The Phoenix Company, Inc. v. Castro-Badillo

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF PUERTO RICO

THE PHOENIX COMPANY, INC., Plaintiff

v. CIVIL NO. 23-1371 (RAM) JAVIER CASTRO-BADILLO; ROCK SOLID TECHNOLOGIES, INC.,

Defendants.

OPINION AND ORDER RAÚL M. ARIAS-MARXUACH, United States District Judge I. FACTUAL AND PROCEDURAL BACKGROUND On July 17, 2023, Plaintiff The Phoenix Company, Inc. (“Plaintiff” or “Phoenix”) filed a lawsuit against Rock Solid Technologies, Inc. (“Rock Solid”) and Javier Castro-Badillo (“Castro-Badillo”) (collectively “Defendants”). (Docket No. 1). On December 7, 2023, Plaintiff filed an Amended Complaint alleging Defendants violated the Defend Trade Secrets Act, 18 U.S.C. § 1836., as well as the Computer Fraud and Abuse Act, 18 U.S.C. § 1830 (“the CFAA”), as well as Puerto Rico law. (Docket No. 19 ¶¶ 1.1, 7.2, 8.5, 9.3). Phoenix claims Defendants misappropriated a trade secret and accessed its computers and software, Monet GFS, without authorization. Id. On August 9, 2024, the Court issued an Opinion and Order granting co-defendant Rock Solid’s Motion to Dismiss Amended Complaint (the “Motion to Dismiss”) and thereby dismissing all federal law claims against Rock Solid.1 (Docket No. 44). Specifically, the Court concluded that Plaintiff failed to: (1) adequately allege facts showing there was a trade secret; and (2) adequately allege a computer fraud claim under 18 U.S.C. § 1030.

Id. The Court subsequently issued an order to show cause instructing Plaintiff “show cause as to (1) why the claims against Javier Castro-Badillo should not be dismissed in light of the Court's Opinion and Order at Docket No. 44; and (2) why the Court should not decline to exercise supplemental jurisdiction over the Puerto Rico law claims against all Defendants.” (Docket Nos. 53 and 54).2 Phoenix filed a one paragraph response to the order to show cause merely stating that it “incorporates the reasons stated in opposition to the motion to dismiss [ECF #37] and in support of the motion to amend [ECF#52] as reasons why this Court should not dismiss this action against Defendant Javier Castro Badillo.”

(Docket No. 53). II. LEGAL STANDARD Fed. R. Civ. P. 12(b)(6) provides for the dismissal of a complaint that “fails to state a claim upon which relief can be

1 The Court incorporates by reference that Opinion and Order in its entirety for the purposes of the present Motion.

2 Plaintiff failed to comply with the order to show cause at Docket No. 53 and the Court sua sponte granted Plaintiff an extension at Docket No. 54. granted.” Under Rule 12(b)(6), a plaintiff must plead enough facts to state a claim that is “plausible” on its face, and the “[f]actual allegations must be enough to raise a right to relief above the speculative level . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact).”

Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citations omitted). “[A] plaintiff’s obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Id. Further, a complaint will not stand if it offers only “naked assertion[s] devoid of further factual enhancements.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks and citation omitted). To determine whether a complaint has stated a plausible, non-speculative claim for relief, courts must treat non-conclusory factual allegations as true. See Nieto-Vicenty v. Valledor, 984 F. Supp. 2d 17, 20 (D.P.R. 2013) (citations omitted). In certain circumstances, “sua

sponte dismissals of complaints under Rule 12(b)(6) ... are appropriate,” under the condition that “the parties have been afforded notice and an opportunity to amend the complaint or otherwise respond.” Chute v. Walker, 281 F.3d 314, 319 (1st Cir. 2002) (quoting Futura Dev. of P.R., Inc. v. Estado Libre Asociado de P.R., 144 F.3d 7, 13–14 (1st Cir.1998)). III. DISCUSSION A. Plaintiff failed to adequately allege the existence of a trade secret.

As discussed at length in the Opinion and Order at Docket No. 44, Phoenix has failed to plead sufficient factual allegations to establish that it was plausibly in possession of a trade secret capable of being misappropriated by Castro-Badillo. “It is hornbook law that ‘the parties and the court cannot accurately decide the question of whether a trade secret exists without first understanding what precisely is asserted as a secret.’” Sutra, Inc. v. Iceland Exp., ehf, 2008 WL 2705580, at *3 (D. Mass. 2008) (quoting Charles Tait Graves and Brian D. Range, Identification of Trade Secret Claims in Litigation: Solutions for a Ubiquitous Dispute, 5 Nw. J. Tech. & Intell. Prop. 68, 69 (2006)); see also Mallet and Co. Inc. v. Lacayo, 16 F.4th 364, 380-81 (3d Cir. 2021) (explaining that “each . . . element[] is predicated on an adequate identification of what the plaintiff contends to be its trade secret”). The First Circuit has interpreted sufficient specificity to mean the plaintiff has “separate[d] the purported trade secrets from the other information . . . that was known to the trade.” Allstate Ins. Co. v. Fougere, 79 F.4th 172, 197 (1st Cir. 2023) (quoting TLS Mgmt. & Mktg. Servs., LLC, 966 F.3d 46, 49 (1st Cir.

2020)) (internal quotations and alterations omitted) (emphasis added). Phoenix’s factual allegations do not distinguish between matters of general knowledge in the trade and the particularities that make its software, Monet GFS, a trade secret. Phoenix alleges “[o]ne of the most innovative and distinct aspects of Monet GFS is the data storage design, which stores the information in a very

efficient manner.” (Docket No. 19 ¶ 3.3). Plaintiff claims the data storage design and the access codes constitute the trade secret that was misappropriated. Id. This fails to adequately describe any characteristics of the software that are distinguishable from that which is within the general or special knowledge of persons skilled in the trade. See Allstate, 79 F.4th at 197; TLS Mgmt., 966 F.3d at 49. Rather than alleging that its efficient data storage design is unique to its software and is not common among companies that provide similar services, Phoenix only asserts that the access codes for each municipality are different and “the software is updated and changes.” 3 (Docket No. 37 at 4). However, although the

access codes themselves are secret, they are not a “trade secret.” Courts in other circuits have held that passwords enabling access to confidential information are not themselves trade secrets unless they are “the product of any special formula or algorithm that it developed[.]” State Analysis, Inc. v. Am. Fin. Services

3 These factual allegations are made not in the Amended Complaint but instead in Plaintiff’s Opposition, and “new arguments, however, may not be made in reply briefs.” United States v. Toth, 33 F.5th 1, 19 (1st Cir. 2022). Assoc., 621 F. Supp. 2d 309, 321 (E.D. Va. 2009); see also North Star Media, LLC v. Winogradsky-Sobel, 2011 WL 13220157, at *10 (C.D. Cal. 2011) (“[A] software company’s proprietary algorithm for its computer programs may be a trade secret, . . . but the key to the safe where the algorithm is stored is not.”). This because,

while passwords “clearly have economic value given that they are integral to accessing [plaintiff’s] database, they have no independent economic value in the way a formula or a customer list might have.” State Analysis, 621 F. Supp. at 321. Therefore, because Plaintiff failed to adequately allege the existence of a trade secret, Phoenix’s claim against Castro-Badillo for misappropriation of a trade secret is hereby DISMISSED. B. Plaintiff failed to adequately allege loss as required by the CFAA.

To assert a claim under 18 U.S.C. § 1030, a plaintiff must establish that the defendant: (1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that he (3) thereby obtained information (4) from any protected computer (if the conduct involved an interstate or foreign communication), and that (5) there was loss to one or more persons during any one- year period at least $5,000 in value.

Philips Med. Sys. P.R., Inc. v. GIS Partners Corp., 203 F. Supp. 3d 221, 230 (D.P.R. 2016) (citing LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009)). All elements must be adequately alleged for plaintiff to “maintain a civil action against the violator.” 18 U.S.C. § 1030(g). A violator of this statute is one who “intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage[.]” id. § 1030(a)(5)(B). In its Amended Complaint, Phoenix clearly identifies Castro-

Badillo as the violator, alleging that he “intentionally breached the security of Phoenix computers with the purpose of obtaining unauthorized access to Monet GFS software, the database design, and the access codes, to make an unauthorized use and disclosure of such.” (Docket No. 19 ¶ 4.18). This allegation on its own satisfies four of the necessary elements to establish a computer fraud claim. See 18 U.S.C. § 1030(g). However, as discussed in the Court’s Opinion and Order at Docket No. 44, Phoenix fails to meet its burden showing a “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.” 18 U.S.C. § 1030(c)(4)(A)(i)(I). “Loss” is defined as “any reasonable cost to any victim, including the cost

of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). Courts generally require plaintiffs to “plead facts about its alleged damages under the CFAA.” HotSpot Therapeutics, Inc. v. Nurix Therapeutics, Inc., 2022 WL 16637988, at *6 (N.D.Cal. 2022) (granting a motion to dismiss where plaintiff merely stated they “suffered actual damages, including but not limited to lost profits”) (quoting Metabyte, Inc. v. NVIDIA Corp., 2013 WL 1729808, at *5 (N.D.Cal. 2013)). Another court in this district found the

loss requirement met when plaintiffs stated they hired a third party to investigate breaches, and to do so that third party “conducted a forensic analysis of these breaches, and had been paid $6,000.” GIS, 204 F. Supp. 3d at 229. In the Amended Complaint, Plaintiff alleges it “suffered a loss due to the time it spent investigating the damages caused by the breach and its loss in business, both of which exceed $5,000” and elsewhere “Defendant’s hacking of Plaintiff’s system caused an interruption in service which induced several of Plaintiff’s customers to cancel their contracts and therefore caused Plaintiff to lose revenue.” (Docket No. 19 ¶¶ 4.33, 6.7). These statements amount to no more than threadbare recitations of the statutory

definition of loss under 18 U.S.C. § 1030(e)(11) and as such fail to satisfy the final element of a claim under 18 U.S.C. § 1030. Plaintiff makes no factual allegations as to what investigative measures were taken to discover damages caused by the breach, fails to state what damage, if any, was actually caused by the alleged hacking, and simply states there was an “interruption of service” without providing facts as to what part of its services were interrupted. (Docket No. 19). Accordingly, Phoenix’s CFAA claims against Castro-Badillo is hereby DISMISSED. C. The Court declines to exercise supplemental jurisdiction over pendent Puerto Rico law claims.

A District Court “may decline to exercise supplemental jurisdiction over a claim” if the court “has dismissed all claims over which it has original jurisdiction[.]” 28 U.S.C. § 1367(c)(3). In federal-question cases, the dismissal of a “foundational federal claim” does not automatically “deprive a federal court of authority to exercise supplemental jurisdiction over pendent state-law claims. Instead, such a dismissal ‘sets the stage for an exercise’ of the district court's broad discretion.” Sexual Minorities Uganda v. Lively, 899 F.3d 24, 35 (1st Cir. 2018) (quoting Roche v. John Hancock Mut. Life Ins. Co., 81 F.3d 249, 256-57 (1st Cir. 1996)) (internal citations omitted) (emphasis added). When exercising said broad and “informed discretion[,]” courts should engage in a “pragmatic and case-specific” analysis. Roche, 81 F. 3d, 256-57. While “[n]o categorical rule governs the analysis; a court must weigh concerns of comity, judicial economy, convenience, and fairness.” Redondo Const. Corp. v. Izquierdo, 662 F.3d 42, 49 (1st Cir. 2011). Notably, the First Circuit has cautioned that “when all federal claims have been dismissed, it is an abuse of discretion

for a district court to retain jurisdiction over the remaining pendent state law claims unless doing so would serve the interests of fairness, judicial economy, convenience, and comity.” Zell v. Ricci, 957 F.3d 1, 15 (1st Cir. 2020) (quoting Wilber v. Curtis, 872 F.3d 15, 23 (1st Cir. 2017)) (internal quotations omitted) (emphasis added). See also Carnegie–Mellon University v. Cohill,

484 U.S. 343, 350 n. 7 (1988) (“in the usual case in which all federal-law claims are eliminated before trial, the balance of factors ... will point toward declining to exercise jurisdiction over the remaining state-law claims.”). Given that Plaintiff’s the federal claims are being dismissed at the pleading stage, the Court declines to exercise supplemental jurisdiction pursuant to 28 U.S.C. § 1367(c). All of Phoenix’ supplemental claims under Puerto Rico law against both co-defendants, are hereby DISMISSED WITHOUT PREJUDICE. IV. CONCLUSION For the foregoing reasons, Phoenix’s federal law claims against Castro-Badillo are DISMISSED WITH PREJUDICE and the

totality of Phoenix’s Puerto Rico law claims against both Defendants are DISMISSED WITHOUT PREJUDICE. Judgment shall be entered accordingly. IT IS SO ORDERED. In San Juan, Puerto Rico, this 25th day of November 2024.

s/Raúl M. Arias-Marxuach_________ UNITED STATES DISTRICT JUDGE