Summary
holding that an allegation that the defendants accessed the plaintiff's electronic database without authorization and downloaded confidential information did not state an ICTA claim because it did not allege that the defendants “insert[ed] or attempt[ed] to insert a program” into the plaintiff's computer system
Summary of this case from Halperin v. International Web Services, LLCOpinion
Case No. 11 C 1332.
2011-10-13
FARMERS INSURANCE EXCHANGE, Mid–Century Insurance Company, and Illinois Farmers Insurance Company, Plaintiffs, v. The AUTO CLUB GROUP d/b/a/ AAA Chicago, Auto Club Insurance Association, MemberSelect Insurance Company, and Does 1 through 10, inclusive, Defendants.
Gregory S. Bailey, R. Ryan Stoll, Skadden Arps Slate Meagher & Flom, LLP CH, Chicago, IL, Raoul D. Kennedy, Richard John Zuromski, Jr., Skadden Arps Slate Meagher & Flom LLP, Palo Alto, CA, Salezka L. Aguirre, Skadden Arps Slate Meagher & Flom LLP, San Francisco, CA, for Plaintiff. Daniel Scott Schecter, Amanda Jane Klopf, Charles Peregrine Courtenay, Latham & Watkins, Los Angeles, CA, Sean M. Berkowitz, Matthew W. Walch, Sue Kyon Paik, Latham & Watkins LLP, Douglas W. Bax, Williams, Bax & Saltzman, P.C., Chicago, IL, for Defendant.
Gregory S. Bailey, R. Ryan Stoll, Skadden Arps Slate Meagher & Flom, LLP CH, Chicago, IL, Raoul D. Kennedy, Richard John Zuromski, Jr., Skadden Arps Slate Meagher & Flom LLP, Palo Alto, CA, Salezka L. Aguirre, Skadden Arps Slate Meagher & Flom LLP, San Francisco, CA, for Plaintiff. Daniel Scott Schecter, Amanda Jane Klopf, Charles Peregrine Courtenay, Latham & Watkins, Los Angeles, CA, Sean M. Berkowitz, Matthew W. Walch, Sue Kyon Paik, Latham & Watkins LLP, Douglas W. Bax, Williams, Bax & Saltzman, P.C., Chicago, IL, for Defendant.
MEMORANDUM OPINION AND ORDER
JAMES F. HOLDERMAN, Chief Judge:
On July 7, 2010, plaintiffs Farmers Insurance Exchange, Mid–Century Insurance Company, and Illinois Farmers Insurance Company (collectively “Farmers”) filed a four-count complaint in the United States District Court for the Central District of California against defendants The Auto Club Group d/b/a/ AAA Chicago, Auto Club Insurance Association, and MemberSelect Insurance Company (collectively “Auto Club”), alleging violations of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030(a)(2)(C) and (a)(4) (Counts I and II), the California Comprehensive Computer Data Access and Fraud Act (“CCDAFA”), California Penal Code § 502 (Count III), and the California Uniform Trade Secrets Act, Cal. Civ.Code § 3426, et seq. (Count IV). (Dkt. No. 11 (“1st Am. Compl.”).) On February 23, 2011, in response to Auto Club's motion to dismiss for lack of personal jurisdiction, District Judge Consuelo B. Marshall ordered the case transferred to the Northern District of Illinois.
Now pending before this court is Auto Club's “Motion to Dismiss Counts I, II and III of Plaintiffs' First Amended Complaint Pursuant to Federal Rule of Civil Procedure 12(b)(6).” (Dkt. No. 57 (“Auto Club's Mot.”).) For the reasons stated below, Auto Club's motion is granted. Counts I, II, and III are dismissed without prejudice. The court also sua sponte dismisses Count IV without prejudice. Farmers is granted leave to file a Second Amended Complaint consistent with this order and the relevant underlying facts on or before November 3, 2011, should it desire to do so. Auto Club's answer is due on or before November 23, 2011.
BACKGROUND
For purposes of the pending motion to dismiss, the court accepts as true the following facts as set forth in Farmers' First Amended Complaint. See Adkins v. VIM Recycling, Inc., 644 F.3d 483, 493 (7th Cir.2011).
Farmers is in the business of selling insurance products. (1st Am. Compl. ¶¶ 4–6, 11.) Specifically, Farmers sells automobile, homeowners, and commercial insurance to customers through the use of independent contractor agents. ( Id. ¶ 11.) Plaintiffs Farmers Insurance Exchange and Mid–Century Insurance Company each have their principle places of business in Los Angeles, California, while Illinois Farmers Insurance Company has its principal place of business in Aurora, Illinois. ( Id. ¶¶ 4–6.)
Like Farmers, defendant The Auto Club Group is also in the business of selling insurance products. ( Id. ¶ 7.) The Auto Club Group, headquartered in Dearborn, Michigan, does business under the assumed names AAA Chicago, AAA Travel Agency, Chicago Motor Club, AAA Auto Club Group, and Road Service, Inc., and sells insurance products to residents of Illinois, Indiana, Iowa, Michigan, Minnesota, Nebraska, North Dakota, and Wisconsin. ( Id.) Defendants The Auto Club Insurance Association and MemberSelect Insurance Company are both in the business of underwriting insurance products, and sell their products through The Auto Club Group. ( Id. ¶¶ 8–9.) The Auto Club Insurance Association and MemberSelect Insurance Company also have their principal places of business in Dearborn, Michigan. ( Id.)
In the course of its business, Farmers maintains certain confidential information about its policyholders, including their names, addresses, telephone numbers, Social Security numbers, drivers license numbers, and financial information. ( Id. ¶ 14.) Farmers also maintains confidential information about its specific policies, including premium amounts, policy expiration dates, details of the insureds' property, and claims histories. ( Id. ¶¶ 13–14.)
To maintain the confidentiality of this policyholder information, Farmers uses a “password protected Internet portal” known as the “Agency Dashboard.” ( Id. ¶ 15.) The Agency Dashboard “allows Farmers' employees and independent contractor agents to track information about and provide services to Farmers' policyholders” by accessing databases that contain Farmers' confidential policyholder information, as well as Farmers' “underwriting practices, guidelines, communications, training information, and ... rating systems.” ( Id.) Reports generated from the information stored in the databases are also used “for marketing, servicing, and managing the agency.” ( Id. ¶ 16.) Farmers' computer servers are physically located in Los Angeles, California, but are accessible throughout the United States. ( Id. ¶ 17.)
Farmers requires all authorized users to sign-in to the Agency Dashboard using an individually authorized login name and password, and the Agency Dashboard itself includes a “prominent message” on the login screen notifying users that they are accessing proprietary and confidential information. ( Id. ¶ 22.) Farmers also requires its insurance agents to agree that they will use Farmers' confidential policyholder information “only in the course of their agency with Farmers” and “to promise not to disclose Farmers' Confidential Policyholder Information to third parties or to use it in any way detrimental to Farmers.” ( Id. ¶ 20.) Copies of Farmers's procedures regarding access to and preservation of its databases are also accessible through the Agency Dashboard. ( Id.)
Beginning “no later than 2007,” certain Farmers agents supplied Auto Club with “login names and passwords that would permit Auto Club personnel to directly access” Farmers' confidential policyholder information. ( Id. ¶ 25.) These agents also printed Farmers' confidential policyholder information and gave hard copies of this information to Auto Club. ( Id.) Auto Club then “accessed, reviewed, transmitted, and/or printed” Farmers' confidential policyholder information without authorization, copied this information into Auto Club's own computer system, created and disseminated spreadsheets containing Farmers' confidential policyholder information, and used this information “to generate quotations for insurance policies in competition with Farmers and without having to generate customer contacts, build loyalty, and gather information on its own.” ( Id. ¶¶ 25–32.)
In response to Auto Club's illegal actions, Farmers “was required to send breach notification letters to thousands of policyholders.” ( Id. ¶ 34.) Farmers claims damages in the form of costs associated with “identifying and ascertaining the extent of Auto Club's unauthorized access to and acquisition of Farmers' Confidential Policyholder Information,” as well as fees and expenses incurred in the course of “determining and complying with customer security breach notification obligations as required by the laws of the States in which the affected customers reside.” ( Id. ¶ 34.) Farmers also claims “lost present and future business and revenue from its policyholders,” as well as damage to its reputation. ( Id. ¶¶ 34–35.)
LEGAL STANDARD
To avoid dismissal under Federal Rule of Civil Procedure 12(b)(6), the factual allegations of a complaint must “raise a right to relief above the speculative level” such that the plaintiff's claim is “plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). In this regard, a “formulaic recitation of the elements of a cause of action will not do.” Id. at 555, 127 S.Ct. 1955. Rather, the plaintiff must include “enough detail to give the defendant fair notice of what the claim is and the grounds upon which it rests, and, through his allegations, show that it is plausible, rather than merely speculative, that he is entitled to relief.” Reger Dev., LLC v. Nat'l City Bank, 592 F.3d 759, 764 (7th Cir.2010) (quoting Tamayo v. Blagojevich, 526 F.3d 1074, 1081 (7th Cir.2008)). If the allegations of a complaint “fail[ ] to state a claim upon which relief can be granted,” the complaint will be dismissed. Fed.R.Civ.P. 12(b)(6). When addressing a motion to dismiss, the court must accept the factual allegations set forth in the complaint as true and draw all reasonable inferences in favor of the plaintiff. Adkins, 644 F.3d at 493.
ANALYSIS
1. Farmers' CFAA Claims (Counts I and II)
The CFAA provisions at issue in this case prohibit “intentionally access[ing] a computer without authorization or exceed[ing] authorized access, ... thereby obtain[ing] information from any protected computer,” 18 U.S.C. § 1030(a)(2)(C) (Count I), and “knowingly and with intent to defraud, access[ing] a protected computer without authorization, or exceed[ing] authorized access, and by means of such conduct further[ing] the intended fraud and obtain[ing] anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1–year period,” 18 U.S.C. § 1030(a)(4) (Count II).
Congress amended several sections of the CFAA in September 2008. See Identity Theft Enforcement and Restitution Act, Pub.L. No. 110–326, §§ 203–208, 122 Stat. 3560, 3561–63 (2008). Because the parties have identified no substantive change in language relevant to the court's current analysis, and because the conduct at issue in this case allegedly occurred both before and after the date of amendment, all citations in this opinion are to the CFAA in its amended form. See SKF USA, Inc. v. Bjerkness, 636 F.Supp.2d 696, 719 n. 12 (N.D.Ill. Apr. 24, 2009) (Pallmeyer, J.).
Although the CFAA is generally criminal in nature, it also provides a private right of action for a person “who suffers damage or loss by reason of a [CFAA] violation.” 18 U.S.C. § 1030(g). “Thus, to recoup compensatory damages, a plaintiff must show either damage or loss.” US Gypsum Co. v. Lafarge N. Am. Inc., 670 F.Supp.2d 737, 743 (N.D.Ill. Oct. 27, 2009) (Pallmeyer, J.) (emphasis in original); see also Motorola, Inc. v. Lemko Corp., 609 F.Supp.2d 760, 767 (N.D.Ill. Feb. 11, 2009) (Kennelly, J.).
The conduct at issue must also involve “1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i).” 18 U.S.C. § 1030(g). In this case, Farmers alleges that Auto Club's conduct caused Farmers a loss of more than $5,000 during a one-year period, as set forth in 18 U.S.C. § 1030(c)(4)(A)(i)(I). (1st Am. Compl. ¶¶ 41–42, 48–49.)
Auto Club argues that both of Farmers' CFAA claims must be dismissed for failure to state a claim, because Farmers has failed to adequately allege either “damage” or “loss” as defined by the CFAA. The court addresses each argument in turn. A. “Damages” Under 18 U.S.C. § 1030
The CFAA defines the term “damage” to mean “any impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). Courts have interpreted the CFAA's definition of damage to include the destruction, corruption, or deletion of electronic files, the physical destruction of a hard drive, or any “diminution in the completeness or usability of the data on a computer system.” Cassetica Software, Inc. v. Computer Sciences Corp., No. 09 C 0003, 2009 WL 1703015, at *3 (N.D.Ill. June 18, 2009) (Kendall, J.); see also Mintel Int'l Group, Ltd. v. Neergheen, No. 08 C 3939, 2010 WL 145786, at *9 (N.D.Ill. Jan. 12, 2010) (Dow, J.); Del Monte Fresh Produce, N.A., Inc. v. Chiquita Brands Int'l Inc., 616 F.Supp.2d 805, 810 (N.D.Ill. Mar. 19, 2009) (Hibbler, J.); Motorola, 609 F.Supp.2d at 769 (“The plain language of the statutory definition refers to situations in which data is lost or impaired because it was erased or because (for example) a defendant smashed a hard drive with a hammer.”); Patrick Patterson Custom Homes, Inc. v. Bach, 586 F.Supp.2d 1026, 1035 (N.D.Ill. Nov. 14, 2008) (Denlow, M.J.); Garelli Wong & Assocs. v. Nichols, 551 F.Supp.2d 704, 709 (N.D.Ill. Jan. 16, 2008) (Kocoras, J.). On the other hand, the mere copying of electronic information from a computer system is not enough to satisfy the CFAA's damage requirement. See Mintel, 2010 WL 145786, at *9 (“copying, e-mailing or printing electronic files from a computer database is not enough to satisfy the damage requirement of the CFAA”); Del Monte, 616 F.Supp.2d at 811 (“copying electronic files from a computer database—even when the ex-employee e-mails those files to a competitor—is not enough to satisfy the damage requirement of the CFAA”). Courts have also specifically found that the disclosure of trade secrets misappropriated through unauthorized computer access does not qualify as damage under the CFAA's definition of the term. See U.S. Gypsum Co., 670 F.Supp.2d at 744 (“the CFAA is not intended to expansively apply to all cases where a trade secret has been misappropriated by use of a computer”); Motorola, 609 F.Supp.2d at 769 (“The only harm [plaintiff] has alleged is the disclosure to a competitor of its trade secrets and other confidential information. The CFAA's definition of damage does not cover such harm ....”); Nichols, 551 F.Supp.2d at 710 (“Though [plaintiff] would like us to believe that recent amendments to the CFAA are intended to expand the use of the CFAA to cases where a trade secret has been misappropriated through the use of a computer, we do not believe that such conduct alone can show ‘impairment to the integrity or availability of data, a program, a system, or information.’ ”) (quoting 18 U.S.C. § 1030(e)(8)).
Auto Club argues that Farmers has not alleged “any diminution in the completeness or usability of the Agency Dashboard ... [or] that [Auto Club's] actions resulted in lost or corrupted data, the unavailability of the Agency Dashboard to other users, or any physical damage to [Farmers'] servers.” (Dkt. No. 58 (“Auto Club's Mem.”) at 7.) In response, Farmers argues that it has alleged Auto Club “impaired the integrity of [its] databases by directly accessing them for their own business purposes.” (Dkt. No. 65 (“Farmers' Resp.”) at 11.)
Farmers cites no case law in support of its interpretation and application of the term “integrity,” and this court is convinced by the persuasive authority cited above that this type of abstract impairment does not satisfy the CFAA's definition of damage. See Mintel, 2010 WL 145786, at *9 (agreeing with defendant that his “allegedly unauthorized acts of copying and e-mailing [plaintiff's] computer files did not impair the integrity or availability of the information in [plaintiff's] system”); US Gypsum Co., 670 F.Supp.2d at 743 (rejecting plaintiff's argument that the CFAA's damage requirement was satisfied due to “the intrinsic value of the proprietary information leaked to [plaintiff's competitor]”); see also Kluber Skahan & Assocs., Inc. v. Cordogen, Clark & Assocs., Inc., No. 08 C 1529, 2009 WL 466812, at *8 (N.D.Ill. Feb. 25, 2009) (Zagel, J.) (the “underlying concern of the [CFAA] [is] damage to data”); Worldspan, L.P. v. Orbitz, LLC, No. 05 C 5386, 2006 WL 1069128, at *5 (N.D.Ill. Apr. 19, 2006) (“Given these definitions of ‘damage’ and ‘integrity,’ we reject [plaintiff's] argument that the mere ‘taking of information’ constitutes ‘damage’ under the CFAA.”) (citations omitted). But see George S. May Intn'l Co. v. Hostetler, No. 04 C 1606, 2004 WL 1197395, at *4 (N.D.Ill. May 28, 2004) (Kocoras, J.) (“We see no principled reason ... why infringement of copyrighted material taken from a protected computer system would not qualify as impairment of the integrity of the copyrighted information.”).
At most, Farmers has alleged that it was concerned Auto Club might have impaired the integrity of its data, thus causing Farmers to investigate the extent of Auto Club's unauthorized access to, and acquisition of, Farmers' confidential policyholder information. (1st Am. Compl. ¶ 34.) Farmers has neither pleaded nor argued that Auto Club actually impaired its databases or data as this term has been interpreted by the courts of this district. The fact that Auto Club is a direct competitor, rather than a disgruntled employee or ex-employee, is a distinction without a difference. The type of damage required by the CFAA is the same regardless of the identity of the wrongdoer. B. “Loss” Under 18 U.S.C. § 1030
The CFAA defines the term “loss” as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11).
District courts within this circuit have interpreted this language in different ways. Compare Cassetica Software, Inc. v. Computer Sciences Corp., No. 09 C 0003, 2009 WL 1703015, at *4 (N.D.Ill. June 18, 2009) (Kendall, J.) (finding that the CFAA's definition of “loss” applies only to “costs of ‘conducting a damage assessment ... incurred because of the interruption of service ’ ”) (emphasis in original), with SKF USA, Inc. v. Bjerkness, 636 F.Supp.2d 696, 721 (N.D.Ill. Apr. 24, 2009) (Pallmeyer, J.) (“As defined in section 1030(e)(11), ‘loss' means two things: first, ‘any reasonable cost to the victim,’ such as responding to the offense or otherwise restoring lost material; second, lost revenue or other damages incurred as a result of an interruption of service.”). The Seventh Circuit has not yet ruled on this point of law.
As noted above, Farmers has alleged that it incurred costs associated with “identifying and ascertaining the extent of Auto Club's unauthorized access to and acquisition of Farmers' Confidential Policyholder Information,” as well as fees and expenses incurred in the course of “determining and complying with customer security breach notification obligations as required by the laws of the States in which the affected customers reside.” (1st Am. Compl. ¶ 34.) Farmers also claims “lost present and future business and revenue from its policyholders” and damages to its reputation as a result of Auto Club's actions. ( Id. ¶¶ 34–35.)
Auto Club argues that Farmers cannot plausibly allege that it suffered any loss as defined by the CFAA, because Farmers did not sustain any damage to its computers, data, or databases, nor has Farmers alleged any interruption of service. In response, Farmers argues that “any reasonable cost to any victim” can be considered a loss under the CFAA, including “the cost of responding to an offense.” (Farmers' Resp. 5 (quoting United States v. Janosko, 642 F.3d 40, 41 (1st Cir.2011)).) Both parties cite case law from the district courts of this circuit in support of their positions.
Based on the plain language of the CFAA, this court finds that a plaintiff can satisfy the CFAA's definition of loss by alleging costs reasonably incurred in responding to an alleged CFAA offense, even if the alleged offense ultimately is found to have caused no damage as defined by the CFAA. See 1st Rate Mortg. Corp. v. Vision Mortg. Servs. Corp., No. 09 C 471, 2011 WL 666088 (E.D.Wisc. Feb. 15, 2011) (Griesbach, J.) (agreeing with plaintiffs that “the CFAA allows recovery for losses sustained even if data or computers were not damaged”); Del Monte Fresh Produce, N.A., Inc. v. Chiquita Brands Int'l Inc., 616 F.Supp.2d 805, 811 (N.D.Ill. Mar. 19, 2009) (Hibbler, J.) (“The CFAA states that a company that pays for damage assessment may satisfy the loss requirement.”); Motorola, Inc. v. Lemko Corp., 609 F.Supp.2d 760, 768 (N.D.Ill. Feb. 11, 2009) (Kennelly, J.) (allegations of loss “related to damage and security assessments ... are sufficient to allege loss for purposes of the CFAA”); TEKsystems, Inc. v. Modis, Inc., No. 08 C 5476, 2008 WL 5155720, at *5 (N.D.Ill. Dec. 5, 2008) (Conlon, J.) (holding that plaintiff “sufficiently allege[d] loss” under the CFAA by alleging “loss exceeding $5,000 for the cost of a computer forensic investigation into [defendant's] conduct”); Sam's Wines & Liquors, Inc. v. Hartig, No. 08 C 570, 2008 WL 4394962, at *4 (N.D.Ill. Sept. 24, 2008) (Darrah, J.) (holding that plaintiff “adequately pleaded loss under the CFAA” by alleging costs of at least $5,000 “in terms of responding to [defendant's] conduct and conducting damage assessments”).
The court acknowledges the presence of conflicting case law within this circuit. See Von Holdt v. A–1 Tool Corp., 714 F.Supp.2d 863, 875–76 (N.D.Ill. May 17, 2010) (Manning, J.) (requiring “damage to the computer or computer system” before a plaintiff can prove “loss” under the CFAA); Cassetica Software, Inc. v. Computer Sciences Corp., No. 09 C 0003, 2009 WL 1703015, at *4 (N.D.Ill. June 18, 2009) (Kendall, J.) (“The CFAA only permits the recovery of costs incurred for damage assessment or recovery when the costs are related to an interruption of service.”). Respectfully, the court disagrees with these interpretations of the CFAA.
Other cases relied upon by Auto Club are distinguishable. For example, in Catapult Communications Corp. v. Foster, the court rejected the plaintiff's argument that costs “incurred from conducting forensic analysis” of the defendant's computer at his new place of employment constituted loss. Catapult Communications Corp. v. Foster, No. 06 C 6112, 2010 WL 3023501, at *3 (N.D.Ill. July 30, 2010) (Andersen, J.). In that context, however, it would be impossible to characterize the forensic analysis of the defendant's computer as an assessment of potential damage to the plaintiff's computers, data, or systems. Similarly, the court in Mintel v. Neergheen determined after a bench trial that the plaintiff's expert was not actually assessing “whether [the defendant] had ‘damaged’ Mintel's computers or data, as the CFAA contemplates ‘damage’; rather, the expert was hired for assistance in Mintel's lawsuit.” Mintel v. Neergheen, No. 08 C 3939, 2010 WL 145786, at *10 (N.D.Ill. Jan. 12, 2010) (Dow, J.). Likewise, at the summary judgment stage in Del Monte, Judge Hibbler found that the plaintiff's consultant did not actually conduct any assessments “to ascertain whether [the defendant] had ‘damaged’ Del Monte's computers or data.” Del Monte Fresh Produce, N.A., Inc. v. Chiquita Brands Int'l Inc., 616 F.Supp.2d 805, 812 (N.D.Ill. Mar. 19, 2009) (Hibbler, J.).
Here, Farmers has alleged that it incurred losses “associated with identifying and ascertaining the extent of Auto Club's unauthorized access to and acquisition of Farmers' Confidential Policyholder Information.” (1st Am. Compl. ¶ 34.) Viewing this allegation in the light most favorable to Farmers, as the court must at this stage of the litigation, the court finds that Farmers has sufficiently alleged costs associated with a “damage assessment,” thus satisfying the CFAA's definition of loss.
On the other hand, this court agrees that “[c]osts not related to computer impairment or computer damages are not compensable under the CFAA.” SKF USA, Inc., 636 F.Supp.2d at 721 (rejecting plaintiff's claim for lost revenues); see also CustomGuide v. CareerBuilder, LLC, 813 F.Supp.2d 990, 998, No. 11 C 945, 2011 WL 3809768, at *5 (N.D.Ill. Aug. 24, 2011) (Holderman, C.J.) (same); Cassetica, 2009 WL 1703015, at *4 (same); First Mortg. Corp. v. Baser, No. 07 C 6735, 2008 WL 4534124, at *3 (N.D.Ill. Apr. 30, 2008) (Moran, J.) (“loss of business and business goodwill” is compensable as a loss under the CFAA, but “only where ... a result of the impairment or unavailability of data on the computer”). But see C.H. Robinson Worldwide, Inc. v. Command Transp., LLC, No. 05 C 3401, 2005 WL 3077998, at *3 (N.D.Ill. Nov. 16, 2005) (St. Eve, J.) (“C.H. Robinson has properly alleged ‘loss' under the CFAA based on its allegations of the loss in value of trade secrets and loss of competitive edge.”).
To the extent Farmers has claimed costs incurred as a result of “determining and complying with customer security breach notification obligations as required by the laws of the States in which the affected customers reside,” the loss of “present and future business,” and damages to its reputation, (1st Am. Compl. ¶¶ 34–35), the court finds that these allegations do not satisfy the CFAA's definition of loss. These losses are not directly attributable to Auto Club's unauthorized computer access itself, but are instead properly attributable to the resulting disclosure of certain confidential information to Auto Club personnel and Auto Club's subsequent use of Farmers' confidential policyholder information to Farmers' detriment. As such, these damages “are better addressed, as they are here, under ... trade secrets law.” SKF USA, Inc., 636 F.Supp.2d at 721.
One final twist involves Farmers' ability to plausibly satisfy the requirements of 18 U.S.C. § 1030(c)(4)(A)(i)(I). As noted above, the CFAA requires that the conduct at issue involve “1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i).” 18 U.S.C. § 1030(g). Section 1030(c)(4)(A)(i)(I), relied upon by Farmers, requires a “loss to 1 or more persons during any 1–year period ... aggregating at least $5,000 in value.” 18 U.S.C. § 1030(c)(4)(A)(i)(I). Farmers has alleged that Auto Club's conduct caused “a loss in excess of $5,000, including but not limited to” the costs associated with Farmers' damage assessment and the costs of Farmers' compliance with its obligations under state law. (1st Am. Compl. ¶¶ 34, 42, 49.) At this point in the litigation, the court has held that costs associated with Farmers' state law obligations do not constitute a loss under the terms of the CFAA. The actual cost of Farmers' damage assessment, by itself, is not clear from the face of the First Amended Complaint; thus, the court cannot say that Farmers has stated a plausible right to relief under the CFAA. Counts I and II are therefore dismissed without prejudice. Farmers is granted leave to file a Second Amended Complaint consistent with this order and the underlying facts, on or before November 3, 2011, for purposes of clarifying its ability to satisfy this element of its CFAA claims. 2. Farmers' CCDAFA Claim (Count III)
Farmers alleges in Count III of its First Amended Complaint that Auto Club violated various provisions of California's Comprehensive Computer Data Access and Fraud Act (“CCDAFA”), as set forth in California Penal Code § 502. The purpose of the CCDAFA is to protect “individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems.” Cal.Penal Code § 502(a). Specifically, Farmers alleges that Auto Club: “knowingly accessed and without permission used the Protected Computer Facilities in order to either (A) devise or execute a scheme or artifice to defraud or deceive or (B) wrongfully control or obtain money, property, or data,” in violation of § 502(c)(1); that Auto Club “knowingly accessed and without permission took, copied, or made use of data stored in the Protected Computer Facilities,” in violation of § 502(c)(2); and that Auto Club “knowingly and without permission accessed, or caused to be accessed the Protected Computer Facilities,” in violation of § 502(c)(7).
Auto Club argues that Illinois substantive law, not California law, applies to the conduct alleged by Farmers, and that Count III must be dismissed because Farmers cannot state a cause of action under relevant Illinois law. Farmers contends that “California law should be applied in this circumstance.” (Farmers' Resp. 15.) A. Choice of Law
Auto Club also asserts that the Illinois Trade Secrets Act, and not California's Uniform Trade Secrets Act, applies to Count IV of the First Amended Complaint. However, Auto Club has not moved to dismiss Count IV because Auto Club concedes that Farmers “could have plausibly stated a claim under the Illinois Trade Secrets Act based on the allegations already in the First Amended Complaint.” (Auto Club's Mot. 2, n. 1.)
The parties both agree that Illinois choice-of-law rules determine the applicable substantive law in this case. See Viernow v. Euripides Dev. Corp., 157 F.3d 785, 793 (10th Cir.1998) (“where the transferor court determines that it lacks personal jurisdiction ... the proper course of action since the enactment of 28 U.S.C. § 1631 is to transfer pursuant to that statute, which requires that the transferee court apply that jurisdiction's law”); Tillett v. J.I. Case Co., 756 F.2d 591, 593 n. 1 (7th Cir.1985) (abrogated on other grounds) (“transferee forum's choice of law rules do govern her claim because no [personal] jurisdiction existed” in the transferor court); Sys. Am., Inc. v. Providential Bancorp., Ltd., No. 05 C 2161, 2005 WL 2008926, at *5 (N.D.Ill. Aug. 19, 2005) (St. Eve, J.) (“if there is no personal jurisdiction over a defendant in the original forum, the choice of law principles of the transferee forum apply”).
The parties also both agree that the applicable substantive law is determined by applying Illinois' “most significant contacts” test, as set forth in Flavorchem Corp. v. Mission Flavors & Fragrances, Inc., 939 F.Supp. 593, 596 (N.D.Ill. Apr. 18, 1996) (Gettleman, J.) (citing Ingersoll v. Klein, 46 Ill.2d 42, 262 N.E.2d 593, 595–97 (1970), and Restatement (Second) of Conflicts of Law § 145). Under this test, the court considers the following relevant contacts: “1. the place where the injury occurred; 2. the place where the conduct causing the injury occurred; 3. the domicile, residence, nationality, place of incorporation and place of business of the parties; and 4. the place where the relationship, if any, between the parties is centered.” Id.; see also Miller v. Long–Airdox Co., 914 F.2d 976, 978 (7th Cir.1990). “Generally, in a tort case, the two most important contacts are the place where the injury occurred and the place where the conduct causing the injury occurred.” Miller, 914 F.2d at 978. All four factors, however, “must be evaluated in light of the underlying policy factors of the specific tort, which include among them the relevant policies of the forum and the relevant policies of any other state which may have a dominant interest in the determination of a particular issue being considered.” Flavorchem Corp., 939 F.Supp. at 596.
The location of Farmers' injuries in this case is unclear as alleged, but can reasonably be considered either California or Illinois. As discussed above, Farmers has alleged that it incurred costs associated with performing a damage assessment and “determining and complying with customer security breach notification obligations as required by the laws of the States in which the affected customers reside.” (1st Am. Compl. ¶ 34.) Farmers has also claimed “lost present and future business and revenue from its policyholders,” as well as damages to its reputation. ( Id. ¶¶ 34–35.) Because Farmers' servers are located in California, ( id. ¶ 17), the damage assessment itself was likely undertaken in California. Similarly, as found by District Judge Marshall, Farmers mailed its breach of notification letters from California to policyholders in Illinois. (Dkt. No. 39 (“2/23/2011 Order”) at 8.) The relevant contacts regarding Farmers' lost revenue and damages to its reputation, on the other hand, stem from the states where Auto Club targeted Farmers' policyholders— that is, Illinois, Indiana, Iowa, Michigan, Minnesota, Nebraska, North Dakota, or Wisconsin. (1st Am. Compl. ¶ 7, 32; see also 2/23/2011 Order 2 (noting Auto Club's admission that “[t]he information obtained from Plaintiffs' Agency Dashboard was used to solicit customers in Indiana and Illinois”).) Because the bulk of Farmers' injuries in this case likely occurred in the form of lost revenue and damages to Farmers' reputation, the court finds that this factor is appropriately weighed in favor of applying Illinois law.
The location of Auto Club's allegedly unlawful conduct is also a factor that points to both states. It is undisputed that Farmers' servers are located in California, and that these servers were accessed by Auto Club personnel acting from within Illinois and Indiana. (1st Am. Compl. ¶ 17; 2/23/2011 Order 2 (noting “Defendants' employees admit accessing Plaintiffs' Agency Dashboard over the internet from Illinois and Indiana”) (citations omitted).) Thus, Auto Club's unauthorized access can reasonably be viewed as taking place in either California or Illinois. See, e.g., Cal.Penal Code § 502(j) (“a person who causes, by any means, the access of a computer, computer system, or computer network in one jurisdiction from another jurisdiction is deemed to have personally accessed the computer, computer system, or computer network in each jurisdiction”). On the other hand, Auto Club's use of Farmers' confidential policyholder information necessarily took place in a state other than California—either in Michigan, where Auto Club is headquartered, or in Illinois and other Midwestern states where Auto Club sells its insurance products. ( See 1st Am. Compl. ¶¶ 7–9; see also 2/3/2011 Order 2 (noting Auto Club's admission that “[t]he information obtained from Plaintiffs' Agency Dashboard was used to solicit customers in Indiana and Illinois”) (citations omitted).) Because the allegations in Count III center on Auto Club's unauthorized access to Farmers' confidential policyholder information and Auto Club's use of the information thus obtained, and these actions can both be said to have taken place in Illinois, the court finds that this factor weighs in favor of applying Illinois law.
The parties' place of incorporation and place of business is, again, a factor that points to both states. Two of the three Farmers plaintiffs are headquartered in California, while one is an Illinois corporation headquartered in Illinois. ( Id. ¶¶ 4–6.) All three of the Auto Club defendants are Michigan corporations with their headquarters in Michigan. ( Id. ¶¶ 7–9.) Accordingly, this factor weighs only slightly in favor of applying California law.
Finally, as articulated by Auto Club, the only pre-existing relationship between Farmers and Auto Club was “as competitors in the Midwest insurance market.” (Auto Club's Mem. 13.) This factor therefore favors the application of Illinois law.
Considering all of the factors set forth above, the court finds that Illinois has the most significant contacts with the claims at issue in this lawsuit. The court agrees with Auto Club that “Illinois has an interest in regulating computer offenses committed within its borders” (Dkt. No. 68 (“Auto Club's Reply”) at 14), and finds that the bulk of the unlawful conduct and harm alleged in this case occurred in Illinois. Because Illinois substantive law applies to Farmers' claims, Count III is dismissed without prejudice. B. Cause of Action Under Illinois Law
The court also sua sponte dismisses Count IV without prejudice, while granting Farmers leave to re-plead this claim as a cause of action arising under the Illinois Trade Secrets Act.
The parties agree that, under Illinois law, the statute applicable to Farmers' cause of action alleged in Count III is the Illinois Computer Crime Prevention Law (“ICCPL”). This law prohibits “computer tampering,” including knowingly and without authorization accessing, or causing to be accessed, a computer, computer network, program, or data, and obtaining data or services. 720 ILCS 5/17–51(a)(2) (previously 720 ILCS 5/16D–3(a)). Illinois law provides a private right of action to whomever “suffers loss by reason of a violation of subdivision (a)(4)” of the ICCPL. 720 ILCS 5/17–51(c). Subdivision (a)(4), in turn, requires that a defendant:
(4) Inserts or attempts to insert a program into a computer or computer program knowing or having reason to know that such program contains information or commands that will or may:
(A) damage or destroy that computer, or any other computer subsequently accessing or being accessed by that computer;
(B) alter, delete, or remove a computer program or data from that computer, or any other computer program or data in a computer subsequently accessing or being accessed by that computer; or
(C) cause loss to the users of that computer or the users of a computer which accesses or which is accessed by such program. 720 ILCS 5/17–51(a)(4).
Auto Club argues that Farmers “[has] not alleged any conduct that would suggest a violation of subsection (a)(4).” (Auto Club's Mem. 14.) The court agrees. Specifically, Farmers has not alleged that Auto Club “insert[ed] or attempt[ed] to insert a program” into Farmers' computer system.
Farmers has asked for leave “to plead Defendants' violations of the [ICCPL's] provisions for ‘caus[ing] loss to the users of a computer.’ ” (Farmers' Resp. 15.) Under the Federal Rules of Civil Procedure, this court “should freely give leave when justice so requires.” Fed.R.Civ.P. 15(a)(2). While the court is skeptical that Farmers can plead a claim under the ICCPL consistent with this opinion and the requirements of Illinois law, the court is not in a position to find that Farmers' proposed amendments would be futile as a matter of law. Farmers is therefore granted leave to re-plead Count III under Illinois law should it desire to do so consistent with the underlying facts of this lawsuit.
CONCLUSION
For the reasons set forth above, Auto Club's “Motion to Dismiss Counts I, II and III of Plaintiffs' First Amended Complaint Pursuant to Federal Rule of Civil Procedure 12(b)(6)” (Dkt. No. 57) is granted. Counts I, II, and III are dismissed without prejudice. The court also sua sponte dismisses Count IV without prejudice. Farmers is granted leave to file a Second Amended Complaint consistent with this order and the relevant underlying facts on or before November 3, 2011, should it desire to do so. Auto Club's answer is due on or before November 23, 2011. Counsel are requested to meet pursuant to Rule 26(f) and jointly file a Form 52 on or before December 7, 2011. This case is set for a report on status and entry of a scheduling order on December 13, 2011 at 9:00 a.m. The parties are encouraged to discuss settlement.