UNITED STATES DISTRICT COURT AT SEATTLE
CASE NO. 2:23-cv-00755-RSL Plaintiff, v.
Defendant.
This matter comes before the Court on the Court’s “Amended Second Order to Show Cause” (Dkt. # 16), plaintiff’s response thereto (Dkt. # 18), defendant’s “Request for Protective Order” (Dkt. # 17), and defendant’s “Verified Emergency Motion for Temporary Restraining Order” (Dkt. # 20). Background In March 2022, plaintiff created a website about his ex-girlfriend, defendant Mahsa Parviz. Plaintiff uses the page to explain how he was duped by Ms. Parviz, asserting that she lied to him about her resume and criminal history and that, despite their break up, she continues to contact him. His avowed purposes in creating the website were to shame and/or expose defendant. In May 2023, Ms. Parviz contacted plaintiff, requesting that he remove the webpage or face a domestic violence complaint filed in the city where he practices law. Plaintiff immediately filed this lawsuit, essentially copying the contents of ORDER OF DISMISSAL - 1 the website into a complaint seeking an award of damages (special, general, and punitive), an award of attorney’s fees, and a declaration that Ms. Parviz is a vexatious litigant. The Court issued an order to show cause why the case should not be dismissed for lack of subject matter jurisdiction: plaintiff’s allegation regarding the amount in controversy was wholly conclusory and unsupported by any factual allegations. Plaintiff then filed an amended complaint adding a federal claim under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030(g), and seeking an injunction against “threated violations of the computer fraud law.” Dkt. # 6 at 21. Sufficiency of Allegations of the First Amended Complaint After reviewing the Verified First Amended Complaint, the Court found that “the newly-added Computer Fraud and Abuse Act claim had not been adequately pled and that ‘the values of judicial economy, convenience, fairness, and comity’ lead to the conclusion that the Court ‘should decline the exercise of jurisdiction [over related state claims] by dismissing the case without prejudice.’” Dkt # 16 at 2 (quoting Carnegie-Mellon Univ. v. Cohill, 484 U.S. 343, 350 (1988) (citation omitted)). Plaintiff was given a second opportunity to show cause why his claims should not be dismissed. The CFAA forbids intentionally accessing a computer without authorization or in excess of the authorized access, 18 U.S.C. § 1030(a), and “is best understood as an anti- intrusion statute and not as a ‘misappropriation statute,’’ hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1196 (9th Cir. 2022) (quoting U.S. v. Nosal, 676 F.3d 854, 857-58 (9th Cir. 2012)). In the Ninth Circuit, “a violation of the terms of use of a website – without more – cannot establish liability under the CFAA.” Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016). Instead, the court looks to see whether the conduct at issue is analogous to breaking and entering. hiQ Labs, 31 F.4th at 1197. “The ‘without authorization’ clause protects computers themselves by targeting so-called outside hackers – those who access a computer without any permission at all. The ‘exceeds authorized ORDER OF DISMISSAL - 2 access’ clause provides complementary protection for certain information within computers by targeting so-called inside hackers – those who access a computer with permission, but then exceed the parameters of authorized access by entering an area of the computer to which that authorization does not extend.” Id. at 1198 (quoting Van Buren v. U.S., __ U.S. __, 141 S. Ct. 1648, 1658 (2021)) (internal quotation marks, citations, and alterations omitted). Plaintiff alleges in the First Amended Complaint that when he ran a Google search regarding Ms. Parviz, two Harvard-related URLs (https://scholar.harvard.edu/mparviz and https://collaborate.med.harvard.edu/display/~MP284/Parviz%2C+Mahsa) popped up.1 These web-based connections seemed to confirm Ms. Parviz’ representations that she holds an M.D. or a Ph.D. from Harvard, that she lectured or taught there, and/or that she has a number of scientific publications to her credit. In February 2022, plaintiff wrote to the Harvard IT department suggesting that Ms. Parviz hacked into Harvard’s system or misused her Harvard Extension School credentials to create and maintain a fake Harvard persona. He requested that Harvard “consider deleting Ms. Parviz’s web pages and disabling her email address for violations of the Harvard acceptable use policy . . . .” Dkt. # 6 at 7. Plaintiff alleges that Harvard deleted Ms. Parviz’s webpage in March 2022. In response to the second order to show cause, plaintiff argues that Ms. Parviz’ use of a Harvard Medical School webpage when she was not enrolled at Harvard constitutes accessing a computer without authorization. He cites without attribution what appear to be the terms governing the use of the university’s web publishing platforms. See https://hwp.harvard.edu/terms-use. The terms specify that a webpage can be created only by “benefits-eligible faculty and staff employed by Harvard” or by “currently enrolled, degree-seeking students,” and that “[f]aculty and students sites will be removed if the site
Free access — add to your briefcase to read the full text and ask questions with AI
UNITED STATES DISTRICT COURT AT SEATTLE
CASE NO. 2:23-cv-00755-RSL Plaintiff, v.
Defendant.
This matter comes before the Court on the Court’s “Amended Second Order to Show Cause” (Dkt. # 16), plaintiff’s response thereto (Dkt. # 18), defendant’s “Request for Protective Order” (Dkt. # 17), and defendant’s “Verified Emergency Motion for Temporary Restraining Order” (Dkt. # 20). Background In March 2022, plaintiff created a website about his ex-girlfriend, defendant Mahsa Parviz. Plaintiff uses the page to explain how he was duped by Ms. Parviz, asserting that she lied to him about her resume and criminal history and that, despite their break up, she continues to contact him. His avowed purposes in creating the website were to shame and/or expose defendant. In May 2023, Ms. Parviz contacted plaintiff, requesting that he remove the webpage or face a domestic violence complaint filed in the city where he practices law. Plaintiff immediately filed this lawsuit, essentially copying the contents of ORDER OF DISMISSAL - 1 the website into a complaint seeking an award of damages (special, general, and punitive), an award of attorney’s fees, and a declaration that Ms. Parviz is a vexatious litigant. The Court issued an order to show cause why the case should not be dismissed for lack of subject matter jurisdiction: plaintiff’s allegation regarding the amount in controversy was wholly conclusory and unsupported by any factual allegations. Plaintiff then filed an amended complaint adding a federal claim under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030(g), and seeking an injunction against “threated violations of the computer fraud law.” Dkt. # 6 at 21. Sufficiency of Allegations of the First Amended Complaint After reviewing the Verified First Amended Complaint, the Court found that “the newly-added Computer Fraud and Abuse Act claim had not been adequately pled and that ‘the values of judicial economy, convenience, fairness, and comity’ lead to the conclusion that the Court ‘should decline the exercise of jurisdiction [over related state claims] by dismissing the case without prejudice.’” Dkt # 16 at 2 (quoting Carnegie-Mellon Univ. v. Cohill, 484 U.S. 343, 350 (1988) (citation omitted)). Plaintiff was given a second opportunity to show cause why his claims should not be dismissed. The CFAA forbids intentionally accessing a computer without authorization or in excess of the authorized access, 18 U.S.C. § 1030(a), and “is best understood as an anti- intrusion statute and not as a ‘misappropriation statute,’’ hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1196 (9th Cir. 2022) (quoting U.S. v. Nosal, 676 F.3d 854, 857-58 (9th Cir. 2012)). In the Ninth Circuit, “a violation of the terms of use of a website – without more – cannot establish liability under the CFAA.” Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016). Instead, the court looks to see whether the conduct at issue is analogous to breaking and entering. hiQ Labs, 31 F.4th at 1197. “The ‘without authorization’ clause protects computers themselves by targeting so-called outside hackers – those who access a computer without any permission at all. The ‘exceeds authorized ORDER OF DISMISSAL - 2 access’ clause provides complementary protection for certain information within computers by targeting so-called inside hackers – those who access a computer with permission, but then exceed the parameters of authorized access by entering an area of the computer to which that authorization does not extend.” Id. at 1198 (quoting Van Buren v. U.S., __ U.S. __, 141 S. Ct. 1648, 1658 (2021)) (internal quotation marks, citations, and alterations omitted). Plaintiff alleges in the First Amended Complaint that when he ran a Google search regarding Ms. Parviz, two Harvard-related URLs (https://scholar.harvard.edu/mparviz and https://collaborate.med.harvard.edu/display/~MP284/Parviz%2C+Mahsa) popped up.1 These web-based connections seemed to confirm Ms. Parviz’ representations that she holds an M.D. or a Ph.D. from Harvard, that she lectured or taught there, and/or that she has a number of scientific publications to her credit. In February 2022, plaintiff wrote to the Harvard IT department suggesting that Ms. Parviz hacked into Harvard’s system or misused her Harvard Extension School credentials to create and maintain a fake Harvard persona. He requested that Harvard “consider deleting Ms. Parviz’s web pages and disabling her email address for violations of the Harvard acceptable use policy . . . .” Dkt. # 6 at 7. Plaintiff alleges that Harvard deleted Ms. Parviz’s webpage in March 2022. In response to the second order to show cause, plaintiff argues that Ms. Parviz’ use of a Harvard Medical School webpage when she was not enrolled at Harvard constitutes accessing a computer without authorization. He cites without attribution what appear to be the terms governing the use of the university’s web publishing platforms. See https://hwp.harvard.edu/terms-use. The terms specify that a webpage can be created only by “benefits-eligible faculty and staff employed by Harvard” or by “currently enrolled, degree-seeking students,” and that “[f]aculty and students sites will be removed if the site
1 Plaintiff also alleges that Ms. Parviz used a Harvard.edu email address long after her association with the university ended. He has not explained how this conduct violates the CFAA. ORDER OF DISMISSAL - 3 owner leaves Harvard.” Id. Plaintiff alleges no facts regarding Ms. Parviz’s status when she created the websites, nor was there an affirmative obligation on her part to delete the webpages when her association with Harvard ended. Even if plaintiff had adequately alleged a violation of Harvard’s terms of use, the Ninth Circuit has rejected a contract- based interpretation of the phrases “without authorization” or “exceeds authorized access.” In the absence of evidence that defendant broke through or evaded restrictions on access, a violation of a webpage’s terms and conditions of use is not enough to give rise to a plausible inference of liability under the CFAA. Plaintiff’s allegations of a CFAA violation were previously found insufficient (Dkt. # 16), and his response to the Order to Show Cause does not remedy the failures. The CFAA claim is therefore DISMISSED. Because plaintiff has failed to allege facts which could support the only federal cause of action asserted in the amended complaint or to show circumstances compelling the Court to deviate from the common practice of declining supplemental jurisdiction when no federal claims remain, the Court declines to exercise supplemental jurisdiction over plaintiff’s state law claims. Protective Order (Dkt. # 17 at 1-2) Ms. Parviz seeks a protective order because plaintiff has contacted her with regards to this lawsuit despite the existence of a domestic violence restraining order issued in a California state proceeding. The terms of the restraining order have not been disclosed, and Ms. Parviz is, apparently “as a matter of legal strategy,” proceeding pro se in this litigation. The rules of this Court require plaintiff to provide notice of filings to defendant and to confer regarding case management issues. Whether these interactions violate the restraining order will have to be determined by the issuing court. Motion to Seal (Dkt. # 17 at 2) Defendant asserts that she intends to file counterclaims in the above-captioned matter, some of which will depend on materials protected by the attorney-client privilege, ORDER OF DISMISSAL - 4 refer to defendant’s minor daughter, and/or relate to criminal matters that are still under investigation. She again requests that the case file be sealed to limit disclosure of these materials. Plaintiff’s complaint has now been dismissed and there are no counterclaims pending. A seal is therefore unnecessary. Motion to Proceed Under a Pseudonym (Dkt. # 17 at 2) Ms. Parviz asserts that some of the information contained in the First Amended Complaint is protected health care information and/or has been disclosed in violation of the attorney-client privilege. She requests that, if the entire case file is not sealed, she be permitted to proceed under the pseudonym “Jane Doe” to avoid harassment, injury, ridicule, or embarrassment to herself and her family. The information at issue has been posted on plaintiff’s webpage since June 2022 and has been publicly accessible on the Court’s docket for almost three months. Plaintiff’s claims have now been dismissed, and the case file will be closed once defendant’s pending motion for sanctions is resolved. Altering the way defendant’s name appears in the docket to allow her to proceed under a pseudonym at this late date would serve no purpose. Motion for Temporary Restraining Order (Dkt. # 20) Defendant seeks a temporary restraining order preventing plaintiff or his agents from destroying, altering, or disclosing information that plaintiff allegedly obtained when he logged into defendant’s Gmail account without authorization. No evidence is offered in support of the allegations of unauthorized access to the Gmail account, unauthorized access to webpages and servers linked to the Gmail account, the alteration or downloading of confidential material, or any threat to alter, destroy, or disclose confidential material. Having failed to show a likelihood of success on the merits of her claims of unlawful access, spoliation, and/or unlawful disclosure, temporary injunctive relief is unavailable.
ORDER OF DISMISSAL - 5 For all of the foregoing reasons, plaintiff’s claims in the above-captioned matter are hereby DISMISSED, and defendant’s motion for a protective order (Dkt. # 17) and motion for a temporary restraining order (Dkt. # 20) are DENIED. The Clerk of Court is directed to enter judgment against plaintiff and in favor of defendant. The Court will consider defendant’s renewed motion for sanctions (Dkt. # 21) on or after the note date of September 1, 2023, and will enter an amended judgment if necessary.
Dated this 16th day of August, 2023.
Robert S. Lasnik United States District Judge ORDER OF DISMISSAL - 6