This post examines an opinion the U.S. District Court for the Middle District of Tennessee issued in a civil case: Morgan
v. Preston, 2013 WL 5963563 (2013). The opinion says that James Tagney
Morgan and Van Asa Preston were
married on March 29, 2008. . . . [Morgan]
alleges that [Preston] `installed SPECTOR PRO commercial software . . . on his personal computer’ without
authorization on or about June 1, 2012. . . . [Morgan] asserts that he and [Preston]
separated `on or about July 6, 2012,’ following which [she] filed for divorce
on July 20, 2012. . . .
Morgan v. Preston,
supra.
In a footnote, the opinion says Morgan alleged that
`SPECTOR PRO is “`monitoring’ software
. . . designed to capture all user activity . . . without a user's knowledge.’
. . . Plaintiff further asserts that SPECTOR PRO `captures all passwords typed
and all emails sent and received as well as all other activity,’ and . . . `automatically
upload[s] this information to a particular website or emailed to a particular
address.’
Morgan v. Preston,
supra.
In the Complaint he filed to initiate the lawsuit, Morgan
alleged that Preston’s
actions `violated 18 U.S. Code §1030(a)(4) by knowingly and with intent to defraud, accessed a protected
computer . . . to obtain information and materials to use against Plaintiff's
economic interests and in furtherance of the parties personal disputes.’ . . .
[Morgan] asserts that his personal
computer was a `protected’ computer as defined under §§1030(e)(1)-(2) of the [Computer Fraud and Abuse Act]. . . . [Morgan] argues
further that [Preston] violated §§ 1030(a)(2)(c) and (a)(4), that
those violations damaged him within the meaning of §§ 1030(e)(8) and (g),
and that [Preston’s] alleged actions caused him `loss during a one year period
of at least Five Thousand Dollars ($5,000)’ within the meaning of §§1030(c)(4)(A)(i)(I) and (e)(11). . . . Based on the foregoing,
plaintiff asserts that he is entitled to damages, costs and attorney fees under
the CFAA.
Morgan v. Preston,
supra. As this site explains, while
the Computer Fraud and Abuse Act (CFAA) is a criminal statute, it also creates a civil cause of action for
those who have been “damaged” or suffered “loss” as the result of a violation
of the CFAA’s criminal provisions. If
you are interested, you can read more about the civil cause of action in this
prior post.
The opinion does not say when Morgan filed his Complaint and
began the action, but it notes that on
May 29, 2013, [Preston] filed a motion
to dismiss under Rule 12(b)(6) [of the Federal Rules of Civil Procedure], accompanied
by a supporting memorandum of law and facts. . . . [She] asserts initially that
the computer at issue was a `family computer located in the family home to
which both parties had equal access.’ . . .
[Preston] argues that the computer
in question was not a `protected’ computer within the meaning of the CFAA, and
that [Morgan’s] claim that he `suffered damages ‘of at least Five Thousand
Dollars ($5,000)’ is a mere legal and factual conclusion . . . not supported by
any facts. . . .’
Morgan v. Preston,
supra.
The Federal Rules of Civil Procedure govern the conduct of
civil suits, including efforts to have a suit dismissed. As I have noted in
prior posts, and as Wikipedia explains, defendants use a Rule 12(b)(6)
motion to ask the judge to dismiss some or all of the plaintiff’s causes of action because they are legally deficient. When a judge rules on such a
motion, he/she is only concerned with whether the plaintiff’s allegations, if
proven at trial, would establish that the plaintiff is entitled to recover for
a given cause of action.
So, if for example, John Doe sues Mary Smith claiming she
published a blog post that libeled him, Mary Smith can file a Rule
12(b)(6) motion to dismiss pointing out (if this is true) that Doe’s complaint
(his statement of his claim) does not plead one of the essential elements of
libel, which is that the statements were false. If the judge finds
that is true, given the facts pled in the complaint he/she will dismiss that
cause of action.
On June 7, 2013, Morgan filed a response to Preston’s motion
to dismiss on
June 7, 2013. . . . In it, [Morgan]
asserts that the computer in question is a `protected computer’ within the
meaning of § 1030(e)(1)(2). .
. . . [He] also argues that, `[s]ince virtually any computer that sends email
in the course of its function is used in interstate or foreign commerce, this
fact, and the facts set forth in Paragraph 13 [of the complaint], squarely
defines the computer in question as “protected” within the meaning of
... section 1030(e)(2)(B).’ . . .
[Morgan] repeats his claim that the
CFAA provides for a private right of action, that he was damaged within the
meaning of §§ 1030(e)(8) and (g), that [Preston’s] alleged
action `caused [him] loss during a one year period of at least Five Thousand
Dollars ($5,000), within the meaning of . . . § 1030(c)(4)(A)(i)(I),’ and
that plaintiff is liable for damages, costs, and attorney's fees under the
CFAA. . . .
Morgan v. Preston,
supra.
Next, Preston filed a reply to Morgan’s response to her
motion to dismiss
on June 18, 2013. . . . [She] argues
that [Morgan] has failed to establish the prerequisites for asserting a private
cause of action under the CFAA, i.e., that he suffered
damages, that the computer at issue was a `protected’ as defined under the Act,
or any facts in support of his claim to have suffered harm in excess of $5,000.
. . .
[Preston] also maintains that [Morgan’s]
argument that the CFAA `covers all computers used or owned by any person’ is
too expansive and `not warranted by the clear wording of the statute.’ . . . [Preston]
also argues again that [Morgan’s] claim of damages is conclusory and as such
are subject to dismissal under Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007).
Morgan v. Preston,
supra.
The U.S. District Court Judge who has the case found the
issues raised by Preston’s motion to dismiss were “properly before the court”
and therefore analyzed the arguments made by both sides. Morgan v. Preston, supra. He
began his analysis of the arguments by noting that in assessing a motion to
dismiss under Rule 12(b)(6),
the court construes the complaint in
the light most favorable to the plaintiff, accepts the plaintiff's factual
allegations as true, and determines whether the complaint `contain[s] sufficient
factual matter, accepted as true, to state a claim to relief that is plausible
on its face.’ Ashcroft v. Iqbal, supra. `[A] plaintiff's obligation
to provide the ‘grounds' of his ‘entitlement to relief’ requires more than
labels and conclusions, and a formulaic recitation of the elements of a cause
of action will not do.’ Bell Atlantic Corp. v. Twombly, supra.
Courts are not required to accept as
true legal conclusions couched as factual allegations. Bell Atlantic
Corp. v. Twombly, supra. `Factual allegations must be enough to raise a
right to relief above the speculative level. . . .’ Bell Atlantic Corp. v.
Twombly, supra. `[O]nly a complaint that states a plausible claim for
relief survives a motion to dismiss. . . . [W]here the well-pleaded facts do
not permit the court to infer more than the mere possibility of misconduct, the
complaint has alleged -- but it has not “show[n]” -- that the pleader is
entitled to relief.’ Ashcroft v. Iqbal, supra (quoting Federal Rule of Civil Procedure Rule 8(a)(2)).
Morgan v. Preston,
supra.
The judge then took up the issues raised by the motion to
dismiss, noting that while the Computer Fraud and Abuse Act creates a civil
cause of action, the cause of action
under the CFAA is constrained as follows:
`Any person who suffers damage or loss by reason of
a violation of this section may maintain a civil action against the violator to
obtain compensatory damages and injunctive relief or other equitable relief. A
civil action for a violation of this section may be brought only if the
conducts involves 1 of the factors set forth in subclauses (I), (II), (III),
(IV), or (V) of section (c)(4)(A) (I). . . .’
28 U.S.C. § 1030(g). The five factors to which § 1030(g) above refers that give rise to a private cause of action are listed below.
(I) loss to 1 or more persons during any 1–year
period ... aggregating at least $5,000 in value;
(II) the modification or impairment, or potential
modification or impairment, of the medical examination, diagnosis, treatment,
or care of 1 or more individuals;
(III) physical injury to any person;
(IV) a threat to public health or safety;
(V) damage affecting a computer used by or for an
entity of the United States Government in furtherance of the administration of
justice, national defense, or national security ....
28 U.S.C. § 1030(c)(4)(A)(i). If a claim does not fall within the ambit of one or more of the five factors above, then a private cause of action under the CFAA will not lie.
Morgan v. Preston,
supra.
He then explained that Morgan asserted
both his complaint and his response
that defendant's alleged actions caused him a `loss during a one year period of
at least Five Thousand Dollars ($5,000). Plaintiff cites specifically to §
1030(c)(4)(A)(i)(I) as grounds for the relief sought which, as noted on
the preceding page, requires `loss to 1 or more persons during any 1–year
period ... aggregating at least $5,000 in value. . . .’
Morgan v. Preston,
supra.
The judge then found that while
§
1030(c)(4)(A)(i)(I) to which [Morgan] refers is one of the five factors
that give rise to a private cause of action, [he] has not provided any factual
allegations in support of his claim that he lost at least $5,000, either in his
complaint or later in his response when he had the chance to do so after [Preston]
argued this claim was conclusory.
[Morgan’s] claim is a mere formulaic
recitation of the elements of a cause of action. As previously established, `a
plaintiff's obligation to provide the ‘grounds' of his ‘entitlement to relief’
requires more than labels and conclusions, and a formulaic recitation of the
elements of a cause of action will not do.’ Bell Atlantic Corp. v.
Twombly, supra. Because of the conclusory nature of his claim, [Morgan] has
failed to establish he has standing to bring private right of action
under § 1030(c)(4)A)(i)(I).
Morgan v. Preston,
supra.
The judge noted that Morgan also
cited § 1030(e)(8) in the context of
this claim. However, § 1030(e)(8) is a definition which defines
`damage’ as `any impairment of the integrity or availability of data, a program,
a system or information. . . .’ Section 1030(e)(8) does not provide
independent grounds for relief. Nevertheless, the court considers out of an
abundance of caution whether [Morgan’s] reference to § 1030(e)(8) was
a not-well-pleaded attempt to assert damages in addition to the money damages
addressed above.
The
only factor listed in §§ 1030(c)(4)(A)(i)(I)-(V) that approximates
damages of the sort defined by § 1030(e)(8) is factor (V), i.e., `damage
affecting a computer used by or for an entity of the United States Government
in furtherance of the administration of justice, national defense, or national
security. . . .’ [Morgan] does not allege that his computer was being `used by
or for an entity of the United States Government in furtherance of the
administration of justice, national defense, or national security . . .,’ nor
can such a claim be inferred from the pleadings.
Morgan v. Preston,
supra.
Lastly, he pointed out that Morgan
cites § 1030(e)(11) in the context of
this claim. Section 1030(e)(11) is another definition which, once
again, does not provide independent grounds for relief. Rather, § 1030(e)
(11) defines `loss’ as `any reasonable cost to any victim, including the
cost of responding to an offense, conducting a damage assessment, and restoring
the data, program, system, or information to its condition prior to the
offense, and any revenue lost, cost incurred, or other consequential damages
incurred because of interruption of service. . . .’ `Loss’ is defined in terms
of `cost,’ i.e., dollars and cents, which brings [Morgan] back
to $5,000 money-related claim which already has been addressed.
For the reasons explained above, [Morgan]
has failed to establish that he has standing to bring a private right of action
under the CFAA. Having determined that [Morgan] does not have standing to bring
a private right of action under the CFAA, it is not necessary for the court to
address the remainder of [his] arguments under the CFAA. [Morgan’s] claim under
the CFAA will be dismissed for failure to state a claim on which relief may be
granted.
Morgan v. Preston,
supra.
The judge therefore dismissed Morgan’s claim under the
CFAA. Morgan v. Preston, supra. He
also dismissed another federal claim Morgan had raised, for essentially the
same reason, i.e., that Morgan had not adequately pled that cause of action,
either. Morgan v. Preston, supra. He also dismissed a cause of action Morgan
had pled under the Tennessee Personal and Commercial Computer Act of 2003 because
without a federal law claim, the court did not have jurisdiction over that
cause of action. This meant Morgan could
file that claim in a state court. Morgan
v. Preston, supra.
No comments:
Post a Comment