folder by creating a hyperlink from the URL disclosed to 16 Kimberly. (Id. at 6.) They downloaded, deleted, added, re-organized, and publicly 17 disclosed the CAN Folder’s contents to the media. (Id. at 13.) Greenburg then hired a 18 forensic IT consultant to assess damage and sued Defendants under the Computer Fraud 19 and Abuse Act (“CFAA”), 18 U.S.C. § 1030(a)(2). (Id. at 14-15.) Defendants now move 20 to dismiss Greenburg’s SAC. (Doc. 73.) 21 II. Legal Standard 22 When analyzing a complaint for failure to state a claim to relief under Rule 12(b)(6), 23 the Court accepts well-pled factual allegations as true and construes them most favorably 24 to the nonmoving party. Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). 25 However, the Court does not accept conclusions couched as factual allegations. Ashcroft 26 v. Iqbal, 556 U.S. 662, 679 (2009). Thus, to avoid dismissal, the complaint must plead 27 sufficient facts to state a claim to relief that is plausible on its face. Bell Atl. Corp. v. 28 Twombly, 550 U.S. 544, 570 (2007). 1 III. Discussion 2 A. CFAA Claim 3 Count I alleges Defendants accessed Greenburg’s Google Drive without 4 authorization in violation of the CFAA. (Doc. 61 at 15.) To bring an action under § 5 1030(a)(2), Greenburg must allege that Defendants: (1) intentionally accessed a computer, 6 (2) without authorization or exceeding authorized access, (3) thereby obtaining 7 information, (4) from any protected computer, and that (5) there was loss to one or more 8 persons during a one-year period aggregating at least $5,000 in value. LVRC Holdings 9 LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). Defendants argue that Greenburg 10 failed to plead the second element. (Doc. 73 at 7.) 11 This is not the first time Defendants have raised this argument or that the Court has 12 considered it. Greenburg’s first amended complaint (“FAC”) accused a sub-set of 13 Defendants of violating this provision, and those Defendants moved to dismiss for reasons 14 similar to those now argued. (Docs. 9, 15.) Following full briefing, oral argument, and 15 thorough consideration, the Court denied the motion. (Doc. 38.) In its order, the Court 16 acknowledged that whether Greenburg had adequately pled the “without authorization” 17 element was a “close call,” but the Court resolved it in Greenburg’s favor given the motion 18 to dismiss standard and the Court’s analysis of the leading Ninth Circuit case on the issue, 19 hiQ Labs Inc., v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022). (Id. at 3.) The Court 20 concluded that Greenburg’s Google Drive was not accessible to anyone with a web browser 21 because it generally was accessible only by four people through password-protected 22 accounts, and the 68-character URL Defendants used to gain access was non-guessable and 23 non-searchable. The Court further reasoned that the inadvertent disclosure of the URL did 24 not per se grant authorization. See Theofel v. Farey-Jones, 359 F.3d 1066, 1074 (9th Cir. 25 2004). 26 Greenburg then filed the SAC, naming additional defendants, bringing additional 27 claims, and adding new factual allegations. Defendants insist their latest motion to dismiss 28 is not an untimely motion for reconsideration of the Court’s prior ruling, but rather that the 1 additional factual allegations in the SAC and some cases not previously presented to the 2 Court should lead the Court to resolve the close call in their favor this time around. (Doc. 3 73 at 8-10.) The Court disagrees, addressing both arguments in turn. 4 1. Additional Allegations 5 The additional factual allegations in the SAC, namely that Defendants accessed the 6 CAN Folder only and not Greenburg’s entire Google Drive, do not materially alter the 7 Court’s analysis. (Doc. 61 at 10.) Here, the parties dispute whether Defendants accessed 8 Greenburg’s Google Drive without authorization. (Doc. 73 at 7.) This is not a case in 9 which some access indisputably was granted and the dispute centers on whether the 10 defendant exceeded the scope of that access. The Court therefore is unpersuaded by 11 Defendants argument that accessing a singular folder, rather than the entire Google Drive, 12 paints a “markedly different picture.” (Id. at 9.) 13 Defendants also highlight that there was more than one point of entry according to 14 the SAC, which indicates that sub-folders within the CAN Folder also have URLs that 15 would grant one access to the CAN Folder.
Free access — add to your briefcase to read the full text and ask questions with AI
1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA
9 Mark Alan Greenburg, No. CV-22-00122-PHX-DLR
10 Plaintiff, ORDER
11 v.
12 Amanda Wray, et al.,
13 Defendants. 14 15 Before the Court is a motion to dismiss Plaintiff Mark Greenburg’s second amended 16 complaint (“SAC”) for failure to state a claim, brought by Defendants Amanda Wray, 17 Daniel Wray, Edmond Richard, Kimberly Stafford, John Stafford, Lindsay Alvey, and 18 Taylor Alvey. (Doc. 73.) For reasons explained below, the motion will be granted in part 19 and denied in part.1 20 I. Background 21 Amanda manages a 2,000-member Facebook group called “SUSD-CAN,” where 22 she posts anti-mask, anti-vaccine, anti-LGTBQ, and anti-Critical Race Theory policies 23 concerning Scottsdale Unified School District (“SUSD”). (Doc. 61 at 5.) Kimberly, 24 Edmond, and Lindsay are members of Amanda’s group. (Id. at 6-8.) The remaining 25 defendants are spouses named to bind their respective marital communities. (Id.) 26 1 Because of the nature of the issues presented, the Court finds that oral argument is 27 not necessary or useful. Accordingly, the request for oral argument is denied. See Mahon v. Credit Bur. of Placer County, Inc., 171 F.3d 1197, 1200 (9th Cir. 1999); Vasquez v. City 28 of Phoenix, Nos. CV-04-481-PHX-DGC, CV-05-608-PHX-DGC, 2006 WL 1147716, at *1 n. 1 (D. Ariz. May 1, 2006). 1 Greenburg resides in Scottsdale, and during the relevant time his son was a SUSD 2 board member. (Id. at 4.) Prior to this lawsuit, Greenburg collected records on Defendants, 3 including photographs, video footage, background checks, and social media posts, along 4 with Greenburg’s own political and private commentary. (Id. at 8-9.) Greenburg housed 5 the documents in his personal Google Drive in a folder called “CAN Folder,” to which he 6 shared access with three other individuals, including his son. (Id.) 7 In 2021, Kimberly accused Greenburg’s son of defamation. (Id. at 10.) His son 8 responded via email with 13 screenshots stored in the CAN Folder. (Id.) However, 9 unknown to Greenburg’s son, the folder’s unique, 68-charcter uniform resource locator 10 (“URL”) was visible in a photograph. (Id. at 10-11.) Greenburg was further unaware of a 11 setting which enabled third parties to access the folder by re-typing the URL into an internet 12 browser. (Id. at 10.) Prior to the inadvertent disclosure, Greenburg and three others 13 accessed the folder by logging into their password-protected Google accounts, and the URL 14 was otherwise not searchable or guessable. (Id. at 9-10.) 15 Defendants accessed the folder by creating a hyperlink from the URL disclosed to 16 Kimberly. (Id. at 6.) They downloaded, deleted, added, re-organized, and publicly 17 disclosed the CAN Folder’s contents to the media. (Id. at 13.) Greenburg then hired a 18 forensic IT consultant to assess damage and sued Defendants under the Computer Fraud 19 and Abuse Act (“CFAA”), 18 U.S.C. § 1030(a)(2). (Id. at 14-15.) Defendants now move 20 to dismiss Greenburg’s SAC. (Doc. 73.) 21 II. Legal Standard 22 When analyzing a complaint for failure to state a claim to relief under Rule 12(b)(6), 23 the Court accepts well-pled factual allegations as true and construes them most favorably 24 to the nonmoving party. Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). 25 However, the Court does not accept conclusions couched as factual allegations. Ashcroft 26 v. Iqbal, 556 U.S. 662, 679 (2009). Thus, to avoid dismissal, the complaint must plead 27 sufficient facts to state a claim to relief that is plausible on its face. Bell Atl. Corp. v. 28 Twombly, 550 U.S. 544, 570 (2007). 1 III. Discussion 2 A. CFAA Claim 3 Count I alleges Defendants accessed Greenburg’s Google Drive without 4 authorization in violation of the CFAA. (Doc. 61 at 15.) To bring an action under § 5 1030(a)(2), Greenburg must allege that Defendants: (1) intentionally accessed a computer, 6 (2) without authorization or exceeding authorized access, (3) thereby obtaining 7 information, (4) from any protected computer, and that (5) there was loss to one or more 8 persons during a one-year period aggregating at least $5,000 in value. LVRC Holdings 9 LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). Defendants argue that Greenburg 10 failed to plead the second element. (Doc. 73 at 7.) 11 This is not the first time Defendants have raised this argument or that the Court has 12 considered it. Greenburg’s first amended complaint (“FAC”) accused a sub-set of 13 Defendants of violating this provision, and those Defendants moved to dismiss for reasons 14 similar to those now argued. (Docs. 9, 15.) Following full briefing, oral argument, and 15 thorough consideration, the Court denied the motion. (Doc. 38.) In its order, the Court 16 acknowledged that whether Greenburg had adequately pled the “without authorization” 17 element was a “close call,” but the Court resolved it in Greenburg’s favor given the motion 18 to dismiss standard and the Court’s analysis of the leading Ninth Circuit case on the issue, 19 hiQ Labs Inc., v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022). (Id. at 3.) The Court 20 concluded that Greenburg’s Google Drive was not accessible to anyone with a web browser 21 because it generally was accessible only by four people through password-protected 22 accounts, and the 68-character URL Defendants used to gain access was non-guessable and 23 non-searchable. The Court further reasoned that the inadvertent disclosure of the URL did 24 not per se grant authorization. See Theofel v. Farey-Jones, 359 F.3d 1066, 1074 (9th Cir. 25 2004). 26 Greenburg then filed the SAC, naming additional defendants, bringing additional 27 claims, and adding new factual allegations. Defendants insist their latest motion to dismiss 28 is not an untimely motion for reconsideration of the Court’s prior ruling, but rather that the 1 additional factual allegations in the SAC and some cases not previously presented to the 2 Court should lead the Court to resolve the close call in their favor this time around. (Doc. 3 73 at 8-10.) The Court disagrees, addressing both arguments in turn. 4 1. Additional Allegations 5 The additional factual allegations in the SAC, namely that Defendants accessed the 6 CAN Folder only and not Greenburg’s entire Google Drive, do not materially alter the 7 Court’s analysis. (Doc. 61 at 10.) Here, the parties dispute whether Defendants accessed 8 Greenburg’s Google Drive without authorization. (Doc. 73 at 7.) This is not a case in 9 which some access indisputably was granted and the dispute centers on whether the 10 defendant exceeded the scope of that access. The Court therefore is unpersuaded by 11 Defendants argument that accessing a singular folder, rather than the entire Google Drive, 12 paints a “markedly different picture.” (Id. at 9.) 13 Defendants also highlight that there was more than one point of entry according to 14 the SAC, which indicates that sub-folders within the CAN Folder also have URLs that 15 would grant one access to the CAN Folder. (Id.) Although the Court acknowledges there 16 was no traditional barrier to prevent Defendants’ access, such as a password requirement, 17 the bottom line is that Defendants accessed the CAN Folder via an inadvertently disclosed, 18 68-character, non-guessable and non-searchable URL, and but for the inadvertent 19 disclosure would not have been able to access it. The Court again recognizes that this issue 20 is a close call. But Defendants have not persuaded the Court that the added detail in the 21 SAC materially changes the analysis. 22 2. New Authority 23 The additional cases cited by Defendants do not persuade the Court to change 24 course. Salinas v. Cornwell Quality Tools Co., supports Defendants’ position that a 25 person’s intent to restrict access cannot support CFAA liability if the person does not also 26 erect gates to protect privacy, but the court in that case addressed the issue in a different 27 procedural posture. No. 5:19-cv-02275-FLA (SPx), 2022 WL 3130875, at *1, 9 (C.D. Cal. 28 June 10, 2022). The issue arose in the context of a motion for reconsideration of an order 1 denying a motion for sanctions. The court was not applying the plausibility standard 2 governing motions to dismiss. In contrast to the fact-finding role performed by the court 3 in Salinas, this Court must accept all factual allegations in the SAC as true and draw all 4 reasonable inferences in Greenburg’s favor. The Court is not persuaded that the analysis 5 in Salinas requires dismissal of Greenburg’s CFAA claim. 6 Nor does Ryanair DAC v. Booking Holdings Inc., No. 20-1191-WCB, 2022 WL 7 13946243 (D. Del. Oct. 24, 2022), help Defendants. There, the court found that resolution 8 of whether the plaintiff sufficiently protected its website from unwanted incursions was 9 improperly decided at the motion to dismiss stage because it depended on forthcoming 10 facts developed in litigation. Id. at *12. The Court shares that view here. Greenburg’s 11 SAC contains sufficient factual allegations to make it at least plausible that Defendants 12 accessed the CAN Folder without authorization. At the motion to dismiss stage, the Court 13 screens for wholly implausible claims, not for weak ones, mindful that a complaint need 14 not contain every conceivable fact that might bear on a question. So long as the claim is 15 plausible, the parties may proceed to discovery, where further factual development will 16 either strengthen or weaken Greenburg’s case. The Court remains unconvinced that 17 dismissal is warranted. 18 B. Civil Conspiracy and Aiding and Abetting Claims 19 Count II alleges that Defendants conspired to violate the CFAA. (Doc. 61 at 16.) 20 Under Arizona law, civil conspiracy is not an independent tort, but requires “an underlying 21 tort which the conspirators agreed to commit.” Health Indus. Bus. Commc’ns Council Inc. 22 v. Animal Health Inst., 481 F. Supp. 3d 941, 959 (D. Ariz. 2020). Thus, to plausibly plead 23 civil conspiracy, Greenburg must allege that Defendants “agreed to accomplish an 24 unlawful purpose or a lawful purpose by unlawful means, and accomplish the underlying 25 tort, which in turn caused damages.” In re Bill Johnson’s Restaurants, Inc., 255 F. Supp. 26 3d 927, 937 (D. Ariz. 2017) (internal quotation and citation omitted). 27 Count III alleges that Kimberly, Amanda, and Edmond provided substantial 28 assistance in accessing the CAN Folder without authorization, thus aiding, and abetting || one another. (Doc. 61 at 16-19.) Under Arizona law, a claim for aiding and abetting has 2|| three elements: “(1) the primary tortfeasor must commit a tort that causes injury to the || plaintiff; (2) the defendant must know the primary tortfeasor's conduct constitutes a breach 4|| of duty; and (3) the defendant must substantially assist or encourage the primary tortfeasor 5 || in the achievement of the breach.” Merritt v. Arizona, 425 F. Supp. 3d 1201, 1233 (D. 6|| Ariz. 2019). “There must be some distinction between the primary tortfeasor and the aiding 7\| and abetting conduct.” Counts v. Tech. Ins. Co. Inc., No. CV-18-00488-TUC-JAS, 2019 WL 13195132 at *2 (D. Ariz. July 12, 2019). 9 Greenburg failed to plausibly plead civil conspiracy and aiding and abetting claims 10 || under Arizona law because a federal statutory violation is not a tort. See In re Apple Inc. 11 || Device Performance Litig., 347 F. Supp. 3d 434, 453 (N.D. Cal. 2018) (“A CFAA claim is 12 || decidedly not a state-law tort claim but is instead a federal claimed appended to a federal 13 || statute.”); see also BioD LLC vy. Amino Tech., LLC, No. 2:13-CV-1670-HRH, 2014 WL 268644, at *11 (D. Ariz. Jan. 24, 2014) (finding a civil conspiracy claim cannot be based 15 || on allegations that defendants conspired to violate the Lanham Act because a claim under the Lanham Act is not a tort). Greenburg’s argument that a CFAA violation seems to meet || Black’s Law Dictionary’s definition of a tort is unpersuasive in light of case law distinguishing statutory claims from torts. And in any event, this argument does not 19|| salvage Greenburg’s aiding and abetting claim because the SAC fails to distinguish 20 || between the primary tortfeasor and the aiding and abetting conduct. 21 IT IS ORDERED that Defendants’ motion to dismiss (Doc. 73) is GRANTED IN 22 || PART and DENIED IN PART. Counts II and III of the SAC are dismissed but Count I 23 || may proceed. 24 Dated this 20th day of June, 2023. 25 - 26 J _—S □□ ee 27 Do . Rayes 38 United States District Judge
-6-