Philips North America LLC v. Advanced Imaging Services, Inc.

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 EASTERN DISTRICT OF CALIFORNIA 10 11 PHILIPS NORTH AMERICA LLC, No. 2:21-cv-00876-JAM-AC 12 Plaintiff, 13 v. ORDER GRANTING IN PART AND DENYING IN PART DEFENDANTS’ 14 ADVANCED IMAGING SERVICES, MOTION TO DISMISS INC., d/b/a Advanced Imaging 15 Parts; and WANG XIUYUAN a/k/a Sean Wang, 16 Defendants. 17 18 I. FACTUAL ALLEGATIONS AND PROCEDURAL BACKGROUND1 19 Philips North America LLC (“Philips” or “Plaintiff”) 20 develops, manufactures, and sells medical imaging systems, 21 including x-ray, magnetic resonance (“MR”), computer tomography 22 (“CT”), ultrasound, and advanced molecular imaging systems. 23 Compl. ¶ 19, ECF No. 1. To support and maintain those systems, 24 Philips has developed proprietary information, documentation, and 25 software for servicing, which it refers to as its Customer 26

27 1 This motion was determined to be suitable for decision without oral argument. E.D. Cal. L.R. 230(g). The hearing was scheduled 28 for August 24, 2021. 1 Service Intellectual Property (“CSIP”). Id. ¶ 20. 2 Philips grants individuals varying levels of access to its 3 CSIP depending on their position and contractual terms. Id. 4 ¶ 23. CSIP Level 0 materials are available to anyone in the 5 United States who request access. Id. Level 1 materials are 6 available to Philips employees and customers with a valid 7 contract and non-disclosure agreement. Id. Philips reserves 8 CSIP Level 2 access for authorized Philips employees and specific 9 trade partners under contract, and Level 3 access for only a 10 subset of service specialists within Philips. Id. 11 Philips has developed and implemented measures to protect 12 the confidentiality of its CSIP. Id. ¶¶ 24-26. For example, 13 Philips’ Integrated Security Tool (“IST”), a digital rights 14 management solution, prevents unauthorized access to Philips’ 15 CSIP. Id. ¶ 27. Philips generates a user-specific IST 16 certificate that controls the documents and service tools the 17 user is entitled to access. Id. Each IST certificate is valid 18 for 30 days and must be renewed, otherwise the IST certificate 19 expires. Id. ¶ 29. Thus, a customer who enters into a service 20 contract with non-disclosure terms may access certain service 21 tools not available to a customer who has not. Id. ¶ 30. 22 Advanced Imaging Services Inc has never been issued an IST 23 certificate beyond CSIP Level 0. Id. ¶ 36. However, a Philips 24 employee observed Sean Wang, on behalf of Advanced Imaging 25 Services, using false login credential to access Philips’ 26 restricted CSIP materials in order to service the Philips 27 systems. Id. ¶¶ 34-36. Philips’ subsequent investigation 28 uncovered that Advanced Imaging Services has used false IST 1 accounts to gain unauthorized access to Philips’ proprietary CSIP 2 a few times. Id. ¶ 35. 3 In response, Philips filed this action against Advanced 4 Imaging Services and Sean Wang (“Defendants”) alleging: 5 (1) violation of the Computer Fraud and Abuse Act; (2) violation 6 of California’s Comprehensive Computer Data Access and Fraud Act; 7 (3) violation of the Digital Millennium Copyright Act; 8 (4) violation of the Defend Trade Secrets Act; (5) violation of 9 California’s Uniform Trade Secrets Act; (6) violation of the 10 California Unfair Trade Practices Act; and (7) fraud. See 11 generally Compl. Defendants now move to dismiss the first, 12 second, fourth, fifth, and seventh causes of action. See 13 generally Def.’s Mot, ECF No. 37. Plaintiff opposed this motion. 14 See Opp’n, ECF No. 61. Defendants replied. Reply, ECF No. 62. 15 For the reasons set forth below the Court grants in part and 16 denies in part Defendants’ motion. 17 II. OPINION 18 A. Legal Standard 19 A Rule 12(b)(6) motion challenges the complaint as not 20 alleging sufficient facts to state a claim for relief. Fed. R. 21 Civ. P. 12(b)(6). “To survive a motion to dismiss [under 22 12(b)(6)], a complaint must contain sufficient factual matter, 23 accepted as true, to state a claim for relief that is plausible 24 on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) 25 (internal quotation marks and citation omitted). While 26 “detailed factual allegations” are unnecessary, the complaint 27 must allege more than “[t]hreadbare recitals of the elements of 28 a cause of action, supported by mere conclusory statements.” 1 Id. “In sum, for a complaint to survive a motion to dismiss, 2 the non-conclusory ‘factual content,’ and reasonable inferences 3 from that content, must be plausibly suggestive of a claim 4 entitling the plaintiff to relief.” Moss v. U.S. Secret Serv., 5 572 F.3d 962, 969 (9th Cir. 2009). 6 B. Analysis 7 1. Computer Fraud and Abuse Act 8 Philips alleges Defendants violated § 1030(a)(2)(c) and 9 § 1030(a)(4) of the Computer Fraud and Abuse Act (“CFAA”). 10 Compl. ¶¶ 52, 54. To successfully bring an action under 18 11 U.S.C. § 1030(a)(2)(c), a plaintiff must establish that the 12 defendant: “(1) intentionally accessed a computer, (2) without 13 authorization or exceeding authorized access, and that he 14 (3) thereby obtained information (4) from any protected computer 15 [. . .], and that (5) there was loss to one or more persons 16 during any one-year period aggregating at least $5,000 in 17 value.” LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th 18 Cir. 2009). To bring a claim under 18 U.S.C. § 1030(a)(4), a 19 plaintiff must establish the defendant “(1) accessed a protected 20 computer, (2) without authorization or exceeding such 21 authorization that was granted, (3) knowingly and with intent to 22 defraud, and thereby (4) furthered the intended fraud and 23 obtained anything of value, causing (5) a loss to one or more 24 persons during any one-year period aggregating at least $5,000 25 in value.” Id. (internal quotation marks and citation omitted). 26 Defendants argue Plaintiff has failed to state a claim 27 under the CFAA as it failed to allege any facts regarding the 28 information obtained by Defendants. Def.’s Mot. at 11. 1 Defendants contend the only plausible allegation of anything 2 Defendants may have obtained is the fake IST certificates which 3 Plaintiff acknowledges came from a third-party. Id. at 11-12. 4 Not so. Plaintiff alleges that Defendants obtained information 5 from the Philips systems when they used the fake IST 6 certificates to gain a higher level of authorization. Compl. 7 ¶ 35. Specifically, Defendants obtained Philips’ proprietary 8 information, documentation, and software for servicing its 9 medical imaging systems otherwise known as its CSIP. Id. ¶¶ 20, 10 35, 40 (“Philips’ subsequent investigation has uncovered that 11 Defendants have been obtaining false IST certificates to hack 12 through Philips’ access controls to gain unlicensed and 13 unauthorized access to Philips’ proprietary CSIP.”). Plaintiff 14 alleges that not only did Defendants obtain this information but 15 that they actually used the information to perform maintenance 16 and other services. Id. ¶ 52. This is sufficient to state a 17 claim under the CFAA. See United States v. Drew, 259 F.R.D. 18 449, 457 (C.D. Cal. 2009) (noting that “obtaining information 19 from a computer” has been described as including mere 20 observation of the data.). Accordingly, Defendants’ motion to 21 dismiss Plaintiff’s CFAA claim is denied. 22 2. Defend Trade Secrets Act and California Uniform 23 Trade Secrets Act Claims 24 Courts often analyze Defend Trade Secrets Act (“DTSA”) and 25 California Uniform Trade Secrets Act (“CUTSA”) claims together. 26 See InteliClear, LLC v. ETC Global Holdings, Inc., 978 F.3d 653, 27 657 (9th Cir. 2020) (noting courts have analyzed DTSA and CUTSA 28 claims together as the elements are substantially similar). For 1 both claims a plaintiff must allege that: (1) the plaintiff 2 owned trade secrets; (2) the defendant misappropriated the trade 3 secrets; and (3) the defendant’s actions damaged the plaintiff. 4 Space Data Corp. v. X, 16-cv-03260-BLF, 2017 WL 5013363, at *1 5 (N.D. Cal. Feb. 16, 2017). At the pleading stage, a plaintiff 6 need not “spell out the details of a trade secret.” Alta 7 Devices, Inc. v. LG Elecs., Inc., 343 F.Supp.3d 868, 881 (N.D. 8 Cal. 2018) (internal quotations and citation omitted). However, 9 “the complaint must do more than describe the subject matter of 10 the trade secrets in a ‘vague and conclusory’ manner.” E. & J. 11 Gallo Winery v. Instituut Voor Landbouw-En Visserijonderzoek, 12 17-cv-00808, 2018 WL 2463869, at *3 (E.D. Cal. June 1, 2018) 13 (internal citations omitted). 14 Defendants argue Plaintiff has failed to identify its trade 15 secret with sufficient particularity. Def.’s Mot. at 12-15. 16 Plaintiff describes its trade secret as “Customer Service 17 Intellectual Property (CSIP)”, encompassing the “proprietary 18 information, documentation, and software for servicing its 19 medical imaging systems.” Compl. ¶ 20. The Court finds 20 Plaintiff has provided sufficient specificity in the allegations 21 of its complaint for Defendants “to be on notice of what trade 22 secrets are at issue.” Synopsys, Inc. v. ATopTech, Inc., 13-cv- 23 02965 SC, 2013 WL 5770542, at *6 (N.D. Cal. Oct. 24, 2013). 24 Plaintiff specifies that the trade secrets relate to how to 25 service their medical imaging systems, including x-ray, MR, CT, 26 ultrasounds, and advanced molecular imaging systems. Compl. 27 ¶¶ 19, 20, 33, 78. This is sufficient to survive a motion to 28 dismiss. See Autodesk, Inc. v. ZWCAD Software Co., 14-cv-01409, 1 2015 WL 2265479, at *5 (N.D. Cal. May 13, 2015) (finding 2 sufficient particularity where plaintiff pled trade secret as 3 “portions of [source] code that underlie the commands, 4 interfaces and program files associated with the dozens of 5 specific features.”) Requiring Plaintiff to go into more detail 6 risks compelling public disclosure of the same trade secrets 7 Plaintiff seeks to protect. See Diodes, Inc. v. Franzen, 260 8 Cal. App. 2d 244, 252 (Ct. App. 1968) (“One who seeks to protect 9 his trade secrets from wrongful use or disclosure does not have 10 to spell out the details of the trade secret to avoid a demurrer 11 to a complaint. To so require would mean that the complainant 12 would have to destroy the very thing for which he sought 13 protection by making public the secret itself.”) 14 Defendants also argue Plaintiff has failed to adequately 15 allege they misappropriated the trade secrets. Def.’s Mot. at 16 15-16. Under both the DTSA and the CUTSA “misappropriation” 17 means either (1) the “[a]cquisition of a trade secret by another 18 person who knows or has reason to know that the trade secret was 19 acquired by improper means” or (2) the “[d]isclosure or use of a 20 trade secret of another without express or implied consent.” 18 21 U.S.C. § 1839(5); Cal. Civ. Code § 3426.1(b). But Plaintiff 22 does allege that Defendants used the trade secret without 23 consent. Specifically, Plaintiff claims that Defendants used 24 their trade secret to service the Philips systems without 25 permission. Compl. ¶ 34 (“Defendants have serviced the Philips 26 systems in the Los Angeles, California area, and specifically 27 the Philips systems at Providence St. John’s Healthcare Center 28 and SimonMed Beverly Hills, by using false login credentials to 1 access Philips’ restricted CSIP materials.”) (emphasis added). 2 Accordingly, the Court denies Defendants’ motion to dismiss 3 Plaintiff’s DTSA and CUTSA claims. 4 3. Preemption Under California’s Uniform Trade 5 Secrets Act 6 California’s Uniform Trade Secrets Act (“CUTSA”) “occupies 7 the field” of common law claims based on the misappropriation of 8 a trade secret. K.C. Multimedia, Inc. v. Bank of America Tech. 9 & Operations, Inc., 171 Cal.App.4th 939, 954 (2009). The Act, 10 however, does not supersede “(1) contractual remedies, whether 11 or not based upon misappropriation of a trade secret, [and] 12 (2) other civil remedies that are not based upon 13 misappropriation of a trade secret.” Cal. Civ. Code 14 § 3426.7(b). The Act’s language “implicitly preempts 15 alternative civil remedies based on trade secret 16 misappropriation.” K.C. Multimedia, 171 Cal.App.4th at 954 17 (citation omitted). A claim cannot simply depend on a 18 “different theory of liability” to survive CUTSA’s preemptive 19 effect. See id. at 957-59 & n. 7. Rather, CUTSA preempts 20 “common law claims that are based on the same nucleus of facts 21 as the misappropriation of trade secrets claim for relief.” Id. 22 at 958 (internal quotation marks and citation omitted). 23 Here, Plaintiff’s CUTSA claim alleges Defendants accessed 24 its network and trade secrets through improper means using fake 25 credentials. Compl. ¶¶ 35, 40, 94. Plaintiff’s fraud claim 26 also rests on the misrepresentation Defendants made in using 27 fake credentials. Id. ¶ 107. Thus, the CUTSA and fraud claims 28 all arise from Defendants’ unauthorized access to Plaintiff’s 1 system. Accordingly, these claims are based on the same 2 “nucleus of facts” and Plaintiff’s fraud claim is preempted by 3 CUTSA. K.C. Multimedia, 171 Cal.App.4th at 958. The Court 4 therefore grants Defendants’ motion to dismiss the fraud claim 5 with prejudice. See Gompper v. VISX, Inc., 298 F.3d 893, 898 6 (9th Cir. 2002) (finding leave to amend need not be granted when 7 amendment would be futile). Because the Court finds dismissal 8 of Plaintiff’s fraud claim is warranted on this ground, it does 9 not reach the parties’ additional arguments regarding dismissal 10 under Rule 9(b). See Def.’s Mot. at 16-19; Opp’n at 11-13. 11 Defendants also argue Plaintiff’s California Comprehensive 12 Computer Data Access and Fraud Act claim arises from the same 13 nucleus of facts as the CUTSA claim and is, therefore, 14 preempted. Def.’s Mot. at 20-22. Plaintiff argues this claim 15 is not subject to preemption under CUTSA because it is brought 16 pursuant to statute. Opp’n at 14. As this Court recently noted 17 California district courts are divided on the issue. See R.R. 18 Donnelley & Sons Company v. Pappas, 21-cv-00753-JAM-AC, 2021 WL 19 3488502, at *3 (E.D. Cal. Aug. 9, 2021) (collecting cases). “As 20 such, the Court errs on the side of caution and does not find 21 that the claim is preempted.” Id. Thus, Defendants’ motion to 22 dismiss this claim is denied. 23 III. Sanctions 24 Defendants exceeded the Court’s 5-page limit on reply 25 memoranda. See Reply; see also Order re Filing Requirements 26 (“Order”), ECF No. 3-2. Violations of the Court’s standing order 27 require the offending counsel, not the client, to pay $50.00 per 28 page over the page limit to the Clerk of Court. Order at 1. ———— mm DEINE II IE IIE IIE IRI I EIEIO IERIE IIE OS ESE IE OSE IR EE ee

1 Moreover, the Court did not consider arguments made past the page 2 limit. Id. Defendants’ reply brief exceeded the Court’s page 3 limit by five pages.* Accordingly, Defendants’ counsel must send 4 a check payable to the Clerk for the Eastern District of 5 California for $250.00 no later than seven days from the date of 6 | this order. 7 Iv. ORDER 8 For the reasons set forth above, the Court GRANTS IN PART 9 | AND DENIES IN PART Defendants’ Motion to Dismiss. The Court: 10 1. DENIES Defendants’ Motion to Dismiss Plaintiff’s CFAA 11 claim (first claim); California Comprehensive Computer Data 12 | Access and Fraud Act claim (second claim); DTSA Claim (fourth 13 claim); and CUTSA claim (fifth claim). 14 2, GRANTS Defendants’ Motion to Dismiss Plaintiff’s fraud 15 claim (seventh claim) with prejudice. 16 3. For violating the Court’s standing order, Defendants’ 17 counsel must send a check payable to the Clerk for the Eastern 18 District of California for $250.00 no later than seven days from 19 | the date of this order. 20 IT IS SO ORDERED. 21 Dated: October 29, 2021 22 kA 23 teiren staves odermacr 7008 24 25 26 27 2 The Court notes the parties stipulated to other page limits with respect to a different motion but not for this motion to 28 | dismiss. See Stipulation and Order at 4, ECF No. 47. 10