Opinion
Case No. 18-cv-02585-NC
02-25-2019
CITCON USA, LLC, Plaintiff, v. RIVERPAY INC., YUE "YORK" HUA, and KENNY E. SHI, Defendants.
ORDER GRANTING DEFENDANTS' MOTION TO DISMISS; ORDERING CITCON TO FILE AN UPDATED THIRD AMENDED COMPLAINT
Re: Dkt. No. 109
In this trade secrets case, plaintiff Citcon brings 5 claims in its Third Amended Complaint against defendants Yue "York" Hua, Kenny Shi, and RiverPay: (1) and (2) trade secret misappropriation against Hua, Shi, and Riverpay; (3) conversion of funds against Hua, Shi, and RiverPay; (4) conversion of a POS device against Hua and RiverPay; and (5) unfair competition against Hua and Shi. Dkt. No. 103. Defendants move to dismiss all claims for which Citcon was granted leave to amend: (1) and (2) trade secret misappropriation against Hua, Shi, and RiverPay; (3) conversion of funds against Hua, Shi, and RiverPay; and (4) conversion of a POS device against Riverpay. Dkt. No. 109. The issue before the Court is whether Citcon has pled sufficient facts to raise facially plausible claims that the defendants are liable for the conduct alleged. Because the Court finds that Citcon has done so for all claims, the motion to dismiss is DENIED.
I. BACKGROUND
A. The Pleading Stage
Citcon's First Amended Complaint brought 11 claims against RiverPay, Hua, Shi, and defendant Hang "Hank" Miao. Dkt. No. 8. Defendants moved to dismiss every count, and the Court granted that motion as to all but one claim against one defendant, granting Citcon leave to amend. Dkt. No. 52. Citcon's Second Amended Complaint brought 12 claims against those same defendants. Dkt. No. 58. Defendants again moved to dismiss. Dkt. Nos. 63, 64. The Court granted those motions to dismiss with leave to amend as to:
• Counts One and Two, trade secret misappropriation of:
? "business plans" against Hua, Shi and RiverPay
? "customer information" against Hua and RiverPay
? "transaction information" against Hua and RiverPay
? "source code" against Hua and RiverPay
? "POS designs" against Shi and RiverPay
• Count Ten (now Three): conversion of funds against Hua, Shi, and RiverPayThe Court granted the motions to dismiss without leave to amend as to:
• Count Three: breach of duty of loyalty against Hua, Shi, and RiverPayFinally, the Court denied the motions to dismiss as to:
• Count Four: defamation and trade libel against all defendants
• Count Five: defamation against Miao, Shi, and RiverPay
• Counts Six and Seven: computer fraud and abuse against Hua, Shi, and RiverPay
• Counts Eight and Nine: intentional interference with contractual relations and intentional interference with prospective economic relations against Hua, Shi, and RiverPay
• Count Twelve: unfair competition against RiverPay
• Counts One and Two:
? "customer information" against Shi
? "transaction information" against Shi
? "source code" against Shi
? "POS designs" against Hua
• Count Eleven: conversion of a POS device against HuaDkt. No. 98. No claims remained against defendant Hang "Hank" Miao. All claims against RiverPay were dismissed, though many with leave to amend. Thus the following claims comprise the Third Amended Complaint:
• Count Twelve: unfair competition against Hua and Shi
• Counts One and Two, against Hua, Shi, and RiverPay, for trade secret misappropriation of:
? "business plans"
? "customer information"
? "transaction information"
? "source code"
? "POS designs"
• Count Three (formerly Ten): conversion of funds against Hua, Shi, and RiverPayCitcon filed its Third Amended Complaint including the same twelve claims that appeared in the Second. Dkt. No. 103. It states that it re-alleges those claims which were dismissed without leave to amend for preservation on appeal; the Court will address this issue more in Section III below. Next, the Court assesses only those claims for which it granted Citcon leave to amend. Dkt. No. 98.
• Count Four (formerly Eleven): conversion of a POS device against Hua
• Count Five (formerly Twelve): unfair competition against Hua and Shi
B. Factual Allegations of the Third Amended Complaint
Citcon alleges the following in the Third Amended Complaint. Dkt. No. 103. In deciding this motion, the Court assumes these allegations to be true and construes all facts in the light most favorable to Citcon. See Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337-38 (9th Cir. 1996).
Citcon provides services that allow merchants in the United States to accept Chinese mobile system payments. Dkt. No. 103 at 2. RiverPay, founded in 2017, also provides these services. Id. Hua was Citcon's Head of Operations and Products until he left to work at RiverPay in June 2017. Id. Shi was Citcon's Vice President of Engineering until he left in December 2017; he too now works at RiverPay. Id. at 3.
In September 2016, a Dropbox account was created using Shi's email address to back up Citcon's customer transactions every day through keys embedded in Citcon's source code. Id. In September 2017, Shi told Citcon's CEO Chuck Huang that he was resigning, but Huang convinced him to withdraw his resignation. Id. at 3. That same month, Shi created a shareable link to the Dropbox account that he had created the prior year to allow authorization for access to it. Id.
In June 2017, Hua resigned from Citcon and took with him one of Citcon's point-of-sales (POS) devices. Id. Hua also downloaded the source code and POS designs from Citcon's computer at that time. Id. at 13. In December 2017, Shi resigned from Citcon. Id. at 5. Before his departure, he downloaded documents including source code, POS designs, client information, and transaction information. Id. at 7.
Citcon eventually discovered that the key to the Dropbox account created by Shi was also embedded elsewhere in its source code. Id. Citcon deciphered the key and gained access to the account, and thereby learned that it had been created using Shi's email address and that shareable links to it had been created. Id.
Citcon also discovered that Hua's login to its MySQL database had never been disabled when he left Citcon. Id. When Citcon disabled the login, its system crashed for a week. Id. Shi was responsible for maintaining Hua's login. Id. at 13. Using this login and the Dropbox account, Hua acquired Citcon's transaction information and client information. Id.
Hua and Shi then disclosed Citcon's source code and POS designs to RiverPay for use in RiverPay products, disclosed Citcon's confidential transaction information to RiverPay to unfairly compete with Citcon and harass its customers, and disclosed Citcon's client information to RiverPay to unfairly solicit Citcon's customers. Id. at 14.
In early May 2018, a RiverPay executive proposed a merger between Citcon and RiverPay while also making vague threats about a "bloody fight" between the companies. Id. at 8. Citcon rejected the proposal and filed this lawsuit. Id. Three days after this suit was filed, a cyberattack caused refunds to be fraudulently issued to some of Citcon's customers. Id. at 8-9. Citcon had to ask some customers to pay back the refunds. Id.
I. LEGAL STANDARD
A motion to dismiss for failure to state a claim under Rule 12(b)(6) tests the legal sufficiency of a complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). On a motion to dismiss, all allegations of material fact are taken as true and construed in the light most favorable to the non-movant. Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337-38 (9th Cir. 1996). The Court, however, need not accept as true "allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences." In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). Although a complaint need not allege detailed factual allegations, it must contain sufficient factual matter, accepted as true, to "state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when it "allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
II. DISCUSSION
A. Counts One and Two: Trade Secret Misappropriation
Citcon alleges that Hua, Shi, and RiverPay misappropriated five categories of its trade secrets under both 18 U.S.C § 1836 (the Defend Trade Secrets Act, or DTSA) and California Civil Code § 3426.1 (the California Uniform Trade Secrets Act, or CUTSA). To plead trade secret misappropriation under both the DTSA and the CUTSA, a plaintiff must plead (1) its ownership of the trade secret, (2) that the defendant acquired it through improper means, and (3) that the defendants' actions damaged the plaintiff. See Rockwell Collins Inc. v. Wallace, Case No. 17-cv-1369 AG, 2017 WL 5502775, at *2 (C.D. Cal. Nov. 10, 2017).
"Both the DTSA and the CUTSA define a trade secret as information that (1) derives its economic value from not being generally known, and (2) is subject to reasonable measures of secrecy by its owner." Rockwell, 2017 WL 5502775, at *2. The trade secret must be identified with "sufficient particularity to separate it from the matters of general knowledge in the trade . . . and to permit the defendant to ascertain at least the boundaries within which the secret lies." See Space Data Corp. v. X, Case No. 16-cv-3260-BLF, 2017 WL 5013363, at *2 (N.D. Cal. Feb. 16, 2017). However, "trade secrets need not be disclosed in detail in a complaint alleging misappropriation for the simple reason that such a requirement would result in public disclosure of the purported trade secrets." Autodesk, Inc. v. ZWCAD Software Co., Case No. 14-cv-1409-EJD, 2015 WL 2265479, at *6 (N.D. Cal. May 13, 2015) (quoting Leucadia, Inc. v. Applied Extrusion Techs., Inc., 755 F. Supp. 635, 636 (D. Del. 1991)).
Here, Citcon claims that the defendants misappropriated five categories of trade secrets: business plans, customer information, transaction information, POS designs, and source code. Dkt. No. 103 at 10-11. The Court previously dismissed the "business plans" claim because Citcon inadequately identified that alleged trade secret. Dkt. No. 98. In its TAC, Citcon has supplied significantly more detail about this claim and the Court finds that it now sufficiently gives notice to the defendants and the Court as to the boundaries of that claim. See Space Data, 2017 WL 5013363, at *2. The Court has already found that the other trade secrets categories were sufficiently pled. Dkt. No. 98. The instant Order addresses those outstanding trade secrets claims for which the Court gave Citcon leave to amend after the last round of motions to dismiss: Hua's and RiverPay's misappropriation of all five categories of trade secrets; and Shi's misappropriation of business plans and POS designs.
i. Pleading Standard: Trade Secret Acquisition and Use
Trade secret misappropriation can be established via wrongful acquisition or wrongful use, i.e., use without consent. Autodesk, 2015 WL 2265479, at *5; see also Cal. Civ. Code § 3426.1.
Citcon inaccurately relies on Autodesk to argue that it need not plead precisely how the defendants acquired the trade secrets. There, the plaintiff did not make any specific factual allegation about the method by which the defendant had obtained the trade secrets at issue. Autodesk, 2015 WL 2265479, at *6. However, the plaintiff had instead pled with great specificity facts to support an inference that the defendant had improperly used the trade secrets. For example, Autodesk supplied multiple screenshots of each company's software product displaying highly unusual and idiosyncratic errors which would have likely only resulted from substantially identical source code. Id. at *2. Because the plaintiff had so thoroughly pled improper use, the Court found that it need not also plead improper acquisition. Id. at *6.
Here, Citcon does not plead nearly such a robust factual basis to show that any of the defendants improperly used any of its trade secrets. Instead, it uses vague terms to describe that use (e.g. RiverPay misappropriated the transaction information "through improper use . . . to unfairly compete with Citcon"). Dkt. 103 at 12. Meanwhile, Citcon pleads some facts to suggest that the defendants improperly acquired the trade secrets, which the Court will analyze as to each defendant separately below.
ii. Hua and Shi
Citcon states that Hua "took the Source Code and the POS designs when he departed Citcon in June 2017, downloading them from Citcon's computer systems." Dkt. No. 103 at 13. Citcon also alleges that Hua acquired its business plans, customer information, and transaction information by repeatedly accessing Citcon's computer system via the Dropbox account and his MySQL login once his employment at Citcon had ended. Id. Hua allegedly next "wrongfully used and disclosed" the source code and POS designs "by incorporating them into RiverPay's competing products." Id.
Likewise, Citcon alleges that Shi misappropriated its business plans and POS designs by downloading them from Citcon's computer system when he departed Citcon at the end of 2017. Id. Shi then helped Hua with his alleged misappropriation through the Dropbox and MySQL login. Id. Later, Shi used the trade secrets by incorporating them into RiverPay's products and unfairly competing with Citcon's customers. Id.
Though the allegation that Hua and Shi "took" these secrets when they departed Citcon is somewhat vague, the Court finds that, taken as true, the specific fact that Hua and Shi downloaded those secrets from Citcon's computers constitutes enough to plead misappropriation via improper acquisition. See Cal. Code Civ. Proc. § 3426.1(a); 18 U.S.C. § 1839(6)(A). The Motion to Dismiss is DENIED as to Counts One and Two against Hua and Shi.
iii. RiverPay
Under the DTSA, the "improper means" used to acquire a trade secret may include "theft, bribery, misrepresentations, breach or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means." 18 U.S.C. § 1839(6). Citcon pleads that "RiverPay directed Hua, and encouraged him with a promise of 'co-founder' status, to misappropriate Citcon's trade secrets." Dkt. No. 103 at 17. Citcon similarly pleads that "Hua was directed to retain the POS device by RiverPay as a condition of his receiving co-founder status as RiverPay." Id. at 32.
The Court finds that this alleged direction is enough to plead RiverPay's liability for misappropriation of trade secrets as both bribery and inducement to breach a duty of secrecy. Because the Court finds that Citcon has sufficiently pled that RiverPay misappropriated its trade secrets, the Motion to Dismiss is DENIED as to Counts One and Two against RiverPay.
Because the Court finds that Citcon has sufficiently pled RiverPay's liability, it does not discuss Citcon's aiding and abetting or conspiracy theories. --------
B. Count Three (formerly Ten): Conversion of Funds
To plead a claim for conversion, a plaintiff must allege (1) ownership or right to possession, (2) defendants' conversion by a wrongful act or disposition of property rights; and (3) damages. Lee v. Hamley, 354 P.3d 334, 344 (Cal. 2015). Citcon pleads that the defendants converted its funds through what it calls the "Refund Attack," wherein the defendants allegedly issued fraudulent refunds to Citcon's customers. Dkt. No. 103 at 3.1
i. Hua and Shi
Citcon pleads that Hua and Shi used specific confidential information to issue the refunds. Id. The details of the attack indicate that someone with expertise on Citcon's systems perpetrated it; Hua and Shi have that knowledge. Id. Citcon states that "[t]he attack required significant insider knowledge" of particular confidential information about Citcon's "merchant tokens" known to both Hua and Shi. Id. Some of this information was allegedly downloaded when Hua and Shi took trade secrets when they left Citcon. Id. These facts are sufficient to plausibly allege that Hua and Shi are liable for the fraudulent refund attack. The Motion to Dismiss is DENIED as to Count Three against Hua and Shi.
ii. RiverPay
Citcon has two theories of RiverPay's liability for trade secret misappropriation: direct liability and vicarious liability.
As to direct liability, Citcon pleads virtually no facts; it only argues that RiverPay had the motive to launch the attack as "Citcon's only close competitor" and points out that the attack preceded RiverPay's CEO making a vague threat to Citcon about a "bloody fight" between the companies. Id. at 8. The Court previously dismissed this claim against RiverPay on the grounds that these vague threats did not show that RiverPay was liable for the refund attack. Dkt. No. 98 at 18. Nothing has changed.
As to vicarious liability, Citcon argues that RiverPay is liable for the conversion committed by Hua and Shi as their employer. Employers are liable for torts committed by their employees within the scope of their employment. Lisa M. v. Henry Mayo Mewhall Mem. Hosp., 12 Cal.4th 291, 296 (1995). If an employee's tort is willful, malicious, or criminal, the employer may be liable whether or not it authorized the tort. Id. The tort, though, must have a causal nexus to the employee's work. Id. at 297; see also Carr v. Wm. C. Crowell Co., 28 Cal.2d 652 (1956). The tort must be engendered by or arise from the work. Id. One test for whether an employer should be held liable for its employees' tort is the foreseeability test from Rodgers v. Kemper Constr. Co., which asks whether the tort was a generally foreseeable consequence of the employer's activity, so that losses fairly attributable to an enterprise should be allocated to the enterprise as a cost of doing business. 50 Cal. App. 3d 608, 618 (1975).
Here, Citcon has pled that by the time of the refund attack in May 2018, Hua was an employee of RiverPay. Dkt. No. 103 at 2-3 (Hua left Citcon "to join RiverPay" in June 2017). However, Citcon never pleads in its TAC if or when Shi began work at RiverPay, except to state that Shi "left Citcon as the end of 2017 and is currently working for RiverPay." Id. at 3. Citcon cannot claim RiverPay's vicarious liability over any of Shi's actions without establishing when Shi worked for RiverPay.
But Hua's alleged actions are enough. Citcon has pled sufficient facts to raise a plausible inference that Hua was behind the refund attack. The attack would constitute a willful, malicious, or criminal tort. See Lisa M., 12 Cal.4th at 296. The tort had a causal nexus to Hua's employment at RiverPay, because the companies are competitors in the same field and create similar products targeting similar customers. Dkt. No. 103 at 2. That an employee might misappropriate trade secrets of a former employee and competitor to commit tortious acts against that competitor is a generally foreseeable consequence of RiverPay's business. See Rodgers, 50 Cal. App. 3d at 618. Citcon has pled sufficiently that RiverPay is vicariously liable for Hua's alleged refund attack.
The Motion to Dismiss is DENIED as to Count Three against RiverPay.
C. Count Four (formerly Eleven): Conversion of a POS Device as to RiverPay
To plead a claim for conversion, a plaintiff must allege (1) ownership or right to possession, (2) defendants' conversion by a wrongful act or disposition of property rights; and (3) damages. Lee v. Hamley, 254 P.3d 334, 344 (Cal. 2015). To plead a conspiracy, a plaintiff must show (1) the existence of an underlying tort, (2) an agreement to commit an unlawful act, (3) wrongful acts committed in furtherance of the common agreement, and (4) injury. Young v. Hamilton, 92 Fed. Appx. 389, 393 (9th Cir. 2003).
Citcon alleges that Hua stole a POS device when he left the company and brought the device to RiverPay. Dkt. No. 103 at 32. Citcon argues that RiverPay is liable for this conversion under a conspiracy theory. Specifically, Citcon alleges that RiverPay induced Hua to steal the device with a promise of co-founder status at RiverPay. Id. Defendants argue that this promise does not constitute an agreement under Twombly. 500 U.S. at 556-57. But the Court finds that, if true, the promise to reward Hua with co-founder status if he brought the device to RiverPay is sufficient to show an agreement to commit an unlawful act. Young, 92 Fed. Appx. at 393. This pleading is more robust than a simple formulaic accusation that a conspiracy existed, like in Twombly. 550 U.S. at 557.
The motion to dismiss is DENIED as to Count Four against RiverPay.
III. CITCON'S TAC VIOLATES THE COURT'S PREVIOUS ORDERS
Citcon's TAC includes the claims and defendant that the Court dismissed from this case without leave to amend in its previous orders. See Dkt. No. 103. Defendants have requested through meet and confer efforts and through motions to the Court that Citcon remove the dismissed claims and defendant from the TAC. See Dkt. Nos. 109, 119, 125. Citcon argues that it includes these counts for preservation on appeal, indicating such via footnotes in the TAC, and that doing so is not prohibited. Dkt. No. 119. Ninth Circuit law is clear that dismissed claims are preserved on appeal regardless of their inclusion in later amended complaints. Lacey v. Maricopa Cty., 693 F.3d 896, 928 (9th Cir. 2012). Continuing to plead dismissed claims and name a dismissed defendant is in violation of the Court's orders on the motions to dismiss.
The Court finds that an updated complaint containing only the remaining claims and defendants would aid the parties in the future of this litigation by simplifying and clarifying which claims move forward out of the pleading stage. Thus the Court ORDERS Citcon to file a new TAC excluding those claims that the Court dismissed without leave to amend, and excluding former defendant Hang "Hank" Miao who is no longer a party to this action. Citcon may use the new numbering provided for the Court in this Order to identify its claims and the parties may use these numbers moving forward.
IV. CONCLUSION
The motion to dismiss the Third Amended Complaint is DENIED. The Court has not granted leave to further amend any claims it has dismissed. The following claims remain:
• Counts One and Two, against Hua, Shi, and RiverPay for trade secret misappropriation of:
? "business plans"
? "customer information"
? "transaction information"
? "source code"
? "POS designs"
• Count Three (formerly Ten): conversion of funds against Hua, Shi, and RiverPayCitcon is ORDERED to submit an updated TAC within 7 days, by March 4, 2019. Defendants must answer within 14 days of service of the updated TAC.
• Count Four (formerly Eleven): conversion of a POS device against Hua and RiverPay
• Count Five (formerly Twelve): unfair competition against Hua and Shi
IT IS SO ORDERED. Dated: February 25, 2019
/s/_________
NATHANAEL M. COUSINS
United States Magistrate Judge