United Rentals, Inc. v. Wilper

• Court: District Court, D. Connecticut
• Decided: September 9, 2022
• Docket: 3:21-cv-01445
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF CONNECTICUT

UNITED RENTALS, INC., and : UNITED RENTALS (NORTH : AMERICA) INC., : Civil Action No. 3:21-cv-01445 : (VLB) Plaintiffs, : v. : : SARAH WILPER, : : Defendant. : September 9, 2022

MEMORANDUM OF DECISION GRANTING DEFENDANT’S MOTION TO DISMISS Plaintiffs, United Rentals, Inc., and United Rentals (North America), Inc. (collectively “United”), bring this action against a former employee, Sarah Wilper (“Defendant”), claiming, among other things, Defendant violated the Computer Fraud and Abuse Action (the “CFAA”), 18 U.S.C. § 1030, by intentionally wiping United’s data from an iPhone provided to her for employment purposes. United also raises various state law claims relating to Defendant’s conduct immediately before and following her resignation. Defendant moves to dismiss the complaint on the grounds that she did not violate the CFAA, and, thus, the Court should decline to exercise supplemental jurisdiction over United’s remaining state law claims. See [Dkt. 27-1]. United opposes, maintaining that Defendant did violate the CFAA. See [Dkt. 38]. For the reasons set forth below, Defendant’s Motion to Dismiss is GRANTED. I. LEGAL STANDARD

Defendant seeks dismissal pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure. Rule 12(b)(1) allows a party to assert by motion a defense that the court lacks subject matter jurisdiction. Rule 12(b)(6) allows a party to assert by motion a defense that the complaint fails to state a claim upon which relief can be granted. Rules 12(b)(1) and 12(b)(6) have similar legal standards. See Lerner v. Fleet Bank, N.A., 318 F.3d 113, 128 (2d Cir. 2003), abrogated on other grounds recognized by Am. Psych. Ass’n v. Anthem Health

Plans, Inc., 821 F.3d 352 (2d Cir. 2016). There are recognized differences such as when factual disputes exist, when determining whether dismissal should be with or without prejudice, and which party bears the burden of proof. See United States ex rel. Daugherty v. Tiversa Holding Corp., 342 F. Supp. 3d 418, 425 n.1 (S.D.N.Y. 2018). When ruling on a motion to dismiss pursuant to Rule 12(b)(1), the “court must take all uncontroverted facts in the complaint (or petition) as true, and draw all reasonable inferences in favor of the party asserting jurisdiction.” Fountain v. Karim, 838 F.3d 129, 134 (2d Cir. 2016). When facts are disputed, the court may

refer “to evidence outside the pleadings, such as affidavits and if necessary, hold an evidentiary hearing.” Id. “A plaintiff asserting subject matter jurisdiction has the burden of proving by a preponderance of the evidence that it exists.” Makarova v. United States, 201 F.3d 110, 113 (2d Cir. 2000). “If subject matter jurisdiction is lacking, the action must be dismissed.” Lyndonville Sav. Bank & Tr. Co. v. Lussier, 211 F.3d 697, 700–01 (2d Cir. 2000). “To survive [a Rule 12(b)(6)] motion to dismiss [for failure to state a claim], a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Not all allegations in a complaint are entitled to the presumption of truth. Id. “In adjudicating a Rule 12(b)(6) motion, a district court must confine its consideration to facts stated on the face of the complaint, in documents appended to the complaint or incorporated in the complaint by reference, and to matters of which judicial notice may be taken.” Rivera v. Westchester Cty., 488 F. Supp. 3d 70,

75–76 (S.D.N.Y. 2020) (citing to Leonard F. v. Isr. Disc. Bank of N.Y., 199 F.3d 99, 107 (2d Cir. 1999)). The defendant bears the burden of proof on a motion to dismiss for failure to state a claim under Rule 12(b)(6). See Sobel v. Prudenti, 25 F. Supp. 3d 340, 352 (E.D.N.Y. 2014). II. BACKGROUND

The following facts are alleged in the amended complaint and will be presumed true for the purposes of deciding the motion to dismiss. United is best known for renting and selling various types of rental materials and equipment. [Id. at ¶ 15]. Defendant was employed by United as an outside sales representative. [Id. at ¶ 3]. Her primary job responsibilities included developing customer relationships, and maintaining customers confidential and proprietary information. [Id.]. Defendant signed a non-compete agreement1 with United during her employment. [Id. at ¶ 8]. United provided Defendant with a company-owned iPhone and computer. [Id. at ¶ 8]. Defendant signed a policy where she agreed not to use United’s technological devices in a manner not approved by the company, nor would she delete or remove information from company devices. [Id. at ¶ 5–6]. Said policy

1 The non-compete provision provides, inter alia, that Defendant will not work for one of United’s competitors located in a specific geographical area within one-year after terminating employment with United. [Dkt. 40 at ¶ 8]. prohibits any employee from intentionally damaging any United device. [Id. at ¶ 5]. The wiping of an iPhone via secure-erasure software would constitute intentional damage under the policy. [Id. at ¶ 6]. On August 13, 2021, Defendant provided verbal notice of resignation from

United. [Id. at ¶ 16]. Shortly thereafter, she began working for one of United’s competitors. [Id. at ¶ 4]. United conducted a forensic review of Defendant’s company-issued laptop and iPhone. [Id. at ¶¶ 16–17]. The forensic review found that Defendant used the secure-erasure function on her United-issued iPhone to “wipe” its contents. [Id. at ¶ 18]. United brought this action against Defendant alleging she violated the CFAA and various state laws. [Dkt. 40]. Defendant moves to dismiss the CFAA claim and requests the Court decline to exercise supplemental jurisdiction over the remaining state law claims. [Id. at 3].

III. DISCUSSION

a. CFAA Claim

The first issue is whether United has sufficiently asserted a CFAA claim. United alleges Defendant violated section 1030(a)(5)2 of the CFAA. [Dkt. 40 at ¶ 32]. The statutory language of (a)(5) reads: Whoever. . .

2 Defendant’s motion to dismiss initially focused on two subsections of the CFAA that are not applicable here, sections 1030(a)(2)2 and 1030(a)(4).2 United’s opposition addressed Defendant’s error and made arguments as to why the claim survives under section 1030(a)(5). Defendant’s reply brief asserts that even under section 1030(a)(5), her argument, that United has failed sufficiently plead that she violated the CFAA, still wins. See [Dkt. 44]. Thus, the Court will address whether United has sufficiently pled that Defendant’s conduct violated section 1030(a)(5). (A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; (B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.

The pertinent question is whether Defendant erased the contents of United’s iPhone “without authorization.” To answer this question, the Court must determine what the meaning of “without authorization” is under the CFAA. The “first step in interpreting a statute is to determine whether the language at issue has a plain and unambiguous meaning with regard to the particular dispute in the case. [The Court’s] inquiry must cease if the statutory language is unambiguous and the statutory scheme is coherent and consistent.” Robinson v. Shell Oil Co., 117 S. Ct 843, 846 (1997). If the statute is ambiguous, the Court will next evaluate the legislative intent to determine “the specific context in which the language is used,” followed by evaluating “the broader context of the statute as a whole.” Id. (citing Estate of Cowart v. Nicklos Drilling Co., 112 S. Ct. 2589, 2594–95 (1992)). The first step in construing a statute is to apply a plain language analysis. Id. at 846. While the phrase “authorization” is not defined in the CFAA, courts interpreting the meaning of “authorization” have found that it is a fundamental cannon of construction. See United States v. Morris, 928 F.2d 504, 511 (2d Cir. 1991); Perrin v. United States, 444 U.S. 37, 42 (1979); LVRC Holdings, LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009). Thus, under the CFAA, the word “authorization” is “of common usage, without any technical or ambiguous meaning.” LVRC Holdings, LLC, 581 F.3d at 1133 (quoting United States v. Morris, 928 F.2d at 411). Multiple dictionaries define “authorization” as “permission or power granted by authority.” LVRC Holdings LLC, 581 F.3d at 1133 (citing to Random House

Unabridged Dictionary, 139 (2001); Webster’s Third International Dictionary, 145 (2002)). More recently, Black’s Law Dictionary has defined “authorization” as “[o]fficial permission to do something; sanction or warrant [or t]he official document granting such permission.” (11th ed. 2019). Thus, “an employer gives an employee ‘authorization’ to access a company computer when the employer gives the employee permission to use it.” LVRC Holdings LLC, 581 F.3d at 1133. Case law discussing the “without authorization” language have come to a similar conclusion—that “without authorization” should mean individuals without any permission from a company to access an electronic device. The Supreme

Court’s decision in Van Buren best addresses the difference between the CFAA’s “exceeds authorized access” and “without authorization” language. See 141 S. Ct. 1648 (2021). Although Van Buren best addresses the CFAA’s definition of “exceeds authorized access,” embedded in the Court’s detailed analysis, exists their analysis of what “without authorization” means. In Van Buren, the defendant asserted that “without authorization” applies to outside-hackers, meaning people without permission to use the computer, and that “exceeds authorized access” applies to people who have permission to use a computer, but use the computer in a way that goes beyond their authorized use. Id. at 1658. The government argued that “without authorization” and “exceeds authorized access” should be used interchangeably, and that a person using a computer in a manner that exceeds the scope of their authorization is using it “without authorization” while also exceeding their authorized access. Id. at 1659. The Supreme Court rejected the government’s argument and adopted the defendant’s interpretation of “exceeds authorized

access.” Id. at 1658–59. When discussing the phrase ‘without authorization,’ the Supreme Court relied on language in LVRC Holdings, that states an individual uses a computer “without authorization” when they access a computer absent any permission from a company. Id. at 1659; LVRC Holdings, LLC, 581 F.3d at 1133. In LVRC Holdings, LLC, the plaintiff alleged that the defendant was using his computer “without authorization” in violation of sections 1030(a)(2) and (a)(4) because the defendant emailed company documents to his personal email. Id. at 1130. The district court granted the defendant’s motion for summary judgment on the grounds that the defendant had not “accessed an LVRC computer or any of the

documents on the computer ‘without authorization.’” Id. at 1132. The court recognized that conceptually, it is difficult to distinguishing between “exceeds authorized access” and “without authorization.” Best stated, an individual who is authorized to use a computer for certain purposes but goes beyond those limitations is considered by the CFAA as someone who has ‘exceeded authorized access.’ On the other hand, a person who uses a computer ‘without authorization’ has no rights, limited or otherwise, to access the computer in question.

Id. at 1133. Thus, the Court held that an individual uses “a computer without authorization . . . when [they have] not received permission to use the computer for any purpose . . . or when the employer has rescinded permission to access the computer and [they use] the computer anyway.” Id. at 1135. See also United States v. Nosal, 676 F.3d 854, 858 (9th Cir. 2012) (finding that “‘[w]ithout’ authorization would apply to outside hackers (individuals who have no authorized access to the computer at all) and ‘exceeds authorized access’ would apply to inside hackers (individuals whose initial access to a computer is authorized but who access

unauthorized information or files.”) (emphasis in original)). Based on the reasons above, the Court finds that “without authorization” under section 1030(a)(5) applies to outside hackers, meaning someone who has no rights to access the computer in question. This finding is consistent with the legislative history. For example, Senator Patrick Leahy stated that the CFAA was enacted “to penalize those who intentionally alter, damage, or destroy certain computerized data belonging to another. . . . [T]his subsection will be aimed at ‘outsiders’ i.e., those lacking authorization to access any . . . computer.” S. REP. 99–432, 10, 1986 U.S.C.C.A.N. 2479, 2488. (statement from Senator Patrick Leahy

addressing Congress about the proposed CFAA statute). The Judicial Committee’s Report to the House provided that when looking at the purpose of the CFAA, “Congress was . . . careful to note that section 1030 deals with an ‘unauthorized access' concept of computer fraud rather than the mere use of a computer. Thus, the conduct prohibited is analogous to that of ‘breaking and entering.’” H.R. Rep. No. 98–894, at 3706 (internal quotation marks omitted). “Consequently, the legislative history consistently characterizes the evil to be remedied—computer crime—as ‘trespass’ into computer systems or data, and correspondingly describes ‘authorization’ in terms of the portion of the computer's data to which one's access rights extend.” United States v. Valle, 807 F.3d 508, 525 (2d Cir. 2015). Therefore, the legislative history favors interpreting “without authorization” to apply to individuals who are not granted any permission from a company to access an electronic device. Here, there is no dispute that Defendant had permission to use the phone

United provided her. Thus, she was not an individual accessing the phone “without authorization” in violation of the CFAA section 1030(a)(5), which is the only section of the CFAA raised in the complaint. Therefore, the CFAA claim must be dismissed. United’s opposition cites to a Northern District of Illinois decision—Arience Builders, Inc. v. Baltes, 563 F. Supp. 2d 883, 884–85 (N.D. Ill. 2008)—to support its claim that Defendant’s conduct constitutes a CFAA violation. Arience Builders is neither controlling nor persuasive here. The issued in Arience Builders related to what the term “transmission” means in the context of a CFAA claim, not “without authorization” as is the issue here. Id. at 884. Arience Builders does not discuss

“without authorization,” much less provide an analysis such as that provided above. In addition, Arience Builders was decided before Van Buren and LVRC Holdings. This Court is required to follow the precedent set by the United States Supreme Court. Therefore, the Court finds that Defendant did not violate the CFAA as alleged by United in the operative complaint and that claim is dismissed. b. Supplemental Jurisdiction Now that the Court has dismissed United’s CFAA claim pursuant to Federal Rule of Civil Procedure 12(b)(6), the remaining question is whether supplemental jurisdiction should be extended over United’s remaining state law claims. United’s state law claims allege that (1) Defendant violated Connecticut statutory law similar to the CFAA; (2) Defendant violated Connecticut tort law; and (3) Defendant violated Connecticut contract law. [Dkt. 40 at ¶¶ 40–75]. Defendant argues this Court should decline to exercise supplemental

jurisdiction over the remaining state law claims, primarily, because the matter “is still in its infancy.” [Dkt. 27-1 at 10]. United does not respond, relying only on their position that the Court has jurisdiction over the CFAA claim. For the reasons set forth below, this Court declines to exercise supplemental jurisdiction over United’s remaining state law claims. Pursuant to 28 U.S.C. § 1367, a district court has supplemental jurisdiction over certain state law claims when they are brought in the same case or controversy as one with federal law issues. However, a district court is entitled to decline supplemental jurisdiction when the claim arises from a novel or complex

state law issue, the state law claim substantially predominates over claims in which the district court has jurisdiction, when the district court has dismissed all claims within its jurisdiction, or for other compelling reasons. See id. It is well-established that supplemental jurisdiction is a doctrine of discretion, not of plaintiff's right. Its justification lies in considerations of judicial economy, convenience and fairness to litigants; if these are not present a federal court should hesitate to exercise jurisdiction over state claims, even though bound to apply state law to them. Needless decisions of state law should be avoided both as a matter of comity and to promote justice between the parties, by procuring for them a surer-footed reading of applicable law. Certainly, if the federal claims are dismissed before trial, even though not insubstantial in a jurisdictional sense, the state claims should be dismissed as well. United Mine Workers of Am. v. Gibbs, 383 U.S. 715, 726 (1966). Thus, because supplemental jurisdiction is a doctrine of discretion, courts have ultimate authority in determining when its use is appropriate. In circumstances where a federal court has dismissed all federal claims in

which original jurisdiction existed, the court “must reassess its jurisdiction over the case by considering several factors—judicial economy, convenience, fairness, and comity.” Motorola Credit Corp. v. Uzan, 388 F.3d 39, 56 (2d. Cir. 2004) (citing Norwalk v. Ironworkers Local Pension 6 Fund, 81 F.3d 1182, 1191 (2d. Cir. 1996)). It has been consistently held within the Second Circuit “that ‘if [all] federal claims are dismissed before trial . . . the state claims should be dismissed as well.’” Id. at 56 (emphasis in original) (citing Castello v. Board of Trustees, 937 F.2d 752, 758 (2d Cir. 1991)). Here, the remaining allegations in United’s operative complaint are state law

claims in which this Court does not have original jurisdiction over. This case is still in its infancy and has not yet gone to trial. For these reasons, the Court declines to exercise supplemental jurisdiction. Therefore, the remaining state law claims are dismissed. IV. CONCLUSION

For the above reasons, Defendant’s Motion to Dismiss is GRANTED. IT IS SO ORDERED. ___/s/_______________ Hon. Vanessa L. Bryant United States District Judge

Dated this day in Hartford, Connectict: September 9, 2022