Opinion
No. 16 C 4297
08-25-2016
RSM US LLP, Plaintiff, v. LAWRENCE BOBER, DAVID STARKSTON, JENNIFER SKOKUN, KATHLENA HYDO, ANN BURKE, and FGMK, LLC, an Illinois Limited Liability Company, Defendants.
MEMORANDUM OPINION AND ORDER
In this suit against Defendants Lawrence Bober, David Starkston, Jennifer Skokun, Kathlena Hydo, Ann Burke, and FGMK, LLC ("FGMK"), Plaintiff RSM US LLP ("RSM") alleges violations of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 ("CFAA"), and asserts various state law claims. Before me is the Defendants' Motion to Dismiss, arguing to dismiss the CFAA claims pursuant to Fed. R. Civ. P. 12(b)(6) and dismiss the state law claims pursuant to Fed. R. Civ. P. 12(b)(1). For the following reasons, Defendants' motion is denied.
BACKGROUND
RSM provides audit, tax, and consulting services from an office in Chicago, Illinois. The firm requires all employees to sign an employment agreement that contains confidentiality and non-disclosure obligations. All the individual Defendants in this case signed such an agreement as RSM employees.
On October 15, 2015, Defendant Lawrence Bober left RSM and signed a settlement agreement. The agreement allowed Bober to solicit the four other individual Defendants in this case about leaving the firm. The settlement agreement contained specific language reiterating that the obligations outlined in the employees' confidentiality agreement remained in effect. Bober separated from RSM to join FGMK and was joined by Starkson, Skokun, Hydo, and Burke.
Bober asked these four coworkers to provide him access to confidential information on RSM's computers prior to leaving the company. This information included Excel spreadsheets related to former clients and client files from RSM's central electronic repository. The individual Defendants transferred these files via e-mail and external USB storage devices. RSM alleges that much of this client information was protected by the employment agreement signed by the individual Defendants and these files were copied without RSM's authorization.
In March 2016, RSM's counsel notified the individual Defendants of their alleged breach of the employment agreements and initiated an investigation into the degree of unauthorized access and the amount of information downloaded off their servers. RSM alleges that it has spent more than $5,000 in this investigation.
RSM asserts violations of subsections (a)(2) and (a)(4) of the CFAA as well as the following state-law claims: misappropriation of trade secrets (Count III), breach of contract (Counts IV and VI), tortious interference with contracts (Count V), and breach of fiduciary duty (Count VII). RSM also alleges that FGMK is vicariously liable for the actions of Defendant Lawrence Bober (Count VIII).
Bober and FGMK filed this motion to dismiss on April 17, 2016 which the other individual Defendants joined on June 6, 2016. Defendants move to dismiss the complaint in its entirety, arguing that Plaintiff has failed to state a federal claim under the CFAA and that the court therefore lacks subject-matter jurisdiction over the state law claims.
LEGAL STANDARD
A motion to dismiss under Rule 12(b)(6) does not test the merits of a claim; rather it tests the sufficiency of the complaint. Gibson v. City of Chi., 910 F.2d 1510, 1520 (7th Cir. 1990). In deciding a 12(b)(6) motion, the court accepts all well-pleaded facts as true, and draws all reasonable inferences in favor of the plaintiff. Id. at 1521. To survive a 12(b)(6) motion, "a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
Rule 12(b)(1) requires dismissal of claims over which the federal court lacks subject matter jurisdiction. Fed. R. Civ. P. 12(b)(1). Jurisdiction is the "power to decide" and must be conferred upon the federal court. In re Chi., Rock Island & Pacific R.R. Co., 794 F.2d 1182, 1188 (7th Cir. 1986). In reviewing a Rule 12(b)(1) motion, we may look beyond the complaint to other evidence submitted by the parties to determine whether subject matter jurisdiction exists. See United Transp. Union v. Gateway W. Ry. Co., 78 F.3d 1208, 1210 (7th Cir. 1996). A plaintiff faced with a 12(b)(1) motion to dismiss bears the burden of establishing that the jurisdictional requirements have been met. See Kontos v. U.S. Dep't Labor, 826 F.2d 573, 576 (7th Cir. 1987).
DISCUSSION
Defendants argue that RSM's CFAA claims fail as a matter of law. To state a civil claim for a violation of the CFAA, a plaintiff must allege: "(1) damage or loss; (2) caused by; (3) a violation of § 1030; and (4) conduct involving one of the factors in § 1030(c)(4)(A)(i)(I)-(V)." PolyOne Corp. v. Lu, No. 14 CV 10369, 2015 WL 3919115, at *5 (N.D. Ill. June 25, 2015) (citing 18 U.S.C. § 1030(g)). The sole issue raised by Defendants' Motion to Dismiss is whether RSM has alleged the sort of "damage or loss" required to maintain a civil action under the CFAA.
I. The CFAA's Definition of "Damage"
Section (e)(8) of the CFAA defines "damage" as "any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). Mere replication of files does amount to "damage" under the CFAA. Del Monte Fresh Produce, N.A., Inc. v. Chiquita Brands Int'l Inc., 616 F. Supp. 2d 805, 811 (N.D. Ill. 2009) ("copying electronic files from a computer database . . . is not enough to satisfy the damage requirement of the CFAA; there must be destruction or impairment to the integrity of the underlying data.").
Here, the RSM has not alleged any destruction or impairment to its computer systems. Defendants allegedly copied and downloaded files, but RSM has not alleged that any data, programs, systems, or files were altered by these actions. Thus RSM has failed to allege "damage" under the CFAA.
II. The CFAA's Definition of "Loss"
Despite not alleging damage, RSM can still state a claim under the CFAA by alleging a loss due to a CFAA violation. See Motorola, Inc. v. Lemko Corp., 609 F. Supp. 2d 760, 767 (N.D. Ill. 2009) ("[A] plaintiff alleging violations of sections 1030(a)(2) or (a)(4) need only allege damage or loss, not both."). Section (e)(11) of the CFAA defines "loss" as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11)
RSM here alleges it has spent over $5,000 investigating this incident. The courts in this District, like the parties in this case, are split as to whether investigation costs unrelated to any system damage, system impairment, or service interruption are considered a "loss" under the CFAA.
Some courts have interpreted § 1030(e)(11) to require some nexus between the cost incurred by the plaintiff and actual systemic impairment or damage to a computer. In SKF USA, Inc. v. Bjerkness, 636 F. Supp. 2d 696 (N.D. Ill. 2009), the court held that costs "not related to computer impairment or computer damages are not compensable under the CFAA," thus lost revenues that resulted from unauthorized transfer of data were not a "loss." Id. at 721. Similarly, in Mintel International Group., Ltd. v. Neergheen, No. 08-CV-3939, 2010 WL 145786 (N.D. Ill. Jan. 12, 2010), the court held that investigation costs fall under CFAA's definition of "loss" only if they "relate to the investigation or repair of a computer or computer system following a violation that caused impairment or unavailability of data or interruption of service." Id. at *10. If I were to adopt this narrower interpretation of "loss," RSM's complaint would be insufficient to state a claim under the CFAA. RSM has not alleged that any computer system was impaired, that any data was made unavailable as a result of Defendants' conduct, or that service was interrupted.
But the recent trend in this District is to consider investigation costs a "loss" under the CFAA "without regard to whether the investigation pertained to an actual disruption of service or impairment to the plaintiff's data." Lane v. Brocq, No. 15 C 6177, 2016 WL 1271051, at *11 (N.D. Ill. Mar. 28, 2016); see also PolyOne Corp. v. Lu, No. 14 CV 10369, 2015 WL 3919115, at *6 (N.D. Ill. June 25, 2015) ("[a]t the pleadings stage, it is sufficient for a plaintiff to allege that it responded to an offense by examining its computer systems and it incurred at least $5,000 in costs associated with that examination."). This trend is rooted in the plain language of the statute that defines loss as "any reasonable cost to any victim, including the cost of responding to an offense." See Pascal Pour Elle, Ltd. v. Jin, 75 F. Supp. 3d 782, 791 (N.D. Ill. 2014) (emphasis in original). This trend recognizes that while the statute includes a list of costs that would be reasonable, "the definition, by its use of the word 'including,' does not state that the list is exhaustive." Id. Defendants argue that even under this recent line of cases, RSM's investigation costs are not losses because they did not arise from an outside intrusion or the kind of computer hacking that was at issue in Pascal Pour and Lane. But contrary to Defendants' argument, the text of § 1030(e)(11) does not distinguish between inside or outside intrusions. Rather, the language broadly categorizes any reasonable cost incurred in response to a CFAA violation a loss.
I agree with the recent trend and find that the text of § 1030(e)(11) covers the investigation costs incurred by RSM. Plaintiff has adequately pled that it spent more than $5,000 investigating Defendants' unauthorized access and acquisition of confidential information. These costs constitute a "loss" under the CFAA and are sufficient to survive a motion to dismiss.
Because Plaintiff has stated a federal claim, the court has supplemental jurisdiction to adjudicate Plaintiff's state law claims pursuant to 28 U.S.C. 1367 as those the federal and state claims derive from a common nucleus of operative fact.
CONCLUSION
For the foregoing reasons, Defendants' motion to dismiss is denied.
/s/
ENTER:
James B. Zagel
United States District Judge DATE: August 25, 2016