Summary
applying statutory canons of construction to conclude that loss only refers to the narrow grouping that is specified in the statute
Summary of this case from Psychas v. Dist. Dep't of Transp.Opinion
Case No. 6:04-cv-1374-Orl-31DAB.
August 10, 2005
ORDER
This case is before the Court on Defendants Lot Builders Association Inc.'s, Michael Boswell's, and Brad Luken's (collectively, "Lot Builders") Motion for Summary Judgment (Doc. 52), Plaintiff ResDev LLC's Cross Motion for Summary Judgment (Doc. 53), and Resdev's and Lot Builder's respective Oppositions (Docs. 73 and 71).
I. BACKGROUND
ResDev has sued Lot Builders for violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 ("CFAA"), on ground that Lot Builders absconded with ResDev's "scattered-lots database," a computerized resource on available residential lots. Lot Builder's principals, two former ResDev employees, acknowledge that, after leaving ResDev's employ, they visited its website and were able to access information that was not password protected. Based on that event and others, ResDev claims that Lot Builders committed unauthorized computer access in violation of the CFAA, and ResDev seeks to recover, inter alia, damages based on the information's alleged trade secret value. Lot Builders asserts, in response, that ResDev has not suffered cognizable loss.
ResDev has also sued Lot Builders in state court on various unfair-competition claims.
II. STANDARD OF REVIEW
Summary judgment "shall be rendered forthwith if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." FED. R. CIV. P. 56(c). Whether a fact is material depends on the substantive law of the case. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). If there is an absence of evidence on a dispositive issue for which the nonmoving party bears the burden of proof, that party must "go beyond the pleadings and by . . . affidavits, or by the depositions, answers to interrogatories, and admissions on file, designate specific facts showing that there is a genuine issue for trial." Celotex Corp. v. Catrett, 477 U.S. 317, 324-25 (1986) (internal quotations and citation omitted). Summary judgment is mandated against the nonmoving party who thereafter fails to present sufficient evidence to establish a genuine issue of fact for trial. Id. at 322, 324-25.
In this review, the Court must consider all inferences drawn from the underlying facts in a light most favorable to the nonmoving party, and resolve all reasonable doubts against the moving party. Anderson, 477 U.S. at 255. If a material issue of fact exists, the court must not decide it, but rather, must deny summary judgment and proceed to trial. Environmental Def. Fund v. Marsh, 651 F.2d 983, 991 (5th Cir. 1981). But "there is no issue for trial unless there is sufficient evidence favoring the nonmoving party for a jury to return a verdict for that party. If the evidence is merely colorable, or is not significantly probative, summary judgment may be granted." Anderson, 477 U.S. at 249-50 (citations omitted).
Unless reversed, decisions of the Fifth Circuit prior to October 1, 1981 are binding precedent on this Court. Bonner v. City of Prichard, 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc).
III. LEGAL ANALYSIS
This case turns primarily on statutory construction. In that regard, there are certain basic rules this Court must follow.
There is a presumption that, in drafting a statute, Congress said what it meant and meant what it said. American Bankers Ins. Group v. United States, 408 F.3d 1328, 1332 (11th Cir. 2005). Indeed, "[t]he first rule in statutory construction is to determine whether the language at issue has a plain and unambiguous meaning with regard to the particular dispute." Shotz v. City of Plantation, Florida, 344 F.3d 1161, 1167 (11th Cir. 2003). Words carry their ordinary meaning, unless otherwise defined. American Bankers, 408 F.3d at 1332. If Congress has used clear statutory language, a court need not consider extrinsic materials, such as legislative history, and certainly should not derive from such materials a meaning that is inconsistent with the statute's plain meaning. Shotz, 344 F.3d at 1167. The only exception is this narrow one: "courts my reach results inconsistent with the plain meaning of a statute `if giving the words of a statute their plain and ordinary meaning produces a result that is not just unwise but is clearly absurd.'" CBS Inc. v. PrimeTime 24 Joint Venture, 245 F.3d 1217, 1228 (11th Cir. 2001) (citation omitted).
Even where Congress has used statutory language that is not entirely transparent, courts are to resort, in the first instance, to canons of construction — time-tested interpretive rules developed to determine the meaning of individual statutory terms from a methodical inquiry into their broader, statutory context. Id. at 1225. In construing a statute's meaning and application to a particular case, a court should resort to extrinsic materials, such as legislative history, only if the statutory language either produces a clearly absurd result or presents a substantial ambiguity. See Shotz, 344 F.3d at 1367; CBS Inc., 245 F.3d at 1225.
A. Relevant Excerpts of the CFAA's Statutory Text
(a) Whoever —
. . .
(5) (A) (i) knowingly causes the transmission of . . . information . . . and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
(ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or
(iii) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage; and
(B) by [such] conduct described in . . . subparagraph (A) caused . . . —
(i) loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value;
(ii) the modification or impairment, or potential modification or impairment of the medical examination, diagnosis, treatment, or care of 1 or more individuals;(iii) physical injury to any person;
(iv) a threat to public health or safety; or
(v) damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security.
. . .
shall be [subject to criminal penalties].
(e) As used in this section —
. . .
(8) the term "damage" means any impairment to the integrity or availability of data, a program, a system, or information;
. . .
(11) the term "loss" means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service;
. . .
(g) Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv) or (v) of subsection (a)(5)(B). Damages for a violation involving only conduct described in subsection (a)(5)(B)(i) are limited to economic damages. * * * No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware.18 U.S.C. § 1030 (emphasis added).
B. Construction of the CFAA's Relevant Statutory Text
At the outset, subsection (g) cites two explicitly-defined injuries — "damage" or "loss" — either of which a plaintiff must suffer, as a result of a CFAA violation, in order to maintain a cause of action for "compensatory damages." Id. (g). A further precondition is that the alleged violation involve one of five enumerated factors. Id. For example, if a hospital patient suffers "damage" — an "impairment to the . . . availability of . . . information" — by reason of a CFAA violation, the patient may maintain a civil action against the violator for compensatory damages, if the violation also involved "impairment . . . of care" or "physical injury." Id. (g), (e)(8), (a)(5)(B)(ii)-(iii)(g). In this regard, the CFAA's private cause of action is principally defined by a two-part injury requirement; a plaintiff must suffer a certain type of root injury, which is not sufficient to support a civil action, unless one of five operatively-substantial effects occurs. Id. (a)(5)(B)(i)-(v), (g).
A plaintiff who has suffered injuries fitting subsection (g)'s two-part injury requirement may, in turn, obtain "compensatory damages and injunctive relief or other equitable relief." Id. (g). In ordinary legal parlance, "compensatory damages" are "[d]amages sufficient in amount to indemnify the injured person for the loss suffered." BLACK'S LAW DICTIONARY 416 (8th ed. 2004). And in ordinary practice, "compensatory damages are not restricted to actual loss of time or money; they cover both mental and physical aspects of injury — tangible and intangible." ELEVENTH CIRCUIT PATTERN JURY INSTRUCTIONS (CIVIL CASES), Federal Claims Instruction 1.2.1 (1999). Subsection (g), however, further limits the available damages to "economic damages," if a violation involved only conduct which caused "loss" aggregating at least $5,000 in a 1-year period. Id. So it is fairly clear that, for conduct which results only in "loss," the only available measure of damages is actual monetary loss. 18 U.S.C. § 1030(g). Thus, besides requiring "damage" or "loss," subsection (g)'s terminology provides two additional limits in regard to damages — damages must be "compensatory" and, for "loss," can only be "economic." Id.
1. ResDev's Principal Position
In the instant case, ResDev claims, as its greatest loss, an amount equal to Lot Builders' revenues, about $175,000, which ResDev sees as resulting from Lot Builder's unauthorized obtainment of ResDev's scattered-lots database. ResDev also acknowledges that the viability of its civil action hinges on subsection (a)(5)(B)(i). ResDev, therefore, assumes that Lot Builder's allegedly ill-gotten revenues qualify as "loss" aggregating over $5,000 in a 1-year period. See id. (a)(5)(B)(i). ResDev's position, however, does not fit the CFAA's meaning of "loss."
The CFAA defines "loss" in terms of "any reasonable cost." Id. (e)(11). "Cost" ordinarily means an "amount paid or charged for something; price or expenditure." BLACK'S LAW DICTIONARY 371 (8th Ed. 2004). The CFAA's "loss" definition goes on to list costs that are similar in that they are all directly associated with, or with addressing, an unauthorized-computer-access event. Among those costs are: "any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11) (emphasis added). By use of the term "cost" and its listing potential injuries directly associated with, or with addressing, an unauthorized-computer-access event, the CFAA plainly enumerates a narrow grouping of "loss" distinct from — and thus excluding — the far greater range of losses that could flow from a violation of the CFAA. ResDev's position, that "loss" can cover a trade secret's exclusivity value, disregards the ordinary meaning of statutory terms, fails to account for surrounding context, and runs counter to the " expression unius . . ." canon of construction, which translates as "the expression of one implies the exclusion of others." See Barnhart v. Peabody Coal Co., 537 U.S. 149, 168 (2003) (indicating that expressio unius cannon has force "when the items expressed are members of an `associated group or series,' justifying the inference that items not mentioned were excluded by deliberate choice, not inadvertence.").
Futhermore, to the extent ResDev asserts that sufficient "damage" or "loss" can open the door to a broader class of damages, ResDev's position both ignores subsection (g)'s wording: "[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages," 18 U.S.C. § 1030(g) (emphasis added); and also ignores the selection of factors listed in subsection (a)(5)(B). Each of the explicitly-defined root injuries — "damage" or "loss" — is an immanently foreseeable effect of unauthorized computer access, and subsection (a)(5)(B)'s five-factor list includes things which clearly may result from "damage" or otherwise constitute "loss." ResDev's position fails to acknowledge that allegedly ill-gotten revenues from a trade secret are neither a "but-for" nor a proximate consequence of "damage," and nor do they fit within the grouping of "loss." In that regard, ResDev's position conflicts with the CFAA's language, where the sine qua non of the private cause of action — either of two explicitly-defined root injuries — narrows the available "damages" to "compensatory damages" — those damages which result from, or constitute, an explicit type of injury.
Although ResDev cites two cases that appear to support its position, neither is helpful. In Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc., 119 F.Supp.2d 1121 (W.D. Wash. 2000), the district court considered a version of the CFAA predating its most recent version. On or after October 26, 2001, Congress amended the CFAA, in relevant part, by defining the term "loss" in subsection (e)(11). See USA Patriot Act of 2001, Pub.L. No. 107-56, § 814(d)(5). That rendered subsection (g)'s reference to "damage" and "loss" a reference to two defined terms, which was not previously the case. See 18 U.S.C. § 1030 (1996). Whereas ResDev's principal alleged loss — trade secret value — may have been considered an actionable loss under the CFAA's previous version, its current version precludes that interpretation.
Another thing that detracts from Shurgard is its heavy reliance on legislative history. Id. at 1126-29. For instance, based on legislative history, Shurgard adopted an unusual and extraordinary interpretation of the word "integrity" within the CFAA's definition of "damage" — i.e., "any impairment to the integrity or availability of data . . . or information." It found "integrity" to contemplate the loss of a trade secret's exclusivity value. Id. at 1126-27. "Integrity," however, ordinarily means "wholeness" or "soundness," OXFORD ENGLISH REFERENCE DICTIONARY 731 (Rev. 2nd ed. 2002), and contemplates, in this context, some diminution in the completeness or use ability of data or information on a computer system. This Court finds no meaningful ambiguity that might weigh in favor of relying on legislative history, especially when it predates the CFAA's more recent amendments. And, whether real or apparent, there appears to have been a recent up-tick in cases looking ill upon such analyses. See e.g., Exxon Mobil Corp. v. Allapattah Servs. Inc., 125 S.Ct. 2611, 2626 (2005) (favorably mentioning the view that legislative-history analyses are akin to "looking over a crowd and picking out your friends.").
As to the second case, it is unfortunate that in Four Seasons Hotels Resorts B.V. v. Consorcio Barr, S.A., the court failed to analyze the effect of the CFAA's 2001 amendments and relied on both Shurgard and another case dealing with an earlier version of the statute. See Four Seasons Hotels, 267 F. Supp. 2d 1268, 1322 (S.D. Fla. 2003) (otherwise relying on EF Culture Travel, B.V. v. Explorica, Inc., 274 F.3d 577, 585 (1st Cir. 2001), which defined "loss" as "detriment, disadvantage, or deprivation from failure to keep, have or get."). In the end, however, it is Congress' words and definitions that generally control statutory meaning. See American Bankers, 408 F.3d at 1332. The CFAA's amendment and current language were not meaningfully analyzed, nor perhaps even flagged as a concern, in Four Seasons Hotels, and the absence of meaningful analysis renders that case unpersuasive.
In an unpublish, non-precedential opinion, the Eleventh Circuit affirmed the district court's liability determination without discussion.
2. ResDev's Secondary Position
In its Opposition (Doc. 73), ResDev claims, as a fallback, that it has incurred loss by having to undertake extensive and costly efforts in response to Lot Builder's unauthorized computer access. It is undisputed that Lot Builder's principals no longer work at ResDev's place of business. Accordingly, remote access is the ongoing threat that apparently causes ResDev concern. As an indication of the threat's magnitude, ResDev points out that one of Lot Builder's principals helped design ResDev's computer system, knows "the type of security he placed on the computers at ResDev, how the security was set up, how many levels of security were in place and where the vulnerabilities in ResDev's security existed." Based on the view that its computers "will never be truly secure" until it sets up "a new security framework," ResDev estimates that the ultimate cost of responding to the threat will probably exceed $150,000, exclusive of interim cost for security evaluation and implementation.
The Court finds utterly meritless ResDev's suggestion that a CFAA violation occurs every time Lot Builders accesses its own computers and allegedly looks at information belonging to Resdev. Such access, if it can be called that, is conduct from which ResDev could not, as a matter of law, reasonably suffer "damage" or "loss" within the CFAA's meaning.
Whether by strategy or a lack of notice, Lot Builders has not clearly addressed ResDev's cost-of-response estimates. Lot Builders has indicated, however, that the extent of its remote access has been one or more visits to ResDev's website; that, each time, the visit to the website occurred under attorney supervision; and that the purpose of the visits was to show how ResDev's website is not adequately secured. Lot Builders, therefore, may have challenged (albeit vaguely) whether its conduct could give rise to cognizable loss.
In that regard, the CFAA provides potential redress for "loss," which includes "any reasonable cost" of responding to a violation. 18 U.S.C. § 1030(e)(11), (g). To enable a cause of action, however, the "loss" from a violation must aggregate at least $5,000 to 1 or more persons in a 1-year period. Id. (a)(5)(B)(i), (g). The CFAA, in addition, explicitly rejects any notion that it provides a cause of action for negligent computer hardware or software design. Id. (g).
Based on the current state of the record, the Court cannot say that either party has revealed the absence of a material issue of fact. Yet it is evident that, at least insofar as ResDev seeks to recoup the cost of building a new computer system with far greater security, the reasonableness of ResDev's alleged "loss" will be an issue. The parties, however, simply have not presented the issue in a manner in which this Court could reasonably consider it. Nevertheless, as the threshold viability of ResDev's cause of action depends on a minimum amount of "loss," the Court will consider, if filed by September 12, 2005, further pre-trial motions on that issue, even though the dispositive-motion's deadline has passed.
IV. CONCLUSION
For the foregoing reasons, it is therefore
ORDERED that Lot Builder's Motion for Summary Judgment (Doc. 52) is GRANTED in part and DENIED in part; ResDev's Motion for Summary Judgment (Doc. 53) is DENIED; and ResDev's claim is dismissed to the extent it seeks compensatory damages for alleged injuries that do not constitute "loss" within the meaning of the CFAA.
DONE and ORDERED.