WalkMe Ltd., an Israeli company v. Whatfix, Inc., a Delaware corporation

Opinion

WALKME LTD., AN ISRAELI Case No. 23-cv-03991-JSW COMPANY, et al., ORDER GRANTING, IN PART, AND Plaintiffs, DENYING, IN PART, MOTION TO v. COMPLAINT AND SCHEDULING CASE MANAGEMENT CONFERENCE WHATFIX, INC., A DELAWARE CORPORATION, et al., Re: Dkt. No. 90 Defendants. Now before the Court for consideration is the motion to dismiss filed by Whatfix, Inc. (“WF Inc.”), which Whatfix PL (“WF PL”) (collectively “Whatfix” unless otherwise noted) has joined. The Court has considered the parties’ papers, relevant legal authority, and the record in this case, and it GRANTS, IN PART, and DENIES, IN PART, Whatfix’s motion. The parties in this case are competitors in the digital adoption platform space. Plaintiffs, WalkMe Ltd. (“WM Ltd.”) and WalkMe Inc. (“WM Inc.”) (collectively “WalkMe” unless otherwise noted), allege they are “the creator of the world’s first digital adoption platform, a software platform that works in tandem with other software applications, hosted services, and websites, and enables [its] customers to more efficiently leverage [the customer’s] technology investments by improving the end user experience and thus driving adoption and utilization of those products.” (FAC ¶ 2; see also id. ¶¶ 20-22.) WalkMe alleges it is the market leader in this space and that its success has spawned competition, including Whatfix. According to WalkMe, Whatfix “is a lower-end imitator, whose business model is to provide cut-rate software that emulates elements of WalkMe’s cutting-edge software, offering fewer features and lesser WalkMe brings three categories of claims against Whatfix. The first category is for alleged violations of the Defendant Trade Secrets Act (“DTSA”), 18 U.S.C. section 1836, and California’s Uniform Trade Secrets Act (“CUTSA”), Civil Code sections 3426, et. seq. (collectively the “trade secret claims”). The second category is for alleged violations of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. section 1030(a)(2), and the California Computer Data Access and Fraud Act (“CCDAFA”) (collectively, the “access claims”). The third category is for false advertising under the Lanham Act, 15 U.S.C. section 1125, California’s Unfair Competition Law, Business and Professions Code sections 17200, et seq., and California’s False Advertising Law, Business and Professions Code sections 17500, et seq. The Court will address additional facts as necessary in the analysis. A. Applicable Legal Standards. A court’s inquiry under Rule 12(b)(6) “is limited to the allegations in the complaint, which are accepted as true and construed in the light most favorable to the plaintiff.” Lazy Y Ranch Ltd. v. Behrens, 546 F.3d 580, 588 (9th Cir. 2008). Even under the liberal pleading standard of Rule 8(a)(2), “a plaintiff’s obligation to provide ‘grounds’ of his ‘entitle[ment] to relief’ requires more than labels and conclusions, and formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)). Pursuant to Twombly, a plaintiff cannot merely allege conduct that is conceivable but must instead allege “enough facts to state a claim to relief that is plausible on its face.” Id. at 570. “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556). Where, as here, a plaintiff asserts a claim sounding in fraud, the plaintiff must “state with particularity the circumstances regarding fraud or mistake.” Fed. R. Civ. P. 9(b). A claim sounds in fraud if the plaintiff alleges “a unified course of fraudulent conduct and rel[ies] entirely on that course of conduct as the basis of a claim.” Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1103 the circumstances constituting fraud so that a defendant can prepare an adequate answer from the allegations.” Moore v. Kayport Package Exp., Inc., 885 F.2d 531, 540 (9th Cir. 1989); see also Vess, 317 F.3d at 1106. Accordingly, “[a]verments of fraud must be accompanied by ‘the who, what, when, where, and how’ of the misconduct charged.” Vess, 317 F.3d at 1106 (quoting Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir. 1997)). If the allegations are insufficient to state a claim, a court should grant leave to amend unless amendment would be futile. See, e.g., Reddy v. Litton Indus. Inc., 912 F.3d 291, 296 (9th Cir. 1990); Cook, Perkiss & Liehe, Inc. v. N. Cal. Collection Serv., Inc., 911 F.2d 242, 246-47 (9th Cir. 1990). Where a plaintiff has previously amended and failed to correct deficiencies, the Court’s “discretion to deny leave to amend is particularly broad[.]” Allen v. City of Beverly Hills, 911 F.2d 367, 373 (9th Cir. 1990) (quoting Ascon Props., Inc. v. Mobil Oil Co., 866 F.2d 1149, 1160 (9th Cir. 1989)). B. The Court Dismisses the Claims Against WF Inc., in Part. WF Inc. moves to dismiss all of WalkMe’s claims against it on the basis that the allegations are directed at WF PL. WalkMe alleges that most of the individuals identified in the FAC worked for WF PL but at least one of them worked for WF Inc. (See, e.g., FAC ¶¶ 32-33, 35, 37; Dkt. No. 23-5, Declaration of Amit Shrama, ¶ 11; FAC ¶¶ 35-36 (alleging Prigge and others “gained unauthorized access” to WalkMe systems).) For that reason, there are allegations that WF Inc. had some involvement in the actions forming the trade secret and computer access claims. However, to the extent WalkMe seeks to hold WF Inc. vicariously liable for the acts of WF PL, the allegations are too conclusory to state a claim. Accordingly, the Court GRANTS, IN PART, AND DENIES, IN PART, WF Inc.’s motion to dismiss on this basis. Because the Court cannot say it would be futile, the Court will grant WalkMe one further opportunity to amend the claims against WF Inc. C. The Court Dismisses the Trade Secret Claims. In order to state a claim under DTSA or CUTSA, WalkMe must allege it possessed a trade secret and that Whatfix misappropriated it. See InteliClear, LLC v. ETC Global Holdings, Inc., similarity of elements); Sargent Fletcher, Inc. v. Able Corp., 110 Cal. App. 4th 1658, 1665 (2003). Whatfix argues that WalkMe fails to sufficiently identify the trade secrets at issue. The DTSA defines a trade secret as all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if-- (A) the owner thereof has taken reasonable measures to keep such information secret; and (B) the information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from the disclosure or use of the information[.] 18 U.S.C. § 1839(3). CUTSA’s definition of a trade secret is similar: “information, including a formula, pattern, compilation, program, device, method, technique, or process, that: (1) Derives independent economic value, actual or potential, from not being generally known to the public or to other persons who can obtain economic value from its disclosure or use; and (2) Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.” Cal. Civ. Code § 3426.1(d). WalkMe is not required to disclose the details of its trade secrets in the FAC. However, it must include facts that “describe the subject matter of the trade secret with sufficient particularity to separate it from matters of general knowledge in the trade or of special knowledge of those persons ... skilled in the trade.” InteliClear, 978 F.3d at 658; accord Diodes, Inc. v. Franzen, 260 Cal. App. 2d 244, 253 (1968). In general, “allegations that set out purported trade secrets in broad, categorical terms that are merely descriptive of the types of information that generally may qualify as protectible trade secrets are insufficient to state a claim.” Beluca Ventures LLC v. Einride Aktiebolag, 660 F. Supp. 3d 898, 907 (N.D. Cal. 2023) (quoting Cisco Sys., Inc. v. Chung, 462 F. Supp. 3d 1024, 1048 (N.D. Cal. 2020) (emphasis in Cisco)). Examples of such “broad, categorical” terms are: “source code, customer lists and customer related information, pricing information … marketing plans and strategic business based transceivers;” and “marketing strategy, product composition, packaging and manufacturing logistics” are too general to state a claim. Cisco, 462 F. Supp. 3d at 1048 (quoting, respectively, Vendavo, Inc. v. Price f(x) AG, No. 17-cv-6930-RS, 2018 WL 145697, at *3-4 (N.D. Cal. Mar. 23, 2018), Space Data Corp. v. X, No. 16-cv-3260-BLF, 2017 WL 5013363, at *2 (N.D. Cal. Feb. 16, 2017), and Five Star Gourmet Foods, Inc. v. Fresh Express, Inc., No. 19-cv-05611-PJH, 2020 WL 513287, at *7 (N.D. Cal. Jan. 31, 2020)); see also Ross v. Abbott Vascular, Inc., No. 19-cv-3794- JST, 2022 WL 20275185, at *10 (N.D. Cal. Mar. 3, 2022) (finding allegations that trade secrets consist of “tangible and intangible business, scientific, and technical information in the form of training methods, techniques, processes, and written materials” insufficient to state a claim). WalkMe alleges the trade secrets include but are not limited to the details of (a) … the specific tools, capabilities, layout, workflow, and other details of WalkMe’s Rule Engine and other editing tools that allow customers to create guidance for users even if the creator of the guidance has no technical training, (b) WalkMe’s customer analytics and how those customer analytics are captured and presented, (c) the tools within WalkMe’s digital adoption platform for customer analytics, including its Session Playback feature, and (d) how the above and other capabilities of the WalkMe platform were used by, and configured for, particular customers. (FAC ¶ 50; see also id. ¶¶ 25 (referring to no-code and editor tools), 26 (“WalkMe has unique access to how its customers interact with its tools” and integrated “insight and learning … into structure, functionality and other design elements”); 36 (alleging Whatfix users accessed “underlying rule configurations”).) In some instances general descriptions of subject matter may “become sufficiently particularized” when a plaintiff alleges they “are contained within specific documents.” Beluca Ventures, 660 F. Supp. 3d at 908. In Cisco, for example, the court determined that if the plaintiff had “left unqualified” some of the descriptions of the alleged trade secrets, “market and strategy data, … product strategies and other financial data, [and] … business information,” those descriptions would be “insufficiently particularized.” 462 F. Supp. 3d at 1049. The plaintiff, however, “narrowed the scope of information at issue in such categories to particular subjects limiting the categories in that fashion, the court held the allegations were sufficiently detailed to allege the existence of a trade secret. Id. Similarly, in Beluca, the defendant asserted a counterclaim for misappropriation of trade secrets and identified material in a report prepared by McKinsey as the purported trade secrets. 660 F. Supp. 3d at 904-05. Although the court determined that other allegations in the FAC were insufficient, it determined the paragraphs discussing that report were “sufficiently particularized to put [the plaintiff] on notice.” Id. at 909; see also Alta Devices, Inc. v. LG Elecs., Inc., 343 F. Supp. 3d 868, 877 (N.D. Cal. 2018) (finding allegations sufficient where plaintiff specifically referenced the technology – a “thin-film GaAs solar technology” – and specific trade secrets relating to the technology, and where defendant signed a non-disclosure agreement that “described with further particularity” the confidential information imparted). In AlterG, Inc. v. Boost Treadmills, LLC, the plaintiff alleged the defendants, its former employees, misappropriated trade secrets relating to an anti-gravity treadmills. 388 F. Supp. 3d 1133, 1139-41 (N.D. Cal. 2019). The plaintiff alleged the trade secrets consisted of “positive and negative learnings of low cost mechanical unweighted systems[,] … mechanical unweighting mainframes, … marketing and product strategy, cost strategies, customer needs, ... [and] knowledge of vendors with appropriate, specialized skills.” Id. at 1145. The court concluded those allegations were distinguishable from the specific allegations in Alta Devices. Instead, they were the type of broad categorical descriptions that are not sufficient to plead a trade secret. Id. Although the defendants signed non-disclosure agreements, as in Alta Devices, the facts alleged did not demonstrate the agreements narrowed the scope of the categories at issue. The Court finds that WalkMe’s allegations “more closely resemble” the broad categories of information courts have found insufficient to plead a trade secret. AlterG, 388 F. Supp 3d at 1145. Although WalkMe does specifically refer to the “Rule Engine” and “Session Playback” in the FAC, Whatfix submitted portions of WalkMe’s website that includes information about those features. In response, WalkMe argues the information available to the public does not include “proprietary tools, capabilities, layout, or workflow of the Rule Engine” and does not show not alleged in the FAC and the existing allegations about those features are not sufficient to separate matters of general knowledge in the trade or of special knowledge of those persons ... skilled in the trade” from non-public information. InteliClear, 978 F.3d at 658. WalkMe also argues that “the information accessed by Whatfix went beyond the user- facing content that a regular customer end user could view; it instead included content creation tools and information about those tools that only certain customer employees with administrator access privileges could see.” (Opp. Br. at 7:12-14.) Again, those facts are not alleged in the FAC. Finally, to the extent WalkMe relies on confidentiality provisions with its customers, it has not alleged facts to show that the definitions contained in those agreements are sufficiently specific to put Whatfix employees on notice of material that would constitute a trade secret. Accordingly, the Court GRANTS Whatfix’s motion to dismiss the trade secret claims. The Court will grant WalkMe one further opportunity to amend these claims. If WalkMe chooses to amend and continues to rely on the theory that its former employees or former employees of WalkMe customers misappropriated trade secrets, it must include additional facts to support that theory. The facts in the FAC are insufficient to allege misappropriation based on that theory. The Court concludes that WalkMe’s allegations are sufficient to plead that at least one of Whatfix’s employees, Dipit Sharma, engaged in conduct that could qualify as misappropriation if WalkMe can sufficiently identify the trade secrets at issue. (See FAC ¶¶ 37-38 (citing Declaration of Dipit Sharma (“Sharma Decl.”) ¶ 3), Sharma Decl., ¶¶ 4-5.)1 D. The Court Dismisses the Access Claims, in Part. 1. The CFAA Claim. “The CFFA was enacted to prevent intentional intrusion onto someone else’s computer— specifically, computer hacking” and “is best understood as an anti-intrusion statute and not as a misappropriation statute[.]” HiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1196 (9th Cir. 2022) (internal quotations and citations omitted). It prohibits, inter alia, intentionally accessing a 1 The unredacted version of the Sharma Declaration is found at Docket No. 23-8. Because WalkMe cites to the declaration in the FAC, the Court has considered Mr. Sharma’s statements computer “without authorization” or by “exceed[ing] authorized access” to obtain information from a protected computer. 18 U.S.C. § 1030(a)(2)(C). The phrase “without authorization” means without permission. See HiQ Labs, 31 F.4th at 1195. The phrase “exceeds authorized access” means accessing “a computer with authorization and [using] such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6). “[L]iability under both clauses stems from a gates-up-or-down inquiry - one either can or cannot access a computer system, and one either can or cannot access certain areas within the system.” VanBuren v. United States, 593 U.S. 374, 141 S.Ct. 1648, 1658-59 (2021). It “does not cover those who …. have improper motives for obtaining information that is otherwise available to them.” Id. at 1652. WalkMe alleges that Whatfix violated Section 1030(a)(2)(C) in two ways. First, it alleges Whatfix used customer credentials to access the WalkMe platform, which WalkMe alleges was “expressly prohibited under the terms of WalkMe’s agreements with its customers.” (FAC ¶ 43.) WalkMe alleges in a conclusory fashion that these account credentials were “fake” but does not explain why that is so. The FAC also does not contain facts from which the Court could reasonably infer that Whatfix employees tricked WalkMe customers into providing them with credentials. Thus, this is not a case where Whatfix employees used “phishing” emails to get information from WalkMe’s customers, which distinguishes it from Microsoft Corp. v. Does 1-2, No. 21-cv-822, RDA/IDD, 2022 WL 18359421, at *4 (E.D. Va. Dec. 27, 2022), report and recommendation adopted, 2023 WL 289701 (E.D. Va. Jan. 18, 2023). WalkMe does allege that Whatfix’s use of the credentials was not allowed under the customers’ contracts or authorized in any way. (Id. ¶ 33.) The phrase “‘exceeds authorized access’ in the CFAA does not extend to violations of use restrictions.” See, e.g., United States v. Nosal, 676 F.3d 854, 864 (9th Cir. 2012). Second, WalkMe alleges that Whatfix exceeded any access that was authorized for the purpose of migrating data. (Id. ¶¶ 6-8, 34, 36-40, 43, 97.) As noted above, however, there are no facts to show Whatfix employees accessed areas of the WalkMe platform that customers were not With one exception, WalkMe’s allegations are not sufficient to allege the type of breaking and entering prohibited by the CFAA. The exception is the allegations regarding Dipit Sharma’s conduct discussed in Section C of this Order. Because the allegations show that he used customer credentials after Whatfix’s work with that customer had ended, the Court concludes WalkMe sufficiently alleges he accessed WalkMe’s platform without authorization or by exceeding authorization he was granted previously. Accordingly, the Court GRANTS, IN PART, AND DENIES, IN PART, Whatfix’s motion to dismiss the CFAA Claim. Because the Court cannot say it would be futile, it will grant WalkMe one further opportunity to amend this claim. 2. The Section 502 Claim. Section 502 makes it unlawful to “[k]nowingly access[] and without permission” take, copy, or make use of “any data from a computer, computer system, or computer network, or… any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.” Cal. Pen. Code § 502(c)(2). Although Section 502 is a state law analogue of the CFAA, the provision of Section 502 at issue “does not require unauthorized access. It merely requires knowing access.” United States v. Christensen, 828 F.3d 763, 788 (9th Cir. 2015); see also Bui-Ford v. Tesla, Inc., No. 23-cv-2321-JST, 2024 WL 694485, at 5 (N.D. Cal. Feb. 20, 2024) (relying on Christensen to distinguish subsections of Section 502 where access must be knowing and unauthorized from subsections (c)(2) and (c)(4) which require only that access be knowing). Under subsection (c)(2), access becomes unlawful when an individual or entity “‘without permission takes, copies, or makes use of’ data on the computer.” Christensen, 828 F.3d at 788 (quoting Cal. Penal Code § 502(c)(2).) In Christensen, the court held “logging into a database with a valid password and subsequently taking, copying, or using the information in the database improperly” would violate the statute. Id. at 789. As currently drafted, that is what WalkMe alleges here, and the Court concludes that those allegations are sufficient to state a claim. Whatfix also argues that WalkMe’s Section 502 claim fails because the statute cannot be located and it does not identify where the WhatFix employees are located. It does generally allege that Whatfix directed its activities at WalkMe’s California business and identified Paula Prigge as a WF Inc. employee based in the United States. At this stage, the Court cannot conclude as a matter of law that all of the conduct at issue took place outside of California. Accordingly, the Court DENIES the motion to dismiss the Section 502 Claim. E. The Court Denies the Motion to Dismiss the False Advertising Claims.2 The essential elements of a claim for false advertising under the Lanham Act are: (1) a false statement of fact by the defendant in a commercial advertisement about its own or another’s product; (2) the statement actually deceived or has the tendency to deceive a substantial segment of its audience; (3) the deception is material, in that it is likely to influence the purchasing decision; (4) the defendant caused its false statement to enter interstate commerce; and (5) the plaintiff has been or is likely to be injured as a result of the false statement, either by direct diversion of sales from itself to defendant or by a lessening of the goodwill associated with its products. Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134, 1139 (9th Cir. 1997); Lexmark Int’l, Inc. v. Static Control Components, Inc., 572 U.S. 118, 140 (2014) (to “invoke the Lanham Act’s cause of action for false advertising, a plaintiff must plead (and ultimately prove) an injury to a commercial interest in sales or business reputation proximately caused by the defendant’s misrepresentations”). Similarly, to state a claim under California’s FAL, WalkMe must allege that “members of the public are likely to be deceived” by a false or misleading statement. Bank of the West v. Sup. Ct., 2 Cal. 4th 1254, 1267 (1994). The Court concludes that WalkMe’s allegations about Whatfix’s false statements satisfy Rule 9(b) and are sufficient to allege what the challenged statements are and why they are literally false. The Court also concludes that the allegations regarding comparison tables are sufficient to allege the statements would be likely to deceive and would be material to a consumer. See, e.g., Southland So., 108 F.3d at 1146 (“publication of deliberately false comparative claims gives rise to a presumption of actual deception and reliance”) (brackets omitted, quoting U–Haul Int’l, Inc.

2 WalkMe’s UCL claim is based on Whatfix’s alleged violation of the Lanham Act and will ] v. Jartran, Inc., 793 F.2d 1034, 1040-41 (9th Cir. 1986)). 2 Accordingly, the Court DENIES Whatfix’s motion to dismiss the false advertising claims 3 and the UCL claim. 5 For the foregoing reasons, the Court GRANTS, IN PART, and DENIES, IN PART, 6 Whatfix’s motion to dismiss. If WalkMe chooses to amend, it shall file an amended complaint by 7 no later than April 5, 2024 and Whatfix shall answer or otherwise respond by April 19, 2024. If 8 WalkMe chooses not to amend, it shall file a notice to that affect by no later than April 5, 2024, 9 and Whatfix’s answer will be due by April 19, 2024. 10 The parties shall appear for an initial case management conference on May 10, 2024, and 11 their joint case management conference statement shall be due by May 3, 2024. 3s 12 IT ISSO ORDERED. a) fo } «13 Dated: March 21, 2024 / / j 2 JEFEREY Sf WHITE } 15 United St ps DistricpJudge 16 j/ ”

«17

Oo Z 18 19 20 21 22 23 24 25 26 27 28