Nucor Steel v. Mauer 10-CV-327-SM 12/07/10 UNITED STATES DISTRICT COURT
DISTRICT OF NEW HAMPSHIRE
Nucor Steel Marion, Inc., Plaintiff
v. Case No. 10-cv-327-SM Opinion No. 2010 DNH 207
Frederick Mauer IV, Defendant
O R D E R
Nucor Steel Marion, Inc. ("Nucor Marion") brought suit against its former employee, Frederick Mauer, asserting various claims, including two claims under the federal Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030. Before the court is Mauer's motion to dismiss Nucor Marion's federal claims. For the reasons given, Mauer's motion to dismiss is granted in part.
The Legal Standard
A motion to dismiss for "failure to state a claim upon which relief can be granted," Fe d . R. C i v . P. 12(b) (6), requires the court to conduct a limited inquiry, focusing not on "whether a plaintiff will ultimately prevail but whether the claimant is entitled to offer evidence to support the claims." Scheuer v. Rhodes, 416 U.S. 232, 236 (1974). That is, the complaint "must contain 'enough facts to raise a reasonable expectation that discovery will reveal evidence' supporting the claims." Fantini
2
v. Salem State Coll., 557 F.3d 22, 26 (1st Cir. 2009) (quoting Bell Atl. Corp. v. Twomblv, 550 U.S. 544, 556 (2007)). When considering a motion to dismiss under Rule 12(b)(6), a trial court "assume[s] the truth of all well-plead facts and give[s] the plaintiff[s] the benefit of all reasonable inferences therefrom." Vernet v. Serrano-Torres, 566 F.3d 254, 258 (1st Cir. 2009) (quoting Ruiz v. Bally Total Fitness Holding Corp., 496 F .3d 1, 5 (1st Cir. 2007)).
"To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Sutliffe v. Eppinq Sch. Dist., 584 F.3d 314, 325(1st Cir. 2009) (quoting Ashcroft v. Iqbal, 129 S. C t . 1937, 1949 (2009)). On the other hand, a Rule 12(b)(6) motion should be granted if "the facts, evaluated in [a] plaintiff-friendly manner, [do not] contain enough meat to support a reasonable expectation that an actionable claim may exist." Andrew Robinson Int'l, Inc. v. Hartford Fire Ins. Co., 547 F.3d 48, 51 (1st Cir. 2008) (citations omitted).
Background
From June 1, 2005, until his resignation on March 21, 2010, Mauer was employed as an outside sales representative by Nucor Marion, a manufacturer of steel products. As of August 6, 2010,
3
Mauer was employed by Gregory Industries, one of Nucor Marion's direct competitors.1
As a Nucor Marion employee, Mauer was bound by a confidentiality agreement that included the following provisions:
The relationship of employer and employee imposes a legal duty on EMPLOYEE not to disclose to others or use to EMPLOYEE'S advantage, to the detriment of NUCOR, any of NUCOR'S trade secrets or confidential information, while EMPLOYEE is employed by NUCOR as well as after such employment ceases and while such trade secrets and confidential information remain confidential.
EMPLOYEE shall maintain in secrecy and confidence and shall not disclose or divulge any of NUCOR'S trade secrets or confidential information, of which EMPLOYEE is or may be informed by reason of EMPLOYEE'S employment with NUCOR, to any other person without the prior written consent of the President or a Vice President of Nucor Corporation.
(Compl. 5 13.) In addition, Mauer was not "authorized to reproduce or retain . . . Nucor Marion data." (Compl. 5 22.) The complaint does not, however, identify any statement of company policy related to employee access to computers that would have prohibited the conduct on which Nucor Marion bases its CFAA claims.2
1 Nucor Marion makes no other factual allegations concerning the chronology of Mauer's association with or employment by Gregory Industries.
2 Alleging that Mauer had been informed that he was not allowed to download or e-mail Nucor Marion data is different from alleging that Mauer had never been told that he was allowed to do
4
While he worked for Nucor Marion, Mauer had the use of at least one company-issued laptop computer.3 Two days after he resigned, Mauer turned in his company computer. The company, in turn, had a consultant perform a forensic analysis of the computer. The consultant discovered that Mauer had connected the computer to an external hard drive and a flash disk USB device "on numerous occasions prior to March 15, 2010 and through March 21, 2010, just prior to his resignation from Nucor Marion." (Compl. 5 19.) Those "connections occurred coincident with changes in access dates to certain key Nucor Marion data, including schematic drawings, cost spreadsheets and cable product technical data." (Compl. 5 20.) While the complaint alleges that Mauer connected his company laptop to an external hard drive and a USB device, it describes neither the information stored on that computer nor the information Mauer allegedly downloaded from it.
Forensic analysis also disclosed that Mauer regularly transmitted Nucor Marion data to the e-mail account of Lisa Mauer. Nucor Marion alleges, upon information and belief, that
so (which is all that has been alleged here).
3 At one point, the complaint alleges that Nucor Marion provided Mauer with two laptops (Compl. 5 57), but everywhere else, the complaint refers to a single laptop. The court will follow suit and refer to a single computer.
5
the data Mauer sent to Lisa Mauer's e-mail account now resides on Mauer's home computer. But, as with the allegations concerning Mauer's use of an external hard drive and a USB device, the complaint does not describe the information Mauer emailed to Linda Mauer, other than to call it "Nucor Marion data." (Compl. 5 21.) The complaint does not directly allege that Mauer transmitted any trade secrets or confidential information.
After Mauer resigned, Nucor demanded an inventory of any Nucor Marion data in Mauer's possession, and the return thereof. Mauer refused to relinquish Nucor Marion's data, and refused to allow a forensic computer analysis of his personal computer.4
Based on the foregoing, Nucor Marion asserts a host of state-law claims,5 along with claims for monetary damages and injunctive relief under four provisions of the federal Computer Fraud and Abuse Act.
4 While the complaint does not say so explicitly, it seems clear that the forensic analysis Nucor Marion sought to perform was on Mauer's personal computer.
5 Specifically, Nucor Marion claims: breach of contract (Counts I & II); misappropriation of trade secrets (Counts III & IV); breach of the duty of loyalty (Counts V & V I ); unfair and deceptive trade practices (Counts IX and X); conversion (Counts XI & XII. Count XIII is a request for injunctive relief that has since been filed as a motion (document no. 10), and withdrawn (see document no. 37).
6
Discussion
The CFAA provides a private right of action for compensatory damages and equitable relief to any person who suffers damage or loss because another
(2 ) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
(C) information from any protected computer;
(4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-
year period;
(5) (A) . . .
(B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or
(C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.
18 U.S.C. § 1030(a); see also 18 U.S.C. § 1030(g) (establishing the CFAA's private right of action).
Mauer argues that Nucor Marion fails to adequately allege that he accessed its computer "without authorization," a required
7
element of two of Nucor Marion's claims, see 18 U.S.C. §§ 1030(a)(5)(B) & (C), and an alternative element of the other two, see 18 U.S.C. §§ 1030(a)(2)(C) & (4). Mauer also argues that Nucor Marion fails to adequately allege that he exceeded his authorized access to its computer, an alternative element of two of its claims. See id.
The CFAA does not define the term "without authorization."
In a case in which the plaintiff sued the defendant for using "a computer program called a 'scraper' to glean . . . information from [the plaintiff's] website," EF Cultural Travel BY v. Explorica, Inc., 274 F.3d 577, 579 (1st Cir. 2001), the court of appeals explained:
Congress did not define the phrase "without authorization," perhaps assuming that the words speak for themselves. The meaning, however, has proven to be elusive. The district court applied what it termed the "default rule" that conduct is without authorization only if it is not "in line with the reasonable expectations" of the website owner and its users.
Appellants argue that this is an overly broad reading that restricts access and is at odds with the Internet's intended purpose of providing the "open and free exchange of information." They urge us to adopt instead the Second Circuit's reasoning that computer use is "without authorization" only if the use is not "in any way related to [its] intended function," United States v. Morris, 928 F.2d 504, 510 (2d Cir. 1991).
Appellees contend that the result would be the same under either test, but we need not resolve this dispute because we affirm the court's ruling based on the "exceeds authorized access" prong of § 1030(a)(4).
8
Id. at 582 n .10.
In Guest-Tek Interactive Entertainment, Inc. v. Pullen, 665 F. Supp. 2d 42 (D. Mass. 2009), a case involving a factual situation more like the one presented in this case. Judge Gorton grappled with a similar definitional issue:
The parties' dispute reflects two lines of cases interpreting the meaning of "authorization." The first position, advocated by the defendants, espouses a narrow interpretation of the CFAA, holding that the phrase "without authorization" only reaches conduct by outsiders who do not have permission to access the plaintiffs' computer in the first place. See, e.g..
Shamrock Foods v. Cast, 535 F. Supp. 2d 962, 967 (D.
Ariz. 2008); Lockheed Martin Corp. v. Speed, et al., No. 6 :05-CV-1580, 2006 WL 2683058 at *5, 2006 U.S.
Dist. LEXIS 53108 at *14 (M.D. Fla. [Aug. 1,] 2006).
In contrast, other courts have opted for a more expansive view, finding that an employee accesses a computer "without authorization" whenever the employee, without the employer's knowledge, acquires an interest that is adverse to that of his employer or is guilty of a serious breach of loyalty. See, e.g., [Int'1 Airport Ctrs. v .1 Citrin, 440 F.3d [418,] 419 [(7th Cir.
2 006)]; Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc., 119 F. Supp. 2d 1121, 1125 (W.D.
Wash. 2000) .
Id. at 45. Judge Gorton adopted the broader reading of the CFAA, expressly rejecting the reasoning employed by the Ninth Circuit in LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1135 (9th Cir. 2009) (holding that employee did not "act [ ] 'without authorization' when he emailed [employer's] documents from his work computer to himself and his wife").
9
Nucor Marion urges the court to adopt the Guest-Tek interpretation of "without authorization." Mauer predictably prefers the narrower interpretation found in LVRC Holdings, Shamrock Foods, and Lockheed Martin, but argues that he is entitled to dismissal under either theory. Even accepting the more expansive view of "without authorization," i.e., the one employed in Guest-Tek, Citrin, and Shurgard, as controlling, Nucor Marion still has not stated a claim on which relief can be granted.
The allegations against the defendant in Guest-Tek were "that prior to [his] resignation on May 3, 2009, for a period of approximately eight months, [he] surreptitiously transposed thousands of Guest-Tek computer files onto his personal USB device and conspired with one of Guest-Tek's largest competitors to launch PureHD, a company which now competes with Guest-Tek." 665 F. Supp. 2d at 43. In Citrin, the Seventh Circuit held that the defendant employee accessed his employer's computer "without authorization" because the employee's "authorization to access the laptop terminated when, having already engaged in misconduct and decided to quit TAG in violation of his employment contract, he resolved to destroy files that incriminated himself and other files that were also the property of his employer, in violation of the duty of loyalty that agency law imposes on an employee."
10
440 F.3d at 420 (citations omitted). And in Shurgard, the complaint alleged that "[w]hile still employed by the plaintiff, but acting as an agent for the defendant, Mr. Leland sent e-mails to the defendant containing various trade secrets and proprietary information belonging to the plaintiff [and did so] without the plaintiff's knowledge or approval." 119 F. Supp. 2d at 1123.
Here, the complaint does not allege that Mauer ever "acquire[d] an interest that [was] adverse to that of his employer or [was] guilty of a serious breach of loyalty," Guest- Tek, 665 F. Supp. 2d at 45, at any time before he downloaded and e-mailed company data from his work computer.6 The complaint alleges that all of Mauer's access took place while he was still an employee, and does not allege that Mauer did anything while he was employed by Nucor Marion that would have terminated his authorization to access Nucor Marion data. That is, the complaint does not allege that Mauer contacted, or transmitted Nucor Marion data to, any Nucor Marion competitor during the course of his employment, nor does the complaint allege that
6 To be sure, Nucor Marion alleges in Counts V and VI that Mauer violated his duty of loyalty by downloading and e-mailing the company's data, but the allegations concerning Mauer's actual use of those data are conclusory and speculative, at best. See Fantini, 557 F.3d at 26 (explaining that the court need not credit "bald assertions, periphrastic circumlocutions, unsubstantiated conclusions, . . . outright vituperation or subjective characterizations, optimistic predictions, or problematic suppositions").
11
Mauer was actively making plans to compete with Nucor Marion while still employed by the company. The allegations are that Mauer quit working for Nucor Marion on March 21, 2010, and that by August 6, he had found his way to Gregory Industries. In short, there is no allegation that Mauer was a "double agent" for Gregory Industries while he was employed by Nucor Marion. The claims in Nucor Marion's complaint, then, stand in stark contrast to the claims in Guest-Tek, Citrin, and Shurgard, and fail to adequately allege that Mauer accessed Nucor Marion's computers without authorization under the theory employed in those cases. Accordingly, Mauer is entitled to dismissal of Nucor Marion's claims under 18 U.S.C. §§ 1030(a) (5) (B) & (C) .
The Seventh Circuit has observed that "[t]he difference between 'without authorization' and 'exceeding authorized access' is paper thin, but not quite invisible." Citrin, 440 F.3d at 420 (citing Pac. Aero. & Elecs., Inc. v. Tavlor, 295 F. Supp. 2d 1188, 1196-97 (E.D. Wash. 2003)). Unlike "without authorization," the term "exceeds authorized access" has a statutory definition — it "means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). Here, however, the complaint expressly alleges that "[b]y virtue of his position.
12
Mauer had significant exposure and access to Nucor Marion's confidential, proprietary and trade secret information." (Compl. SI 11.) In other words, the complaint alleges that Mauer was entitled to obtain the information at issue. Moreover, the complaint nowhere alleges that Mauer used his authorized access to obtain information from a Nucor Marion computer beyond that which he was entitled to obtain.7 Accordingly, Mauer is also entitled to dismissal of Nucor Marion's claims under 18 U.S.C. §§ 1030(a)(2)(B) & (4). See LVRC Holdings, 581 F.3d at 1135 n.7 ("To the extent LVRC implicitly argues that Brekka's emailing of documents to himself and to his wife violated §§ 1030(a)(2) and (4) because the document transfer 'exceed[ed] authorized access,' such an argument also fails. As stated by the district court, it is undisputed that Brekka was entitled to obtain the documents at issue. Moreover, nothing in the CFAA suggests that a defendant's authorization to obtain information stored in a company computer is 'exceeded' if the defendant breaches a state law duty of loyalty to an employer . . .") .
Because Nucor Marion fails to allege facts sufficient to meet the "unauthorized access" and "exceeds authorized access" elements of its CFAA claims, it is not necessary to address
7 The complaint also does not allege that Mauer altered any Nucor Marion information.
13
Mauer's alternative argument, that Nucor Marion fails to allege damages sufficient to cross the threshold set out in the CFAA.
Conclusion
For the reasons given, Mauer's motion to dismiss (document no. 23) is granted to the extent that Nucor Marion's federal claims (Counts VII & VIII) are dismissed. Dismissal of Nucor Marion's federal claims, however, does not lead the court to relinquish jurisdiction over the remaining state-law claims, because Nucor Marion has invoked both federal-question jurisdiction, 28 U.S.C. § 1331, and diversity jurisdiction, 28 U.S.C. § 1332. Mauer's contention that Nucor Marion has not adequately alleged the $5,000 threshold for damages under the CFAA certainly calls into question the sufficiency of Nucor Marion's allegation that its damages satisfy the $75,000 minimum necessary for diversity jurisdiction, see id., but that is a question for another day.
SO ORDERED.
Uzeven J./McAuliffe
Chief Judge
December 7, 2010
cc: Benjamin P. Fryer, Esq.
Paul J. Peralta, Esq.
Daniel P. Schwarz, Esq.
Philip L. Pettis, Esq.