Three women who “are former employees of . . . Jeremiah
Johnson and/or [his] law firm”, which apparently is/was in Kansas, sued him in
federal court, alleging “claims of invasion of privacy, outrage and breach of
fiduciary duty.” Bashaw v. Johnson, 2012 WL 1623483 (U.S. District Court for the District of Kansas 2012).
The opinion only says a little about how they came to bring
the suit, but according to a news story, the plaintiffs
allege that “personal injury attorney” Johnson “encouraged” them (the opinion
says he “required” them) to “wear `skirts and high heels’ and then
surreptitiously placed an iPhone (or iPad) under their desks with a[n] . . . app
called Cam-u-flage, `the best spy camera app to take pictures without
anyone noticing.”
The opinion says Johnson used Cam-u-flage on “iPhone and
iPad to conduct video surveillance of the area beneath a particular desk in the
office such that [he] secretly obtained video recordings of [their] legs, lower
torsos and undergarments.” Bashaw v. Johnson, supra.
The news story says the women realized what was happening
when one of them “found the camera under the desk.” Bashaw
v. Johnson, supra. It says they were apparently “able to see and
delete the photos”, after which they sued Johnson, claiming damages of $75,000
each. He responded by filing a counterclaim against them in which he alleged
that the women, “ in violation of the [Computer Fraud and Abuse Act],
accessed [his] iPhone and iPad in excess of their authorization and deleted
data from those devices.” Bashaw v. Johnson, supra. (I don’t
have the counterclaim but since the story says the women “were able to see and
delete the photos,” I’m assuming it’s based on their allegedly unlawful
access to Johnson’s iPhone and/or iPad.)
As I’ve noted before, the Computer Fraud and Abuse Act [CFAA],
which is codified as 18 U.S. Code 1030, is the general federal cybercrime
statute. It criminalizes accessing a
computer without being authorized to do so, among other things. And as I’ve also noted, § 1030 creates a
civil cause of action for someone who has been injured by criminal conduct that
violates the Act. Section 1030(g)
states, in part, that “[a]ny person who suffers damage or loss by reason of a
violation of this section may maintain a civil action against the violator to
obtain compensatory damages. . . .” That
is what Johnson did, although he filed his 1030(g) action as a counterclaim,
rather than as an original claim in a civil complaint.
The three plaintiffs
responded by filing a Rule 12(b)(6) motion to dismiss Johnson’s counterclaim. Bashaw v. Johnson, supra. Rule 12(b)(6) motions are created by Rule
12(b)(6) of the Federal Rules of Civil Procedure, which are the rules that
govern civil suits in federal court. As
Wikipedia explains, a Rule 12(b)(6) motion to dismiss is how
lawsuits with insufficient legal
theories underlying their cause of action are dismissed from court.
For example, assault requires intent, so if the plaintiff has failed
to plead intent, the defense can seek dismissal by filing a 12(b)(6) motion.
`While a complaint attacked by a Rule
12(b)(6) motion to dismiss does not need detailed factual allegations, a
plaintiff’s obligation to provide the grounds of his entitlement to relief
requires more than labels and conclusions, and a formulaic recitation of the
elements of a cause of action will not do. Factual allegations must be enough
to raise a right to relief above the speculative level, on the assumption that
all the allegations in the complaint are true (even if doubtful in fact). Bell
Atlantic Corp. v. Twombly, 550 U.S. 544 (2007).
In his counterclaim, Johnson asserted that “one or more” of
the plaintiffs violated the CFAA
accessing, without authorization or in excess of their authorization, [his] iPad, iPhone and one or more of [his] computers and deleting unspecified data from those devices. [Johnson] asserts that he has been damaged by the actions of plaintiffs and that the damages `would exceed’ at least $5000 in value. . . .
Bashaw v. Johnson,
supra.
The plaintiffs’ Rule 12(b)(6) motion to dismiss the
counterclaim argued that it “fails in at least two respects”: Johnson did not “sufficiently allege the
nature of his damages within the meaning of the CFAA” and he did not “sufficiently
allege a qualifying `loss’ within the meaning of the CFAA”. Bashaw
v. Johnson, supra.
The federal district court judge began his analysis of their
arguments by noting that under 18 U.S. Code § 1030(g),
a civil action may be brought only if
the conduct `involves 1 of the factors set forth in subclauses (I), (II),
(III), (IV), or (V) of subsection [18 U.S. Code 1030](c)(4)(A)(i).’ 18
U.S.C. § 1030(g). In other words, a
plaintiff alleging a violation under § 1030(g) must allege the conduct
involved one of the following factors:
(I) loss to 1 or more persons during any
1–year period . . . aggregating at least $5,000 in value; (II) the modification
or impairment, or potential modification or impairment, of the medical
examination, diagnosis, treatment, or care of 1 or more individuals; (III)
physical injury to any person; (IV) a threat to public health or safety; [or]
(V) damage affecting a computer used by or for an entity of the United States
Government in furtherance of the administration of justice, national defense,
or national security.
Bashaw v. Johnson,
supra.
The judge noted that Johnson’s counterclaim stated claims against the
three plaintiffs under § 1030(g) “for violations of §
1030(a)(2), (a)(4) and (a)(5).” Bashaw
v. Johnson, supra. He also noted
that each of these three subsections of 18 U.S. Code 1030,
with some variation, prohibits accessing a . . .
computer without authorization and obtaining information from the computer.
According to the counterclaim complaint, each of these asserted violations are
based on conduct (as required by § 1030(g))
involving a loss aggregating at least $5,000 in value.
For each of these asserted violations, then, [Johnson]
must allege a `loss’ within the meaning of the CFAA. In addition, subsection
(a)(5) contains an express “damage” requirement such that [he] must also
adequately allege `damage’ within the meaning of the statute for purposes of
his subsection (a)(5) claim. . . .Thus,
to state a claim under § 1030(g) for violation
of § 1030(a)(5) based upon §
1030(c)(4)(A)(i)(I), a plaintiff must allege both
`damage’ and a `loss’ aggregating at least $5,000 in value.
Bashaw v. Johnson,
supra.
The judge explained that §
1030(e)(8) of the CFAA “defines the term `damage’ as `any impairment to the
integrity or availability of data, a program, a system, or information.’” Bashaw v. Johnson, supra. He also explained that in construing this
term, court have found that “damage” refers to “`the
destruction, corruption, or deletion of electronic files, the physical destruction
of a hard drive, or any “diminution in the completeness or usability of the
data on a computer system.”’“ TriTeq
Lock, 2012 WL 394119 *5 (N.D. Ill. 2012).
The judge then noted that
Johnson
conclusorily
alleges in this counterclaim that he `has been damaged’ but he does not assert
the nature of such damage. In his submissions on the motion, he claims that he
suffered damages because `data was erased.’ No where in his submissions or his
counterclaim complaint does [Johnson] identify the data that was allegedly
erased.
This
allegation, then, essentially parrots the statutory language and is
insufficiently factual to frame plausibly the damages element of defendant's
CFAA claim. . . . For this reason, [Johnson] cannot state a claim for
relief under [18 U.S. Code 1030] subsection (a)(5).
Bashaw v. Johnson,
supra.
The judge also found that Johnson had failed to plead “a
qualifying `loss’ for purposes of the CFAA. Bashaw
v. Johnson, supra. He noted that
under 18 U.S. Code 1030, the
`term “loss” means any reasonable cost
to any victim, including the cost of responding to an offense, conducting a
damage assessment, and restoring the data, program, system, or information to
its condition prior to the offense, and any revenue lost, cost incurred, or
other consequential damages incurred because of interruption of service.’
Bashaw v. Johnson,
supra (quoting 18 U.S.C. §
1030(e)(11)).
The judge then explained that the “majority of courts have
construed the term `loss’ to include only two types of injury -- costs incurred
(such as lost revenues) because the computer's service was interrupted and
costs to investigate and respond to computer intrusion or damage.” Bashaw v. Johnson, supra.
He then applied this standard to Johnson’s
counterclaim. Bashaw v. Johnson, supra. The
judge found that in his counterclaim, Johnson
has not alleged that he suffered any
`loss’ under the CFAA.
While he alleges that unspecified
losses `would exceed’ $5,000 in value, he does not allege that he actually
incurred losses in that amount. He does not allege or identify any
investigative or response costs incurred as a result of the alleged CFAA
violation and he does not allege any lost revenues or other losses incurred due
to any interruption in service.
In his submissions, he contends that
qualifying losses under the statute include `for example’ the prorated salaries
or wages of employees who spent time restoring a backup of deleted data or
recreating lost work, but he does not suggest that his employees performed
these tasks or that he incurred costs relating to such tasks.
Bashaw v. Johnson,
supra.
The judge therefore held that
[b]ecause he has not alleged any loss
under the statute, [Johnson] cannot maintain a CFAA claim for violations of any
of the subsections identified in his counterclaim complaint. This claim is
dismissed in its entirety.
Bashaw v. Johnson, supra.
The judge dismissed Johnson’s CFAA counterclaim, which means
that as of May 9, 2012 it was no longer part of this case. Bashaw
v. Johnson, supra. The dismissal
does not prevent Johnson from trying again, i.e, from filing another
counterclaim in which he resolves the deficiencies in the initial one.
No comments:
Post a Comment