Hold Security LLC v. Microsoft Inc

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE HOLD SECURITY LLC., a Wisconsin CASE NO. 23-899 Limited Liability Corporation, ORDER GRANTING MOTION TO Plaintiff, DISMISS v. MICROSOFT CORPORATION, a Washington Corporation, This matter comes before the Court on Defendant’s Motion to Dismiss. (Dkt. No. 21.) Having reviewed the Motion, Plaintiff’s Response (Dkt. No. 25), the Reply (Dkt. No. 28), and all other relevant material, the Court GRANTS the Motion. This case arises out of a contract between Plaintiff Hold Security (“Hold”) and Defendant Microsoft for services provided to Microsoft by Hold. Hold brings breach of contract claims and extra-contractual claims based on Microsoft’s alleged misuse of Hold’s services outside the intended use of the contract. Hold is an internet security company that assists corporations in protecting the security of their users’ online accounts against cyberattacks. (AC ¶ 3.2 (Dkt. No. 17); Response at 1.) One of the services Hold provides is the “Credential Integrity Service.” (AC ¶ 3.2.) This involves recovering stolen data, such as account log in information, and then providing the data to the

corporate client who can alert users that their account has been compromised. (Id.) Hold’s pricing model for its services is based on the expected benefit to the clients. (Id. at ¶ 3.3.) Hold factors in how many potential user victims there might be, the type of client, the type of customer the client has, and the type of data being recovered. (Id.) In 2014, Microsoft contacted Hold to obtain services related to recovering stolen account credentials. (AC ¶ 3.5.) Microsoft, through an employee, represented to Hold that it would limit the use of the recovered stolen data “to activities that are designed to prevent or mitigate harm to our customers.” (Id. at ¶ 3.13.) Microsoft assured Hold the data would not be used for any other purpose, and that it would destroy all copies of the data. (Id.) Based on Microsoft’s representations, Microsoft and Hold entered into negotiations “with the explicit and sole

objective of protecting certain Microsoft services, brands, and customers.” (Id. at ¶ 3.20.) Hold understood the protected Microsoft domains, services, and brands would be exclusively business-to-consumer – meaning the data supplied by Hold would only be used for Microsoft customers, not other businesses. (Id. at ¶ 3.2.) Hold specifically excluded business-to-business domains, services, and brands so as not to reduce Hold’s potential customer base. (Id.) Hold and Microsoft signed a contract in 2015, which incorporated a 2014 Non-Disclosure Agreement (“NDA”), a Master Supplier Services Agreement (“MSSA”), and a Statement of Work (“SOW”). Microsoft drafted the MSSA using one of its standard form agreements. (AC ¶ 3.23.) Hold contends that this means the MSSA contains terms and provisions that are not

applicable to its agreement with Microsoft. (Id.) Though Hold is silent as to who drafted the SOW, the language indicates both parties had a hand in drafting it. (See AC ¶ 3.24 (“Microsoft and Hold executed a Statement of Work . . . The parties agreed . . .”) The following are the relevant contract provisions that the Court required for its analysis:

The NDA The NDA provides in the pertinent part: [The parties] will not disclose the other’s confidential information to third parties; and [the parties] will use and disclose the other’s confidential information only for purposes of our business relationship with each other.

NDA Section 3(a). (Declaration of Jacob Thornburg ISO MTD, Exhibit A, NDA at 2 (Dkt. No. 22).) The MSSA The MSSA provides: Section 1 - Definitions (c): “Deliverables means all IP or other work product developed by Supplier (or a Subcontractor of Supplier for Microsoft under a SOW or as part of the Services; Section 3 – Ownership and use of the parties’ respective IP (e)(1): Ownership of IP Rights in Deliverables. All Deliverables are “work made for hire” for Microsoft under applicable copyright law . . . To the extent any Deliverables do not qualify as work made for hire, Supplier assigns all right, title, and interest in and to the Deliverables, including all IP rights, to Microsoft. Supplier waives, and agrees not to assert, any moral rights that may exist in the Deliverables. (Thornburg Decl. Ex. B.) The SOW The SOW provides: Section 3 – Description of Services and Delivery Schedule (b): Services. Microsoft has asked Supplier to deliver compromised “Account Credential Data” that have been recovered by the Supplier from sites on the Internet in order to reveal and protect against threats to services, brands and domains owned by Microsoft. “Account Credential

Data” are defined as lists of pairs of user id and password where user id is in form of a valid e- mail address [RFC 2822] only and password is non-blank. Supplier will conduct an extensive search of its data sources to provide Microsoft all currently held Account Credential Data as a one-time deliverable as a ‘catch-up’ . . . Per the line item details below, Supplier will provide compromised Account Credential Data on a daily basis: 1) Supplier will be collecting compromised accounts from sites on the Internet; the methods of which are proprietary to the Supplier. Supplier’s proprietary methods for gathering Account Credential Data from sites on the Internet shall not be considered Supplier IP incorporated into the Deliverables.

Compromised Account Credential Data will be used to check against Microsoft’s own services, brands and domains in order to protect Microsoft customers. The reason for including third-party account credential data is that Microsoft customers are able to use third-party user credentials (e.g., john@contoso.com) on Microsoft brands and services. All services shall be treated as Microsoft Confidential Information unless otherwise designated by Microsoft. Details - Supplier will on a daily basis collect and deliver to Microsoft compromised Account Credential Data for the following domains (The asterisk ‘*’ indicates matching of any

and all characters; e.g., hotmail.* would match for hotmail.com, hotmail.co.uk, hotmail.fr and many others): • microsoft.* • bing.* • hotmail.* • office365.* • live.* • office.* • outlook.* • legallery.* • msn.* • microsoftstore.com • passport.* • onmicrosoft.com • windowslive.* • microsoftonline.com • msncs.com • onmschina.cn • skype.* • *.TLD (third-party login • nokia.* credentials, e.g., ‘contoso.com’) • xbox.* The SOW also provides a payment and delivery schedule, which outlines the dates by which Hold must deliver all services to Microsoft and what Microsoft will pay in return. (SOW Sections 4, 5.) (Thornburg Decl. Ex. C.) The Lawsuit The parties performed pursuant to the contract from 2015 until 2020. (AC ¶ 3.31.) In 2020, Hold discovered Microsoft was using the data in a matter it believed to be outside the scope of the contract in the following three ways: First, Microsoft allegedly employed an updated version of its Active Directory Federation Service (“AD FS”) “enabling federated identity and access management.” (AC ¶ 3.32.) Hold alleges Microsoft used the data provided by Hold in order to create the AD FS. (Id.) Though Hold provides no information on what the AD FS is or how it works, it claims the AD FS does not protect Microsoft customers per se, but instead, is a business to business authentication service that directly competes with Hold. (Id.) Hold claims Microsoft breached the contract when it developed the AD FS because it uses the data outside the scope of the contract. (Response at 6.) Second, Microsoft allowed third parties to use the data through Microsoft’s web browser Edge. (AC ¶ 3.40.) The intent behind Edge is to protect the internet as a whole, therefore when

someone logs into any online account using Edge the data is used to confirm the log in credentials. (Id.; Response at 6.) This application of the data applies regardless of whether the account is for a Microsoft owned domain or not. (Response at 6.) Hold claims Microsoft breached the contract when it implemented this service into Edge, because it goes beyond the scope of protecting Microsoft customers. (Id.) Third, Microsoft acquired LinkedIn and GitHub after the parties entered into the contract, and Microsoft used the data in its administration of these newly acquired domains. (AC ¶¶ 3.33- 3.34.) Hold argues that the list of domains contained in Section 3(b) “Details” limits the domains that Microsoft may use the data for. (Response at 5.) Hold claims Microsoft breached the contract when it began using the data for LinkedIn and GitHub. (Id.)

Hold then brought this action seeking damages for Microsoft’s alleged breach of contract. Hold contends Microsoft breached the contract by using the data outside the scope, and breached the NDA for using the data beyond the two parties’ business relationship. Microsoft brings this Motion to Dismiss arguing that the unambiguous language of the contract directly contradicts Hold’s allegations. A. Legal Standard Under Fed. R. Civ. P. 12(b)(6), a court may dismiss a complaint for “failure to state a claim upon which relief can be granted.” Dismissal is appropriate only where a complaint fails to

allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is plausible on its face “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The court must accept

all facts alleged in the complaint as true and make all inferences in the light most favorable to the non-moving party. In re Fitness Holdings, Int’l, Inc., 714 F.3d 1141, 1144-45 (9th Cir. 2013). But “conclusory allegations of law and unwarranted inferences will not defeat an otherwise proper motion to dismiss.” Vasquez v. Los Angeles Cnty., 487 F.3d 1246, 1249 (9th Cir. 2007). B. Breach of Contract Claims Contract interpretation is generally a question of law for the Court. Berg v. Hudesman, 115 Wn.2d 657, 663 (1990). Under Washington law, courts follow the “objective manifestation” theory of contracts. Hearst Commc’ns, Inc. v. Seattle Times Co., 154 Wn.2d 493, 503 (2005). This requires courts to “determine the parties’ intent by focusing on the objective manifestations of the agreement, rather than on the unexpressed subjective intent of the parties. Id. (internal

citation omitted). Thus, when interpreting contracts, courts should “generally give words in a contract their ordinary, usual, and popular meaning unless the entirety of the agreement clearly demonstrates a contrary intent.” Id. at 504. If the language of a contract is clear and unambiguous, the Court must “enforce the contract as written; it may not modify the contract or create ambiguity where none exists.” Lehrer v. State Dep’t of Social & Health Servs., 101 Wn. App. 509, 515 (2000). “Language is ambiguous if, on its face, it is fairly susceptible to more than one reasonable interpretation.” Mendoza v. Rivera-Chavez, 88 Wn. App. 261, 268 (1997). “[A]mbiguous contract language is strictly construed against the drafter.” Jones Assocs., Inc. v. Eastside Props., Inc., 41 Wn. App. 462, 468 (1985).

All of Hold’s arguments rely on extrinsic evidence to show the unexpressed intent of the parties and to modify the contract. Because the contract is clear and unambiguous, Hold’s arguments fail. 1. Breach of the MSSA and SOW

The crux of Hold’s breach of contract claims is that Microsoft used the Account Credential Data outside the scope of the contract in two ways: (1) through its development of AD FS and Microsoft Edge; and (2) its use of the data for LinkedIn and GitHub. The Court finds the Amended Complaint fails to allege sufficient facts that, taken as true, violate the contract. a. Development of AD FS and Microsoft Edge Hold’s first allegations of breach pertains to Microsoft’s use of the account data for the development of AD FS and Microsoft Edge. (Response at 10.) The Court finds this claim fails because Hold does not allege sufficient facts to state a claim for relief. Hold’s argument regarding Microsoft’s use of the data for the development of AD FS and Microsoft Edge is unconvincing because it fails to explain how the use of the data in this way

violates the contract. Hold argues Section 3(b) of the SOW limits Microsoft’s use of the data exclusively to protecting Microsoft customers. (Response at 10.) Section 3(b) states the data “will be used to check against Microsoft’s own services, brands and domains to protect Microsoft customers.” Hold claims that Microsoft retained “unmatched data” – that is stolen login credentials that do not “match” the login credentials of any account maintained by Microsoft – to create and operate AD FS and Edge. (Id. at 10-11.) The insinuation of this is that there is not a Microsoft customer to protect because the data does not “match” an existing account. But the Amended Complaint fails to explain what AD FS is, let alone how it works and how it benefits non-Microsoft customers. Instead, the Court is left to assume what Hold means

and make inferential leaps that it is not required to make. All the Complaint alleges is Microsoft’s development of AD FS benefited Microsoft itself and created a business-to-business authentication service that competes with Hold. (AC ¶ 3.32.) It is unclear how a business-to- business service does not protect Microsoft customers as required by section 3(b). A business-to- business service theoretically still means the businesses using the service are Microsoft

customers. Similarly, Hold’s allegations regarding the use of data for Microsoft Edge is insufficient. All Hold states is that Edge provides protection to the internet as a whole and creates a business- to-business service. Again, this allegation is devoid of sufficient facts to explain how the use of Edge works, how it goes beyond the scope of protecting Microsoft customers and why a business-to-business service violates the agreement. And to the extent that Hold argues Microsoft violated the contract by retaining the “unmatched data,” the Court notes that nowhere in the MSSA or the SOW does it discuss “unmatched data” and what Microsoft may or may not do with it. Rather than relying on the language of the contract, Hold seeks to bring in extrinsic

evidence regarding the negotiations leading up to the formation of the contract. Hold claims the negotiations make clear the data was only to be used for business-to-consumer purposes. (AC ¶ 3.2.) Hold’s argument is unavailing because the contract makes no mention of limiting the data to business-to-consumer. And Hold’s use of extrinsic evidence to demonstrate intention independent of the contract is expressly prohibited under Washington law. Hearst, 154 Wn.2d at 503 (extrinsic evidence is relevant only to determine the meaning of specific words and terms used, not to show an intention independent of the instrument or to vary, contradict or modify the written word). Hold points only to the contract provision that requires Microsoft to use the data

for Microsoft customers, but fails to allege how AD FS and Edge do not protect Microsoft customers. Hold’s argument that there is ambiguity also fails because the contract provision is not ambiguous. Hold argues there is ambiguity in the provision in Section 3(b) that reads:

“Compromised Account Credential Data will be used to check against Microsoft’s own services, brands, and domains in order to protect its customers.” (Response at 12.) (emphasis in original). Hold contends the examination of extrinsic evidence is needed to determine the meaning and intent of this provision. Hold argues this phrase limits Microsoft’s use of the data to checking Microsoft user accounts against the nineteen domains listed in Section 3(b) “Details.” (Id. at 12- 13.) But nothing about this provision is, on its face, ambiguous. And Hold does not argue the term is subject to two interpretations. Rather, Hold’s argument hinges on introducing extrinsic evidence such as emails prior to the contract, its benefits based pricing, and services options to clarify the intent of the parties and thereby limit what Microsoft may do with the data. (See Response at 12-13.) Again, this runs contrary to Washington law, and the provision, on its

face, is not susceptible to multiple interpretations. The Court finds the provision is not ambiguous such that extrinsic evidence is required to clarify its meaning. Hold fails to allege sufficient facts that Microsoft’s use of the data for AD FS and Edge violate the contract. The Court GRANTS Microsoft’s Motion as to Hold’s Breach of Contract claim for AD FS and Edge. b. Microsoft’s use of the data for domains not listed in Section 3(b) “Details” Hold attempts to limit the domains that Microsoft may use the data for to the list of nineteen contained in Section 3(b) “Details,” and argues that because LinkedIn, GitHub, AD FS and Edge are not listed there, the use of the data for these domains violates the contract. This

argument fails because there is no language limiting Microsoft’s use of the data to these domains in the contract. Hold argues Microsoft’s use of the data is limited to the list of domains set forth in Section 3(b) “Details.” (Response at 11.) But a plain reading of the “Details” section does not

appear to limit Microsoft’s use of the data to the nineteen domains listed. Instead, the section provides the list of domains is where Hold should collect account compromised data from – “Supplier will on a daily basis collect and deliver to Microsoft compromised Account Credential Data for the following domains . . .” (SOW Section 3(b) “Details”.) This section outlines Hold’s obligations, specifically which domains it should collect the data from and how frequently. The section is silent as to Microsoft’s obligations. Simply because the section provides parameters for where the data comes from does not mean those parameters apply to Microsoft’s use of the data. Because there is nothing to suggest Microsoft may only use the data to check for compromised accounts on those nineteen domains, the Court finds this argument fails. Hold argues ambiguity exists as to the “Details” provision. (Response at 13.) The Court

disagrees. Hold contends that the list of nineteen domains, when coupled with an explanatory sentence earlier in Section 3(b) that “[t]he reason for including third-party account credential data is that Microsoft customers are able to use third-party user credentials . . . on Microsoft brands and services” limits Microsoft’s use of the data to those domains. (Id.; AC ¶ 3.25.) Hold argues that Microsoft may disagree with it, but that in itself creates an ambiguity. (Response at 13.) The problem with this argument is three-fold. First, a disagreement between the parties on a specific provision does not inherently create an ambiguity. Second, there is no language in the contract that incorporates the “Details” provision into the earlier one. And third, even if the earlier provision incorporates the nineteen domains, there is still no language that limits

Microsoft’s use of the data to those domains. Per the contract, Microsoft was to use the data to check against its own services, brands, and domains. Microsoft’s acquisition of LinkedIn and GitHub, along with its development of AD FS and Edge, are Microsoft’s own services, brands and domains for which the data may be used. The Court finds there is no ambiguity as to the

“Details” provision and that Microsoft is not limited to the nineteen domains listed therein. The Court finds Hold has failed to allege sufficient facts that would give rise to a breach of contract claim with regard to Microsoft’s use of the data outside the list of nineteen domains. The Court GRANTS Microsoft’s Motion as to Hold’s Breach of Contract claim for Microsoft’s use of the data for AD FS, Edge, LinkedIn, and GitHub. c. The term “Deliverable” Hold argues the data provided to Microsoft is not a “Deliverable” as defined in the MSSA, or is at least ambiguous as applied to the data. The Court finds this argument unconvincing. When looking at the MSSA and the SOW as a whole, the term “Deliverable”

incorporates the data provided by Hold. Deliverables in the MSSA is defined as “all IP or other work product developed by Supplier . . . for Microsoft under a SOW or as part of the Services.” (MSSA Section 1(c).) Though the data may not be “developed” by Hold in the traditional sense, Hold searches for specific account data and compiles that data for Microsoft. The searching and accumulation of data is the “Service” that Hold was hired for, and the data is the “Deliverable” produced as part of that Service. This interpretation is also supported by language in Section 3(b) of the SOW, which provides: “Supplier will conduct an extensive search of its data sources to provide Microsoft all currently held Account Credential Data as a one-time deliverable as a ‘catch-up.’” (emphasis added). Section 4 of the SOW also provides a schedule under which Hold

should provide the “Deliverables.” The repeated use of the term “Deliverable” as a synonym for the data suggests the data is in fact a Deliverable. Further, the contract omits Hold’s proprietary methods from being considered a Supplier IP incorporated into the Deliverables. (SOW Section 3(b)(2).) The parties’ exclusion of Hold’s methodology suggests they knew to exclude certain material and could have also excluded the data, but deliberately chose not to.

Hold makes two arguments in response. First, Hold argues the data is not a “deliverable” as defined in the SOW because it is not an IP or work product developed by Hold. (Response at 13.) Hold claims because the data provided to Microsoft is the same data Hold collects and uses in providing security services for all its customers, it is not something that was “developed” for Microsoft. (Id.) Rather, Hold argues it simply provided Microsoft with “access” to the data. (Id. at 13-14.) Hold claims that even if the Court agrees with Microsoft, it must find the term “Deliverable” ambiguous. (Id.) Hold’s argument is unconvincing. Nowhere in the MSSA or SOW does it reference providing Microsoft with “access” to the data. The language of the contract repeatedly states Hold will “deliver” the data to Microsoft or “provide” the data to Microsoft. (SOW Section

3(b).) Similarly, Section 3(b) states that “Supplier will conduct an extensive search. . .” and Supplier will collect compromised accounts on a daily basis. (Id.) This does not suggest that Hold did nothing for Microsoft other than allow it access to already accumulated compromised account data. And the “Details” section specifically provides which domains Hold should collect the data from. This specification contradicts Hold’s argument that this is the same data it collects for all clients. Though the Amended Complaint repeatedly uses the term “access” regarding the account data, neither the MSSA nor the SOW give any indication that Microsoft is only being granted access to the data. Rather, a contextualized reading of the contract indicates the data is a Deliverable as defined in the MSSA. The Court finds the term “Deliverable” is not ambiguous.

Second, Hold argues that its services do not qualify as “work for hire” under copyright law, and the clause granting ownership of the Deliverables produced pursuant to the “work for hire” do not apply to it. This argument fails because the MSSA contains a catch-all provision for the Deliverables. Without needing to determine whether Hold’s services were “work for hire”

under applicable copyright law, the MSSA includes a provision giving Microsoft ownership of the Deliverables even if the work does not qualify as “work for hire.” (MSSA Section 3(e)(1).) (“To the extent any Deliverables do not qualify as work made for hire, Supplier assigned all right, title and interest in and to the Deliverables, including all IP rights to Microsoft.”) Assuming, arguendo, Hold’s services are not “work for hire,” Microsoft would still own the Deliverables given the language contained in Section 3(e)(1). Because Hold fails to explain how the definition “Deliverables” is subject to multiple interpretations, the Court finds “Deliverables” is not ambiguous such that extrinsic evidence is needed. The Court finds Hold’s Breach of Contract claims fail because it does not allege

sufficient facts that would give rise to relief. The Court also finds the contract is not ambiguous and does not require extrinsic evidence to interpret the contract. The Court GRANTS Microsoft’s Motion as to Hold’s Breach of Contract claim. 2. Breach of the NDA Hold alleges Microsoft breached the NDA when it utilized the data to “serve Edge users, new customers from the acquisitions of LinkedIn and GitHub, and through the creation of AD FS.” (AC ¶ 5.7.) The Court finds this argument fails because it ignores unambiguous provisions of the contract.

The NDA prohibits Hold and Microsoft from using the other’s confidential information for purposes other than the business relationship. (NDA Section 3.) The NDA is incorporated into the MSSA in Section 6(a)(1) of the MSSA – something neither party disputes. (MSSA at 9.) Critically, the SOW provides that “[a]ll Services shall be treated as Microsoft Confidential

Information unless otherwise designated by Microsoft.” (SOW Section 3(b).) The SOW defines Hold’s services, in part, as “providing to Microsoft all currently held Account Credential Data as a one-time deliverable,” and thereafter providing daily deliverables. (SOW Section 3(b).) As such, a plain reading of the contract suggests the data is part of the Services provided and is therefore Microsoft’s confidential information, not Hold’s. Hold argues the Services discussed in the SOW only describe the act of providing the data to Microsoft. (Response at 20.) Therefore, the provision of data to Microsoft might qualify as Microsoft Confidential Information, but the data itself does not qualify. (Id.) This argument requires mental gymnastics that run contrary to a more logical reading of the contract. In order to find Hold’s argument persuasive, the Court would have to find the “Services” defined in the

SOW only pertain to Hold’s collection of the data, not the data itself. This interpretation conflicts with a clause in the SOW that specifically disclaims Hold’s proprietary methods for gathering the data from being incorporated into the Deliverables. (SOW Section 3(b)(2).) Hold’s argument therefore asks the Court to find that Hold’s proprietary methods are not owned by Microsoft but are nonetheless Microsoft’s confidential information, while the data provided is not. To hold both to be true would be a bizarre interpretation of the contract. It is more reasonable to find the Services discussed in the SOW, the purpose of which is to deliver the Account Credential Data, includes the data. Bryne v. Ackerlund, 108 Wn.2d 445, 454 (1987) (“Where one construction would make a contract unreasonable, and another, equally consistent with its language, would

make it reasonable, the latter more rational construction must prevail.”) As such, the Court finds Hold’s argument unconvincing. Even assuming the data is not owned by Microsoft or considered Microsoft confidential information under the SOW, Hold still fails to adequately allege how Microsoft’s use of the data

goes beyond the business relationship. Again, Hold argues that Microsoft’s use of the data to serve Edge users, new customers, and for AD FS expands into business-to-business protection, which is outside the scope of agreement. (AC ¶ 5.7.) But as the Court already explained, whether the data was used for business-to-consumer or business-to-business is irrelevant, so long as the data was used to protect Microsoft customers. The Complaint fails to explain how Edge and the AD FS serves non-Microsoft customers. And, again, the list of nineteen domains is not outside the scope of the agreement because that simply describes the domains Hold should accumulate data from. Because Hold fails to allege sufficient facts to demonstrate that Microsoft violated the NDA by using the data for AD FS, Edge, LinkedIn and GitHub, the Court finds this claim fails.

The Court GRANTS Microsoft’s Motion as to the Breach of NDA claim. C. Extra-Contractual Claims 1. Unjust Enrichment Hold brings an unjust enrichment claim against Microsoft alleging that because Microsoft used the data in ways not envisioned by the parties, it has been unjustly enriched. The Court disagrees. Under Washington law, “[u]njust enrichment occurs when one retains money or benefits which in justice and equity belong to another.” Bailie Communications v. Trend Business Sys. 61 Wn. App. 151, 160 (1991). The three elements required for an unjust enrichment claim are (1)

a benefit conferred on one party to another; (2) appreciation and knowledge of the benefit by the party receiving it; and (3) acceptance of the benefit under circumstances that make it inequitable for the receiving party to retain the benefit without paying its value. See, e.g., Dragt v. Dragt/DeTray, LLC, 139 Wn. App. 560, 576 (2007). But unjust enrichment is “the method of

recovery for the value of the benefit retained absent any contractual relationship because notions of fairness and justice require it.” Young v. Young, 164 Wn.2d 477, 484 (2008). A plaintiff who is party to a valid contract may not bring a claim for unjust enrichment for issues arising under the contract’s subject matter. United States ex rel. Walton Tech., Inc. v. Weststar Eng’g, Inc., 290 F.3d 1199, 1204 (9th Cir. 2002) (applying Washington law). Hold alleges the parties intended the data provided to Microsoft to be used to match the account credentials to then-existing Microsoft customers, or specified Microsoft domains. (AC ¶ 6.2.) Microsoft promised to destroy any credentials not matched to customers or domains. (Id. at ¶ 6.4.) Because Microsoft retained the credentials for its own use and benefit, i.e., development of Edge and AD FS, as well as its application for later existing customers, it has been unjustly

enriched. (Id. at ¶¶ 6.7-6.8.) Hold’s allegations fail for three reasons. First, there is an existing contracting, which deals exclusively with the account credential data. Second, Microsoft conferred a benefit to Hold when it paid Hold for delivering the data. (SOW Section 5 – Payment.) Third, the language in the contract says nothing about matching the data to then-existing customers, or what Microsoft would do with any data that did not match existing customers. The contract defines the account credential data as “lists of pairs of user id and password where user id is in form [sic] of a valid e-mail address [RFC-2822] only and password is non-blank.” (SOW Section 3(b).) The contract also states the data would be used “to check against Microsoft’s own services, brands and

domains in order to protect Microsoft customers.” There is no language limiting the duration Microsoft could use the data or what it must do with any unmatched data. As such, the use of the data is defined in a valid contract, and Hold was properly compensated. The Court GRANTS the Motion as to Hold’s Unjust Enrichment claim.

2. Promissory Estoppel Hold’s promissory estoppel claim relates to Microsoft’s use of the unmatched data and its alleged promise not to destroy the data. (AC ¶ 7.2.) Because there is a valid contract that discusses the use of the data, the Court finds this claim fails. Similar to unjust enrichment claims, “the doctrine of promissory estoppel does not apply where a contract governs” the conduct at issue. Spectrum Glass Co., v. Pub. Util., Dist. No. 1 of Snohomish Cnty., 129 Wn. App. 303, 317 (2005). Hold argues that its promissory estoppel claim should not be dismissed because: (1) the use of unmatched data falls outside the scope of the contract, (2) the ambiguous provisions of the contract require extrinsic evidence to determine the meaning of the contract, and (3) if the Court agrees with Microsoft’s interpretation of the

contract, then Microsoft fraudulently induced Hold into signing the agreements, thus voiding the contract. (Response at 22.) Hold’s promissory estoppel claim fails for the same reasons as the unjust enrichment claim. The contract is valid, discusses how Microsoft may use the data, and the contract is not ambiguous. As to whether Microsoft fraudulently induced Hold, this is the first time Hold makes this allegation. And Hold does little more than declare that if the Court agrees with Microsoft, then the contract is the result of fraudulent inducement. This conclusory allegation fails to sway the Court. The Court GRANTS Microsoft’s Motion as to Hold’s Promissory Estoppel claim.

3. Tortious Interference with a Business Expectancy Microsoft moves to dismiss Hold’s tortious interference claim on the grounds that Hold failed to allege sufficient facts that would give to a claim for relief. Hold does not oppose this portion of the motion to dismiss.

Under Local Civil Rule 7(b)(2), “if a party fails to file papers in opposition to a motion, such failure may be considered by the court as an admission that motion has merit.” This applies to the failure to respond to individual claims in a motion to dismiss. See Leonard v. Reconstruct Company, N.A., No. 15-5866 RJB 2016 WL 304802, at *8 (W.D. Wash. Jan. 26, 2016), aff’d sub nom., Bruce v. Reconstruct Co., N.A., 719 F. App’x 713 (9th Cir. 2018); Edwards v Caliber Home Loans, No. C16-1466-JCC, 2016 WL 9185356, at *2 (W.D. Wash. Dec. 12, 2016.) (finding plaintiffs’ failure to respond to portions of defendants’ argument can be construed as conceding the argument has merit); Piacentini v. United States, No. C96-5763RJB, 1997 WL 176375, at *2 (W.D. Wash. Jan. 13, 1997) (same). The Court finds Hold’s failure to respond to Microsoft’s Motion for this claim is acknowledgement the argument has merit. The Court

GRANTS Microsoft’s Motion as to this claim. 4. Breach of Implied Covenant of Good Faith and Fair Dealing Hold argues Microsoft breached the implied covenant of good faith and fair dealing when it retained the unmatched data and used the data outside the scope of the contract. Because Hold’s allegations are merely conclusory and do not contain sufficient facts, the Court finds this claim does not meet the Rule 12(b)(6) standard. A duty of good faith and fair dealing is implied in every contract. Badgett v. Sec. State Bank, 116 Wn.2d 563 (1991). This duty required the parties to a contract to cooperate with each other so that each may obtain the full benefit of performance, even if the parties have different

requirements under the contract. Id. (internal citation omitted). But this duty does not require a party to accept a material change in the terms of its contract. Id. (internal citation omitted). The implied duty of good faith and fair dealing arises out of the obligations created by a contract and only exists in relation to the performance of specific contract terms. Keystone Land & Dev. Co.

v. Xerox Corp., 152 Wn.2d 171 (2004). Hold alleges Microsoft’s retention of the unmatched data and its use of the data outside the scope of the contract violate the covenant of good faith and fair dealing. (AC ¶¶ 9.1.-9.10.) To support its claim, Hold again points to precontractual negotiations and promises that Microsoft would delete any unmatched data, and Hold’s assumption the data would only apply to the domains outside the nineteen listed. (Id. at ¶¶ 9.4-9.6.) As the Court has already discussed, the contract does not limit Microsoft’s use of the data. But, to the extent that Microsoft used the data for purposes other than to protect its customers, Hold may have a valid claim. The problem with this is the same problem Hold has with its breach of contract claims – it fails to explain how Microsoft’s use of the data in Edge and AD FA does not protect Microsoft customers. The

current complaint does not sufficient allege that Microsoft breached its duty of good faith and fair dealing. The Court GRANTS Microsoft’s Motion as to this claim. 5. Declaratory Judgment Hold seemingly seeks declaratory judgment as a stand-alone, catch all remedy in case all of its other claim fail. The Court finds this remedy is already provided for through Hold’s other claims and should be dismissed. Hold brings a claim for relief under the Declaratory Judgment Action under RCW 7.24.050. (AC ¶ 10.3.) The Washington Supreme Court has historically “limited the operation of the uniform declaratory judgment act to cases where there is no satisfactory remedy at law

available.” Hawk v. Mayer, 36 Wn.2d 858, 866 (1950). Requests for declaratory judgement that merely impose the remedies provided for in other claims are duplicative and may be dismissed on that basis. Swartz v. KPMG LLP, 476 F.3d 756, 766 (9th Cir. 2007) (adopting opinion of Swartz v. KPMG LLP, 401 F.Supp.2d 1146, 1154-55 (W.D. Wash. 2004)).

Hold appears to use this cause of action as a catch all in case its other claims fail. In its Response brief, Hold explains that it included a “cause of action for declaratory relief to ensure such relief is available regardless of the legal theory accepted by the Court.” (Response at 26.) But regardless of whether the Court is persuaded by any of Hold’s legal theories, Hold’s claims for relief still include declaratory judgment as a remedy. Hold’s separate cause of action is therefore duplicative. The Court GRANTS Microsoft’s Motion to Dismiss Hold’ Declaratory Judgment claim. The Court GRANTS Microsoft’s Motion to Dismiss. The majority of Hold’s claims rely on extrinsic evidence to demonstrate an unexpressed intent of the contract. Hold failed to

convince the Court that the contract contained ambiguous language such that extrinsic evidence is needed. And even when taking all factual allegations of the complaint as true, the Court finds that Hold failed to allege sufficient factual grounds to support a plausible claim for relief. The Court GRANTS Microsoft’s Motion to Dismiss without prejudice. Polich v. Burlington Northern, Inc., 942 F.2d 1467, 1472 (9th Cir. 1991) (“Dismissal without leave to amend is improper unless it is clear, upon de novo review, that the complaint could not be saved by any amendment.”) Hold has thirty (30) days from entry of this Order to file an amended complaint. // //

The clerk is ordered to provide copies of this order to all counsel. Dated December 5, 2023. A Marsha J. Pechman United States Senior District Judge