TrustLabs, Inc. v. An

Opinion

TRUSTLABS, INC., Case No. 21-cv-02606-CRB

Plaintiff,

ORDER GRANTING IN PART AND v. DENYING IN PART MOTION FOR SUMMARY JUDGMENT Defendant.

Defendant Daniel Jaiyong An is the cofounder and former CEO of Plaintiff TrustLabs, Inc., a cryptocurrency company. Just before An was fired as CEO, he deleted TrustLabs’ account with Slack, an electronic messaging service that TrustLabs employees frequently used to communicate with one another. TrustLabs sued An under two federal statutes, the Computer Fraud and Abuse Act and the Stored Communications Act, and one California statute, the Comprehensive Computer Data Access and Fraud Act. TrustLabs also seeks punitive damages against An. TrustLabs now moves for summary judgment. The Court finds the matter suitable for resolution without oral argument pursuant to Local Civil Rule 7-1(b), GRANTS the motion as to liability under the California statute, and otherwise DENIES the motion. I. BACKGROUND1 Leading up to July 2023, Defendant An was the CEO of Plaintiff TrustLabs. Alexader de Lorraine Decl. (dkt. 140-3) ¶ 4. Rafael Cosman was TrustLabs’ other

1 The Court views the evidence in the light most favorable to An as the party opposing cofounder, see Alexander de Lorraine Dep. (dkt. 143, Ex. C) at 23:25–24:1, and Alexander de Lorraine was TrustLabs’ Director of Finance and Operations, see de Lorraine Decl. ¶ 2. Cosman and de Lorraine met with An during the last week of June 2023 to discuss their concerns about his performance, and on July 2 de Lorraine told An that TrustLabs’ shareholders “would like to remove [him] from the board” and from his position as CEO. de Lorraine Dep. at 14:7–8. An does not remember these conversations but does not contest that they occurred. Daniel Jaiyong An Dep. (dkt. 140-1, Ex. 1) at 156:2–6. Soon after, on July 6, Cosman emailed An: At the end of your conversation with Alex de Lorraine, you mentioned that you would step down as CEO of TrustLabs, Inc. We have not received your official resignation letter and ask that you forward it by 4pm PST today, the 6th of July 2020. Please note that if we do not receive your answer at or before 4 pm we are forced to enact a stockholder consent which will replace the board of TrustLabs, Inc. and hire a new CEO. … If you choose to resign, the Company is agreeable to treating your resignation as a termination by you for Good Reason and working with you to communicate the decision to the public. If you do not provide an answer by 4 pm and the Company enacts the stockholder consent, the public narrative will necessarily change. Id. Exh. 5 (Cosman email) (emphasis omitted). An denies that he ever told de Lorraine that he would resign as CEO. Id. at 156:10–13. An did not tender a resignation letter by 4 p.m. on July 6 or otherwise respond to Cosman’s email. Instead, at 6:36 p.m. he deleted TrustLabs’ Slack account. Def.’s Am. Resps. to Pl.’s Requests for Admission (dkt. 140-1, Ex. 6) at 4. Slack was “one of [TrustLabs’] main means of communication,” Anna Arpilleda Dep. (dkt. 140-1, Ex. 4) at 18:12–14, and a “critical piece of company infrastructure,” de Lorraine Dep. at 37:5–6. While TrustLabs’ Slack account was inactive, “[b]usiness pretty much ground to a halt” and “[f]orward progress on company initiatives … was little to none.” Id. at 37:6–16. TrustLabs was able to secure Slack access approximately 12 hours later. Id. at 32:6–12. Decl. (dkt. 140-2) ¶¶ 6–7; de Lorraine Decl. ¶ 8. After An deleted TrustLabs’ Slack account, TrustLabs conducted an emergency stockholder vote, called an emergency session of its board of directors, and voted to remove An from the company board and as CEO. An Dep. Exh. 6 (termination letter). TrustLabs formally terminated An’s employment on July 7. Id. Several days later, an individual using An’s name and email address tried to access TrustLabs’ email marketing list and social media accounts. Id. Exh. 13 (cease and desist letter). And on July 24 An emailed the legal counsel of one of TrustLabs’ clients to propose details for an upcoming deal. Id. Exh. 11 (An email). TrustLabs sued An under three statutes: the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030; the federal Stored Communications Act, 18 U.S.C. § 2701, et seq.; and California’s Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502. Compl. (dkt. 1) ¶¶ 26–40. Before the Court is TrustLabs’ motion for summary judgment on all three counts. MSJ (dkt. 140). Summary judgment is proper when there is “no genuine dispute as to any material fact and the [moving party] is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). Material facts are those that may affect the outcome of the case. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A dispute is genuine if “the evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Id. The moving party bears the initial burden of identifying those portions of the pleadings, discovery, and affidavits that demonstrate the absence of a genuine issue of material fact. Celotex Corp. v. Cattrett, 477 U.S. 317, 323 (1986). Once the moving party meets its initial burden, the nonmoving party must go beyond the pleadings to demonstrate the existence of a genuine dispute of material fact by “citing to particular parts of materials in the record” or “showing that the materials cited do not establish the absence or presence of a genuine dispute.” Fed. R. Civ. P. 56(c). If the nonmoving party fails to do so, “the TrustLabs brings against An two federal statutory claims and one state statutory claim. Though the three statutes at issue regulate different conduct, for purposes of this case they apply in similar ways. A. Statutory Standing TrustLabs has established that it suffered over $6,000 in damages when An deleted the company’s Slack account. That is sufficient under all three statutes. See 18 U.S.C. § 1030(c)(4)(A)(i)(I), (g) ($5,000 threshold for private suit under the CFAA); Hahn v. Rothman, No. CV 09-249 ODW, 2010 WL 11507395, at *4–5 (C.D. Cal. Oct. 8, 2010) (citing 18 U.S.C. § 2707(c)) (no damages threshold under the SCA); Mintz v. Mark Bartelstein & Assocs. Inc., 906 F. Supp. 2d 1017, 1032 (C.D. Cal. 2012) (citing Cal. Penal Code § 502) (no damages threshold under the CCDAFA). For his part, An fails to offer any evidence to meaningfully contest the amount of damages. He points to deposition testimony that it took “less than 12 hours” to restore Slack access, de Lorraine Dep. at 32:6–12, but that testimony is consistent with TrustLabs’ assertion that it took over 50 hours to “recover[] the Company’s Slack account” and also “ensur[e] the security of TrustLabs’ remaining digital resources” by “reintegrat[ing] all Slack connections to Company systems, review[ing] access to shared channels, and updat[ing] administrative access credentials.” MSJ at 7 (citing Moore Decl. ¶¶ 4–7). An also argues that TrustLabs’ request for over $6,000 in damages is “convenient” (because it is just slightly over the CFAA’s $5,000 damages threshold) and that TrustLabs’ litigation strategy “suggests that [its] true motive is not to recover minimal losses, but rather to use the legal system as a weapon for retaliation or harassment.” MSJ Opp. (dkt. 143) at 6–7. Yet such “speculation and guesswork” is not enough to create a genuine dispute of material fact. Guidroz-Brault v. Mo. Pac. Ry. Co., 254 F.3d 825, 829 (9th Cir. 2001). B. Qualifying Conduct An concedes that he deleted TrustLabs’ Slack account. This is qualifying conduct First, deleting TrustLabs’ Slack account implicates the CFAA, which prohibits “knowingly caus[ing] the transmission of a program, information, code, or command … to a protected computer.” 18 U.S.C. § 1030(a)(5)(A). An’s computer qualifies as a “protected computer” because TrustLabs operates nationally and internationally. de Lorraine Decl. ¶ 10; see also 18 U.S.C. § 1030(e)(2)(B) (a “protected computer” is one that “is used in or affecting interstate or foreign commerce or communication”). Second, An’s conduct implicates the SCA, which prohibits “intentionally access[ing] … a facility through which an electronic communication service is provided … and thereby obtain[ing], alter[ing], or prevent[ing] authorized access to a wire or electronic communication while it is in electronic storage in such system.” 18 U.S.C. § 2701(a). TrustLabs’ Slack account is a “facility through which an electronic communication service is provided” as it “provides to users [] the ability to send or receive wire or electronic communications.” Id. § 2510(15); see also In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1057 (N.D. Cal. 2012) (“the computer systems of an email provider, a bulletin board system, or an ISP are uncontroversial examples of facilities that provide electronic communications services”).2 Third, An’s conduct falls under several provisions of the CCDAFA. As relevant here, that statute prohibits (1) knowingly “alter[ing], damage[ing], delet[ing], or destroy[ing] any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network”; (2) knowingly “disrupt[ing] or caus[ing] the disruption of computer services”; and (3) knowingly “den[ying] or caus[ing] the denial of computer services to an authorized user of a computer, computer system, or computer network.” Cal. Penal Code § 502(c)(4)–(5). Slack, an “electronic message service,” is a “computer service” for purposes of California’s statute. Id. § 502(b)(4). An does not contest that these statutes apply to deleting TrustLabs’ Slack account. C. Authorization or Permission The core dispute in this action is An’s status with respect to TrustLabs when he deleted the company’s Slack account. Both the CFAA and the SCA prohibit conduct that is without authorization or in excess of authorization. See 18 U.S.C. §§ 1030(a)(5)(A), 2701(a). California’s CCDAFA, meanwhile, prohibits conduct undertaken “without permission.” Cal. Penal Code § 502(c)(4), (5). Federal Claims. TrustLabs primarily relies on Cosman’s July 6, 2020 email to An as proof that An deleted the company’s Slack account without authorization. TrustLabs argues that An’s “authorization to access TrustLabs’ Slack account was revoked—at the latest—upon the Company’s formal notice that his employment would be involuntarily terminated if he did not provide a resignation letter by 4 p.m. on July 6, 2020.” MSJ at 12. But Cosman’s email does not conclusively establish that An’s authority as CEO—and with it, his authority to delete TrustLabs’ Slack account—was revoked at 4 p.m. on July 6, 2020. In his email, Cosman explained that “if we do not receive your answer at or before 4 pm we are forced to enact a stockholder consent which will replace the board of TrustLabs, Inc. and hire a new CEO.” An Dep. Exh. 5. While that statement could mean that An’s authority as CEO expired at 4 p.m. on July 6 whether or not he tendered his resignation, it could also mean that An’s failure to tender his resignation by 4 p.m. on July 6 would merely cause Cosman and de Lorraine to seek his termination through other means. Indeed, that is what seems to have played out: by refusing to resign, An initiated a sequence of events that ultimately culminated in the board firing him as CEO. It is at least possible that An’s authority as CEO did not expire until the board actually fired him— which it did only after An deleted the company’s Slack account. Additionally, it is not clear that Cosman (or de Lorraine, for that matter) himself had authority to strip An of his CEO role, so his email might not be of any legal significance. For these same reasons, TrustLabs’ reliance on Astec America LLC v. Li, No. 14CV1457 JLS, 2014 WL 12516024 (S.D. Cal. Nov. 17, 2014), is misplaced. That after the company had informed the employee of his pending termination and demanded the return of the laptop. Id. at *3. The court rejected the employee’s argument that he had authorization to access the laptop while his termination was pending and he was still an employee, holding that “once he went on medical leave and [the company] demanded the laptop be returned, his authority was revoked.” Id. Cosman’s email, by contrast, is more ambiguous. It contains no language equivalent to the demand in Astec America that the employee return the laptop. Nor does it establish that Cosman (or de Lorraine) even could revoke An’s authority as CEO—something not at issue in Astec America. This case is therefore unsuitable to resolving at summary judgment.3 To be clear, the Court does not hold that Cosman’s July 6, 2020 email is insufficient to establish that An’s authority was revoked as a matter of law. Context—such as details about the stockholder consent process or Cosman and de Lorraine’s authority—might be sufficient for a finder of fact to conclude that An’s authority as CEO was in fact revoked before he deleted TrustLabs’ Slack account. All the Court now holds is that the email is not enough, standing alone, to conclusively establish that An’s authority had been revoked. TrustLabs’ secondary argument is that An had agreed to resign as CEO at some point before July 6, 2020. MSJ Reply (dkt. 144) at 6. But An clearly disputes this: he declared under oath that he “never agreed nor provided indication that [he] would provide notice of resignation as CEO of TrustLabs ever.” Daniel Jaiyong An Decl. (dkt. 143) ¶ 3. TrustLabs tries to write off An’s declaration as “self-serving” and “conclusory,” MSJ Reply at 6 n.2, but it is of no legal significance that a declaration is self-serving, see Nigro v. Sears, Roebuck & Co., 784 F.3d 495, 497 (9th Cir. 2015), and it is not conclusory for An to deny that he made a specific statement. (Perhaps An’s additional statement that he never “provided indication” that he would resign is conclusory, but the Court need not, and does not, rely on that statement to deny summary judgment.) The finder of fact may well reject An’s testimony as to what he did or did not say leading up to July 6, 2020, but such a classic credibility determination is an issue for trial, not summary judgment. The Court therefore denies the motion for summary judgment with respect to TrustLabs’ federal claims. State Claim. Unlike the federal CFAA and SCA, California’s CCDAFA prohibits conduct undertaken “without permission,” rather than without authorization. California’s statute is thus more expansive, as it “may properly be applied to an employee who uses his or her authorized access to a computer system to disrupt or deny computer services to another lawful user.” People v. Childs, 220 Cal. App. 4th 1079, 1104 (2013) (CCDAFA properly applies to network engineer who configured county computer system to restrict access to anyone but himself); see also Cal. Pen. Code § 502(b)(10) (“‘Injury’ means … the denial of access to legitimate users of a computer system, network, or program.”). That said, California’s statute also includes a defense that the defendant acted “within the scope of [his] lawful employment”—that is, that his actions were “reasonably necessary to the performance of [his] work assignment.” Cal. Pen. Code § 502(h)(1); Childs, 220 Cal. App. 4th at 1102–03 (describing the “scope of employment” defense). TrustLabs has shown that when An deleted Slack, he denied access to that program to the entire company, including many legitimate users. And An fails to identify any evidence that deleting Slack was within the scope of his lawful employment.” He states in his brief that his “management of company communication systems, including the decision to transition away from Slack, falls within [the] scope” of his lawful employment, MSJ Opp. at 11, but he does not support this assertion with evidence, and “[u]nsupported allegations made in briefs are not sufficient [] to defeat a motion for summary judgment.” Stanley v. Univ. of S. Cal., 178 F.3d 1069, 1076 (9th Cir. 1999). At bottom, An points to no evidence, and the Court could not find any, to suggest that it was reasonably necessary for him to delete TrustLabs’ Slack account when he did so. The Court therefore GRANTS summary adjudication against An as to An’s liability under the CCDAFA. D. Punitive Damages The final issue is the question of punitive damages. TrustLabs argues that An not only acted knowingly (the requisite intent for liability under all three statutes)4 but that he also acted intentionally and with malice and therefore owes punitive damages. MSJ at 19– 20. As evidence of An’s intent and malice, TrustLabs points to An’s post-termination conduct—specifically, his purported attempts to log into several of the company’s accounts and his communications with one of the company’s clients. Id. An vigorously contests TrustLabs’ assertion that he acted maliciously. In doing so, he raises various allegations of misconduct on the part of TrustLabs, apparently for the purpose of portraying himself as a sort of whistleblower acting with pure intentions. See MSJ Opp. at 6, 10–11, 23.5 While An failed to properly substantiate most of these allegations, and any evidence on this topic would be irrelevant to determining An’s statutory liability, TrustLabs’ alleged misconduct around the time that An was terminated may have some limited relevance to the question of punitive damages. So there is a genuine dispute of material fact as to whether punitive damages are appropriate, and the Court DENIES TrustLabs’ motion for summary judgment as to punitive damages on all counts.6 4 See 18 U.S.C. §§ 1030(a)(5), 2701(a); Cal. Pen. Code § 502(c)(4), (5). An does not seriously dispute that he acted knowingly when he deleted TrustLabs’ Slack account; indeed, he concedes that he did so and suggests only that his motive may have been legitimate. See MSJ Opp. at 6, 11. 5 An attempted to file supplemental authority consisting of an SEC complaint against TrustLabs and a press release regarding the parties’ subsequent settlement. Mot. for Leave to File Supp. Evid. (dkt. 145). This motion would be procedurally improper under either Local Civil Rule 7-3(d)(2), which applies only to “relevant judicial opinion[s]” (emphasis added), or Local Civil Rule 7-11, which requires a stipulation or a declaration explaining the absence of one. The authority itself is irrelevant in any case, as “a consent judgment between a federal agency and a private corporation [] is not the result of an actual adjudication of any of the issues.” Twin City Fire Ins. Co. v. SLRA Inc., No. 19-cv-6131- JSC, 2020 WL 3035793, at *4 (N.D. Cal. June 5, 2020) (quoting Lipsky v. Commonwealth United Corp., 551 F.2d 887, 893 (2d Cir. 1976)). An’s motion is therefore DENIED. 6 TrustLabs’ federal claims will go to trial regardless, so it is in the interest of judicial economy for the finder of fact to evaluate punitive damages for all three claims at the same time. See United Energy Trading, LLC v. Pac. Gas & Elec. Co., No. 15-cv-2383-RS, 2018 WL 11431182, at *6 n.6 (N.D. Cal. Jan. 22, 2018) (“Where an issue is closely intertwined For the foregoing reasons, the Court vacates the hearing set for November 15, 2024 at 10 a.m. and • GRANTS summary adjudication in favor of TrustLabs and against An as to liability under the Comprehensive Computer Data Access and Fraud Act; • DENIES summary adjudication as to liability under the Computer Fraud and Abuse Act and the Stored Communications Act; and • DENIES summary adjudication as to damages on all counts. Dated: November 13, 2024 CHARLES R. BREYER United States District Judge