Hold Security LLC v. Microsoft Inc

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE HOLD SECURITY, CASE NO. C23-899 Plaintiff, ORDER GRANTING MOTION TO DISMISS v. Defendant. This matter comes before the Court on Defendant’s Motion to Dismiss. (Dkt. No. 39.) Having reviewed the Motion, the Response (Dkt. No. 44), the Reply (Dkt No. 46), and all other supporting material, the Court GRANTS the Motion. This case arises out of a contract between Microsoft Corporation (“Microsoft”) and Hold Security (“Hold”). Hold alleges Microsoft breached the contract by using Hold’s services outside the intended scope of the contract. (Response at 1.) This is Hold’s second attempt to bring claims against Microsoft, following the Court’s dismissal of its First Amended Complaint for failure to state a claim for relief. (Dkt. No. 37.) Hold then brought its Second Amended Complaint (“SAC” (Dkt. No. 38)) within the allotted time frame, and Microsoft now moves to dismiss the SAC with prejudice. Hold is an internet security company that provides a “Credential Integrity Service.” Hold

conducts searches of the “Dark Web” to recover stolen and/or compromised login credentials and then shares that information with its company customers so they can identify and alert users’ who have had their login credentials stolen or otherwise compromised. (SAC ¶¶ 3.1, 3.3-3.4.) In 2014, Microsoft contacted Hold about utilizing Hold’s services. (Id. at ¶ 3.8.) Microsoft represented to Hold that its sole objective in using the Compromised Account Credential Data retrieved by Hold was to check against the login credentials of Microsoft customers for Microsoft’s own services, products, and domains. (Id. at ¶ 3.12.) Microsoft also allegedly told Hold that it would delete and discard all compromised Account Credential Data once it had been checked against the login credentials of Microsoft customers. (Id. at ¶ 3.13.) Based on these representations Hold discussed pricing and service options, and the parties began

negotiating a contract. (Id. at ¶¶ 3.8-3.16.) The Contract In 2015, Microsoft and Hold executed a Master Supplier Services Agreement (“MSSA”), which provides in the pertinent part: Section 1 - Definitions (c): “Deliverables means all IP or other work product developed by Supplier (or a Subcontractor of Supplier for Microsoft under a Statement of Work (“SOW”) or as part of the Services; Section 3 – Ownership and use of the parties’ respective IP

(e)(1): Ownership of IP Rights in Deliverables. All Deliverables are “work made for hire” for Microsoft under applicable copyright law . . . To the extent any Deliverables do not qualify as work made for hire, Supplier assigns all right, title, and interest in and to the Deliverables, including all IP rights, to Microsoft. Supplier waives, and agrees not to assert, any

moral rights that may exist in the Deliverables. (Declaration of Jacob Thornburgh ISO MTD, Exhibit B, MSSA (Dkt. No. 22).) Microsoft and Hold also executed a Statement of Work (“SOW”) at the same time as the MSSA, which is incorporated into the MSSA. The SOW provides: Section 3 – Description of Services and Delivery Schedule (b): Services. Microsoft has asked Supplier to deliver compromised “Account Credential Data” that have been recovered by the Supplier from sites on the Internet in order to reveal and protect against threats to services, brands and domains owned by Microsoft. “Account Credential Data” are defined as lists of pairs of user id and password where user id is in form of a valid email address [RFC 2822] only and password is non-blank.

Supplier will conduct an extensive search of its data sources to provide Microsoft all currently held Account Credential Data as a one-time deliverable as a ‘catch-up’ . . . Per the line item details below, Supplier will provide compromised Account Credential Data on a daily basis: 1) Supplier will be collecting compromised accounts from sites on the Internet; the methods of which are proprietary to the Supplier. Supplier’s proprietary methods for gathering Account Credential Data from sites on the Internet shall not be considered Supplier IP incorporated into the Deliverables. Compromised Account Credential Data will be used to check against Microsoft’s own services, brands and domains in order to protect Microsoft customers. The reason for including

third-party account credential data is that Microsoft customers are able to use third-party user credentials (e.g., john@contoso.com) on Microsoft brands and services. All services shall be treated as Microsoft Confidential Information unless otherwise designated by Microsoft.

Details - Supplier will on a daily basis collect and deliver to Microsoft compromised Account Credential Data for the following domains (The asterisk ‘*’ indicates matching of any and all characters; e.g., hotmail.* would match for hotmail.com, hotmail.co.uk, hotmail.fr and many others): • microsoft* • bing.* • hotmail* • office365.* • live.* • office.* • outlook.* • legallery.* • msn.* • microsoftstore.com • passport.* • onmicrosoft.com • windowslive.* • microsoftonline.com • msncs.com • onmschina.cn • skype* • *.TLD (third party login • nokia.* credentials, e.g., • xbox.* ‘contoso.com’) The SOW also provides a payment and delivery schedule, which outlines the dates by which Hold must deliver all services to Microsoft and what Microsoft will pay in return. (SOW Sections 4, 5.) (Thornburgh Decl. Ex. C.) Microsoft’s Use of the Data Hold alleges that after it executed the contract with Microsoft, Microsoft employed an updated version of its Active Directory Federation Service (AD FS). (SAC ¶ 3.25.) Microsoft’s AD FS service provides security services for third parties’ products by using the Compromised Account Credential Data to check against the login credentials of the third-party’s users. (Id.) Hold claims Microsoft breached their contract by employing this service because it directly competes with Hold’s services. (Id.) Microsoft also launched an updated version of its Microsoft Edge web browser that uses the Compromised Account Credential Data to check against any login credentials entered into

any website, not just Microsoft’s services, brands, and domains. (SAC ¶ 3.26.) Hold alleges the use of the compromised login data for this use is outside the scope of the contract. (Id. at ¶ 3.27.) Lawsuit Hold then brought this lawsuit against Microsoft alleging several breach of contract claims. The Court dismissed Hold’s First Amended Complaint for failure to state a claim for relief. Hold amended its complaint and filed its SAC alleging breach of contract as well as a Washington Consumer Protection Act (“CPA”) claim. Microsoft now moves to dismiss Hold’s SAC for failing to state a claim for relief under Federal Rule of Civil Procedure 12(b)(6). A. Legal Standard

Under Fed. R. Civ. P. 12(b)(6), a court may dismiss a complaint for “failure to state a claim upon which relief can be granted.” Dismissal is appropriate only where a complaint fails to allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is plausible on its face “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The court must accept all facts alleged in the complaint as true and make all inferences in the light most favorable to the non-moving party. In re Fitness Holdings, Int’l, Inc., 714 F.3d 1141, 1144-45 (9th Cir. 2013).

But “conclusory allegations of law and unwarranted inferences will not defeat an otherwise proper motion to dismiss.” Vasquez v. Los Angeles Cnty., 487 F.3d 1246, 1249 (9th Cir. 2007). B. Breach of Contract Claims Contract interpretation is generally a question of law for the Court. Berg v. Hudesman,

115 Wn.2d 657, 663 (1990). Under Washington law, courts follow the “objective manifestation” theory of contracts. Hearst Commc’ns, Inc. v. Seattle Times Co., 154 Wn.2d 493, 503 (2005). This requires courts to “determine the parties’ intent by focusing on the objective manifestations of the agreement, rather than on the unexpressed subjective intent of the parties. Id. (internal citation omitted). Thus, when interpreting contracts, courts should “generally give words in a contract their ordinary, usual, and popular meaning unless the entirety of the agreement clearly demonstrates a contrary intent.” Id. at 504. If the language of a contract is clear and unambiguous, the Court must “enforce the contract as written; it may not modify the contract or create ambiguity where none exists.” Lehrer v. State Dep’t of Social & Health Servs., 101 Wn. App. 509, 515 (2000). “Language is ambiguous if, on its face, it is fairly susceptible to more than

one reasonable interpretation.” Mendoza v. Rivera-Chavez, 88 Wn. App. 261, 268 (1997). “[A]mbiguous contract language is strictly construed against the drafter.” Jones Assocs., Inc. v. Eastside Props., Inc., 41 Wn. App. 462, 468 (1985). Though Hold makes several new arguments regarding its claims the Court still finds Hold’s allegations, taken as true, are insufficient to state a claim for relief. 1. The Term “Deliverable” As an initial matter, the Court determines whether the data is considered a “Deliverable” as defined under the MSSA. In its previous Order, the Court found that, based on the parties’ arguments, the data was a “Deliverable” and therefore owned by Microsoft. Based on that Order,

Microsoft argues that Hold’s complaint fails because it owns the data. (Mot. at 5.) However, in the latest briefs Hold brings a novel argument that there is a difference between the capitalized term “Deliverable” and the lower case “deliverable” – the capitalized term conferring ownership of the data to Microsoft, while the lower case term does not. The Court is not persuaded by

Hold’s argument. The language of the contract does not imply two different meanings for the term “deliverable” depending on whether it is capitalized or not. Section 2 of the SOW states that “[c]apitalized terms used but not defined in this SOW have the meanings given in the Agreement.” (Thornburgh Decl. Ex. C.) “Deliverable” is not defined in the SOW, but is defined in the MSSA as “all IP or other work product developed by Supplier . . .” (Thornburgh Decl. Ex. B.) And Section 3(e) of the MSSA confers ownership for all Deliverables to Microsoft. (Id.) The SOW uses the word deliverable(s) three times, two of which are capitalized, and one is lower cased. Section 3 of the SOW provides the following provisions in its description of the services

to be provided: Supplier will conduct an extensive search of its data sources to provide to Microsoft all currently held Account Credential Data as a one-time deliverable as a ‘catch-up.’ Supplier will be collecting compromised accounts from sites on the Internet; the methods of which are proprietary to the Supplier. Supplier’s proprietary methods for gathering Account Credential Data form sites on the Internet shall not be considered Supplier IP incorporated into the Deliverables.

(Thornburgh Decl. Ex. C.)(emphasis added) The final time the term is used is as a heading in Section 4 “Deliverables/Delivery Schedule.” (Thornburgh Decl. Ex. C.)(emphasis added) The problem with Hold’s arguments is that whenever the term “deliverable” is used, whether capitalized or not, it refers to the Account Credential Data. For instance, the first mention of “deliverable” in Section 3, and notably the only time the term is not capitalized, refers to the Account Credential Data being provided as a one-time ‘catch-up’ deliverable. The

term “deliverable” in context with the sentence makes clear the term synonymous with Account Credential Data. And because the Account Credential Data is the work product developed by Hold for Microsoft, it fits the definition of Deliverable under the MSSA regardless of whether or not it is capitalized. The other two mentions of the term are capitalized and therefore there is no doubt they fall under the definition in the MSSA. For these reasons, the Court finds the lower case “deliverable” has the same meaning as the capitalized terms. And because Microsoft owns all “Deliverables” it owns the Account Credential Data. The Court finds Hold’s novel argument here fails. 2. Microsoft’s Use of the Data for Edge and AD FS Hold’s second argument is that even if Microsoft owns the Account Credential Data, the

contract still limits Microsoft’s use of the data. Hold argues that Microsoft breached the contract because the contract only allowed Microsoft to use the Compromised Account Credential Data “to check against Microsoft’s own services, brands, and domains in order to protect Microsoft customers” and that Microsoft’s use of the data to develop AD FS and Microsoft Edge violate that provision. (SAC ¶¶ 4.3-4.4.) Microsoft argues the contract does not contain any limitations of its use of the data, but that even if it did, Hold’s claim still fails because it did not violate that provision. (Mot. at 5-8.) The Court agrees with Microsoft. In its previous Order dismissing Hold’s First Amended Complaint, the Court found Hold’s breach of contract claim against Microsoft for its development of AD FS and Edge failed

because Hold failed to explain what these two services did and how it violated the contract. (Order Granting Motion to Dismiss at 8-9.) However, the Court found that based on its understanding of the services, they appeared to still protect Microsoft’s customers. (Id.) In its SAC, Hold explains what these services do, but it still fails to properly allege sufficient facts that

demonstrate these services violate the contract. Hold’s argument is based upon a provision in Section 3(b) of the SOW that states: “Compromised Account Credential Data will be used to check against Microsoft’s own services, brands and domains in order to protect Microsoft customers.” (Thornburgh Decl. Ex. C. ) Hold alleges that AD FS and Edge use the data to check against third-party (non-Microsoft) services, brands and domains, which breach the provision in Section 3(b). (SAC ¶¶ 4.3-4.4.) The main problem with Hold’s argument is that AD FS and Edge are services provided by Microsoft and therefore in line with the contract. Though they did not exist at the formation of the contract, there is no language in the contract that limits Microsoft’s use of the data to its then existing services.

Hold advances two additional arguments, neither of which have merit. First, Hold argues that the provision in Section 3(b) discussed above, in conjunction with the provision that follows it: “[t]he reason for including third-party account credential data is that Microsoft customers are able to use third-party user credentials (e.g. john@contoso.com) on Microsoft brands and services” (Thornburg Decl. Ex. C) restricts Microsoft’s use of the data under the canon of expressio unius est exclusion alterius. (Response at 12.) Hold argues that by explaining why third-party account credential data is included, the contract implicitly excludes Microsoft’s use of the data for any other purpose. But expressio unius est exclusion alterius, which is a principal of statutory interpretation that means “the express mention of one thing excludes all others,”

“does not apply to every statutory listing or grouping; it has force only when the items expressed are members of an associated group or series, justifying the inference that items not mentioned were excluded by deliberate choice, not inadvertence.” Barnhart v. Peabody Coal Co., 537 U.S. 149, 168 (2003) (internal quotation and citation omitted). The two provisions at issue here are

not a listing or grouping that justify the inference that anything not mentioned is excluded. But even if the inclusion of third-party credentials did create an exclusive use of the data, the two provisions still allow the use of the data for AD FS and Edge given that customers using these services can utilize them with third-party user credentials. Second, Hold argues that Microsoft has impermissibly expanded the definition of “customer.” (Response at 14-15.) Hold contends that the ordinary meaning of the term “customer” is someone who purchases a good/service. (Id. at 15.) Because users of AD FS and Edge do not purchase this service, the services breach the contract because the data is not being used to protect against Microsoft customers. This argument fails because it renders much of the contract ineffective and meaningless.

Words in a contract should be given their ordinary meaning, Corbray v. Stevenson, 98 Wn.2d 410, 415 (1982), but courts should not adopt a contract interpretation that renders a term ineffective or meaningless, Wagner v. Wagner, 95 Wn.2d 94, 101 (1980). Here, the contract involves Hold providing Compromised Account Credential Data “in order to reveal and protect against threats to services, brands and domains owned by Microsoft.” (Thornburg Decl. Ex. C.) The services, brands and domains owned by Microsoft are listed in the SOW under Section 3 “Details.” And the compromised data is to be obtained by searching that list of domains. (Id.) The SAC refers to the users of those domains as Microsoft’s “customers.” (SAC ¶ 3.21.)(“Microsoft’s Xbox and Skype services allowed customers to use non-Microsoft domains

for usernames.”) And Hold continues to refer to the users of these domains as Microsoft “customers.” (Response at 4.) But most of these domains allow users to sign up and use the domains for free. (Reply at 6.)(“[M]any of the Microsoft services expressly identified in the contract – e.g., Hotmail, Skype, Bing – are free to use.) Because the users of these domains are

not paying customers, but are the “customers” the contract discusses protecting, the most logical interpretation of the contract is that the term “customer” refers to users, not paying customers. For this reason, the Court finds Hold’s argument here fails. Because a plain reading of the contract allows Microsoft to use the data for its AD FS and Edge services, the Court finds Hold fails to allege sufficient facts that would give rise to its breach of contract claim. The Court GRANTS Microsoft’s Motion to Dismiss this claim. 3. Breach of Implied Covenant of Good Faith and Fair Dealing Hold argues Microsoft breached the implied covenant of good faith and fair dealing by using the data for purposes outside the scope of the contract. Because the Court has already held that the data was not used for purposes outside the scope of the contract, the Court finds this

claim fails to state sufficient facts that give rise to relief. A duty of good faith and fair dealing is implied in every contract. Badgett v. Sec. State Bank, 116 Wn.2d 563 (1991). This duty required the parties to a contract to cooperate with each other so that each may obtain the full benefit of performance, even if the parties have different requirements under the contract. Id. (internal citation omitted). But this duty does not require a party to accept a material change in the terms of its contract. Id. (internal citation omitted). The implied duty of good faith and fair dealing arises out of the obligations created by a contract and only exists in relation to the performance of specific contract terms. Keystone Land & Dev. Co. v. Xerox Corp., 152 Wn.2d 171 (2004).

Hold’s argument here essentially repeats is breach of contract argument by asserting Microsoft used the Account Credential Data in an unauthorized manner. Hold attempts to bring in alleged promises made prior to the formation of the contract to demonstrate the parties’ expectations. But any discussions held before the formation of the contract are irrelevant. Hearst,

154 Wn.2d at 503 (courts “determine the parties’ intent by focusing on the objective manifestations of the agreement, rather than on the unexpressed subjective intent of the parties.”). Hold’s belief that discovery will demonstrate that Microsoft used the data in additional ways beyond the scope of the SOW does not save it here. (Response at 19.) The Court has already found that based on the facts alleged, Microsoft did not use the data outside the scope of the contract. Because Microsoft adhered to the contract terms, the Court finds Hold has failed to allege that Microsoft breached its duty of good faith and fair dealing. The Court GRANTS Microsoft’s Motion as to this claim. C. Hold’s CPA Claim Hold’s SAC adds a new claim under Washington’s Consumer Protection Act claim.

Because Hold fails to explain how its contract and dealings with Microsoft affect the public interest, it fails. In order to state a claim for relief under the CPA, a plaintiff must show (1) an unfair or deceptive act or practice, (2) occurring in trade or commerce, (3) impacting the public interest, (4) injury to the plaintiff’s business of property, and (5) causation. Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 Wn.2d 778, 719 (1986); RCW 19.86.020. Taking all material allegations as true, the Court finds Hold’s CPA claim fails because it is a private dispute that does not affect the public interest. In order for conduct to be an unfair or deceptive practice under the CPA, it must have the capacity to “deceive a substantial portion of

the public.” Sing v. John L. Scott, Inc., 134 Wn.2d 24, 30 (1997). And “[o]rdinarily, a breach of private contract affecting no one but the parties to the contract is not an act or practice affecting the public interest.” Hangman, 105 Wn.2d at 790 (internal citation omitted). In this case, the allegations in the SAC demonstrate Hold’s CPA claim is predicated on

the subjective intent it had when it entered into the contract with Microsoft. Hold does nothing more than reexplain its belief regarding Microsoft’s intentions and the alleged promises that Microsoft made regarding its intended use of the data provided by Hold. (See SAC ¶¶ 6.1-6.12.) Hold does not allege Microsoft contacted members of the general public, or that the claims involve any parties other than Microsoft and Hold. The SAC’s only mention of the public interest are two conclusory statements wherein Hold alleges that Microsoft’s use of the data harms consumers, and the public, at large because “cyber criminals can now use Edge to verify whether the stolen data . . . has been recovered by Hold” and “Microsoft’s material misrepresentations and misuse of the data were and are unfair and deceptive acts or practices in trade and commerce which affect the public interest.” (SAC ¶¶ 3.29, 6.11.) These allegations are

wholly conclusory and moreover, illogical. It stands to reason that Microsoft’s use of the data to develop Edge, which seemingly protects all users of Edge by alerting them if their login credential has been compromised, benefits the public. Whether cyber criminals are using that to determine whether the account credentials have changed has nothing to do with Microsoft’s actions. Hold argues there is a public interest in protecting small businesses entering into contracts with Microsoft. (Response at 23.) The Court in Hangman set forth four factors that indicate when a private dispute may affect the public interest: (1) whether the alleged acts were committed in the course of defendant’s business; (2) whether defendant advertised to the public

in general; (3) whether defendant actively solicited this particular plaintiff, indicating potential solicitation of others; and (4) whether plaintiff and defendant occupy unequal bargaining positions. 105 Wn.2d at 790-91. Hold argues it meets three out of four of these factors. The Court disagrees.

The four Hangman factors do not weigh in favor of Hold. Though the first factor favors Hold because Microsoft’s acts were committed during the course of its business, the other three factors weigh against Hold. For the second factor, Hold does not allege that Microsoft advertised to the public in general. Again, the contract was strictly between the two parties. And critically, Hold does not argue Microsoft advertised to the public. (Response at 23.) Similarly with regard to the third factor, though Microsoft may have solicited Hold for its particular services, the SAC contains no allegations to suggest Microsoft solicited others. As for the fourth factor, Hold argues it is “evident that Microsoft and Defendant [sic] occupy unequal bargaining positions” because Microsoft’s resources “dwarfs that of Hold.” (Id. at 23.) But though Hold may claim the parties’ bargaining power unequal, the Court is not convinced. Hold performed a service that

Microsoft sought out. (SAC ¶ 3.8.) Hold had several pricing options that it offered. (Id. at ¶¶ 3.9- 3.11.) Microsoft selected one of the options and the parties negotiated a contract. (Id. at ¶¶ 3.12- 3.13.) Prior to entering into a contract Microsoft required Hold to obtain a legal opinion from Hold’s counsel. (Id. at ¶ 3.15.) The facts contained in the SAC suggest Hold had equal bargaining power, and indeed determined which service and pricing options to offer Microsoft. Hold also had counsel during the process. The Court finds the fourth factor does not favor Hold. Taking into consideration all of the factors, the Court is unconvinced by Hold’s argument and finds the SAC does not contain sufficient facts to demonstrate the contract affects the public interest.

Because the SAC in no way indicates that Microsoft’s conduct extended beyond the two parties to the alleged contract, Hold fails to state a CPA claim upon which relief can be granted. The Court GRANTS Microsoft’s Motion as to this claim.

The Court GRANTS Microsoft’s Motion to Dismiss. Microsoft asks the Court to dismiss the SAC with prejudice. Generally, dismissals under Rule 12(b)(6) should be granted with leave to amend, unless it is clear the complaint cannot be saved by any amendment. Polich v. Burlington Northern, Inc., 942 F.2d 1467, 1472 (9th Cir. 1991). This is the second time the Court has dismissed Hold’s complaint. And though the SAC brings a new claim under the Washington CPA, the Court finds that claim cannot be saved by any amendment. The Court GRANTS Microsoft’s request and DISMISSES the case with prejudice. The clerk is ordered to provide copies of this order to all counsel. Dated April 2, 2024. A Marsha J. Pechman United States Senior District Judge