Run The World Inc. v. Jiang

Opinion

RUN THE WORLD INC., Case No. 23-cv-03130-AMO

Plaintiff, ORDER GRANTING MOTIONS TO v. DISMISS COUNTERCLAIMS

XUAN JIANG, Re: Dkt. Nos. 80, 82, 85 Defendant.

This is a Computer Fraud and Abuse Act (“CFAA”) case. Counterclaim Defendants’ several motions to dismiss were heard before this Court on August 1, 2024.1 Having read the papers filed by the parties and carefully considered their arguments therein and those made at the hearing, as well as the relevant legal authority, the Court hereby GRANTS the Counterclaim Defendants’ motions to dismiss, for the reasons stated below. In 2019, Xuan Jiang and Xiaoyin Qu co-founded Run The World, Inc. (“RTW”), an online platform for hosting virtual events such as professional conferences. Second Am. Countercl. (ECF 78, “SACC”) ¶¶ 2, 13. Qu was the company’s CEO, Jiang was its Director of Engineering and Chief Technical Officer, and both were shareholders. SACC ¶ 14. RTW initially enjoyed success under Qu’s leadership, with investors initially valuing the company at $60 million by May 2020. SACC ¶¶ 18, 23. 1 At the hearing, the Court granted the motions to stay discovery of Counterclaim Defendants Qu, Chan, and AH Capital Management, LLC. ECF 101, ECF 103. The Court additionally denied On April 3, 2023, Jiang sent an email to RTW’s primary investor saying that Jiang had “made the decision to step down as the tech co-founder of Run The World” to “pursue a new opportunity,” and expressing Jiang’s stated view that, even without her “continued involvement,” RTW “ha[d] a bright future ahead.” SACC ¶ 208, Compl. (ECF 1) ¶¶ 23-24 & Ex. D; Answer (ECF 16) ¶ 23. The parties disagree about what led to Jiang’s resignation email and what happened next. A. Run the World’s Claims Against Jiang RTW alleges in its Complaint that its business depended on its customer-facing website, www.runtheworld.today, which in turn relied on a network of internal domains and developer tools, including the “rtw.team” and “rtw.today” domains. Compl. ¶¶ 12, 15-16, 33. RTW further alleges that soon after Jiang resigned and then tried to retract that resignation, its websites began experiencing outages that left 700,000 RTW user accounts inaccessible for over a week. Compl. ¶¶ 23-33. These outages were linked to Jiang’s deletion or cancellation of the internal domains, which were maintained by third-party domain registrar GoDaddy. Compl. ¶¶ 12, 28-32; see also Answer ¶ 32 (acknowledging Jiang’s conduct). Jiang’s primary response to that admitted conduct is that one of the domains, rtw.team, was her “personal property.” See Answer ¶¶ 7, 14-15. Jiang also admits to having wiped her company-issued laptop and refusing to return other RTW property. Compl. ¶¶ 36-43; Answer ¶¶ 37, 42. B. Jiang’s Amended Counterclaims and the Allegations at Issue in These Motions Jiang answered RTW’s suit and asserted a total of 20 counterclaims against RTW, Qu, one of RTW’s investors (AH Capital Management, LLC, “a16z”), and one of that investor’s general partners (Connie Chan). ECF 16. Jiang then filed her First Amended Counterclaims on February 6, 2024, listing the same 20 counterclaims. ECF 58. The parties stipulated to permit Jiang to file her Second Amended Counterclaims, in which she would drop her Twentieth Counterclaim (abuse of process), as well as related language in several other allegations. Compare ECF 58, ¶¶ 61,76 (partial), 90 (partial), 112 (partial) 118 (partial) 237-242 with ECF 78. Jiang alleges in her SACC that she entered into a Restricted Stock Purchase Agreement period. See SACC ¶ 14. Qu purportedly “recognized that the end of RTW was near” as a result of Qu’s purported mismanagement and shifted her focus to winding down the company, thereby harming its share value. See SACC ¶¶ 25-26, 29, 34-42. Qu then aimed to oust Jiang to prevent her from blocking a potential sale of the company. SACC ¶¶ 34, 44. Despite the resignation email mentioned above, Jiang contends that she never resigned, or that if she did, she was induced to do so by misrepresentations that RTW would be wound down. SACC ¶¶ 198-209. Jiang contends that she did not resign, she was wrongfully terminated. She explains that she was forced out so that Qu and other shareholders could enrich themselves, and that Qu harassed and terminated her because she was pregnant. SACC ¶¶ 32-33, 43-54, 60-61. Jiang avers that the termination violated a contract that could only be terminated for cause – though her written, integrated employment contract expressly and repeatedly described her employment as “at-will.” SACC ¶¶ 122-26; Hayward Decl., Ex. 1, ¶ 5. Jiang also complains that her alleged termination deprived her of rights to RTW equity that had not yet vested – though the RSPA on which she relies made clear that equity vesting was contingent on Jiang’s continued at-will service as an employee or director. SACC ¶¶ 192-96; Hayward Decl., Ex. 2 ¶ 10K. Finally, Jiang alleges that Qu tortiously accessed, without Jiang’s permission, Jiang’s personal account on GoDaddy that hosted the domain “rtw.team,” and which was used “to test new features that could be implemented in RTW.” SACC ¶¶ 16, 21-22, 37-38, 169-74, 233-35. Counterclaim Defendants all move to dismiss the Second Amended Counterclaim under both Rule 12(b)(6) for failure to state a claim and Rule 12(b)(1) for lack of subject matter jurisdiction. Jiang’s sole federal cause of action is her counterclaim under the Computer Fraud and Abuse Act (CFAA), and Counterclaim Defendants all argue that, because she fails to state a claim for violation of the CFAA, the Court should decline to exercise supplemental jurisdiction over her remaining 18 counterclaims arising under state law. A. Failure to State a Claim (Rule 12(b)(6)) Counterclaim Defendants all argue that Jiang fails to state a claim under CFAA.2 1. Legal Standard A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests for the legal sufficiency of the claims alleged in the complaint. Ileto v. Glock, 349 F.3d 1191, 1199-1200 (9th Cir. 2003). Under Federal Rule of Civil Procedure 8, which requires that a complaint include a “short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), a complaint may be dismissed under Rule 12(b)(6) if the plaintiff fails to state a cognizable legal theory, or has not alleged sufficient facts to support a cognizable legal theory. Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). While the court is to accept as true all the factual allegations in the complaint, legally conclusory statements, not supported by actual factual allegations, need not be accepted. Ashcroft v. Iqbal, 556 U.S. 662, 678-79 (2009). The complaint must proffer sufficient facts to state a claim for relief that is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 558-59 (2007) (citations and quotations omitted). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citation omitted). “[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged – but it has not ‘show[n]’ – that the pleader is entitled to relief.” Id. at 679. Where dismissal is warranted, it is generally without prejudice, unless it is clear the complaint cannot be saved by any amendment. Sparling v. Daou, 411 F.3d 1006, 1013 (9th Cir. 2005). 2. Computer Fraud and Abuse Act (Eleventh Counterclaim) Jiang alleges that Qu violated portions of CFAA: Title 18 U.S.C. § 1030(a)(5)(A), (B), and (C). SACC ¶ 170 (citation corrected). Those subsections require her to plead that Qu either: 2 Jiang argues that most of the Counterclaim Defendants lack standing to challenge the CFAA cause of action because it is only alleged against Qu. The Court finds this argument unavailing knowingly caused the transmission of a program, information, code, or command that intentionally caused damage, without authorization, to a protected computer (subsection (a)(5)(A)); intentionally accessed a protected computer, without authorization, and recklessly caused damage (subsection (a)(5)(B)); or intentionally accessed a protected computer, without authorization, and caused damage and loss (subsection (a)(5)(C)). Jiang contends that Qu violated CFAA by accessing and taking possession of the rtw.team domain by accessing Jiang’s personal GoDaddy account without Jiang’s authorization, and changing Jiang’s password and email address on the account “to lock-out Jiang from accessing her own personal account.” SACC ¶ 172. Counterclaim Defendants advance two challenges to the CFAA counterclaim: (a) that Jiang fails to allege damage to a “computer” rather than to an online account and (b) that Jiang fails to allege the required “harm” and “loss” under the CFAA. The Court focuses only on the latter – whether Jiang sufficiently pleads “harm” and “loss.” “The CFFA was enacted to prevent intentional intrusion onto someone else’s computer – specifically, computer hacking” and “is best understood as an anti-intrusion statute and not as a misappropriation statute.” HiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1196 (9th Cir. 2022) (internal quotations and citations omitted). The damage asserted in support of a CFAA claim must be “harm to computers or networks, not economic harm due to the commercial value of the data itself.” NetApp, Inc. v. Nimble Storage, Inc., 41 F. Supp. 3d 816, 834 (N.D. Cal. 2014) (collecting cases). Separately and in addition to harm to computers, a civil claim under the CFAA requires “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.” 18 U.S.C. § 1030(c)(4)(A)(i)(I); Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1262 (9th Cir. 2019). The CFAA “defines ‘loss’ as ‘any reasonable cost to any victim, including the cost of responding to an offense, conducting a damages assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.’” Andrews, 932 F.3d at 1262 (quoting 18 U.S.C. § 1030(e)(11)). Recovery in a civil action based on an alleged violation of subsection (c)(4)(A)(i)(I) – the subsection at issue in this case – is expressly limited to Jiang fails to plead economic damages based on access to her GoDaddy account. See Brodsky v. Apple Inc., 19-CV-00712, 2019 WL 4141936, at *8 (N.D. Cal. Aug. 30, 2019). She claims only damages based on “Jiang’s own ingenuity, time, money, and resources in creating, developing, and maintaining the software and developer tools hosted on her personal GoDaddy account, which Jiang routinely used to earn a living as a software developer.” SACC ¶ 174. This does not constitute harm to a computer, particularly where Jiang cannot specify any lasting impact to the computer code. Moreover, Jiang’s counsel stated at the hearing that any impairment to the availability of data lasted little more than a day. Jiang cannot establish harm to a computer on these facts. Cf. NovelPoster v. Javitch Canfield Grp., 140 F. Supp. 3d 954, 961-62 (N.D. Cal. 2014) (finding seven-month interruption of service to constitute damage under CFAA). Regarding loss, Jiang contends that Qu attempted to lock her out of the GoDaddy account and that her “identity” and “developer tools and stored code bases . . . were compromised.” SACC ¶¶ 172-173. None of these allegations establish economic damages. See, e.g., NetApp, Inc., 41 F. Supp. 3d at 834 (“NetApp alleges only that Reynolds accessed its databases without permission, not that he damaged any systems or destroyed any data.”). Even if Jiang could allege any qualifying damage, she fails to allege facts showing at least $5,000 of loss as required by the CFAA. See Brodsky, 2019 WL 4141936, at *8 (finding conclusory allegations about loss insufficient, especially so when plaintiff failed to allege a dollar value of any alleged damage). The Court therefore DISMISSES the CFAA cause of action on this basis. At the hearing, the Court asked if Jiang could bolster the harm and loss aspects of her CFAA claim if granted leave to amend. Counsel stated that fact discovery would be necessary to produce additional factual support, particularly with regard to any file corruption of the code accessed through the contested GoDaddy account. This falls short of showing that Jiang would be able to add facts in support of her claim, and the Court accordingly finds that amendment would prove futile. See Sparling, 411 F.3d at 1013. Jiang’s CFAA cause of action is accordingly // B. Subject Matter Jurisdiction Over Remaining State Law Claims (Rule 12(b)(1)) As noted above, Counterclaim Defendants move to dismiss the remainder of Jiang’s state law counterclaims in light of the deficiencies in her CFAA counterclaim, arguing that the court should decline supplemental jurisdiction over them. A motion under Rule 12(b)(1) tests the Court’s subject-matter jurisdiction. Where, as here, the challenge relies solely on the pleadings, the question is whether the “allege[d] facts” are “sufficient as a legal matter to invoke the court’s jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). Federal courts have limited jurisdiction but may, in specific instances, maintain supplemental jurisdiction over claims and counterclaims which have no other basis for jurisdiction in federal court. 28 U.S.C. § 1367. A court has jurisdiction over state law claims “that are so related to claims” brought under the Court’s federal question jurisdiction “that they form part of the same case or controversy under Article III.” Id. The assessment of whether such a claim forms part of the same “case or controversy,” requires the Court to determine whether the federal claim and the state law claim arise from the same “common nucleus of operative fact.” In re Pegasus Gold Corp., 394 F.3d 1189, 1195 (9th Cir. 2005) (citing United Mine Workers v. Gibbs, 383 U.S. 715, 725 (1966)); Bahrampour v. Lampert, 356 F.3d 969, 978 (9th Cir. 2004). Closely related to the jurisdictional inquiry under Section 1367 is Federal Rule of Civil Procedure 13, which governs the process by which a defendant may allege counterclaims. Counterclaims may be compulsory or permissive. Fed. R. Civ. P. 13. If a counterclaim “arises out of the transaction or occurrence that is the subject matter of the opposing party's claim,” it is compulsory and must be raised in response to the opposing party’s claim unless an exception applies. Fed. R. Civ. P. 13(a). Thus, under Rule 13(a), a court must consider whether “the essential facts of the various claims are so logically connected that considerations of judicial economy and fairness dictate that all the issues be resolved in one lawsuit.” Pochiro v. Prudential Ins. Co. of Am., 827 F.2d 1246, 1249 (9th Cir. 1987). All other counterclaims are permissive and need not be raised in the same lawsuit. Fed. R. Civ. P. 13(b). Here, the only basis for federal subject matter jurisdiction that Jiang alleges is federal remaining counterclaims under Section 1367. SACC ¶ 7. Jiang argues that all of her state court claims arise from the same case or controversy and are compulsory counterclaims, if not permissive counterclaims. Opp. (ECF 87) at 11-12. RTW’s Complaint alleges that Jiang accessed protected computers and sabotaged RTW’s business, mostly in April 2023. See Compl. (ECF 1) ¶¶ 26-52. In contrast, Jiang’s Counterclaims center on a related, though different set of facts spanning a greater amount of time, including a purported scheme to enrich other shareholders, wrongful termination of her employment, and employment discrimination based on her pregnancy. See, e.g., SACC ¶¶ 11-64. Jiang’s state law counterclaims do not arise out of the same transaction or occurrence as her alleged disruption of the company’s internal domains, and they are thus not compulsory counterclaims to RTW’s CFAA claim under Rule 13. Because the Court dismissed the sole federal claim among Jiang’s Counterclaims, the Court declines to exercise supplemental jurisdiction pursuant to 28 U.S.C. § 1367(c)(3) over the remaining state law claims. See Wade v. Reg’l Credit Ass’n, 87 F.3d 1098, 1101 (9th Cir. 1996) (“Where a district court dismisses a federal claim, leaving only state claims for resolution, it should decline jurisdiction over the state claims and dismiss without prejudice.”); see, e.g., Sikhs for Just. “SFJ”, Inc. v. Facebook, Inc., 144 F. Supp. 3d 1088, 1096-97 (N.D. Cal. 2015), aff’d sub nom. Sikhs for Just., Inc. v. Facebook, Inc., 697 F. App’x 526 (9th Cir. 2017) (declining to exercise supplemental jurisdiction over state law claims where the case had not proceeded beyond the pleadings and dismissal “promote[d] comity by allowing the California courts to interpret state law in the first instance”). The Court therefore DISMISSES the counterclaims without prejudice to Jiang filing them in state court. // // // // // 1 CONCLUSION 2 For the foregoing reasons, the Court DISMISSES Jiang’s CFAA counterclaim with 3 prejudice. The Court declines to exercise jurisdiction over Jiang’s 18 remaining state law claims 4 and accordingly DISMISSES those counterclaims without prejudice to filing in state court. 6 Dated: August 2, 2024 7 - 3 . ARACELI MARTINEZ-OLGUIN 9 United States District Judge 10 11 12

15 16 & it

Z 18 19 20 21 22 23 24 25 26 27 28