Invasion of Privacy, Outrage and the iPad

Three women who “are former employees of . . . Jeremiah Johnson and/or [his] law firm”, which apparently is/was in Kansas, sued him in federal court, alleging “claims of invasion of privacy, outrage and breach of fiduciary duty.”  Bashaw v. Johnson, 2012 WL 1623483 (U.S. District Court for the District of Kansas 2012).

The opinion only says a little about how they came to bring the suit, but according to a news story, the plaintiffs allege that “personal injury attorney” Johnson “encouraged” them (the opinion says he “required” them) to “wear `skirts and high heels’ and then surreptitiously placed an iPhone (or iPad) under their desks with a[n] . . . app called Cam-u-flage, `the best spy camera app to take pictures without anyone noticing.”

The opinion says Johnson used Cam-u-flage on “iPhone and iPad to conduct video surveillance of the area beneath a particular desk in the office such that [he] secretly obtained video recordings of [their] legs, lower torsos and undergarments.”  Bashaw v. Johnson, supra.

The news story says the women realized what was happening when one of them “found the camera under the desk.”  Bashaw v. Johnson, supra.  It says they were apparently “able to see and delete the photos”, after which they sued Johnson, claiming damages of $75,000 each. He responded by filing a counterclaim against them in which he alleged that the women, “ in violation of the [Computer Fraud and Abuse Act], accessed [his] iPhone and iPad in excess of their authorization and deleted data from those devices.”  Bashaw v. Johnson, supra. (I don’t have the counterclaim but since the story says the women “were able to see and delete the photos,” I’m assuming it’s based on their allegedly unlawful access to Johnson’s iPhone and/or iPad.)

As I’ve noted before, the Computer Fraud and Abuse Act [CFAA], which is codified as 18 U.S. Code 1030, is the general federal cybercrime statute.  It criminalizes accessing a computer without being authorized to do so, among other things.  And as I’ve also noted, § 1030 creates a civil cause of action for someone who has been injured by criminal conduct that violates the Act.  Section 1030(g) states, in part, that “[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages. . . .”  That is what Johnson did, although he filed his 1030(g) action as a counterclaim, rather than as an original claim in a civil complaint. 

The three plaintiffs responded by filing a Rule 12(b)(6) motion to dismiss Johnson’s counterclaim. Bashaw v. Johnson, supra.  Rule 12(b)(6) motions are created by Rule 12(b)(6) of the Federal Rules of Civil Procedure, which are the rules that govern civil suits in federal court.  As Wikipedia explains, a Rule 12(b)(6) motion to dismiss is how

lawsuits with insufficient legal theories underlying their cause of action are dismissed from court. For example, assault requires intent, so if the plaintiff has failed to plead intent, the defense can seek dismissal by filing a 12(b)(6) motion.

`While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff’s obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do. Factual allegations must be enough to raise a right to relief above the speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in fact). Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007).

In his counterclaim, Johnson asserted that “one or more” of the plaintiffs violated the CFAA

accessing, without authorization or in excess of their authorization, [his] iPad, iPhone and one or more of [his] computers and deleting unspecified data from those devices. [Johnson] asserts that he has been damaged by the actions of plaintiffs and that the damages `would exceed’ at least $5000 in value. . . .

Bashaw v. Johnson, supra.

The plaintiffs’ Rule 12(b)(6) motion to dismiss the counterclaim argued that it “fails in at least two respects”:  Johnson did not “sufficiently allege the nature of his damages within the meaning of the CFAA” and he did not “sufficiently allege a qualifying `loss’ within the meaning of the CFAA”.  Bashaw v. Johnson, supra.

The federal district court judge began his analysis of their arguments by noting that under 18 U.S. Code § 1030(g),

a civil action may be brought only if the conduct `involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection [18 U.S. Code 1030](c)(4)(A)(i).’ 18 U.S.C. § 1030(g).  In other words, a plaintiff alleging a violation under § 1030(g) must allege the conduct involved one of the following factors:

 (I) loss to 1 or more persons during any 1–year period . . . aggregating at least $5,000 in value; (II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (III) physical injury to any person; (IV) a threat to public health or safety; [or] (V) damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security.

Bashaw v. Johnson, supra.

The judge noted that Johnson’s counterclaim stated claims against the three plaintiffs under § 1030(g) “for violations of § 1030(a)(2), (a)(4) and (a)(5).” Bashaw v. Johnson, supra.  He also noted that each of these three subsections of 18 U.S. Code 1030,

with some variation, prohibits accessing a . . . computer without authorization and obtaining information from the computer. According to the counterclaim complaint, each of these asserted violations are based on conduct (as required by § 1030(g)) involving a loss aggregating at least $5,000 in value.  

For each of these asserted violations, then, [Johnson] must allege a `loss’ within the meaning of the CFAA. In addition, subsection (a)(5) contains an express “damage” requirement such that [he] must also adequately allege `damage’ within the meaning of the statute for purposes of his subsection (a)(5) claim. . . .Thus, to state a claim under § 1030(g) for violation of § 1030(a)(5) based upon § 1030(c)(4)(A)(i)(I), a plaintiff must allege both `damage’ and a `loss’ aggregating at least $5,000 in value.

Bashaw v. Johnson, supra.

The judge explained that § 1030(e)(8) of the CFAA “defines the term `damage’ as `any impairment to the integrity or availability of data, a program, a system, or information.’” Bashaw v. Johnson, supra.  He also explained that in construing this term, court have found that “damage” refers to “`the destruction, corruption, or deletion of electronic files, the physical destruction of a hard drive, or any “diminution in the completeness or usability of the data on a computer system.”’“ TriTeq Lock, 2012 WL 394119 *5 (N.D. Ill. 2012). 

The judge then noted that Johnson 

conclusorily alleges in this counterclaim that he `has been damaged’ but he does not assert the nature of such damage. In his submissions on the motion, he claims that he suffered damages because `data was erased.’ No where in his submissions or his counterclaim complaint does [Johnson] identify the data that was allegedly erased.

This allegation, then, essentially parrots the statutory language and is insufficiently factual to frame plausibly the damages element of defendant's CFAA claim. . . . For this reason, [Johnson] cannot state a claim for relief under [18 U.S. Code 1030] subsection (a)(5).

Bashaw v. Johnson, supra. 

The judge also found that Johnson had failed to plead “a qualifying `loss’ for purposes of the CFAA. Bashaw v. Johnson, supra.  He noted that under 18 U.S. Code 1030, the

`term “loss” means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.’

Bashaw v. Johnson, supra (quoting 18 U.S.C. § 1030(e)(11)).

The judge then explained that the “majority of courts have construed the term `loss’ to include only two types of injury -- costs incurred (such as lost revenues) because the computer's service was interrupted and costs to investigate and respond to computer intrusion or damage.” Bashaw v. Johnson, supra. 

He then applied this standard to Johnson’s counterclaim.  Bashaw v. Johnson, supra.  The judge found that in his counterclaim, Johnson

has not alleged that he suffered any `loss’ under the CFAA.

While he alleges that unspecified losses `would exceed’ $5,000 in value, he does not allege that he actually incurred losses in that amount. He does not allege or identify any investigative or response costs incurred as a result of the alleged CFAA violation and he does not allege any lost revenues or other losses incurred due to any interruption in service.

In his submissions, he contends that qualifying losses under the statute include `for example’ the prorated salaries or wages of employees who spent time restoring a backup of deleted data or recreating lost work, but he does not suggest that his employees performed these tasks or that he incurred costs relating to such tasks.

Bashaw v. Johnson, supra. 

The judge therefore held that

[b]ecause he has not alleged any loss under the statute, [Johnson] cannot maintain a CFAA claim for violations of any of the subsections identified in his counterclaim complaint. This claim is dismissed in its entirety.

Bashaw v. Johnson, supra. 

The judge dismissed Johnson’s CFAA counterclaim, which means that as of May 9, 2012 it was no longer part of this case.  Bashaw v. Johnson, supra.  The dismissal does not prevent Johnson from trying again, i.e, from filing another counterclaim in which he resolves the deficiencies in the initial one.