The Computer Fraud and Abuse Act, the Spouse and Spector Pro

-->

This post examines an opinion the U.S. District Court for the Middle District of Tennessee issued in a civil case:  Morgan v. Preston, 2013 WL 5963563 (2013). The opinion says that James Tagney Morgan and Van Asa Preston were

married on March 29, 2008. . . . [Morgan] alleges that [Preston] `installed SPECTOR PRO commercial software . . . on his personal computer’ without authorization on or about June 1, 2012. . . . [Morgan] asserts that he and [Preston] separated `on or about July 6, 2012,’ following which [she] filed for divorce on July 20, 2012. . . .

Morgan v. Preston, supra.

In a footnote, the opinion says Morgan alleged that

`SPECTOR PRO is “`monitoring’ software . . . designed to capture all user activity . . . without a user's knowledge.’ . . . Plaintiff further asserts that SPECTOR PRO `captures all passwords typed and all emails sent and received as well as all other activity,’ and . . . `automatically upload[s] this information to a particular website or emailed to a particular address.’

Morgan v. Preston, supra.

In the Complaint he filed to initiate the lawsuit, Morgan alleged that Preston’s

actions `violated 18 U.S. Code §1030(a)(4) by knowingly and with intent to defraud, accessed a protected computer . . . to obtain information and materials to use against Plaintiff's economic interests and in furtherance of the parties personal disputes.’ . . .

[Morgan] asserts that his personal computer was a `protected’ computer as defined under §§1030(e)(1)-(2) of the [Computer Fraud and Abuse Act]. . . . [Morgan] argues further that [Preston] violated §§ 1030(a)(2)(c) and (a)(4), that those violations damaged him within the meaning of §§ 1030(e)(8) and (g), and that [Preston’s] alleged actions caused him `loss during a one year period of at least Five Thousand Dollars ($5,000)’ within the meaning of §§1030(c)(4)(A)(i)(I) and (e)(11). . . . Based on the foregoing, plaintiff asserts that he is entitled to damages, costs and attorney fees under the CFAA.

Morgan v. Preston, supra.  As this site explains, while the Computer Fraud and Abuse Act (CFAA) is a criminal statute, it also creates a civil cause of action for those who have been “damaged” or suffered “loss” as the result of a violation of the CFAA’s criminal provisions.  If you are interested, you can read more about the civil cause of action in this prior post.

The opinion does not say when Morgan filed his Complaint and began the action, but it notes that on

May 29, 2013, [Preston] filed a motion to dismiss under Rule 12(b)(6) [of the Federal Rules of Civil Procedure], accompanied by a supporting memorandum of law and facts. . . . [She] asserts initially that the computer at issue was a `family computer located in the family home to which both parties had equal access.’ . . . 

[Preston] argues that the computer in question was not a `protected’ computer within the meaning of the CFAA, and that [Morgan’s] claim that he `suffered damages ‘of at least Five Thousand Dollars ($5,000)’ is a mere legal and factual conclusion . . . not supported by any facts. . . .’

Morgan v. Preston, supra. 

The Federal Rules of Civil Procedure govern the conduct of civil suits, including efforts to have a suit dismissed. As I have noted in prior posts, and as Wikipedia explains, defendants use a Rule 12(b)(6) motion to ask the judge to dismiss some or all of the plaintiff’s causes of action because they are legally deficient. When a judge rules on such a motion, he/she is only concerned with whether the plaintiff’s allegations, if proven at trial, would establish that the plaintiff is entitled to recover for a given cause of action.  

So, if for example, John Doe sues Mary Smith claiming she published a blog post that libeled him, Mary Smith can file a Rule 12(b)(6) motion to dismiss pointing out (if this is true) that Doe’s complaint (his statement of his claim) does not plead one of the essential elements of libel, which is that the statements were false.  If the judge finds that is true, given the facts pled in the complaint he/she will dismiss that cause of action.

On June 7, 2013, Morgan filed a response to Preston’s motion to dismiss on

June 7, 2013. . . . In it, [Morgan] asserts that the computer in question is a `protected computer’ within the meaning of § 1030(e)(1)(2). . . . . [He] also argues that, `[s]ince virtually any computer that sends email in the course of its function is used in interstate or foreign commerce, this fact, and the facts set forth in Paragraph 13 [of the complaint], squarely defines the computer in question as “protected” within the meaning of ... section 1030(e)(2)(B).’ . . .

[Morgan] repeats his claim that the CFAA provides for a private right of action, that he was damaged within the meaning of §§ 1030(e)(8) and (g), that [Preston’s] alleged action `caused [him] loss during a one year period of at least Five Thousand Dollars ($5,000), within the meaning of . . . § 1030(c)(4)(A)(i)(I),’ and that plaintiff is liable for damages, costs, and attorney's fees under the CFAA. . . .

Morgan v. Preston, supra. 

Next, Preston filed a reply to Morgan’s response to her motion to dismiss

on June 18, 2013. . . . [She] argues that [Morgan] has failed to establish the prerequisites for asserting a private cause of action under the CFAA, i.e., that he suffered damages, that the computer at issue was a `protected’ as defined under the Act, or any facts in support of his claim to have suffered harm in excess of $5,000. . . .

[Preston] also maintains that [Morgan’s] argument that the CFAA `covers all computers used or owned by any person’ is too expansive and `not warranted by the clear wording of the statute.’ . . . [Preston] also argues again that [Morgan’s] claim of damages is conclusory and as such are subject to dismissal under Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007). 

Morgan v. Preston, supra. 

The U.S. District Court Judge who has the case found the issues raised by Preston’s motion to dismiss were “properly before the court” and therefore analyzed the arguments made by both sides. Morgan v. Preston, supra.  He began his analysis of the arguments by noting that in assessing a motion to dismiss under Rule 12(b)(6),

the court construes the complaint in the light most favorable to the plaintiff, accepts the plaintiff's factual allegations as true, and determines whether the complaint `contain[s] sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.’ Ashcroft v. Iqbal, supra. `[A] plaintiff's obligation to provide the ‘grounds' of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.’ Bell Atlantic Corp. v. Twombly, supra.

Courts are not required to accept as true legal conclusions couched as factual allegations. Bell Atlantic Corp. v. Twombly, supra. `Factual allegations must be enough to raise a right to relief above the speculative level. . . .’ Bell Atlantic Corp. v. Twombly, supra. `[O]nly a complaint that states a plausible claim for relief survives a motion to dismiss. . . . [W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged -- but it has not “show[n]” -- that the pleader is entitled to relief.’ Ashcroft v. Iqbal, supra (quoting Federal Rule of Civil Procedure Rule 8(a)(2)).  

Morgan v. Preston, supra. 

The judge then took up the issues raised by the motion to dismiss, noting that while the Computer Fraud and Abuse Act creates a civil cause of action, the cause of action

under the CFAA is constrained as follows:

`Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conducts involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of section (c)(4)(A) (I). . . .’

28 U.S.C. § 1030(g). The five factors to which § 1030(g) above refers that give rise to a private cause of action are listed below.

(I) loss to 1 or more persons during any 1–year period ... aggregating at least $5,000 in value;

(II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals;

(III) physical injury to any person;

(IV) a threat to public health or safety;

(V) damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security ....

28 U.S.C. § 1030(c)(4)(A)(i). If a claim does not fall within the ambit of one or more of the five factors above, then a private cause of action under the CFAA will not lie.

Morgan v. Preston, supra. 

He then explained that Morgan asserted

both his complaint and his response that defendant's alleged actions caused him a `loss during a one year period of at least Five Thousand Dollars ($5,000). Plaintiff cites specifically to § 1030(c)(4)(A)(i)(I) as grounds for the relief sought which, as noted on the preceding page, requires `loss to 1 or more persons during any 1–year period ... aggregating at least $5,000 in value. . . .’

Morgan v. Preston, supra. 

The judge then found that while

§ 1030(c)(4)(A)(i)(I) to which [Morgan] refers is one of the five factors that give rise to a private cause of action, [he] has not provided any factual allegations in support of his claim that he lost at least $5,000, either in his complaint or later in his response when he had the chance to do so after [Preston] argued this claim was conclusory.

[Morgan’s] claim is a mere formulaic recitation of the elements of a cause of action. As previously established, `a plaintiff's obligation to provide the ‘grounds' of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.’  Bell Atlantic Corp. v. Twombly, supra. Because of the conclusory nature of his claim, [Morgan] has failed to establish he has standing to bring private right of action under § 1030(c)(4)A)(i)(I).

Morgan v. Preston, supra. 

The judge noted that Morgan also

cited § 1030(e)(8) in the context of this claim. However, § 1030(e)(8) is a definition which defines `damage’ as `any impairment of the integrity or availability of data, a program, a system or information. . . .’ Section 1030(e)(8) does not provide independent grounds for relief. Nevertheless, the court considers out of an abundance of caution whether [Morgan’s] reference to § 1030(e)(8) was a not-well-pleaded attempt to assert damages in addition to the money damages addressed above.

The only factor listed in §§ 1030(c)(4)(A)(i)(I)-(V) that approximates damages of the sort defined by § 1030(e)(8) is factor (V), i.e., `damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security. . . .’ [Morgan] does not allege that his computer was being `used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security . . .,’ nor can such a claim be inferred from the pleadings.

Morgan v. Preston, supra. 

Lastly, he pointed out that Morgan

cites § 1030(e)(11) in the context of this claim. Section 1030(e)(11) is another definition which, once again, does not provide independent grounds for relief. Rather, § 1030(e) (11) defines `loss’ as `any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service. . . .’ `Loss’ is defined in terms of `cost,’ i.e., dollars and cents, which brings [Morgan] back to $5,000 money-related claim which already has been addressed.

For the reasons explained above, [Morgan] has failed to establish that he has standing to bring a private right of action under the CFAA. Having determined that [Morgan] does not have standing to bring a private right of action under the CFAA, it is not necessary for the court to address the remainder of [his] arguments under the CFAA. [Morgan’s] claim under the CFAA will be dismissed for failure to state a claim on which relief may be granted.

Morgan v. Preston, supra. 

The judge therefore dismissed Morgan’s claim under the CFAA.  Morgan v. Preston, supra.  He also dismissed another federal claim Morgan had raised, for essentially the same reason, i.e., that Morgan had not adequately pled that cause of action, either. Morgan v. Preston, supra.  He also dismissed a cause of action Morgan had pled under the Tennessee Personal and Commercial Computer Act of 2003 because without a federal law claim, the court did not have jurisdiction over that cause of action.  This meant Morgan could file that claim in a state court. Morgan v. Preston, supra.