The Former Employee, the Computer Fraud and Abuse Act and Trade Secrets

This post examines an opinion recently issued by a U.S.District Court Judge who sits in the U.S. District Court for the District of Puerto Rico:  Sun West Mortgage Company, Inc. v. Matos Flores, 2016 WL 1030074 (2016).  The judge begins by explaining that

[i]n this action, Plaintiff Sun West Mortgage Company (`Sun West’) contends that its former employee, Defendant Miguel Matos Flores (`Matos’) breached his employment agreement and made unauthorized disclosures regarding company trade secrets in violation of The Computer Fraud and Abuse Act, 18 U.S. Code § 1030, et seq. (`CFAA’), the Stored Wire and Electronic Communications and Transactional Records Access Act, 18U.S. Code §§ 2071-2712 et seq. (the`Stored Communications Act’ or the `SCA’), and the Wire and Electronic Communication and Interception of Oral Communications Act, 18U.S. Code §§ 2510-2522 et seq. (the `Wiretap Act’). (Docket No. 1 ¶¶ 36-58.)

In addition to these federal claims, Sun West also contends that Matos violated various Puerto Rico laws, invoking diversity jurisdiction. (Docket No.¶¶ 1, 59-93.)

Presently before the Court is Matos' motion to dismiss the federal claims pursuant to FEDERALRULES OF CIVIL PROCEDURE Rule 12(b)(6) for failure to state a claim upon which relief can be granted. (Docket No. 25). Additionally, Matos requests jurisdictional discovery in order to ascertain whether the parties are completely diverse and Sun West's state law claims are properly before the Court. (Docket No. 25).

Sun West Mortgage Company, Inc. v. Matos Flores, supra.

The judge then outlined the “relevant factual and procedural background,” i.e., the facts and events that brought the case before him and required that he resolve certain issues:

Sun West hired Matos as a loan officer on April 11, 2011. (Docket No. 1 ¶ 5.) He was responsible for `sourc[ing] prospective consumer borrowers’ and signing them up for single-family loan mortgage packages. Id. ¶ 6. As a result of his position, Matos had access to Sun West's borrower, broker, customer and investors lists, contractual arrangements, lists of real estate agents, vendors, suppliers, and service providers that had contractual arrangements with Sun West, Sun West's pricing and financial structures, marketing programs and plans, operational methods and cost information, accounting procedures, and research and development. Id. ¶ 7. Pursuant to the Employment Agreement (the `Agreement’), Matos agreed not to `publish, disclose or allow to be published or disclosed, Trade Secrets to any person who is not an employee of Sun West unless such disclosure is necessary for the performance of Loan Officer's obligation under the Agreement.’ Id. ¶ 8.

Carlos Gaztambide is the Executive President of Multiples Mortgage Corp, a competitor of Sun West in Puerto Rico. (Docket No. 1 ¶¶ 14-15.) Sun West alleges that on December 5, 2014, Matos told Gaztambide that he wanted to refer a client to Multiples Mortgage and that he was unhappy at Sun West.  Id. ¶¶ 15-16. Sun West also contends that Matos indicated he could set up a team of Sun West employees who would leave to join Multiples Mortgage.  Id. ¶ 17.

In an affidavit appended to the Complaint, Gaztambide states that he notified Matos that he would not hire anyone from Sun West without first speaking with Sun West's Executive Vice President Raul Padilla, and that Multiples Mortgage could not compensate any Sun West loan officers for referrals. (Docket No. 1-5 ¶¶ 5, 8.)

Gaztambide also stated that after Matos complained that Sun West was not properly compensating loan originators, Gaztambide asked to see Sun West's pricing. Id. ¶ 10. Gaztambide states that Matos accessed this information on his telephone and showed it to him. Id. Gaztambide states that later that day, Matos contacted him again to request that he keep their conversation confidential. Id. ¶ 11.

Sun West alleges that Matos sent and downloaded to his personal e-mail account 270 transmissions containing Sun West's confidential information and trade secrets without authorization, though it has not determined if Matos reproduced or revealed any of this information. (Docket No. 1 ¶¶ 22-23.)

Sun West Mortgage Company, Inc. v. Matos Flores, supra.

The judge went on to outline the “standard of review” he was obliged to apply in ruling on the defendant’s motion:

When considering a motion to dismiss for failure to state a claim upon which relief can be granted, see FED. R. CIV. P. 12(b)(6), the court analyzes the complaint in a two-step process under the current context-based `plausibility’ standard established by the Supreme Court. See Schatz v. Republican State Leadership Comm., 669 F.3d 50, 55 (U.S. Court ofAppeals for the 1st Circuit 2012) (citing Ocasio-Hernández v. Fortuño-Burset, 640 F.3d 1, 12 (1st Cir. 2011) which discusses Ashcroftv. Iqbal, 556 U.S. 662 (2009) and Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007)).

First, the court must `isolate and ignore statements in the complaint that simply offer legal labels and conclusions or merely rehash cause-of-action elements.’ Id. A complaint does not need detailed factual allegations, but `[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.’ Ashcroft v. Iqbal, supra.  Second, the court must then `take the complaint's well-[pleaded] (i.e., non-conclusory, non-speculative) facts as true, drawing all reasonable inferences in the pleader's favor, and see if they plausibly narrate a claim for relief.’ Schatz v. Republican State Leadership Comm., supra.  Plausible, means something more than merely possible, and gauging a pleaded situation's plausibility is a context-specific job that compels the court to draw on its judicial experience and common sense. Schatz v. Republican State Leadership Comm., supra (citing Ashcroft v. Iqbal, supra). This `simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence of’ the necessary element. Bell Atl. Corp. v. Twombly, supra.

`[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged—but it has not “show[n]”—“that the pleader is entitled to relief.”’ Ashcroft v. Iqbal, supra (quoting FED. R. CIV. P. 8(a)(2)). If, however, the `factual content, so taken, “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged,” the claim has facial plausibility.’ Ocasio-Hernández v. Fortuño-Burset, supra (quoting Ashcroft v. Iqbal, supra).

Sun West Mortgage Company, Inc. v. Matos Flores, supra.

The judge then turned to the analysis of the issues raised in Matos’ motion to dismiss, explaining that Matos argues that

`the bare assertion that the [ ] 270 emails sent to his personal email were trade secrets is insufficient to state a claim under CFAA, SCA or the Wire Tap Act.’ (Docket No. 25 ¶ 4.3.) The Court will address each in turn.

Sun West Mortgage Company, Inc. v. Matos Flores, supra.

He began his analysis of the plaintiff’s CFAA claim by explaining that the CFAA

provides a civil remedy for victims who suffer damages in excess of $5,000 as a result of an individual who `knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access’ in furtherance of fraud.18 U.S. Code §1030(a)(4). Accordingly, to state a claim under the CFAA, Sun West must demonstrate that Matos accessed a protected computer `without authorization’ or that he `exceeded’ his `authorized access’ in order to commit a fraud. Id. Despite the CFAA's expansive language, the statute was not intended to criminalize `benign activities such as workplace procrastination.’ Advanced Micro Devices, Inc. v. Feldstein, 951 F. Supp. 2d 212, 218 (U.S. District Court for the District of Massachusetts 2013) (citing United States v. Nosal, 676 F.3d 854, 866 (U.S. Court of Appeals for the 9^th Circuit  2012)).

The term `without authorization’ is not defined by the statute and courts have split on whether to take a broad or narrow view of the language. Advanced Micro Devices, Inc, 951 F. Supp. 2d at 217-18 (describing CFAA interpretations). The narrow interpretation of the CFAA holds that the term `without authorization’ only reaches conduct by outsiders who did not have permission to access the plaintiff's computer. E.g., Shamrock Foods v. Gast, 535 F. Supp. 2d 962, 967 (U.S. District Court for the District of Arizona 2008). This interpretation of the statute would preclude a claim under the CFAA by an employer against its employee. Conversely, the broad view allows for an employer's CFAA claim against an employee who accesses a computer whenever he, without the employer's knowledge, `acquires an interest that is adverse to that of his employer or is guilty of a serious breach of loyalty.' Guest-Tek Interactive Entm't, Inc. v. Pullen, 665 F. Supp. 2d 42, 45 (D. Mass. 2009) (analyzing CFAA interpretations). Although the [U.S. Court of Appeals for the] 1st Circuit has not specifically addressed the meaning of `without authorization’ or `exceeded authorization,’ it has favored a broader reading of the statute. Guest-Tek Interactive Entm't, Inc. v. Pullen, supra. . . .

Sun West Mortgage Company, Inc. v. Matos Flores, supra.

The judge went on to explain that

[e]ven under a broad interpretation of the statute, Sun West failed to satisfy the Twombly and Iqbal pleading requirements as to the CFAA claim. Sun West's allegation that Matos forwarded information to his personal e-mail account, sending 270 transmissions, is insufficient to state a claim. Sun West specifically does not allege that he copied, revealed to third parties, or reproduced any information, proprietary or otherwise. (Docket No. 1 ¶ 23.) Sun West also does not allege that Matos sent such emails with `intent to defraud,’ in furtherance of a fraud, or that he obtained anything of value. 18 U.S. Code § 1030(a). Similarly, Sun West's allegation that Matos showed confidential pricing information to Gaztambide on his telephone is insufficient to support an inference that he accessed a Sun West computer without authorization, or in excess of his authorization, absent allegations he did so in furtherance of a fraud. At most, the Court interprets this alleged incident as an attempt to justify his desire to leave Sun West to Gaztambide, who expressed skepticism that Matos was being mistreated by Sun West. (Docket No. 1-5 ¶ 10.)

Sun West Mortgage Company, Inc. v. Matos Flores, supra.

The judge therefore went on to find that Sun West’s claim

under the CFAA also fails to satisfy the damages requirement. The CFAA defines damage as `any impairment to the integrity or availability of data, a program, a system or information. . . .’ 18 U.S. Code § 1030(e)(8). This language does not encompass any harm resulting from the disclosure to a competitor of trade secrets or other confidential information. Courts have interpreted this to include `the destruction, corruption, or deletion of electronic files, the physical destruction of a hard drive, or any diminution in the completeness or usability of the data on a computer system.’ E.g., New South Equip. Mats, LLC v. Keener, 989 F. Supp. 2d 522 (U.S. District Court for the Southern District of Mississippi 2013) (finding that mere copying of electronic information is not enough to satisfy the CFAA's damage requirement). Although the First Circuit has not limited `loss’ under the statute to purely physical damages, the statute does not permit claims for matters unrelated to the computer. See Shirkov v. Dunlap, Grubb & Weaver, PLLC, 2012 WL 1065578, at *24 (U.S. District Court for the Southern District of Mississippi, Mar. 27, 2012).

Sun West asserts that its damages include `the hiring of a forensic computer examiner to determine the scope of Matos' breach and a damages assessment; the hiring of counsel to bring this legal action; the management's time necessary for addressing, responding to and remediating Matos' wrongdoings; and the value of the information Matos retrieved from the Sun West premises.’ (Docket No. 1 ¶ 41.) These damages are not sufficient to trigger the CFAA. Courts have held that legal fees do not constitute a loss under the CFAA. Wilson v. Moreau, 440 F. Supp. 2d 81 (U.S. District Court for the District of Rhode Island 2006). Similarly, management's time spent evaluating whether Matos' conduct is actionable is not recoverable under the CFAA. Id.

The value of information Matos may have retrieved from Sun West is speculative at best because Sun West concedes it has no basis to believe Matos `copied, revealed to third parties [or] reproduced’ any of this information. (Docket No. 1 ¶ 23.) Sun West does not allege that its computers or network were out of commission or damaged in any way. Neither does Sun West contend that it incurred costs repairing its computers. Thus, the motion to dismiss Sun West's claim pursuant to the CFAA is hereby GRANTED.

Sun West Mortgage Company, Inc. v. Matos Flores, supra (emphasis in the original).

The Judge then addressed and disposed of Sun West’s claims under the Stored Communications Act and the Wiretap Act.  Sun West Mortgage Company, Inc. v. Matos Flores, supra.  He began with the Stored Communications Act (“SCA”), explaining that it

prohibits an individual from intentionally accessing, without authorization, a facility that provides an electronic communication service or exceeding an authorization to access that facility, and thereby obtaining, altering or preventing authorized access to a wire or electronic communication while it is in electronic storage in such system. 18 U.S. Code § 2701(a). Under the statute, `any person aggrieved’ by knowing and intentional conduct that violates the SCA has a private right of action. 18 U.S. Code § 2707(a). An aggrieved person is one who was a party to an intercepted electronic communication, or against whom the interception was directed.  Padmanabhan v. Healey, 2016 WL 409673, at *3 (U.S. District Court for the District of Massachusetts Feb. 2, 2016).

Since the SCA was established in 1986, courts have struggled with the same language at issue under the CFAA, namely `access without authorization’ and `exceed [ ] an authorization to access’ a facility. Cheng v. Romo, 2012 WL 6021369 (U.S. District Court for the District of Massachusetts Nov. 28, 2012). As with the CFAA, the First Circuit has not directly addressed the meaning of these terms under the SCA; however, courts in the First Circuit have consistently applied CFAA caselaw in analyzing the SCA. Id. at *4 (citing Guest-Tek Interactive Entm't, Inc. v. Pullen, 665 F. Supp. 2d 42 (U.S. District Court for the District of Massachusetts 2009).

Thus, the Court's analysis under this statute is the same as under the CFAA. The Complaint fails to allege sufficient facts to support an inference that Matos obtained, altered, or prevented authorized access to a wire or electronic communication. The mere assertion that he sent Sun West's confidential information and trade secrets to his personal e-mail account, without more, does not satisfy the Plaintiff's pleading requirements under Twombly and Iqbal. The motion to dismiss Sun West's claim pursuant to the SCA is GRANTED.

Sun West Mortgage Company, Inc. v. Matos Flores, supra (emphasis in the original).

Finally, the judge took up Sun West’s claim under the Wiretap Act, explaining that

[w]ithout providing citation to a specific chapter or provision of the U.S. Code, Sun West claims that `Matos' actions were in violation of the Wiretap Act, which entitles Sun West to recover damages (compensatory and punitive) costs and attorneys' fees against Matos and injunctive relief to enjoin Matos from further violating the Wiretap Act.’ . . . 18 U.S. Code § 2511 prohibits any person from intentionally intercepting, endeavoring to intercept, or procuring any other person to intercept any wire, oral or electronic communication. It also prohibits disclosure and intentional use of information or the contents of such communications. Id. Under the statute, `intercept’ is the `acquisition of the contents of any . . . electronic communication . . . through the use of any electronic, mechanical or other device.’ 18 U.S. Code § 2510(4).

Sun West Mortgage Company, Inc. v. Matos Flores, supra (emphasis in the original).

The judge then went on to explain that, in order to

prevail under this statute, a plaintiff must demonstrate that the defendant `acted with the purpose of committing a criminal or tortious act other than the recording of the communication itself.’ Vazquez-Santos v. El Mundo Broad. Corp., 283 F. Supp. 2d 561, 566-67 (U.S. District Court for the District of Puerto Rico 2003) Similarly, `a disclosure or use of the contents of any intercepted communication is only unlawful if the person knows or has reason to know that the interception was illegal.’ Vazquez-Santos v. El Mundo Broad. Corp, supra. Importantly, the Wiretap Act permits interception of electronic communications if consent is given by at least one of the parties to the communications. United States v. Bennett, 538 F. Supp. 1045 (U.S. District Court for the District of Puerto Rico 1982).

In this case, Sun West has not specified which factual allegations in its Complaint support this claim. To the extent Sun West bases this claim on its allegations regarding the `270 transmissions to [Matos'] personal email from Sun West's information computer system,’ Sun West offers nothing to support its claim under the Wiretap Act that Matos acted with a criminal or tortious intent. (Docket No. 1 ¶ 22.) Sun West presents exclusively conclusory statements that support only a threadbare recitation of the elements of a claim. Allegations that Matos `intercepted the confidential information with a tortious intent’ and that he `intends to benefit economically from the confidential information he intercepted’ are insufficient to satisfy the pleading requirements. These allegations do not allow the Court to infer more than a mere possibility of misconduct, and thus, do not support a reasonable inference that Sun West is entitled to relief under the Wiretap Act. The motion to dismiss this claim is GRANTED.

Sun West Mortgage Company, Inc. v. Matos Flores, supra (emphasis in the original).

The judge then went on to explain that

[i]n sum, the Court GRANTS Defendant's motion to dismiss the federal claims under CFAA, the Stored Communications Act, and the Wiretap Act. These claims are DISMISSED with prejudice. Judgment shall be entered accordingly.

Sun West Mortgage Company, Inc. v. Matos Flores, supra (emphasis in the original).

As Wikipedia explains,

[p]rejudice is a legal term with different meanings when used in criminal, civil or common law. . . . Two of the more common applications of the word are as part of the terms `with prejudice’ and `without prejudice’. In general, an action taken with prejudice is essentially final; in particular, `dismissal with prejudice’ would forbid a party from refiling the case. . . .