The Engineering Firm, the Computer Fraud and Abuse Act and the Preliminary Injunction

This post examines a decision by a U.S. District Court Judge in the Southern District of Ohio in a civil suit.  The issue involved “Plaintiff Goken America, LLC (`Goken’)'s Motion for Temporary Restraining Order and Preliminary Injunction”.  Goken America, LLC v. Naveen Bandepalya, et al., 2014 WL 6673830 (2014).

The judge begins this opinion by explaining how the litigation arose:

Goken America, LLC (`Goken’) is an Ohio engineering firm that employed defendant, Naveen Bandepalya (`Bandepalya’), from September 2010 until January 2014. Goken promoted Bandepalya to a supervisory position in October 2012. Goken issued Bandepalya a company laptop and iPhone upon his promotion.

In April 2013, Bandepalya requested access to a `Business Development’ subfolder within a larger `Admin’ folder. The larger `Admin’ folder houses a variety of important Goken files, such as: a Japanese–English dictionary specified to Honda engineering terms, employee payroll information, Development Support Engineer information, HR information, employee immigration information, and a folder with legal files. Goken CEO, Doug Smith (`Smith’), gave Bandepalya access to the entire `Admin’ folder on his Goken laptop because it would have been logistically difficult to give Bandepalya restricted access to just the `Business Development’ subfolder.

The Goken network required a unique username and password to access the `Admin’ folder so that only approved employees have access to it. The parties did not discuss Bandepalya's authorization for the other sub-folders within the restricted `Admin’ folder. But Smith testified that it was his understanding that Bandepalya would only access files in the `Business Development’ sub folder based on a conversation they had and based on common practice. (Transcript of Preliminary Injunction Hearing, Goken America v. Bandepalya, 2:14–cv–1445 (2014)).

Bandepalya quit his job at Goken in January 2014. He returned his Goken-issued laptop and iPhone during his exit interview, but both devices had been wiped clean of all Bandepalya's files and restored to default settings. Goken then submitted the devices to a forensic investigator who could recover deleted files and determine some activity from the laptop. That investigator determined that a month before quitting at Goken, in December 2013, Bandepalya copied 8,659 files, the entire contents of the restricted `Admin’ folder, onto his laptop and then onto an external hard drive. Bandepalya confirmed that he copied those files in or around the beginning of January. But he stated that he only meant to take his personal files and presentations that he prepared during his employment at Goken. He testified that he did not open any of Goken's files after downloading them onto the external hard drive. But Liptak, the forensic investigator, testified that Goken files from the `Admin’ folder had been viewed at least 69 times from the external hard drive while it was in Bandepalya's possession.

Goken America, LLC v. Naveen Bandepalya, et al., supra.

The judge goes on to explain that both of the parties to this suit agreed there was

no non-compete contract in effect when Bandepalya was employed at Goken. Goken published a handbook of employee expectations, and that handbook included a confidentiality clause, which Bandepalya signed. His signature affirmed that he had read and understood the policies, but not specifically that he agreed to be bound by the policies. But Bandepalya agreed that he knew that the information on the `Admin’ folder was not to be shared with people outside the company. . . .

While working at Goken, Bandepalya supervised ongoing projects with a valuable client, Honda R & D Americas, Inc. (`Honda’). Bandepalya currently works for Defendant American Hydrostatics (`AH’) and was contracted out to its subsidiary, Defendant Cresttek, LLC (`Cresttek’). Bandepalya's duties at Cresttek are similar to his prior responsibilities at Goken. The similarities include working primarily with Honda, seeking to improve Cresttek's reputation at Honda, and identifying resumes for filling prospective work at Honda. . . .

Goken America, LLC v. Naveen Bandepalya, et al., supra.

The judge explained that on September 3, 2014, Goken filed the complaint that initiated this lawsuit and a motion for a Temporary Restraining Order (TRO) and “Preliminary Injunctive Relief”.  Goken America, LLC v. Naveen Bandepalya, et al., supra.  He entered the TRO which enjoined the defendants from “using or disclosing Goken's confidential business trade secret information”, prohibited Bandepalya “from working on Honda projects until a hearing on the merits”, ordered the defendants “to preserve all documents and electronic files that could be relevant to this lawsuit”, ordered them to “identify and turn over all Goken trade secret information” and ordered Bandepalya “to deliver all external hard drive and USB devices he connected to his Goken laptop during his employment.” Goken America, LLC v. Naveen Bandepalya, et al., supra. Goken’s motion asks the judge to replace the TRO with a Preliminary Injunction.  Goken America, LLC v. Naveen Bandepalya, et al., supra.

The judge began the substantive part of his opinion by explaining that a 

preliminary injunction is a remedy used by the court to preserve the status quo between the parties pending trial on the merits. University of Texas v. Camenisch, 451 U.S. 390 (1981). When determining whether to grant a preliminary injunction, this Court must balance the following four factors: (1) whether the movant has shown a strong likelihood of success on the merits; (2) whether the movant will suffer irreparable harm if the injunction is not issued; (3) whether the issuance of the injunction would cause substantial harm to others; and (4) whether the public interest would be served by issuing the injunction. Overstreet v. Lexington–Fayette Urban Cnty. Gov't, 305 F.3d 566, (U.S. Court of Appeals for the 6th Circuit 2002).

These factors are to be balanced against one another other and should not be considered prerequisites to the grant of a preliminary injunction. United Food & Commercial Workers Union, Local 1099 v. Sw. Ohio Reg'l Transit Auth., 163 F.3d 341 (U.S. Court of Appeals for the 6th Circuit 1998). As an extraordinary remedy, a preliminary injunction is to be granted only if the movant carries his or her burden of proving that the circumstances clearly demand it. Leary v. Daeschner, 228 F.3d 729 (U.S. Court of Appeals for the 6th Circuit 2000).

Goken America, LLC v. Naveen Bandepalya, et al., supra.

The judge noted that the plaintiff alleged, “among other things, a cause of action for violation of the Computer Fraud and Abuse Act (CFAA),” which creates a civil cause of action as well as criminal offenses. Goken America, LLC v. Naveen Bandepalya, et al., supra.  Goken claimed “it has a strong likelihood of success because defendants violated three sections” of the CFAA. Goken America, LLC v. Naveen Bandepalya, et al., supra.  Specifically, Goken asserted, first, that the defendants in the suit violated

U.S. Code § 1030(a) (2)(C). This subsection makes it illegal `intentionally [to] access[ ] a computer without authorization or exceed[ ] authorized access’ and thereby obtain information from a protected computer. 18 U.S. Code § 1030(a)(2)(C). A protected computer is a computer `used in or affecting interstate or foreign commerce or communication.’ 18 U.S. Code § 1030(e)(2)(B). Goken contends Bandepalya violated this section of the Computer Fraud and Abuse Act because he exceeded authorized access when he only had permission to access the `Business Development’ subfolder within the larger `Admin’ folder, yet he accessed and downloaded many other files in the `Admin’ folder.

Second, Goken contends that Defendants violated § 1030(a)(4) of the CFAA. This subsection makes it illegal for a person `knowingly and with intent to defraud, [to] access[ ] a protected computer without authorization, or exceed [ ] authorized access’ to further the intended fraud and obtain something of value. . . . . Goken argues that Bandepalya's deletion of all the downloaded files from his laptop and concealment of his business relationship with AH and Cresttek during the time that he downloaded the files demonstrate the high likelihood of succeeding on this point. Goken also discusses the competitive value of their trade secrets and argue that they fulfill the “something of value” prong of this section.

Third, Goken relies on § 1030(a)(5)(C) of the CFAA, which prohibits an individual from `intentionally access[ing] a protected computer without authorization, and as a result of such conduct, causes damage and loss.’ . . . Goken argues that this section applies because Bandepalya's access was outside the scope of his authority. Goken also contends that it suffered damage and loss when its confidential business information was made available to a direct competitor.

Goken America, LLC v. Naveen Bandepalya, et al., supra.

The defendants denied “any likelihood of success” on the claim because there

is no violation of the CFAA when permission is knowingly and voluntarily given. They contend that the CFAA does not apply when an individual misappropriates information after access is freely given. Defendants state that Goken gave Bandepalya access to the `Admin’ folder, so there can be no violation of the CFAA. They argue that the CFAA is not the appropriate statute for this case because Bandepalya did not improperly access the files. Defendants assert that a Bandepalya purportedly misused the information already at his disposal, rather than improperly accessing it in the first place.

Goken America, LLC v. Naveen Bandepalya, et al., supra (emphasis in the original).

The judge began his analysis of the parties’ respective positions by noting that courts

`around the country struggle with whether the CFAA applies in a situation where an employee who had been granted access to his employer's computers uses that access for an improper purpose’ Ajuba Intern., L.L.C. v. Saharia, 871 F.Supp.2d 671 (U.S.District Court for the Eastern District of Michigan 2012). There are some courts that `have construed the terms narrowly, holding that an employee's misuse or misappropriation of an employer's business information is not “without authorization” so long as the employer has given the employee permission to access such information.’ Cranel Inc. v. Pro Image Consultants Grp., LLC, 2014 WL 4829485 (U.S. District Court for the Southern District of Ohio 2014). . . . Other courts have determined that `an employee accesses a computer without authorization whenever the employee, without the employer's knowledge, acquires an interest that is adverse to that of his employer or is guilty of a serious breach of loyalty.’ Cranel Inc. v. Pro Image Consultants Grp., supra. . .

One Court in this district has construed the term `exceeds authorized access’ narrowly. That Court recently held that an employee who has total access to an employer's computer but misuses the information from that computer does not operate `without authorization’ under the CFAA. See Cranel Inc. v. Pro Image Consultants Grp., supra. The employee in that case did not `exceed authorized access’ because the employee had authorization to access all files on the computer. See Cranel Inc. v. Pro Image Consultants Grp., supra. An employee `exceeds authorized access’ when that employee `access[es] a computer with authorization and [uses] such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.’ Cranel Inc. v. Pro Image Consultants Grp., supra (citing 18 U.S. Code § 1030(e)(6)).

Goken America, LLC v. Naveen Bandepalya, et al., supra.

He went on to explain that while he did not agree “with this narrow construction”, he did not have to “resolve this issue” because

[e]ven under the Cranel Court's narrow construction of the term `exceeds authorized access,’ Bandepalya did exceed that access. Unlike the situation in Cranel, Bandepalya was only given permission to access the `Business Development’ subfolder within the larger `Admin’ folder. He was not explicitly instructed to avoid the other folders, but in his email to Smith, he only requested access to the `Business Development’ subfolder.

Furthermore, Bandepalya admitted that he understood that the information was confidential and was not to be shared outside of the company, especially with Goken competitors. . . .

Smith testified that it was his understanding that Bandepalya would only operate within the business development folder `[b]ased on the conversation we had and my way of thinking that that's common respect and you don't go looking at other people's personnel information.’ (Transcript of Preliminary Injunction Hearing, Goken America v. Bandepalya, (2014)). He also testified that Bandepalya's `request and the authorization were all specific to the business development [sub]folder.’ Id. Smith's testimony regarding his understanding with Bandepalya, in conjunction with Bandapalya's narrow request to access only the business development subfolder, compel the conclusion that Bandepalya was not authorized to access files that were beyond the purview of his duties and responsibilities.

Goken America, LLC v. Naveen Bandepalya, et al., supra (emphasis in the original).

The judge therefore found that Goken

is likely to succeed on the merits of §§ 1030(a)(2)(C) and (a)(4) because it can show that Goken never gave Bandepalya permission to access to the entire `Admin’ folder. Goken has a high likelihood of success on this point because in his email to Smith, Bandepalya only requested permission to access the `Business Development’ subfolder and not the entire `Admin’ folder.

So even under this Court's narrow reading of the CFAA, Goken is likely to succeed on §§ 1030(a)(2)(C) and (a)(4) because Bandepalya `exceeded authorized access.’ But Goken is unlikely to succeed under § 1030(a)(5)(C) because that section only applies to those `without authorization’ and Bandepalya merely `exceeded authorized access.’

Goken America, LLC v. Naveen Bandepalya, et al., supra.

The judge went on to consider the three remaining preliminary injunction factors, finding, first, that Goken

will likely suffer irreparable harm without this injunction because the case involves corporate trade secrets. Courts are typically sensitive to the irreparable harm that trade secret disclosure can cause. . . . As Defendants point out in their response brief, grounds for irreparable injury include `loss of control of reputation, loss of trade, and loss of good will.’ Kos Pharmaceuticals, Inc. v. Andrx Corp., 369 F.3d 700 (U.S. Court of Appeals for the 3rd Circuit 1989). Because exposed trade secrets could harm a plaintiff's share of the market and cause loss of business opportunities and reputation, this Court finds a strong likelihood of irreparable injury for Goken without a preliminary injunction.

Goken America, LLC v. Naveen Bandepalya, et al., supra.

He then took up the next factor: substantial harm to others. Goken America, LLC v. Naveen Bandepalya, et al., supra.  Goken argued that “the balance of equities" favored

Plaintiff because `no legally cognizable harm occurs . . . by enjoining the unlawful use of Goken Business and Trade Secret Information” and any harm to Bandepalya “is the direct result of his actions.’  Defendants assert that an award of a preliminary injunction would cause their company substantial harm because an inability to service Honda could cause it to go out of business.

The Court can significantly decrease the potential harm to Defendants by allowing the companies AH and Cresttek to continue working with Honda and allowing Bandepalya to continue working for AH and Cresttek. As with the Temporary Restraining Order, the Court prohibits Bandepalya from performing work for Honda but allows him to continue employment by servicing other clients. Although Defendants claim that they might not be able to continue employing Bandepalya if he is prohibited from working with Honda clients, Mr. Bramadesam, an investor in both AH and Cresttek, testified that he has no doubt that Bandepalya would be able to learn the software tools that Cresttek uses for work with other clients like GM. . . . [T]o avoid irreparable injury for the Defendants, this Preliminary injunction will not prevent Bandepalya from working for AH and Cresttek but will prohibit him for working with Honda and on current and prospective Honda business and projects.

Goken America, LLC v. Naveen Bandepalya, et al., supra.

Finally, the judge took up Goken’s argument that “the public interest is served because the public has a legitimate interest in an Ohio company “being able to protect its trade secrets.” Goken America, LLC v. Naveen Bandepalya, et al., supra. The defendants, on the other hand, argued that

the public interest would be harmed if the Court awards a preliminary injunction to Goken because they delayed a claim for seven months. They argue that the preliminary injunction would not `maintain a status quo, which no longer exists’ because of Goken's delay.

Goken America, LLC v. Naveen Bandepalya, et al., supra.

Having considered these arguments, the judge found that the protection of trade secrets

weighs in favor of the public interest. See Kendall Holdings Ltd. V. Eden Cryogenics LLC, 630 F.Supp.2d 853 (U.S. District Court for the Southern District of Ohio 2008). So this factor weighs in favor of Goken because it is in the public's interest for a company to be able to protect its trade secrets. Although Defendants cite the proposition that laches is appropriate to bar injunctive relief when the party seeking relief lacked diligence in pursuing its claim, the Court does not find that Goken lacked diligence in pursuing its claims. A seven month delay, during which time Goken sought to uncover evidence for its litigation, is common in litigation. Defendants have not asserted adequate evidence that Goken lacked diligence in its pursuit of information and in its preparation for litigation.

Goken America, LLC v. Naveen Bandepalya, et al., supra.

The judge therefore found that, based on the above analysis, “the balance of factors weighs in favor of issuing a preliminary injunction in this action.” Goken America, LLC v. Naveen Bandepalya, et al., supra.  He granted Goken’s motion and ordered that

A. Defendants are enjoined from using or disclosing Goken's confidential trade secret information;

B. Defendants are ordered to preserve all documents and electronic files that could be relevant in this lawsuit;

C. Defendants are ordered to identify and turn over all Goken trade secret information;

D. Bandepalya is ordered to deliver all external hard drive and USB devices he connected to his Goken laptop during his employment;

E. Bandepalya is prohibited from engaging in any work relating to Honda and on Honda projects; and

F. Defendants are enjoined from recruiting Goken employees.

Goken America, LLC v. Naveen Bandepalya, et al., supra.