Jetcrete North America LP v. Austin Truck & Equipment, Ltd.

• Court: District Court, D. Nevada
• Decided: September 3, 2020
• Docket: 2:18-cv-01999
• Status: Unknown

Opinion

1 UNITED STATES DISTRICT COURT 2 DISTRICT OF NEVADA 3 JETCRETE NORTH AMERICA LP, Case No.: 2:18-cv-01999-APG-BNW

4 Plaintiff Findings of Fact, Conclusions of Law, and Order for Entry of Judgment in Favor of 5 v. Defendant

6 AUSTIN TRUCK & EQUIPMENT, LTD.,

7 Defendant

8 On August 4 and 5, 2020, I conducted a non-jury trial of the claims asserted in this case 9 by plaintiff Jetcrete North America LP (Jetcrete) against defendant Austin Truck & Equipment, 10 Ltd. d/b/a Freightliner of Austin (Austin). As required by Federal Rule of Civil Procedure 11 52(a)(1), I hereby enter my findings and conclusions. 12 FINDINGS OF FACT 13 In June 2018, Jetcrete needed to quickly acquire three ready-mix trucks for a mining 14 project. On June 11, 2018, Jetcrete’s Manager, Richard Miranda, called Austin to inquire about 15 purchasing the trucks from Austin’s inventory. Mr. Miranda was assigned to Austin sales 16 representative James Walpole. 17 From June 11 through June 13, Messrs. Miranda and Walpole negotiated over the phone 18 and by email and reached an agreement for Austin to sell Jetcrete three new trucks for a total of 19 $518,124.18. Various employees of Jetcrete’s parent company, Thyssen Mining Inc., were 20 included in many of the emails because Thyssen performed some administrative functions for 21 Jetcrete, including purchasing and making payments. 22 On June 13, Mr. Walpole emailed wiring instructions to Mr. Miranda requesting a 23 $6,000 deposit be wired to the account of Freightliner of Austin at JP Morgan Chase Bank in 1 Austin, Texas. The funds were wired that day by Thyssen’s accounts payable department. The 2 next day, Mr. Walpole emailed Mr. Miranda confirming receipt of the funds. 3 At an unknown time, someone hacked into Mr. Walpole’s email account. Austin’s email 4 platform was hosted by an outside company called Intermedia.net Inc.

5 On Friday, June 15, Mr. Walpole and Thyssen’s Purchasing Administrator Judy Schwartz 6 exchanged purchase orders and invoices finalizing the terms of the deal. Ms. Schwartz and Mr. 7 Miranda confirmed the terms at 12:45 and 1:46 p.m. at their respective locations. See Exh. 10. 8 Almost immediately thereafter, Mr. Miranda received an email, purportedly from Mr. Walpole, 9 saying: 10 FYI, you have the old wiring instructions which can only accommodate deposits in smaller amounts. we only use those for purchases less than $50k, reason why i 11 sent it for the $6,000. I will send you our other wiring instructions or the balance due first thing Monday morning. Waiting to get it from accounting. 12 Thanks, James 13 14 See Exh. 9. Although this email came from Mr. Walpole’s correct email address, unbeknownst 15 to Mr. Miranda, the email was authored by the hacker. At nearly the same time, the real Mr. 16 Walpole emailed to Ms. Schwartz and Mr. Miranda confirming the total price and attaching a 17 .pdf with wiring instructions for payment of the $512,124.18 balance. See Exh. 10. Those wiring 18 instructions were the same ones used for the $6,000 deposit. Almost immediately thereafter, Mr. 19 Miranda and Ms. Schwartz received another email—from Mr. Walpole’s email address and 20 using the same email string that Mr. Walpole had just used—saying: 21 I’m sorry to have sent the old wiring instructions again. please ignore the wiring instructions in my previous email. we stopped using those for larger purchases as 22 explained to Richard earlier. I will be sending the updated info shortly or first thing Monday morning. I apologize for the mix up 23 Thanks, James 1 See Exh. 11. Again, unbeknownst to Mr. Miranda and Ms. Schwartz, this email was 2 written by the hacker. 3 On Monday, June 18, at 7:27 a.m. the hacker sent another email to Mr. Miranda and Ms. 4 Schwartz attaching fraudulent wiring instructions directing Jetcrete to wire the funds to a

5 different bank and different payee from the $6,000 wired deposit, specifically National 6 Equipment & Trucking’s account at Bank of America in Austin, Texas. See Exh. 13. The next 7 day, Thyssen wired $512,124.18 to National Equipment & Trucking’s account at Bank of 8 America. At 3:00 p.m. that day, Mr. Miranda emailed Mr. Walpole that the funds had been 9 wired. The real Mr. Walpole did not receive that email because the hacker intercepted it and 10 responded the next morning that the funds had been received. 11 On June 20, Mr. Miranda emailed Mr. Walpole asking when the trucks would be 12 delivered. The hacker intercepted this and other emails to Mr. Walpole and strung Mr. Miranda 13 along for several days, leading him to believe everything was in order. On June 26, the parties 14 finally realized something was amiss, that Mr. Walpole’s email had been hacked, and that the

15 wired funds had been stolen. 16 On June 26, Austin’s Vice President and part owner Paul Werner notified Intermedia 17 about the hack and stated that a representative of Jetcrete would contact Intermedia. Intermedia 18 responded that Jetcrete would need the “appropriate account contact entry and security 19 questions.” See Exh. 39. Mr. Werner never provided Jetcrete that information because he did not 20 know the security questions. Id. So when Jetcrete’s IT Director Mike Selinger contacted 21 Intermedia it refused to speak with him. Over the next few days, Intermedia reached out to Mr. 22 Werner to address the situation but Mr. Werner never responded. Id. Intermedia eventually 23 deleted the data needed to trace the hack under its data retention policy. 1 Jetcrete was unable to recover the wired funds. Because Jetcrete needed the trucks 2 quickly for its project, it agreed to Austin’s demand that it wire another $512,124.18. Jetcrete 3 wired those funds on June 28, after which Austin delivered the trucks. 4 Jetcrete’s First Amended Complaint in this action asserts claims for breach of contract

5 and the implied covenant of good faith and fair dealing, conversion, fraudulent 6 misrepresentation, unjust enrichment, and vicarious liability. Jetcrete abandoned the unjust 7 enrichment claim before trial. 8 CONCLUSIONS OF LAW 9 1. Breach of Contract 10 “Nevada law requires the plaintiff in a breach of contract action to show (1) the existence 11 of a valid contract, (2) a breach by the defendant, and (3) damage as a result of the breach. Saini 12 v. Int’l Game Tech., 434 F. Supp. 2d 913, 919–20 (D. Nev. 2006) (citing Richardson v. Jones, 1 13 Nev. 405, 405 (Nev. 1865)). Jetcrete and Austin were parties to a contract under which Jetcrete 14 agreed to pay Austin $518,124.18 for three ready-mix trucks. Jetcrete paid Austin a $6,000.00

15 deposit, leaving a balance of $512,124.18. Jetcrete wired the balance in response to the 16 instructions it received from the hacker and the funds were stolen. Because Austin did not 17 receive the funds, it required Jetcrete to send the balance a second time. Once Austin received 18 that payment, it delivered the trucks to Jetcrete. 19 The parties view the question of breach from the perspective of their own contractual 20 obligations. Jetcrete contends it completed its obligations by wiring the total purchase price, but 21 Austin breached by refusing to deliver the trucks until Jetcrete paid a second time. Austin 22 contends it completed its obligations by delivering the trucks after it received the contracted sale 23 price. Both are correct that they performed their respective contractual obligations. As the 1 plaintiff, Jetcrete has the burden of proving Austin breached the contract. Because Austin 2 delivered the trucks after it received full payment, it did not breach the contract. 3 Jetcrete argues that this analysis dodges the real issue as to who should bear the loss of 4 the funds stolen by the hacker. Jetcrete asserts that, because the contract involved the sale of

5 goods, resolution is governed by the Uniform Commercial Code, which Nevada codified in 6 Nevada Revised Statutes Chapters 104 and 104A. Nevada’s version of U.C.C. § 3-304 states: 7 1. If an impostor . . . induces the issuer of an instrument to issue the instrument to the impostor, . . . by impersonating the payee of the instrument or a person 8 authorized to act for the payee, an endorsement of the instrument by any person in the name of the payee is effective as the endorsement of the payee in favor of a 9 person who, in good faith, pays the instrument or takes it for value or for collection. 10 . . . .

11 4. With respect to an instrument to which subsection 1 . . . applies, if a person paying the instrument or taking it for value or for collection fails to exercise 12 ordinary care in paying or taking the instrument and that failure substantially contributes to loss resulting from payment of the instrument, the person bearing 13 the loss may recover from the person failing to exercise ordinary care to the extent the failure to exercise ordinary care contributed to the loss. 14 15 Nev. Rev. Stat. § 104.3404 (emphasis added). Austin responds that this section does not apply 16 because it governs negotiable instruments not wired funds. Other courts have cited to U.C.C. 17 § 3-404 when wired funds have been fraudulently diverted by a hacker. See, e.g., Beau Townsend 18 Ford Lincoln, Inc. v. Don Hinds Ford, Inc., 759 Fed. Appx. 348, 357 (6th Cir. 2018); Bile v. 19 RREMC, LLC, 2016 WL 4487864, at *8 (E.D. Va. August 24, 2016); Arrow Truck Sales, Inc. v. 20 Top Quality Truck & Equipment, Inc., 2015 WL 4936272, at *5-6 (M.D. Fla. Aug. 18, 2015). 21 Those courts relied on § 3-404’s rule that “the party who was in the best position to prevent the 22 forgery by exercising reasonable care suffers the loss.” Arrow, 2015 WL 4936272, at *5. 23 1 Jetcrete argues that Austin was in the best position to avoid the loss by employing 2 reasonable security measures to prevent the hack of Mr. Walpole’s email. It contends Mr. 3 Miranda could not have known that some of the emails he received from Mr. Walpole’s account 4 were authored by the hacker. On the other hand, it argues, Mr. Walpole received fraudulent

5 emails that contained warning signs (e.g., misspelled company domain names) that should have 6 tipped him off to the hack. 7 Austin responds that some of the emails Mr. Miranda received contained similar warning 8 signs (e.g., poor grammar and punctuation, different font sizes), so Mr. Miranda is at fault to the 9 same degree Jetcrete condemns Mr. Walpole. Austin points out that it took reasonable security 10 steps by hiring an IT consultant (Shane Poteet of Full Suite Communications), installing 11 Symantec virus scanner software on its system, and hosting its email server at Intermedia. 12 Austin argues that Jetcrete was in the best position to avoid the loss by simply calling Austin to 13 verify the wiring instructions. By not doing so, Jetcrete failed to exercise reasonable care, 14 therefore causing the loss.

15 It is unknown how and when the hacker broke into Mr. Walpole’s email. The data that 16 might show that was deleted by Intermedia. Because Austin did not stop Intermedia from 17 destroying the data, Jetcrete moved in limine for an adverse inference that the lost data would be 18 unfavorable to Austin. ECF No. 39.1 To obtain that adverse inference, Jetcrete must prove 19 (1) Austin had control over the data and an obligation to preserve it; (2) the destruction or loss 20 was accompanied by a culpable state of mind, which includes negligence; and (3) the evidence 21 that was destroyed is relevant to Jetcrete’s claims or Austin’s defense. Soulé v. P.F. Chang’s 22

1 I denied that motion without prejudice to Jetcrete presenting evidence at trial to support 23 it. Jetcrete now renews the motion for an adverse inference. ECF No. 51 at 6-7. 1 China Bistro, Inc., 2020 WL 959245, at 4 (D. Nev. Feb. 26, 2020) (internal citations and 2 quotation marks omitted). Austin owned the data. See Exh. 502 at p. 3 § 1.2. It had an 3 obligation to preserve it. Gonzalez v. Las Vegas Metro. Police Dep’t, 2012 WL 1118949, at *5 4 (D. Nev. Apr. 2, 2012) (“The duty to preserve [evidence] . . . extends to the period before

5 litigation when a party should reasonably know that evidence may be relevant to anticipated 6 litigation.”). Although Mr. Werner opened a support ticket with Intermedia, he failed to follow 7 up on Intermedia’s responses, which would have allowed Mr. Selinger to investigate the hack. 8 See Exh. 39. It appears that Intermedia destroyed the data after Mr. Werner failed to follow up. 9 The data likely would show when and how the hacker broke into Mr. Walpole’s account, which 10 is relevant to whether Austin used reasonable care to secure its email platform. Thus, Jetcrete is 11 entitled to an adverse inference that the lost data would be unfavorable to Austin. 12 But that does not end the inquiry because an adverse inference can be rebutted. Austin 13 argues in rebuttal that it hired an IT security consultant, installed Symantec virus detection 14 software, and paid Intermedia to host its email platform. No email platform is impervious to

15 hacking and even the most sophisticated entities and governments have been hacked. Jetcrete 16 seems to suggest a form of strict liability for hacks: because Austin’s email platform was hacked, 17 it must be liable for the resulting damage of Jetcrete’s wiring funds to the wrong account. Such a 18 rigid standard is not practical in today’s business environment. And it is contrary to the standard 19 Jetcrete invokes, that the court must determine which party was in the best position to avoid the 20 loss. Austin has demonstrated that it took reasonable steps to protect its email platform, thereby 21 undercutting somewhat, if not completely, the adverse inference. 22 Even if Austin failed to use reasonable care, that must be weighed against Jetcrete’s 23 actions, especially if Jetcrete, too, failed to use reasonable care. After Mr. Miranda and Ms. 1 Schwartz received the fake emails changing the wiring instructions, Jetcrete and Thyssen failed 2 to confirm the validity of the new instructions. Mr. Miranda testified that he relied on Thyssen’s 3 Purchasing Department to verify the wiring instructions, but that did not happen. A simple 4 phone call to Mr. Walpole or anyone else at Austin would have revealed the fraud and avoided

5 the loss. The failure to do so is especially disconcerting after Jetcrete received conflicting email 6 instructions within minutes of each other. See Exhs. 9, 10, 11. 7 The hack of Mr. Walpole’s email account created the scenario for the loss. But Jetcrete 8 was in the best position to prevent the loss by taking the reasonable precaution of verifying the 9 wiring instructions by phone. Thus, even under an analysis based on Nevada Revised Statutes 10 § 104.3404, Jetcrete should suffer the loss. Arrow, 2015 WL 4936272, at *5. Cf. S. Pac Co v. Bd. 11 of R Comm’rs of Cal., 78 F. 236, 252 (C.C.N.D. Cal. 1896) (“They being in pari delictu, the law 12 gives aid to neither.”). 13 Finally, Jetcrete argues that Austin should be liable under an “agency by estoppel” 14 theory, citing to the Restatement (Third) of Agency § 2.05. Jetcrete contends that Austin should

15 be bound by the actions of the hacker, as if the hacker was Austin’s agent, because the hacker 16 utilized Mr. Walpole’s email account as if he was Austin’s agent. While Nevada courts often 17 look to the Restatements for guidance, no Nevada court in the last 99 years has recognized this 18 theory and none has ever applied it. See Robertson v C.O.D. Garage Co., 199 P. 356, 359 (Nev. 19 1921) (mentioning the theory of “agency by estoppel” but declining to apply it). I am loathe to 20 create Nevada law. But even if Nevada recognized the “agency by estoppel” theory, it would not 21 save Jetcrete. The theory is limited to situations where the principal “intentionally or carelessly 22 caused” the injured party to believe the fraudulent actor was acting on behalf of the principal. 23 1}| See Restatement (Third) of Agency § 2.05 (2006). Under the facts of this case, I do not find that Austin carelessly caused Jetcrete to believe the hacker was Mr. Walpole. 3 Jetcrete has failed to prove that Austin breached the contract so I deny this claim. 4 2. Jetcrete’s Other Claims 5 Jetcrete argues that its “agency by estoppel theory also supports finding in Jetcrete’s favor on its other claims.” See Jetcrete’s Proposed Findings of Fact and Conclusions of Law, 7\| ECF No. 47 at 18. Neither of the parties made any further arguments in support of Jetcrete’s 8|| other claims in any of their post-trial briefs. See ECF Nos. 51,54, 55. Because I have rejected 9|| that theory under the facts of this case, and because Jetcrete has not proven the elements of those 10]| claims under Nevada law, I deny all of Jetcrete’s other claims. 11 CONCLUSION 12 I THEREFORE ORDER the clerk of the court to enter judgment in favor of defendant 13] Austin Truck & Equipment, Ltd. and against plaintiff Jetcrete North America LP on all of the 14|| claims asserted in this case. 15 DATED this 3rd day of September, 2020. 16 ZL. - M ANDREW P.GORDON 18 UNITED STATES DISTRICT JUDGE

19 20 21 22 23