UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS
___________________________________ ) CHRISTOPHER AARON WOFSE and ) the ESTATE OF LEONARD WOFSE, ) ) Plaintiffs, ) ) v. ) CIVIL ACTION ) NO. 19-12396-WGY MICHAEL HORN, TRACY HORN, and ) JOHN/JANE DOES 1-10, ) ) Defendants. ) ___________________________________)
YOUNG, D.J. March 2, 2021 MEMORANDUM & ORDER I. INTRODUCTION This case involves anonymous cyberattacks. It has one significant weakness -- a matter of proof. The problem lies not in what happened but who did it. Contending that his neighbors, Michael and Tracy Horn (collectively, the “Horns”), perpetrated a series of cyberattacks, Christopher Wofse maintains the present action on his own behalf and representing the estate of his father, Leonard Wofse (collectively, the “Wofses”), alleging ten counts: defamation (count I as to Christopher Wofse), commercial disparagement (count II as to Christopher Wofse), interference with advantageous relationship (count III as to Christopher Wofse), intentional infliction of emotional distress (count IV as to Christopher Wofse and count V as to the estate of Leonard Wofse), negligent infliction of emotional distress (count VI as to Christopher Wofse and count VII as to the estate of Leonard Wofse), invasion of privacy (count VIII), wrongful death of Leonard Wofse (count IX), and violation of the Computer Fraud
and Abuse Act (count X). See generally Pls.’ Mot. Am. Compl., Ex. 1, Second Am. Compl. & Jury Demand, ECF No. 14-1. A. Undisputed Facts Christopher Wofse, the founder of an online precious metals market analysis business, lives in Lexington, Massachusetts. Decl. Seth B. Orkand (“Orkand Decl.”), Ex. K, iGold Advisor, ECF No. 11-11; Pls.’ Opp’n Mot. Dismiss, Ex. 1, Aff. Christopher Wofse ¶ 1, ECF No. 18-1. He was the subject of a New York Times Magazine article on drone warfare in 2018. See generally Orkand Decl., Ex. J, The Wounds of the Drone Warrior, ECF No. 11-10. He lived with his father, Leonard Wofse, until his father passed
away in August 2019. State Ct. R. 152, 366 ¶ 1, ECF No. 7. The Horns also live in Lexington, Massachusetts. Pls.’ Suppl. Resp. Defs.’ Mot. Summ. J. (“Pls.’ Suppl. Resp.”), Ex. 1, Dep. Michael Horn (“Michael Horn Dep.”) 9, ECF No. 37-1; id. Ex. 2, Dep. Tracy Horn (“Tracy Horn Dep.”) 9, ECF No. 37-1. A self- proclaimed expert on “disruptive innovation,” Michael Horn obtained his bachelor’s degree at Yale University and his master of business administration at Harvard Business School. Michael Horn Dep. 23, 28, 51-52. Michael Horn researches “disruptive innovations in education.” Id. 53. Tracy Horn, Michael Horn’s wife, obtained a bachelor’s degree in engineering at Dartmouth College, studied cooking at Le Cordon Bleu, and completed a two- day course at The Pennsylvania State University. Tracy Horn
Dep. 21, 23; Defs.’ Suppl. Reply Pls.’ Suppl. Resp. Mot. Summ. J. (“Defs.’ Suppl. Reply”), Ex. 1, Aff. Tracy K. Horn ¶ 4, ECF No. 38-1. She is experienced in online business operations, and she has hosted a podcast on “disruptive innovation.” Tracy Horn Dep. 25-47. The Horns have two young daughters. Id. 7. The Horns interacted with the Wofses’ two dogs at least twice. The first instance occurred in May 2016, when the Wofses’ off-leash dogs approached the Horns and their daughters in a park and “started circling around [them].” Michael Horn Dep. 74. In response, the Horns called out for the dogs’ owner, whom they learned later was Leonard Wofse. Tracy Horn Dep. 65-
66. Tracy Horn reported this encounter to the Town of Lexington. Id. 67; see generally Pls.’ Suppl. Resp., Ex. 3, Email from Tracy Horn, ECF No. 37-1. The second instance occurred approximately one year later, in May 2017, when the Wofses’ dogs approached the Horns and one of their daughters in a park. Michael Horn Dep. 82; Tracy Horn Dep. 73-74. Michael Horn called out for the dogs’ owner, and he and Leonard Wofse then “argued about whether they should be on or off leash.” Michael Horn Dep. 82. Michael Horn “made a fist” during this argument and “alleged that one of the dogs bit his daughter a year earlier, in May 2016.” State Ct. R. 366 ¶¶ 5-6. Tracy Horn called the Lexington police about this encounter. Tracy Horn Dep. 74; see State Ct. R. 123.
Approximately one month later, in June 2017, a series of anonymous cyberattacks against the Wofses began. These cyberattacks “increase[d] in intensity dramatically” after Christopher Wofse “returned to Lexington after a long absence” and saw Michael Horn in December 2018. Pls.’ Opp’n Mot. Dismiss, Ex. 1, Aff. Christopher Wofse ¶¶ 4-6. “Following the serving of summons against Michael and Tracy Horn, the attacks abated . . . .” Id. Ex. 29, Aff. Christopher Wofse ¶ 6, ECF No. 37-2. In June 2020, under the name “Lendead Mashwoof,” the cyberattackers registered the email address “lawsootloser@gmail.com” to Christopher Wofse’s “Global Markets
Intel Launch” list. Id. Ex. 16, ECF No. 37-2. The Horns deny any involvement with the cyberattacks. Defs.’ Suppl. Reply, Ex. 1, Aff. Tracy K. Horn ¶ 2; id. Ex. 2, Aff. Michael Horn ¶ 2, ECF No. 38-2. The cyberattacks took three forms: unsolicited or anonymous communications with the Wofses, anonymous emails sent to Christopher Wofse’s business associates and clients, and unauthorized attempts to access the Wofses’ private information. First, from 2017 to 2019, the Wofses received a multitude of unsolicited or anonymous messages. Pls.’ Suppl. Resp., Exs. 13-14, ECF No. 37-2. Several of the unsolicited communications concerned out-of-state rental properties, funeral and pet
funeral services, and burial insurance services. Id. Leonard Wofse also received anonymous text messages which stated in part, “If [Christopher Wofse] suffers from PTSD there’s legislature Section 12 that can help,”1 id. Ex. 22, ECF No. 37-2 (cleaned up), and “feeling a bit Machiavellian today,” id. Ex. 25, ECF No. 37-2. Michael Horn had tweeted a Machiavelli quotation four days before Leonard Wofse received the text message mentioning Machiavelli. Id. Ex. 24, ECF No. 37-2. Many of the anonymous messages also contained threats and insults, see, e.g., Pls.’ Suppl. Resp., Ex. 6, ECF No. 37-1; id. Ex. 7, Ex. 10, Exs. 19-22, Ex. 25, ECF No. 37-2, one of which demanded
that the Wofses leave the neighborhood because “[p]roperty values decline thanks to scumbags like [them],” Pls.’ Suppl. Resp., Ex. 6 (“Take your grimy offspring and the rest of your
1 Massachusetts General Laws chapter 123, section 12 provides for the “[e]mergency restraint and hospitalization of persons posing risk of serious harm by reason of mental illness.” filthy zoo and LEAVE.” (cleaned up)), and another which stated in part, “disruption leads to learning,” id. Ex. 10. Second, during the same period, several of Christopher Wofse’s business associates and clients received anonymous emails accusing Christopher Wofse of using a “false name” -- Christopher Aaron, his first and middle names -- on his YouTube
page and business website to evade taxes, conceal a past bankruptcy, and hide an illicit drug problem. Id. Ex. 12, Ex. 23, Ex. 26, Ex. 28, ECF No. 37-2. Several of these emails also claimed that Christopher Wofse had fabricated his professional experiences, military service, and other biographical information. Id. Ex. 28. One such email stated, “We are all well connected in our community as most of us attended Yale, Harvard, Princeton, Brown, Penn State etc.” Id. Ex. 23. In October 2017, the author of the New York Times Magazine article about Christopher Wofse received an anonymous email accusing Christopher Wofse of being “anti-government,” failing to pay his
dog licenses, failing to neuter and vaccinate his dogs, owning dogs with rabies, and allowing his dogs to spread “[f]eces all around.” Id. Ex. 5, ECF No. 37-1. Finally, throughout this time the cyberattackers attempted to access the Wofses’ private information without authorization. For example, the cyberattackers appear to have submitted a request to “recover” a Google account in Christopher Wofse’s name, Pls.’ Suppl. Resp., Ex. 9, ECF No. 37-2,2 and to “authenticate” Christopher Wofse’s Amazon password, id. Ex. 11, ECF No. 37-2. Some attempts appear to have been successful: in July 2017, Christopher Wofse received an anonymous email with his date of birth, social security number, and driver’s license number in the subject line, State Ct. R. 20 ¶ 31, and later that
day he received an anonymous text message criticizing his taste in music based on a disk that he had left “face up on the passenger side of his car parked outside his home,” id. ¶ 32.3 Christopher Wofse also received anonymous text messages gloating that it was “too late” to “beef up security” because “[i]n’s in,” id. 18 ¶ 26, and suggesting that his attempt to set a new router password was futile, id. 21 ¶ 34.
2 The record contains one email from Google written in English and three emails from Google written in German. Pls.’ Suppl. Resp., Ex. 9, Ex. 11. Because the Wofses failed to file a translation of the German-language emails, the Court considers only the English-language email. See Light for Life, Inc. v. Our Firm Found. for Koreans, Inc., No. 12-CV-38 CAR, 2015 WL 631138, at *7 (M.D. Ga. Feb. 12, 2015) (“Without an English translation, the Court cannot consider this evidence on summary judgment.”).
3 Because the Wofses verified the original complaint in the Massachusetts Superior Court, see State Ct. R. 35, the Court treats that document “as the functional equivalent of an affidavit to the extent that it satisfies the standards explicated in Rule 56(e),” thus considering its admissible factual averments but disregarding its conclusions of law, see Sheinkopf v. Stone, 927 F.2d 1259, 1262 & n.3 (1st Cir. 1991). The Wofses endeavored to handle these multifaceted cyberattacks, but they were met with little success. Although they commissioned a forensic report to identify the cyberattackers, the report was inconclusive. Defs.’ Suppl. Reply, Ex. 3, Wofse Case Report 6-7, 18, ECF No. 38-3. As a result of the cyberattacks, Christopher Wofse’s existing
business subscribers “cancelled their contracts, and potential subscribers did not register” for his services. Pls.’ Suppl. Resp., Ex. 29, Aff. Christopher Wofse ¶ 4; see id. Ex. 4, Ex. 5, ECF No. 37-1; id. Ex. 28. He estimates his “total business income loss as a result of the attacks” to be $1,412,000, $9,600 of which he attributes to “a cancelled writing contract with a business associate who was targeted by the email attacks.” Id. Ex. 29, Aff. Christopher Wofse ¶¶ 3, 7. The cyberattacks also adversely affected the Wofses’ health. Christopher Wofse began to suffer from anxiety, panic attacks, insomnia, and internal bleeding “as a result of the
attacks.” Pls.’ Suppl. Resp., Ex. 30, Letter from Alexander Angelov, M.D. 1, ECF No. 37-2. Prior to the cyberattacks, Leonard Wofse took .25mg of clonazepam once daily for panic episodes, insomnia, and anxiety, and 10mg Lisinopril once daily for hypertension. Id. “As a result of these attacks,” Leonard Wofse’s prescription for clonazepam was tripled to .25mg thrice daily, and once the attacks began to exacerbate his hypertension and cause him to suffer hypertensive emergencies, he often had to increase his Lisinopril dosage above the daily 10mg baseline. Id. Leonard died of cancer in August 2019. State Ct. R. 152. B. Procedural History In February 2019, the Wofses filed a complaint against John Does 1-10 in the Massachusetts Superior Court sitting in and for
the County of Middlesex. Id. 15 ¶ 6. After Leonard Wofse died in August 2019, Christopher substituted his estate. Id. 146- 163. Three months later, the Wofses filed an amended complaint to name the Horns as defendants and add count IX for the wrongful death of Leonard Wofse. Id. 201 ¶¶ 6-7, 231-232 ¶¶ 129-135. In response, the Horns removed the action to this Court, Notice of Removal, ECF No. 1, and moved to dismiss for failure to state a claim, Defs.’ Mot. Dismiss, ECF No. 9. The Wofses then moved for leave to file a second amended complaint, Mot. Am. Compl., ECF No. 14, which the Court allowed, noting that it would “adjudicate the pending motion to dismiss against
the second amended complaint,” Elec. Order, ECF No. 16 (Jan. 15, 2020). The Wofses filed a memorandum and affidavit in opposition to the motion to dismiss, Pls.’ Opp’n Mot. Dismiss, ECF No. 18; id. Ex. 1, Aff. Christopher Wofse, and the Horns moved to strike the affidavit, Defs.’ Mot. Strike Improper Aff. Christopher Wofse Filed with Opp’n Mot. Dismiss & Related References, ECF No. 20. On February 20, 2020, the Court denied the motion to strike and informed the parties that it would treat the pending motion to dismiss as a motion for summary judgment. Elec. Order, ECF No. 22 (Feb. 20, 2020). At a hearing on March 17, 2020, the Court allowed the motion to dismiss as to count IX for the wrongful death of Leonard Wofse, reiterated that after 90 days it would treat the
motion to dismiss the remaining counts as a motion for summary judgment on those counts, and ordered depositions of the Horns and Christopher Wofse. Elec. Clerk’s Notes, ECF No. 27 (Mar. 17, 2020); Tr. Teleconference 6, 17-18, ECF No. 31. The parties later filed supplemental briefing. See generally Pls.’ Suppl. Resp.; Defs.’ Suppl. Reply. II. ANALYSIS A. Summary Judgment Standard Summary judgment is appropriate when “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). The
moving party initially bears the burden of demonstrating that “the nonmoving party has failed to make a sufficient showing on an essential element of her case with respect to which she has the burden of proof.” Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). If the movant does so, then the nonmovant must set forth specific facts sufficient to establish a genuine issue for trial. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586–87 (1986). In reviewing the evidence, the Court must “draw all reasonable inferences in favor of the nonmoving party, and it may not make credibility determinations or weigh the evidence.” Reeves v. Sanderson Plumbing Prods., Inc., 530 U.S. 133, 150 (2000) (citations omitted). “[I]f the evidence is such that a reasonable jury could return a verdict for the
nonmoving party,” a court cannot grant a motion for summary judgment. Anderson v. Liberty Lobby, 477 U.S. 242, 248 (1986). B. Identity of Cyberattackers The central legal issue before the Court is whether the Wofses, as the nonmoving party, have adduced sufficient evidence which, if believed by the jury, would entitle them to judgment. See Fed. R. Civ. P. 56(c). It is true that the Wofses’ case lacks direct evidence establishing the identity of the cyberattackers. Nevertheless, the Court rules that there is sufficient circumstantial evidence from which a reasonable jury could infer that the Horns are responsible for the cyberattacks. As the Supreme Court explained nearly seventy years ago, long
before anyone could have imagined anonymous cyberattacks, Circumstantial evidence in this respect is intrinsically no different from testimonial evidence. Admittedly, circumstantial evidence may in some cases point to a wholly incorrect result. Yet this is equally true of testimonial evidence. In both instances, a jury is asked to weigh the chances that the evidence correctly points to guilt against the possibility of inaccuracy or ambiguous inference. In both, the jury must use its experience with people and events in weighing the probabilities. Holland v. United States, 348 U.S. 121, 140 (1954). First, the incidence of cyberattacks roughly tracked developments in the relationship between the Wofses and the Horns. The cyberattacks began in June 2017, approximately one month after the second time the Horns encountered the Wofses’ dogs in a park. See Michael Horn Dep. 82; Tracy Horn Dep. 73- 74; Pls.’ Suppl. Resp., Ex. 22. The cyberattacks later “increase[d] in intensity dramatically” after Christopher Wofse “returned to Lexington after a long absence” and saw Michael Horn. Pls.’ Opp’n Mot. Dismiss, Ex. 1, Aff. Christopher Wofse ¶¶ 4-6. “Following the serving of summons against Michael and
Tracy Horn, the attacks abated . . . .” Id. Ex. 29, Aff. Christopher Wofse ¶ 6. In June 2020, well after Leonard Wofse passed away, State Ct. R. 152, and well after the Horns were named as defendants in this action, id. 201 ¶¶ 6-7, under the name “Lendead Mashwoof” the cyberattackers registered the email address “lawsootloser@gmail.com” to Christopher Wofse’s “Global Markets Intel Launch” list, Pls.’ Suppl. Resp., Ex. 16. Second, the cyberattackers appear to have localized knowledge and concerns. The cyberattackers mentioned “legislature Section 12,” id. Ex. 22, ostensibly referring to the Massachusetts statute, and they expressed concern about property values declining due to the Wofses’ presence in Lexington, id. Ex. 6. The cyberattackers also stated facts that individuals who live near the Wofses’ home might be more likely to know than those who do not, including that the Wofses lived together, id. Ex. 28, and that Christopher Wofse listened to certain music based on the disk left “face up on the passenger side of his car parked outside his home,” State Ct. R. 20 ¶ 32.
Finally, there are similarities between the cyberattackers’ cryptic statements and the Horns’ conduct. Whereas the cyberattackers once stated that “disruption leads to learning,” Pls.’ Suppl. Resp., Ex. 10, Michael Horn -- a self-proclaimed expert on “disruptive innovation,” Michael Horn Dep. 51-52 -- researches “disruptive innovations in education,” id. 53, and Tracy Horn hosted a podcast on “disruptive innovation,” Tracy Horn Dep. 40-43. Similarly, whereas the cyberattackers once claimed to have attended “Yale, Harvard, Princeton, Brown, Penn State etc.,” id. Ex. 23, Michael Horn obtained his bachelor’s degree at Yale University and his master of business
administration at Harvard Business School, Michael Horn Dep. 23, 28, and Tracy Horn completed a two-day course at The Pennsylvania State University, Defs.’ Suppl. Reply, Ex. 1, Aff. Tracy K. Horn ¶ 4. Furthermore, four days after Michael Horn tweeted a Machiavelli quotation, Pls.’ Suppl. Resp. Ex. 24, Leonard Wofse received an anonymous text message which read in part, “feeling a bit Machiavellian today,” id. Ex. 25. Drawing all reasonable inferences in the Wofses’ favor, the Court concludes that summary judgment would be inappropriate on the identification issue. Accordingly, having ruled the evidence sufficient to warrant a finding that the Horns were the cyberattackers, the Court proceeds to assess the sufficiency of the evidence underlying the Wofses’ nine remaining counts.
C. Count I: Defamation A plaintiff pursuing a defamation claim under Massachusetts law “must establish that the defendant was at fault for the publication of a false statement regarding the plaintiff, capable of damaging the plaintiff’s reputation in the community,4 which either caused economic loss or is actionable without proof of economic loss.”5 White v. Blue Cross & Blue Shield of Mass., Inc., 442 Mass. 64, 66 (2004). “The level of fault required varies between negligence (for statements concerning private persons) and actual malice (for statements concerning public
4 A statement is “capable of damaging the plaintiff’s reputation in the community” when it is defamatory, i.e., when it “tends so to harm the reputation of another as to lower him in the estimation of the community or to deter third persons from associating or dealing with him.” Ravnikar v. Bogojavlensky, 438 Mass. 627, 629-30 (2003) (quotations omitted).
5 There are four categories of statements actionable without proof of economic loss: “statements that constitute libel; statements that charge the plaintiff with a crime; statements that allege that the plaintiff has certain diseases; and statements that may prejudice the plaintiff’s profession or business.” Ravnikar, 438 Mass. at 630 (citations omitted). officials and public figures).” Ravnikar v. Bogojavlensky, 438 Mass. 627, 630 (2003). Actual malice means “knowledge that [the statement] was false or with reckless disregard of whether it was false or not.” New York Times Co. v. Sullivan, 376 U.S. 254, 280 (1964). Plaintiffs who “voluntarily inject[] [themselves] or [are] drawn into a particular public controversy
and thereby become[] a public figure for a limited range of issues” are limited-purpose public figures required to prove actual malice. Gertz v. Robert Welch, Inc., 418 U.S. 323, 351 (1974). Their “‘limited range of issues’ is identified ‘by looking to the nature and extent of an individual’s participation in the particular controversy giving rise to the defamation.’” Lluberes v. Uncommon Prods., LLC, 663 F.3d 6, 13 (1st Cir. 2011) (quoting Gertz, 418 U.S. at 352). “The defendants bear the burden of demonstrating that the plaintiff is a public figure.” Alharbi v. Theblaze, Inc., 199 F. Supp. 3d 334, 355 (D. Mass. 2016) (Saris, C.J.).
The record is replete with vitriolic statements, some of which the Horns contend are “simply vulgar attacks,” “statements implying a threat or harassment,” or “statements of opinion” -- none of which “are capable of being proved true of false.” Defs.’ Mem. Supp. Mot. Dismiss 9, ECF No. 13 (quoting Pan Am Sys., Inc. v. Atl. Ne. Rails & Ports, Inc., 804 F.3d 59, 65 (1st Cir. 2015)). Other statements, the Horns argue, are true. Id. 10-11. The Court declines the Horns’ invitation to deem these statements legally inconsequential, however, proceeding instead to highlight just a few examples sufficient to deny the Horns’ motion for summary judgment as to count I. The cyberattackers sent anonymous emails to Christopher Wofse’s business associates and clients accusing him of using a
“false name” to evade taxes, conceal a past bankruptcy, and hide an illicit drug problem. Pls.’ Suppl. Resp., Ex. 28. First, a reasonable jury could find that the cyberattackers published these statements to Christopher Wofse’s business associates and clients, id., and that these statements were false, State Ct. R. 28-29 ¶¶ 62, 64 (declaring under penalty of perjury in verified complaint that accusations of “deception, hiding information, tax evasion, questionable business practices, and illegal drug use” were “false”). Second, a reasonable jury could find that as part of a broader scheme to harm the Wofses, the Horns made these statements with at least negligent disregard for their
veracity. See Ravnikar, 438 Mass. at 630. Third, a reasonable jury could conclude that the statements concerned Christopher Wofse, as they addressed him by name. Pls.’ Suppl. Resp., Ex. 28. Fourth, based on Christopher Wofse’s affidavit, a reasonable jury could find that the statements were capable of damaging his reputation. See id. Ex. 29, Aff. Christopher Wofse ¶¶ 1-5, 7. Finally, there is sufficient evidence from which to infer that the statements either caused economic loss, id., or fall within one of the four categories of statements actionable without proof of economic loss, see Ravnikar, 438 Mass. at 630. The Horns’ motion for summary judgment is DENIED as to count I. The Court pauses to reject the Horns’ attempt to cast Christopher Wofse as a limited-purpose public figure based on
the New York Times Magazine article about him. See Pendleton v. City of Haverhill, 156 F.3d 57, 68 (1st Cir. 1998) (“[T]he question of whether a defamation plaintiff is a public figure is properly resolved by the court, not by the jury, regardless of the contestability of the predicate facts.”). Whatever the “nature and extent” of Christopher Wofse’s voluntary participation in a drone warfare “controversy,” the allegedly defamatory statements here do not concern that “limited range of issues.” See Lluberes, 663 F.3d at 13. Rather, the anonymous emails sought to undermine Christopher Wofse’s professional reputation in the estimation of the online precious metals
market analysis community, and thereby to deter current and prospective associates and clients from dealing with him. See Ravnikar, 438 Mass. at 630. Accordingly, the Horns cannot sustain their burden of proving that Christopher Wofse was a public figure with respect to these statements, and as a result, Christopher Wofse need not prove that the statements were made with actual malice. D. Count II: Commercial Disparagement Under Massachusetts law, a plaintiff pursuing a commercial disparagement claim must establish that a defendant (1) published a false statement to a person other than the plaintiff; (2) “of and concerning” the plaintiff’s products or services; (3) with knowledge of the statement’s falsity or with reckless disregard of its truth or falsity; (4) where pecuniary harm to the plaintiff’s interests was intended or foreseeable; and (5) such publication resulted in special damages in the form of pecuniary loss. HipSaver, Inc. v. Kiel, 464 Mass. 517, 523 (2013). Unlike defamation, commercial disparagement requires the plaintiff to prove actual malice “irrespective of whether the plaintiff is a public or private figure.” Id. at 529-31 & n.14. Actual malice “is not measured by whether a reasonably prudent man would have published or would have investigated before publishing,” but rather whether there is “sufficient evidence to permit the conclusion that the defendant in fact entertained serious doubts as to the truth of his publication.” Id. at 530 (quotations omitted) (quoting St. Amant v. Thompson, 390 U.S. 727, 731 (1968)). Thus the “inquiry is a subjective one as to the defendant’s attitude toward the truth or falsity of the statement . . . .” Id. Only a “high degree of awareness of [the] probable falsity” will suffice. Id. (ellipsis and quotations omitted) (quoting Garrison v. Louisiana, 379 U.S. 64, 74 (1964)). Additionally, “special damages” means “pecuniary loss that results directly and immediately from the effect of the conduct of third persons acting in response to the alleged disparagement, and the expense of measures reasonably necessary to counteract the publication.” Id. at 536 (quotations omitted). To establish special damages, “a plaintiff must show, where feasible, a specific loss of sales to identifiable customers.” Id. at 537.
For the reasons stated above with respect to count I, a reasonable jury could find that the emails sent to Christopher Wofse’s business associates and clients accusing him of using a “false name” to evade taxes, conceal a past bankruptcy, and hide an illicit drug problem, Pls.’ Suppl. Resp., Ex. 28, were published, false, and “of and concerning” his online business, see Kiel, 464 Mass. at 523. Furthermore, there is a genuine dispute as to whether the Horns made these statements with actual malice. One reasonable (but not inexorable) reading of the record is that the series of vitriolic statements, in combination with other cyberattacks against the Wofses, was
intended to harm Christopher Wofse’s online business. See Pls. Suppl. Resp., Ex. 28. Because the Court cannot say as matter of law that this evidence could not support such a factual finding, it cannot grant summary judgment on the third or fourth elements of commercial disparagement. See Anderson, 477 U.S. at 248. Finally, based on Christopher Wofse’s affidavit, a reasonable jury could conclude that Christopher Wofse suffered special damages. See Pls.’ Suppl. Resp., Ex. 29, Aff. Christopher Wofse ¶¶ 4, 6 (declaring that “[e]xisting subscribers cancelled their contracts, and potential subscribers did not register as a result of the defamatory and disparaging messages,” leading Christopher Wofse’s business to lose $1,412,000 in total, $9,600 of which was attributable to “a cancelled writing contract with
a business associate who was targeted by the email attacks”). The Horns’ motion for summary judgment is DENIED as to count II. E. Count III: Interference with Advantageous Relationship “The elements of the tort of interference with an advantageous relationship that a plaintiff must prove are (1) a business relationship or contemplated contract of economic benefit; (2) the defendant’s knowledge of such relationship; (3) the defendant’s intentional and malicious interference with it; (4) the plaintiff’s loss of advantage directly resulting from the defendant’s conduct.” Comey v. Hill, 387 Mass. 11, 19 (1982) (quotations omitted). There is sufficient evidence from which a reasonable jury
could conclude that the Horns interfered with Christopher Wofse’s advantageous relationship with associates and clients of his online business. Christopher Wofse’s affidavit explains that he “operates a business” in which he “give[s] investment advice” to “paying subscribers.” Pls.’ Suppl. Resp., Ex. 29, Aff. Christopher Wofse ¶¶ 1, 4. One reasonable inference to draw from the series of cyberattacks against the Wofses generally and Christopher Wofse’s business specifically is that the Horns both knew about Christopher Wofse’s advantageous relationship with his business associates and clients and intentionally and maliciously interfered with this relationship by identifying and contacting his associates and clients. See
id. Ex. 28. Christopher Wofse further attests that “[e]xisting subscribers cancelled their contracts, and potential subscribers did not register as a result” of the cyberattacks. Id. Ex. 29, Aff. Christopher Wofse ¶ 4. Thus “the evidence is such that a reasonable jury could return a verdict for the nonmoving party,” and the Horns’ motion for summary judgment is therefore DENIED as to count III. See Anderson, 477 U.S. at 248. F. Counts IV and V: Intentional Infliction of Emotional Distress A plaintiff pursuing a claim for intentional infliction of emotional distress under Massachusetts law must show “(1) that [the defendant] intended, knew, or should have known that his conduct would cause emotional distress; (2) that the conduct was extreme and outrageous; (3) that the conduct caused emotional distress; and (4) that the emotional distress was severe.” Polay v. McMahon, 468 Mass. 379, 385 (2014). Conduct is “extreme and outrageous only if it goes beyond all possible
bounds of decency, and is regarded as atrocious, and utterly intolerable in a civilized community.” Id. at 386 (brackets and quotations omitted). Although “mere insults, indignities, threats, annoyances, petty oppressions, or other trivialities” will not suffice, id. at 385, “neither a factfinder nor an appellate court is obliged to balkanize the defendant’s course of conduct, isolating its component parts and, in the bargain,
minimizing their net effect,” Sindi v. El-Moslimany, 896 F.3d 1, 21 (1st Cir. 2018) (applying Massachusetts law). Rather, a jury is “entitled to put as harsh a face on the actions of the defendant as the basic facts would reasonably allow.” Id. (brackets and quotations omitted). Thus “[r]epeated harassment may compound the outrageousness of incidents which, taken individually, might not be sufficiently extreme to warrant liability for infliction of emotional distress.” Id. (ellipsis and quotations omitted). Here, a reasonable jury could conclude that the Horns are liable for intentional infliction of emotional distress. First,
the jury could conclude based on the orchestrated series of cyberattacks that the Horns at least should have known that their actions would cause the Wofses to suffer emotional distress. See Polay, 468 Mass. at 385. Second, in putting “as harsh a face on the actions of the [Horns] as the basic facts would reasonably allow,” see Sindi, 896 F.3d at 21, the jury could find that the net effect of the cyberattacks “goes beyond all possible bounds of decency, and is regarded as atrocious, and utterly intolerable in a civilized community,” see Polay, 468 Mass. at 386. Furthermore, there is sufficient evidence to raise a genuine dispute regarding whether the Horns’ actions caused the Wofses to suffer severe emotional distress, including new and worsened physical and mental ailments. Pls.’ Suppl.
Resp., Ex. 30. The Horns’ motion for summary judgment is DENIED as to counts IV and V. G. Counts VI and VII: Negligent Infliction of Emotional Distress To recover for negligent infliction of emotional distress under Massachusetts law, “a plaintiff must prove the following: (1) negligence; (2) emotional distress; (3) causation; (4) physical harm manifested by objective symptomatology; and (5) that a reasonable person would have suffered emotional distress under the circumstances of the case.” Helfman v. Ne. Univ., 485 Mass. 308, 327 (2020) (quotations omitted). The existence of a duty -- an essential element of negligence -- is a question of law to be “determined by reference to existing social values and customs and appropriate social policy.” Williams v. Steward Health Care Sys., LLC, 480 Mass. 286, 290 (2018). “No better general statement can be made than that the courts will find a duty where, in general, reasonable persons would recognize it
and agree that it exists.” Jupin v. Kask, 447 Mass. 141, 146 (2006). “As a general principle of tort law, every actor has a duty to exercise reasonable care to avoid physical harm to others.” Remy v. MacDonald, 440 Mass. 675, 677 (2004) (citing Restatement (Second) of Torts § 302 cmt. a (Am. L. Inst. 1965) (“In general, anyone who does an affirmative act is under a duty to others to exercise the care of a reasonable man to protect
them against an unreasonable risk of harm to them arising out of the act”.)). “That duty is limited by the principle that the risk of harm must be foreseeable to the actor.” Harbi v. Mass. Inst. of Tech., Civil Action No. 16-12394-FDS, 2017 WL 3841483, at *8 (D. Mass. Sept. 1, 2017) (Saylor, J.). The Court rules that the Horns owed the Wofses a “general duty to refrain from conduct that creates an unreasonable risk of foreseeable harm.” See id. Viewing the record in the light most favorable to the Wofses, there is sufficient evidence from which to conclude that the risk of emotional distress resulting from a prolonged series of multifaceted cyberattacks was
reasonably foreseeable. Furthermore, the Court concludes that genuine issues of material fact exist as to the remaining elements of counts VI and VII. There is evidence that the Wofses suffered emotional distress, that the Horns’ cyberattacks caused this distress, that the Wofses suffered “physical harm manifested by objective symptomatology” (i.e., Christopher Wofse’s internal bleeding and Leonard Wofse’s hypertensive emergencies), and that a reasonable person in the Wofses’ position would have suffered such distress. See Pls.’ Suppl. Resp., Ex. 30. The Horns’ motion for summary judgment is DENIED as to counts VI and VII. H. Count VIII: Invasion of Privacy Massachusetts law recognizes a statutory right to privacy.
See Mass. Gen. Laws ch. 214, § 1B. Massachusetts General Laws chapter 214, section 1B provides, “A person shall have a right against unreasonable, substantial or serious interference with his privacy. The superior court shall have jurisdiction in equity to enforce such right and in connection therewith to award damages.” Id. “To sustain a claim for invasion of privacy, the invasion must be both unreasonable and substantial or serious.” Polay, 468 Mass. at 382. Although most “jurisprudence under that statute has involved public disclosure of private facts . . . a plaintiff also may support a claim of invasion of privacy by showing that a defendant has intruded
unreasonably upon the plaintiff’s ‘solitude’ or ‘seclusion.’” Id. The statute is framed “in broad terms so that the courts can develop the law thereunder on a case-by-case basis, by balancing relevant factors,” including “the location of the intrusion, the means used, the frequency and duration of the intrusion, and the underlying purpose behind the intrusion.” Id. at 383 (quotations omitted). Thus whether an intrusion is “unreasonable and substantial or serious” generally presents a question of fact. Id. Here, there is evidence that the cyberattackers submitted a request to “recover” a Google account in Christopher Wofse’s name, Pls.’ Suppl. Resp., Ex. 9, and to “authenticate” Christopher Wofse’s Amazon password, id. Ex. 11. In July 2017,
Christopher Wofse received an anonymous email with his date of birth, social security number, and driver’s license number in the subject line, State Ct. R. 20 ¶ 31, and later that day he received an anonymous text message criticizing his taste in music based on a disk that he had left “face up on the passenger side of his car parked outside his home,” id. ¶ 32. Christopher Wofse also received anonymous text messages gloating that it was “too late” to “beef up security” because “[i]n’s in,” id. 18 ¶ 26, and suggesting that his attempt to set a new router password was futile, id. 21 ¶ 34. This evidence is sufficient to raise a genuine dispute regarding whether the Horns’ actions
were “unreasonable and substantial or serious.” See Polay, 468 Mass. at 383. The Horns’ motion for summary judgment is DENIED as to count VIII. I. Count X: Computer Fraud and Abuse Act The Computer Fraud and Abuse Act criminalizes, among other conduct, “intentionally access[ing] a computer without authorization . . . and thereby obtain[ing] . . . information from any protected computer.” 18 U.S.C. § 1030(a)(2)(C). “Any computer with internet access is covered by the statute . . . .” T.H. Glennon Co., Inc. v. Monday, CIVIL ACTION NO. 18-30120-WGY, 2020 WL 1270970, at *8 (D. Mass. Mar. 17, 2020) (quotations omitted). A user “accesses ‘without authorization’ when that user has no permission to access the computer system at all.”
Id. at *9. When a violation of the Computer Fraud and Abuse Act “involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i),” a private right of action exists to remedy the violation. Id. § 1030(g). Whereas subclause (I) applies to “damage or loss”6 “aggregating at least $5,000 in value” and permits recovery of only “economic damages,” id. § 1030(c)(4)(A)(i)(I), the other subclauses are not so limited, see id. § 1030(g). See also Hains v. Adams, Civil No. 19-cv-504 (DJN), 2019 WL 5929259, at *8 (E.D. Va. Nov. 12, 2019) (“Unlike Subclause (I), Subclause (II) does not
contain a $5,000 threshold, nor does § 1030(g) limit the
6 Damage” means “any impairment to the integrity or availability of data, a program, a system, or information . . . .” 18 U.S.C. § 1030(e)(8). “Loss” means “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service . . . .” Id. § 1030(e)(11). recoverable damages to only economic damages.”). Subclause (II) applies to “the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals,” id. § 1030(c)(4)(A)(i)(II), and subclause (III) covers “physical injury to any person,” id. § 1030(c)(4)(A)(i)(III). The
difference between subclauses (II) and (III) is that the former applies when the violation modifies or impairs an individual’s existing medical examination, diagnosis, treatment, or care, and the latter applies when the violation causes a physical injury. Hains, 2019 WL 5929259, at *8. As an initial matter, the Court rules that there is a genuine dispute regarding whether the Horns “intentionally access[ed] a computer without authorization . . . and thereby obtain[ed] . . . information from any protected computer.” See 18 U.S.C. § 1030(a)(2)(C). The cyberattackers submitted a request to “recover” a Google account in Christopher Wofse’s
name, Pls.’ Suppl. Resp., Ex. 9, and to “authenticate” Christopher Wofse’s Amazon password, id. Ex. 11. In July 2017, Christopher Wofse received an anonymous email with his date of birth, social security number, and driver’s license number in the subject line, State Ct. R. 20 ¶ 31. Christopher Wofse also received anonymous text messages gloating that it was “too late” to “beef up security” because “[i]n’s in,” id. 18 ¶ 26, and suggesting that his attempt to set a new router password was futile, id. 21 ¶ 34. The cyberattackers also appear to have obtained the email addresses of Christopher Wofse’s business associates and clients. See Pls.’ Suppl. Resp. Ex. 12, Ex. 23, Ex. 26, Ex. 28. This is sufficient evidence from which a reasonable jury could conclude that the Horns intentionally
accessed the Wofses’ internet-connected computer without authorization and thereby obtained information. See 18 U.S.C. § 1030(a)(2)(C). Still, to prevail against the Horns in a civil action, this potential violation must fall within at least one enumerated subclause of 18 U.S.C. § 1030(c)(4)(A)(i). See 18 U.S.C. § 1030(g). At issue here are subclauses (I), (II), and (III). As to subclause (I), the Court does not consider Christopher Wofse’s loss of business income to count toward the $5,000 statutory minimum. See Tri Cty. Tel. Ass’n v. Campbell, Case No: 17-CV-89-F, 2019 WL 7841073, at *6 (D. Wyo. June 4,
2019) (“[C]ourts have held that loss of business opportunities or goodwill do not constitute loss within the meaning of the [Computer Fraud and Abuse Act].”). Congress’s definition of “loss,” “with its references to damage assessments, data restoration, and interruption of service,” limited the “focus to harms caused by computer intrusions, not general injuries unrelated to the hacking itself.” Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1263 (9th Cir. 2019). See also Shirokov v. Dunlap, Grubb & Weaver, PLLC, Civil Action No. 10-12043-GAO, 2012 WL 1065578, at *24 (D. Mass. Mar. 27, 2012) (O’Toole, J.) (“There is nothing to suggest that the ‘loss’ or costs alleged can be unrelated to the computer.”). Accordingly, the Court declines to consider “the way the information was later used”
allegedly to harm Christopher Wofse’s business in determining whether the Wofses have adduced evidence of a predicate “loss.” See Nexans Wires S.A. v. Sark-USA, Inc., 319 F. Supp. 2d 468, 477 (S.D.N.Y. 2004), aff’d, 166 F. App’x 559 (2d Cir. 2006). Of course, the Wofses might have incurred a “cost of responding to [the] offense” when they commissioned the ultimately unsuccessful forensic report. See 18 U.S.C. § 1030(e)(11). Even assuming that this cost is the type of “loss” contemplated under subclause (I), however, there is no evidence that it totaled $5,000 or more. Seeing no basis for a private right of action under subclause (I), the Court turns to
subclauses (II) and (III). As noted above, the $5,000 statutory minimum does not apply to subclauses (II) or (III). See Hains, 2019 WL 5929259, at *8. The Court therefore need only determine whether the Wofses have adduced sufficient evidence of a “modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals,” see 18 U.S.C. § 1030(c)(4)(A)(i)(II), or of a “physical injury to any person,” see id. § 1030(c)(4)(A)(i)(III). As to subclause (II), there is evidence that “[a]s a result of these attacks,” Leonard Wofse’s prescription for clonazepam was tripled from .25mg once daily to .25mg thrice daily, and that his intake of Lisinopril often
increased above his baseline dosage of 10mg. Pls.’ Suppl. Resp., Ex. 30. On these facts, a reasonable jury could conclude that the Horns’ cyberattacks modified or impaired Leonard Wofse’s treatment or care for his panic episodes, insomnia, and anxiety. As to subclause (III), there is evidence that “as a result of the attacks,” Christopher Wofse began to suffer from anxiety, panic attacks, insomnia, and internal bleeding. Id. On this basis, a reasonable jury could conclude that the Horns’ cyberattacks caused Christopher Wofse to suffer a physical injury. The Horns’ motion for summary judgment on count X is DENIED.
III. CONCLUSION For the foregoing reasons, the Court DENIES the Horns’ motion for summary judgment.
SO ORDERED. /s/ William G. Young WILLIAM G. YOUNG DISTRICT JUDGE