Opinion
3:21-CV-602
2021-07-06
Drew Austin SPECKMAN, Plaintiff, v. Cosimo FABRIZIO; Adrian Lee; Reza Madhavan; Jake McEvoy; and Does 1-50, Defendants.
OF COUNSEL: JASON HOLLANDER SUNSHINE, ESQ., MAURICE D. PESSAH, ESQ., PESSAH LAW GROUP PC, Attorneys for Plaintiff, 661 N. Harper Avenue Suite 208, Los Angeles, California 90048. OF COUNSEL: BRIAN CAPITUMMINO, ESQ., WOODS OVIATT GILMAN LLP, Attorneys for Defendants, 1900 Bausch & Lomb Place, Rochester, New York 14604.
OF COUNSEL: JASON HOLLANDER SUNSHINE, ESQ., MAURICE D. PESSAH, ESQ., PESSAH LAW GROUP PC, Attorneys for Plaintiff, 661 N. Harper Avenue Suite 208, Los Angeles, California 90048.
OF COUNSEL: BRIAN CAPITUMMINO, ESQ., WOODS OVIATT GILMAN LLP, Attorneys for Defendants, 1900 Bausch & Lomb Place, Rochester, New York 14604.
MEMORANDUM-DECISION and ORDER
DAVID N. HURD, United States District Judge
I. INTRODUCTION
On May 25, 2021, plaintiff Drew Austin Speckman ("Speckman" or "plaintiff") filed a complaint against defendants Cosimo Fabrizio ("Fabrizio"), Adrian Lee ("Lee"), Reza Madhavan ("Madhavan"), and Jake McEvoy ("McEvoy," collectively "defendants"). Essentially, plaintiff alleges an improper corporate takeover by defendants, his business partners and former college classmates. With his complaint, plaintiff also moved for a temporary restraining order ("TRO") against defendants looking to reverse their alleged efforts to disrupt his rights to exercise ownership over RapStudy, Inc. ("RapStudy").
Plaintiff amended his complaint on June 7, 2021 to add McEvoy as a defendant. The complaint also lists fifty Doe defendants.
The Court granted Speckman's TRO that same day and set a hearing to consider whether to convert the TRO into a preliminary injunction. Defendants not only opposed granting plaintiff's preliminary injunction, they also cross-moved to dismiss the complaint in its entirety under Federal Rule of Civil Procedure ("Rule") 12(b)(6). The Court heard oral argument on both motions on Thursday, June 17, 2021. The cross-motions will now be decided on the parties’ submissions and oral arguments.
II. BACKGROUND
In 2018, Speckman was a student at Cornell University. Dkt. 17 ("Compl."), ¶ 20. While in school, plaintiff had an idea that would eventually sprout into RapStudy. Id. As RapStudy's name suggests, plaintiff's idea was to pair modern, popular music with educational lyrics as a teaching tool. See id. ¶ 18.
The facts are taken from plaintiff's Amended Complaint and the documents attached to it for the purposes of resolving defendants’ motion to dismiss. The facts are also taken in the light most favorable to plaintiff. If plaintiff's complaint survives, the Court will consider the additional materials the parties submitted to resolve plaintiff's motion for a preliminary injunction, as well as plaintiff's objections to those materials. Dkt. 27.
But having an idea and bringing it to life are two decidedly different things. To that end, Speckman reached out to defendant Fabrizio in October of 2018 to bring him aboard the fledgling company. Compl. ¶ 22. In the process, plaintiff had Fabrizio sign a non-disclosure agreement ("NDA") on October 28, 2018. Dkt. 17, pp. 26-34. By the NDA's terms, Fabrizio was prohibited from using any information plaintiff shared with him "for any purpose that might be directly or indirectly detrimental" to plaintiff. Id. at 28. The NDA similarly prohibited Fabrizio from interfering with plaintiff's relationship with any other employees and contractors he might employ. Id. at 29-30.
Pagination corresponds with CM/ECF. Plaintiff's amended complaint contains multiple exhibits. Citations to Dkt. 17—rather than to Compl.—are citations to those exhibits rather than the amended complaint itself.
By November of 2019, RapStudy had begun to round into form, so Speckman looked for more potential employees. See Compl. ¶ 23 He found them in defendants Madhavan, Lee, and McEvoy. Id. All three would sign NDAs of their own: Madhavan on November 5, 2019, McEvoy on November 7, and Lee on November 12. Id. The Lee NDA notes that all materials Lee produced would be plaintiff's sole property. Dkt. 17, p. 36. The Madhavan NDA is essentially the same. Id. at 38. However, the McEvoy NDA provides that any materials he produced would be plaintiff's property "and/or" the property of "those involved with RapStudy at present or in the future." Id. at 40.
In any case, having started to assemble a team of employees, Speckman filed articles of incorporation for RapStudy in the State of Delaware on November 20, 2019. Dkt. 17, pp. 22-24. The certificate of incorporation lists plaintiff as the "Sole Incorporator." Id. at 22, 24. Eventually, plaintiff also became RapStudy's CEO, and as that role demands he claims he began negotiating contracts with school districts, arranging for licensing, and generally managing his nascent business and helping it to grow. Compl. ¶¶ 4, 21.
Through Speckman's and defendants’ combined efforts, RapStudy developed apace until early fall of 2020, when the company's once-bright horizons began to threaten a storm. Around that time, plaintiff started dating one of the company's employees, Claire Choi ("Choi"). Compl. ¶ 24. By all accounts, that relationship was purely consensual. Id. Nevertheless, apparently plaintiff and Choi did not disclose it to any other RapStudy employee at the time. See id. ¶ 24.
Neither the relationship nor its secrecy would last forever. Apparently, Choi and Speckman broke up not long after they became involved. See Compl. ¶ 24. Choi kept the relationship secret until April 26 and 27, 2021, when she finally confided in defendants that she and plaintiff had been an item. Id.
On May 3, 2021, defendants escalated matters by submitting a notice of misconduct criticizing Speckman for his handling of his relationship with Choi. Compl. ¶ 25. The notice of misconduct alleged that plaintiff had shown: (1) an inability to separate his work and personal lives, (2) poor judgment and general misconduct; and (3) had otherwise violated defendants’ trust. Id. As a consequence, defendants requested that plaintiff take a leave of absence until August 8, 2021. Id. ¶ 26. They similarly expressed their discomfort in having plaintiff continue as CEO of RapStudy. Id.
If the notice of misconduct signaled defendants’ escalation, their next steps amounted to a declaration of war. On May 11, 2021, Speckman got an alert that his passwords had been changed for all of his RapStudy-related Google accounts. Compl. ¶ 27. By extension, plaintiff was effectively locked out of the company's files and was cut off from responding to any emails as CEO of RapStudy. Id. ¶ 28. According to plaintiff, he knows that defendants were responsible because the four defendants have access to RapStudy's Google account, while every other employee does not. Id. ¶ 29.
On May 13, 2021, Speckman discovered that he was also locked out of RapStudy's bank account and his name was removed as an account holder. Compl. ¶ 32. Defendant Fabrizio alone is a joint signatory on RapStudy's bank account. Id. ¶ 33. Finally, plaintiff claims defendant Fabrizio removed him from RapStudy's digital storage site for its program source code, called "GitHub." Id. ¶ 35.
Suddenly cut off from accessing this series of accounts—each apparently critical to RapStudy's operations—Speckman filed a complaint and TRO application on May 25, 2021. Dkt. 1. On June 7, 2021, plaintiff submitted an amended complaint adding McEvoy as a defendant. Dkt. 17. Plaintiff's complaint as amended alleges seven counts: (I) a request for a declaratory judgment under the Declaratory Judgment Act ("DJA"), 28 U.S.C. § 2201, affirming his status as sole incorporator, CEO, and exclusive owner of RapStudy; (II) a violation of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030 ; (III) Conversion; and (IV-VII) breaches of contract against Fabrizio, Madhavan, Lee, and McEvoy respectively.
On June 8, 2021, defendants cross-moved to dismiss plaintiff's complaint for failure to state a claim and lack of subject-matter jurisdiction. Dkt. 18. The Court heard oral argument on both motions on June 17, 2021. Text Minute Entry Dated 6/17/2021. This decision follows.
III. LEGAL STANDARD
A. Motion to Dismiss
To survive a motion to dismiss, "a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). That factual matter may be drawn from "the facts alleged in the complaint, documents attached to the complaint as exhibits, and documents incorporated by reference in the complaint." DiFolco v. MSNBC Cable L.L.C. , 622 F.3d 104, 111 (2d Cir. 2010).
Importantly, "the complaint is to be construed liberally, and all reasonable inferences must be drawn in the plaintiff's favor." Ginsburg v. City of Ithaca , 839 F. Supp. 2d 537, 540 (N.D.N.Y. 2012) (citing Chambers v. Time Warner, Inc. , 282 F.3d 147, 152 (2d Cir. 2002) ). If the complaint and its additional materials—when viewed through that pro-plaintiff lens—are not enough to raise the plaintiff's right to relief on a claim above the speculative level, that claim must be dismissed. See Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).
B. Preliminary Injunction
The Second Circuit requires a plaintiff seeking a preliminary injunction to prove four elements:
(1) a likelihood of irreparable harm; (2) either a likelihood of success on the merits or sufficiently serious questions as to the merits plus a balance of hardships that tips decidedly in [the movant's] favor; (3) that the balance of hardships tips in [the movant's] favor regardless of the likelihood of success; and (4) that an injunction is in the public interest.
The Second Circuit appears to still be in the process of formally harmonizing its prior existing standards with the four-element test required by the Supreme Court in Winter , 555 U.S. at 20, 129 S.Ct. 365.
Chobani, LLC v. Dannon Co. , 157 F. Supp. 3d 190, 199 (N.D.N.Y. 2016) (analyzing changes to Second Circuit preliminary injunction standard and comparing existing standards). The movant must make a "clear showing" that each of these elements is met. Winter v. Nat. Res. Def. Council, Inc. , 555 U.S. 7, 22, 129 S.Ct. 365, 172 L.Ed.2d 249 (2008).
If a movant's desired injunction would alter, rather than preserve, the status quo, that injunction is mandatory in nature and subject to heightened scrutiny. Yang v. Kosinski , 960 F.3d 119, 127-28 (2d Cir. 2020). To satisfy that heightened burden, the movant must make a "strong" showing of irreparable harm and demonstrate a "clear or substantial likelihood of success on the merits." Id. at 128.
IV. DISCUSSION
Two motions are pending. But if the Court finds merit in defendants’ motion to dismiss, Speckman's motion for a preliminary injunction falls away as moot. Accordingly, the Court will consider defendants’ motion first and only turn to plaintiff's afterwards if necessary.
A. Plaintiff's CFAA Claims
The CFAA is a federal criminal statute intended to punish frauds enacted through computers. See generally, 18 U.S.C. § 1030. But as anyone with an email account can attest, computer-based frauds are decidedly commonplace. To help make sure that digital fraudsters are held accountable without overheating federal prosecutors, Congress included a civil enforcement provision in the CFAA allowing private citizens to bring their own claims under that statute. Id. at § 1030(g).
Among several other permutations of computer fraud, § 1030(a)(4) of the CFAA prohibits: (1) "knowingly and with intent to defraud"; (2) "accessing a protected computer"; (3) "without authorization" or by exceeding whatever authorization was granted; and (4) furthering an intended fraud and obtaining something of value through accessing the protected computer. Scottrade, Inc. v. BroCo Invs., Inc. , 774 F. Supp. 2d 573, 583 (S.D.N.Y. 2011) (citing 18 U.S.C. § 1030(a)(4) ) (cleaned up). Defendants levy several attacks on Speckman's complaint, but recent developments draw the Court's focus to the third element of acting "without authorization" or "exceeding whatever authorization was granted." To meet that element, plaintiff argues that although defendants had the authorization credentials needed to access RapStudy's Google and GitHub accounts, they exceeded the access he granted them by locking him out in violation of the NDAs. Compl. ¶¶ 29, 35. To plaintiff's point, the Fifth Circuit interpreted "exceeding authorized access" just as plaintiff envisions that element in United States v. John . 597 F.3d 263, 272 (5th Cir. 2010) ("Access to a computer and data that can be obtained from that access may be exceeded if the purposes for which access has been given are exceeded."), abrogated by Van Buren v. United States , ––– U.S. ––––, 141 S. Ct. 1648, 210 L.Ed.2d 26 (2021).
Yet obviously this Court is bound to follow the Second Circuit, not the Fifth. Under Second Circuit caselaw, Speckman's argument was a longshot from the jump. In United States v. Valle , the Second Circuit defined "exceeding authorized access" as using a computer the defendant is authorized to access to reach materials that the defendant is not authorized to reach. 807 F.3d 508, 524 (2d Cir. 2015).
Think of it this way. A person is authorized to use a computer if the computer's functions are locked, but he possesses a password that allows him to use it all the same. See Valle , 807 F.3d at 524. But if that person then uses that computer he is authorized to use to access files that he is not allowed to access in a technical sense, he runs afoul of § 1030(a)(4). See id. at 524, 527 (defining exceeding authorized access to mean "inside hackers" whose "access to a computer is authorized but who access unauthorized information or files").
By the Second Circuit's logic, this definition cabins the CFAA's reach to hackers who breach digital security measures. Valle , 807 F.3d at 524-28. Otherwise, the CFAA would make it a federal felony for an office worker to check his personal Facebook account on his work computer against company policy. Id. ("While the Government might promise that it would not prosecute an individual for checking Facebook at work, we are not at liberty to take prosecutors at their word in such matters."). Speckman's reliance on John for a broader definition of "exceeding authorized access" is thus misplaced, because this Court is bound to follow Valle . John, 597 F.3d at 272.
To be fair to Speckman, though, until earlier this month there were many circuit courts that disagreed with Valle and had endorsed that broader definition of "exceeding authorized access." Unfortunately for plaintiff, the Supreme Court silenced that disagreement when it issued Van Buren v. United States on June 3, 2021. 141 S. Ct. 1648. In Van Buren , the Supreme Court resolved the disharmony among the circuits and held that "exceeded authorized access" involves the defendant using a computer he is authorized to access to reach information he is not entitled to reach. See id. at 1655.
Try as he might, Speckman cannot prove the element of exceeding authorized access after Van Buren . Plaintiff principally argues that defendants’ locking him out of RapStudy's Google and GitHub accounts violated the CFAA because he never gave them permission to change his credentials. However, after Van Buren , any esoteric principles concerning how plaintiff might have planned on defendants using their access to the Google and GitHub accounts is moot. See 141 S. Ct. at 1655. Instead, he must prove that defendants did not have the necessary authorization to lock him out. See id.
He cannot. After all, Speckman specifically claims that defendants were administrators of RapStudy's Google account, which if anything proves that defendants were authorized to change the password. Compare Compl. ¶ 29 (plaintiff claiming that defendants had administrative access credentials to RapStudy's Google accounts), with Van Buren , 141 S. Ct. at 1655 ; Valle , 807 F.3d at 524-28. As a consequence, his only evidence that defendants were the ones who changed his Google account—specifically that defendants and only defendants had the appropriate credentials to change his passwords—actively disproves that defendants exceeded their authorized access. See Van Buren , 141 S. Ct. at 1655 (noting that exceeding authorized access requires defendant to lack access credentials).
Similarly, Speckman alleges no facts to suggest that defendants hacked into RapStudy's GitHub account instead of using credentials they were provided. Compl. ¶ 35. Accordingly, the complaint presents no allegations to support that his CFAA claim meets Van Buren ’s definition of exceeding authorized access. 141 S. Ct. at 1655.
Plaintiff's last-minute argument in response and at oral argument that defendants also must have improperly accessed RapStudy's letterhead to have plaintiff removed from RapStudy's bank account does not help his case. He has not alleged or argued that this letterhead is locked behind some password that he alone was privy to. There remains no evidence that defendants ever exceeded their authorized access and this claim fails just as inevitably.
Speckman nevertheless strains to distinguish Van Buren and salvage his CFAA claim. First, he argues that unlike Van Buren , this is not a criminal case, and given the more muted stakes there is less of a need to have an eye for lenity. 141 S. Ct. at 1653 (describing factual background of criminal charges). However, the Supreme Court specifically declined to reach the rule of lenity because it concluded that the plain language of the CFAA was enough to settle the matter. Id. at 1661. That same statutory language is in play now. See 18 U.S.C. § 1030(e)(6) (defining "exceeds authorized access"). Accordingly, the difference between the civil and criminal contexts changes nothing.
Second, Speckman would distinguish Van Buren based on the provision of the CFAA at issue in that case as opposed to this one. Specifically, the defendant in Van Buren simply accessed information: plaintiff claims these defendants took the further step to alter it in furtherance of a fraud. Compare 141 S. Ct. at 1653 (noting defendant was charged under 18 U.S.C. § 1030(a)(2) for accessing information without authorization), with Compl. ¶¶ 29, 35, 46 (alleging claim under 18 U.S.C. § 1030(a)(4) for exceeding authorized access in furtherance of fraud).
To be sure, the precise conduct at issue in this case looks different from the conduct in Van Buren. 141 S. Ct. at 1653 (noting that defendant was police officer who accessed license plate records in exchange for $5,000). And as a result, many of the elements at issue in Van Buren look different from the elements here. Id. at 1652 (describing elements of 18 U.S.C. § 1030(a)(2) as "intentionally access[ing] a computer without authorization or exceed[ing] authorized access[ ] and thereby obtain[ing] computer information").
Compelling as the differences Speckman points to may seem at a distance, from up close plaintiff is making a mountain out of a molehill. At bottom, the import of Van Buren comes from the Supreme Court defining "exceeding authorized access" for the purposes of the CFAA as requiring a defendant to access or alter information he lacks the credentials to use but from a computer he is authorized to use. 141 S. Ct. at 1655. That definition is binding on this Court, and plaintiff's complaint not only fails to meet it, but actively disproves it.
By extension, the lesser-included distinction that Speckman relies on—between accessing and altering information—must also be discarded. In fact, the CFAA treats accessing and altering information identically by its plain terms. See 18 U.S.C. § 1030(e)(6) ("the term ‘exceeds authorized access’ means to access a computer with authorization and to use such access to obtain or alter information in the computer that the access[o]r is not entitled so to obtain or alter " (emphasis added)).
In sum, there is no characteristic of this case that distinguishes it from Valle or Van Buren to such an extent that the Court is empowered to depart from those cases. The Court is thus bound to follow the narrow definition of "exceeding authorized access" those cases endorse.
Under that rubric, Speckman has failed to allege that defendants exceeded any authorization he gave them. On the contrary, he has affirmatively claimed that they were empowered to lock him out of the Google and GitHub accounts, he simply did not want them to. That is neither a crime nor a tort under the CFAA.
At oral argument, Speckman tried to drive home the injustice that would follow from this conclusion. To his mind, the Court's dismissal of his CFAA claim would be tantamount to sanctioning deplorable conduct and leaving him with no recourse to redress that conduct. But plaintiff is wrong. The only import of a holding that plaintiff has failed to allege a CFAA claim is that defendants’ conduct would not qualify as a federal felony or a federal tort. Plaintiff is welcome to continue to pursue his remaining claims in state court, even if his federal case falls.
Accordingly, defendants’ motion to dismiss must be granted, and Speckman's Count II CFAA claim must be dismissed with prejudice. See, e.g. , Associated Mortg. Bankers, Inc. v. Calcon Mut. Mortg. LLC , 159 F. Supp. 3d 324, 335-36 (E.D.N.Y. 2016) (dismissing § 1030(a)(4) claim for failure to plead exceeding authorization).
B. Plaintiff's State Law Claims
Speckman's complaint now stands without a single federal claim to support jurisdiction in this Court. A district court that has dismissed all federal claims in a case relying on federal question jurisdiction may decline to exercise supplemental jurisdiction over any lingering state law claims. 28 U.S.C. § 1367(c)(3). But first, that court must consider "the values of judicial economy, convenience, fairness, and comity" before making the choice to keep or dispose of the case. Kroshnyi v. U.S. Pack Courier Servs. , 771 F.3d 93, 102 (2d Cir. 2014) (internal citations and quotation marks omitted).
The DJA is also a federal statute, but it does not confer jurisdiction on federal courts on its own. Fleet Bank, Nat'l Ass'n v. Burke , 160 F.3d 883, 886 (2d Cir. 1998).
Those considerations point toward disclaiming jurisdiction in a healthy majority of cases. See Brzak v. United Nations , 597 F.3d 107, 113-14 (2d Cir. 2010) ("[I]f a plaintiff's federal claims are dismissed before trial, the state claims should be dismissed as well." (internal citations and quotation marks omitted)).
The Court sees no cause to depart from the standard rule. This month-old case is in its infancy, so the parties have not become too accustomed to its presence in federal court. Neither is fairness much of an issue. Defendants asked for the Court to decline supplemental jurisdiction over Speckman's state law claims, and Valle is six years old, so plaintiff should have known that there was a substantial likelihood that his federal claims would disappear. 807 F.3d 508. Accordingly, defendants’ motion to dismiss the amended complaint in its entirety must be granted.
In addition, for the reasons discussed above Speckman's showing for his CFAA claims is so powerfully antithetical to what a valid claim under that statute would look like that the Court sees no reason to grant him leave to amend. Plaintiff would effectively have to gin up entirely new claims based on an entirely distinct fact pattern to state a plausible CFAA claim. Amendment would therefore be futile, and plaintiff's request for leave to amend must therefore be denied. See Cuoco v. Moritsugu , 222 F.3d 99, 112 (2d Cir. 2000) (noting that where there is substantive defect in plaintiff's complaint, leave to amend would be futile and should be denied).
Obviously, then, plaintiff's motion for a preliminary injunction must be denied. The TRO established by this Court's May 25, 2021 order must also be dissolved. Dkt. 6.
V. CONCLUSION
Speckman hung his every hope for this case on his claim under the CFAA. If Van Buren had been decided otherwise, his broad definition of that statute might have been plausible and allowed his injunction to stand. 141 S. Ct. at 1655. Unfortunately for him, the Supreme Court took the opposite path and read that statute narrowly on the precise basis that plaintiff needed it to be broad. Id. In the absence of that one anchoring claim, plaintiff's complaint must be set adrift.
Therefore, it is
ORDERED that
1. Plaintiff Drew Austin Speckman's Motion for a Preliminary Injunction is DENIED;
2. The Temporary Restraining Order imposed on defendants in the Court's May 25, 2021 order is dissolved;
3. Defendants’ motion to dismiss is GRANTED;
4. Plaintiff Drew Austin Speckman's Count II claim under the CFAA is DISMISSED WITH PREJUDICE; and
5. The remainder of plaintiff Drew Austin Speckman's amended complaint is DISMISSED WITHOUT PREJUDICE.
IT IS SO ORDERED.