Source: http://va.findacase.com/research/wfrmDocViewer.aspx/xq/fac.20190306_0000469.C04.htm/qx
Timestamp: 2019-08-22 20:23:58
Document Index: 369559724

Matched Legal Cases: ['§ 1030', '§ 2701', '§ 18', '§ 2510', '§ 18', '§ 18']

FindACase™ | Hately v. Watts
Hately v. Watts
PATRICK HATELY, an individual, Plaintiff - Appellant,
DR. DAVID WATTS, an individual, Defendant-Appellee. THE CENTER FOR DEMOCRACY & TECHNOLOGY; THE ELECTRONIC FRONTIER FOUNDATION; NEW AMERICA'S OPEN TECHNOLOGY INSTITUTE, Amici Supporting Appellant, DIGITAL JUSTICE FOUNDATION, Amicus Supporting Appellee.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Anthony J. Trenga, District Judge. (1:17-cv-00502-AJT-JFA)
Eric James Menhart, LEXERO LAW, Washington, D.C., for Appellant.
Jonathan David Frieden, ODIN, FELDMAN & PITTLEMAN, P.C., Reston, Virginia, for Appellee.
James P. Miller, ODIN, FELDMAN & PITTLEMAN, P.C., Reston, Virginia, for Appellee.
Marta F. Belcher, James R. Batchelder, Monica A. Ortel, James H. Rickard, East Palo Alto, California, Evan Gourvitz, Lance W. Shapiro, New York, New York, Kathryn C. Thornton, ROPES & GRAY LLP, Washington, D.C.; Gregory T. Nojeim, CENTER FOR DEMOCRACY & TECHNOLOGY, Washington, D.C.; Andrew Crocker, ELECTRONIC FRONTIER FOUNDATION, San Francisco, California; Kevin Bankston, NEW AMERICA'S OPEN TECHNOLOGY INSTITUTE, Washington, D.C., for Amici The Center for Democracy & Technology, The Electronic Frontier Foundation, and New America's Open Technology Institute. Andrew Grimm, DIGITAL JUSTICE FOUNDATION, Omaha, Nebraska, for Amicus The Digital Justice Foundation.
Before GREGORY, Chief Judge, MOTZ and WYNN, Circuit Judges.
Patrick Hately brought this action alleging that David Watts unlawfully accessed messages in Hately's web-based email account in violation of the Virginia Computer Crimes Act and the federal Stored Communications Act. But the district court found that Hately failed to demonstrate the requisite statutory injury under state law, and that Hately's previously opened and delivered emails stored by a web-based email service were not in statutorily protected "electronic storage" under federal law. We disagree with both determinations and therefore reverse and remand this case to the district court for further proceedings consistent with this opinion.
In August 2008, Hately enrolled at Blue Ridge Community College ("Blue Ridge College"), a constituent institution of the Virginia Community College System. At Blue Ridge College, Hately had a student email account that he continued to use after he graduated in 2013.
Blue Ridge College uses a web-based email client with branding specific for Blue Ridge College. Google hosts all emails.[1] Account holders can access the copies stored on their web-based email page as long as the student does not delete those copies. Blue Ridge College also stores at least one additional copy of all student emails, which can be used to recover any email that is accidentally deleted. Students may access these stored copies only by requesting them from Blue Ridge College's technical support personnel.
From August 2011 to February 2015, Hately had an intimate relationship with Nicole Torrenzano ("Nicole"), with whom Hately has two children. During their relationship, Hately and Nicole shared login and password information for their email accounts-including Hately's Blue Ridge College email account. But when, about March 2015, Nicole informed Hately that she also was involved in an intimate relationship with Watts, who was her co-worker and married to Audrey Hallinan Watts ("Audrey"), Hately and Nicole separated. Pertinent to this action, Hately did not change the password that he shared with Nicole for his Blue Ridge College email account.
Watts and Nicole continued their personal relationship, and during the fall of 2015, Watts and Audrey initiated divorce proceedings. In an effort to help Watts in his divorce proceedings, Nicole told Watts that Hately and Audrey were having an affair. Nicole said she knew of emails between Hately and Audrey that Watts could obtain by using the password that she had to Hately's Blue Ridge College email account.
Watts stated that he used the password Nicole gave him to browse through Hately's emails but contended that he "did not open or view any email that was unopened, marked as unread, previously deleted, or in the [student email account]'s 'trash' folder." J.A. 506. Watts also said that he did not "change the status of, or modify, any email in any way." Id.
In September 2016, Hately filed his first lawsuit against Watts and Nicole in the United States District Court for the Eastern District of Virginia ("Hately I"), alleging that they unlawfully accessed his email, in violation of: (1) the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030; (2) the federal Stored Communications Act, 18 U.S.C. § 2701, et seq.; and (3) the Virginia Computer Crimes Act, Va. Code Ann. § 18.2-152.1, et seq. Shortly after filing suit, Hately voluntarily dismissed his claims against Watts, without prejudice, and amended his complaint against Nicole. In his amended complaint, Hately alleged that he "incurred actual damages by the illicit access because [he] was forced to incur damages in time invested, software purchases to track and prevent future access, and more[.]" J.A. 39 ¶ 93. He further alleged that he had "incurred many hours of valuable time away from day-to-day responsibilities in attempting to determine the source of the computer breach." J.A. 37 ¶ 76.
In an order dated December 2, 2016, the district court in Hately I dismissed "without prejudice" Hately's Computer Fraud and Abuse Act and Virginia Computer Crimes Act claims against Nicole. The order provided no explanation as to why the court dismissed those claims. But in a subsequent opinion addressing a different issue, the court explained: "[a]lthough [Nicole] moved to dismiss the [Virginia Computer Crimes Act] Claims on multiple grounds, the Court dismissed the [Virginia Computer Crimes Act] Claims because [Hately] failed to sufficiently allege how he sustained any injury to person or property by reason of a violation of the [Virginia Computer Crimes Act]." Hately v. Torrenzano, No. 1:116-CV-01143 (GBL/MSN), 2017 WL 2274326, at *3 (E.D. Va. May 23, 2017). The district court did not dismiss Hately's Stored Communications Act claim.
On February 13, 2017, Hately moved to amend his complaint for a second time. This time, Hately sought to rename Watts as a defendant and to reinstate his Computer Fraud and Abuse Act and Virginia Computer Crimes Act claims against Nicole. The district court denied the motion solely on grounds that Hately's "attempt to amend the complaint would cause undue prejudice to [Nicole]." Hately v. Torrenzano, No. 1:16-CV-01143 (GBL/MSN), 2017 WL 1428712, at *1 (E.D. Va. Apr. 20, 2017). According to the court, amending the complaint "would certainly require the Court to reopen discovery for Watts" and would "change the nature of this litigation" by "add[ing claims] to what would otherwise be a narrow case involving a single cause of action under the Stored Communications Act[.]" Id. Hately did not appeal the Hately I court's denial of his motion to amend.
In April 2017, Hately refiled his action against Watts, again alleging that Watts unlawfully accessed his email, in violation of the Computer Fraud and Abuse Act, the Stored Communications Act, and the Virginia Computer Crimes Act.
Unlike his initial action against Watts, which was voluntarily dismissed without prejudice, Hately's refiled action supported his Virginia Computer Crimes Act claims by reciting additional factual allegations bearing on damages. Hately, 2017 WL 2274326, at *3. For example, whereas Hately's initial complaint alleged that Hately "incurred many hours of valuable time away from day-to-day responsibilities in attempting to determine the source of the computer breach," J.A. 37 ¶ 76, Hately's complaint in the refiled action provided greater detail as to the time he lost as a result of the breach, alleging that he "was forced to identify" and make "several calls to" Blue Ridge College's technical support personnel "in order to ascertain the individual(s) that owns the domain for his school-related email account, as well as the individual(s) that manages the exchange servers for his school-related email account." J.A. 165 ¶¶ 94-96. And Hately's refiled complaint alleged that he "review[ed]" "hundreds or thousands of email messages" and "restore[d]" "deleted but unread email messages" that "were previously unknown to [Hately]." J.A. 166 ¶¶ 97-98. Also, the refiled complaint alleged that Hately was "forced to download and run programs that scanned his mobile telephone for viruses." J.A. 170 ¶ 115.
After conducting a hearing on July 6, 2017, the district court dismissed the Virginia Computer Crimes Act claims against Watts for two independent reasons.[2] First, the court held that the Virginia Computer Crimes Act claims were barred by collateral estoppel. The court explained in an oral ruling that "[a]ll of the damages that [Hately] alleges in this [instant] action . . . were the subject of [a prior motion to dismiss in Hately I], and that issue was fully briefed and argued in open court in the prior proceedings." J.A. 377. Even though the Hately I court dismissed the Virginia Computer Crimes Act claims "without prejudice," the district court concluded that the previous dismissal had "finally determined" that Hately had not "sustained injury to person or property" under the Virginia Computer Crimes Act. J.A. 382. Accordingly, the district court held that Hately was "estopped from relitigating those injury claims." Id. Second, the district court concluded that, even if collateral estoppel did not apply, Hately failed to plausibly allege statutory injury, notwithstanding that Hately's new complaint included additional factual allegations bearing on injury. J.A. 383 (holding that Hately had "not alleged facts that make plausible his claim that he has sustained injury to person or property as those terms have been construed under the [Virginia Computer Crimes Act]").
Thereafter, in January 2018, Hately and Watts filed cross-motions for summary judgment on the remaining Stored Communications Act claim. In an order entered March 14, 2018, the district court denied Hately's motion, granted Watts' motion, and dismissed the case. In an accompanying opinion, the court held that "previously opened and delivered emails" stored "in a web-based email client" were not in protected "electronic storage" for purposes of the Stored Communications Act. Hately v. Watts, 309 F.Supp.3d 407, 408, 410-14 (E.D. Va. 2018). According to the court, the statutory definition of "electronic storage" "covers emails only up to the point where the emails have been initially transmitted to their recipient and read or initially downloaded." Id. at 410.
The district court also held that Hately's emails were not protected under the statute because they were not stored by an "electronic communication service" and were not stored "for purposes of backup protection." Id. at 412-413 (quoting 18 U.S.C. § 2510(17)(B)). According to the court, Blue Ridge College was acting, for purposes of the Stored Communications Act, as a "remote computing service"-not as an "electronic communication service"-because the emails Watts accessed were "service copies" maintained by Blue Ridge College "for the purposes of transmitting them to a single user's account upon that user's command." Id. at 413. Furthermore, the emails were not stored for purposes of backup protection because, the court maintained, they were stored for Hately's backup purposes rather than Blue Ridge College's "own backup or administrative purposes." Id. Because Hately's accessed emails were not protected "electronic storage," Watts was entitled to judgment as a matter of law on the Stored Communications Act claim. Id.
Hately timely appealed the dismissal of his Virginia Computer Crimes Act claims and the grant of summary judgment on the Stored Communications Act claim. We address each claim in turn.
Regarding the district court's dismissal of his Virginia Computer Crimes Act claims, Hately contends that the district court's error was twofold. First, that the court improperly applied the doctrine of collateral estoppel, also referred to as "issue preclusion," to bar reconsideration of whether he adequately alleged that his "property or person [was] injured" within the meaning of the Virginia Computer Crimes Act. See Va. Code Ann. § 18.2-152.12(A). And second, that the court incorrectly determined that he failed to plausibly allege injury to person or property within the meaning of the Virginia Computer Crimes Act. We agree, and therefore conclude that the district court erred in dismissing Hately's Virginia Computer Crimes Act claims.
The district court applied the doctrine of issue preclusion to bar reconsideration of whether Hately's complaint adequately alleged his "property or person [was] injured" within the meaning of the Virginia Computer Crimes Act. Va. Code Ann. § 18.2-152.12(A). Issue preclusion bars "successive litigation of an issue of fact or law actually litigated and resolved in a valid court determination essential to the prior judgment, even if the issue recurs in the context of a different claim." Taylor v. Sturgell, 553 U.S. 880, 892 (2008) (citation and alterations omitted); see also Angstadt v. Atlantic Mut. Ins. Co., 457 S.E.2d 86, 87 (Va. 1995) ("The doctrine of collateral estoppel precludes parties to a prior action and their privies from litigating in a subsequent action any factual issue that actually was litigated and essential to a valid, final judgment in the prior action."). We review the application of issue preclusion de novo. United States v. Fiel, 35 F.3d 997, 1005 (4th Cir. 1994).
To determine whether the district court properly applied issue preclusion, we must determine which jurisdiction's preclusion law governs. See Semtek Int'l v. Lockheed Martin Corp., 531 U.S. 497, 506-09 (2001) (citing, among others, Erie R. Co. v. Tompkins, 304 U.S. 64, 78-80 (1938)). Neither the Supreme Court nor this Court has ever addressed what law governs the issue-preclusive effect of a federal court disposition of a state law claim rendered in a case in which the federal court exercised supplemental jurisdiction over the state law claim. However, in Semtek International v. Lockheed Martin, the Supreme Court held that when a federal court exercises diversity jurisdiction over a state law claim, "federal common law governs the claim-preclusive effect of a dismissal" of the state law claim by the federal court. 531 U.S. at 508. The federal preclusion rule in such cases is to apply "the law that would be applied by state courts in the State in which the federal diversity court sits" as long as the state rule is not "incompatible with federal interests." Id. at 508-09 (citations omitted). Federal courts apply state preclusion law because "there is no need for a uniform federal rule" in a state-law cause of action, the Court explained. Id. Indeed, an alternative federal rule would "produce the sort of forum shopping and inequitable administration of the laws that Erie seeks to avoid, since filing in, or removing to, federal court would be encouraged by the divergent effects that litigants would anticipate from likely grounds of dismissal." Id. (internal quotations and citations omitted).
These justifications are equally persuasive in cases in which federal courts exercise supplemental, as opposed to diversity, jurisdiction over state law claims. Accordingly, we hold that when a federal court exercises supplemental jurisdiction over a state law claim, federal common law governs the preclusive effect of the federal court's disposition of that claim. Cf. id. The federal rule of decision in such cases is to apply state preclusion law, unless the state preclusion law is incompatible with federal interests. Cf. id.; accord Access 4 All Inc. v. Trump Int'l Hotel & Tower Condo., No. 04-CV-7497KMK, 2007 WL 633951, at *3 (S.D.N.Y. Feb. 26, 2007).
Here, we discern no reason why Virginia preclusion law is incompatible with federal interests. Applying state preclusion law here would not undermine "federal courts' interest in the integrity of their own processes." See Semtek Int'l., 531 U.S. at 509 (providing, as an example, that a state's failure to estop "willful violation[s] of discovery orders . . . might justify a contrary federal rule"). On the contrary, applying Virginia preclusion law furthers the "federalism principle of Erie" by ensuring there are not "substantial variations in outcomes between state and federal litigation which would likely influence the choice of a forum." Id. at 504 (internal quotations and alterations omitted); see also Q Int'l Courier Inc. v. Smoak, 441 F.3d 214, 218, 218 n.1 (4th Cir. 2006) (finding Virginia's claim preclusion law was "not incompatible with any federal interest" when state law would bar the plaintiff from relitigating a "common core of operative facts").
We thus apply Virginia preclusion law to determine whether the doctrine of issue preclusion barred Hately from litigating the adequacy of his allegations as to damages in his new complaint. Under Virginia law, a party asserting defensive issue preclusion has "the burden of proving that the claim or question had been in issue and determined in [a] prior . . . action." Scales v. Lewis, 541 S.E.2d 899, 901 (Va. 2001). Specifically, the proponent of issue preclusion must demonstrate that: "(1) the parties to the two proceedings, or their privies, be the same; (2) the factual issue[3] sought to be litigated must have been actually litigated in the prior action and must have been essential to the prior judgment; and (3) the prior action must have resulted in a valid, final judgment against the party sought to be precluded in the present action." Weinberger v. Tucker, 510 F.3d 486, 491 (4th Cir. 2007) (citing TransDulles Ctr., Inc. v. Sharma, 472 S.E.2d 274, 275 (Va. 1996)). Also, "in Virginia, [issue preclusion] requires a fourth element, mutuality." Id. (citing TransDulles Ctr., 472 S.E.2d at 275).
As under federal preclusion law, Virginia applies the doctrine of issue preclusion only when the decided issue is "essential to the prior judgment." See TransDulles Ctr., 472 S.E.2d at 275. Thus, when, as here, issue preclusion is "considered in the context of two separate litigations[, ] if a judgment in the prior case is supported by either of two findings, neither finding can be found essential to the judgment." In re Microsoft Corp. Antitrust Litig., 355 F.3d 322, 328 (4th Cir. 2004); see Scales, 541 S.E.2d at 901; cf. Reid v. Ayscue, 436 S.E.2d 439, 441 (Va. 1993) (holding that issue preclusion was appropriate when there was only one "rational interpretation" of a prior jury verdict).
Although the Hately I dismissal order did not explain why Hately's Virginia Computer Crimes Act claims were dismissed, the court later elaborated that Hately had "failed to sufficiently allege how he sustained any injury to person or property by reason of a violation of the Virginia Computer Crimes Act." Hately, 2017 WL 2274326, at *3. In rendering its oral ruling on issue preclusion, the district court in the instant case appears to have read this sentence as a determination that the three "categories" of damages Hately alleged-(1) "expenses incurred in connection with evaluating the defendant's alleged wrongful conduct," (2) expenses incurred in "reporting the alleged hacking to law enforcement," and (3) the cost of time spent "reviewing records, restoring e-mails, and researching and implementing security enhancements"-were not, as a matter of law, actionable under the Virginia Computer Crimes Act. See J.A. 375-77 (holding that in his current "complaint, [Hately] alleged damages that fall within the three categories of damages" he set forth in his first action).
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;But the Hately I court&#39;s explanation for its decision to dismiss the Virginia Computer Crimes Act claims is as-if not more-plausibly read as holding not that the three "categories" of damages alleged were not actionable under the Virginia Computer Crimes Act, but rather, in the court&#39;s own words, that Hately&#39;s complaint failed to include "sufficien[t]," nonconclusory factual allegations establishing such damages to satisfy the requirements of Federal Rule of Civil Procedure 12(b)(6). Hately, 2017 WL 2274326, at *3; see also Aziz v. Alcolac, Inc., 658 F.3d 388, 391 (4th Cir. 2011) ("[S]tatements of bare legal conclusions are not entitled to the assumption of truth and are insufficient to state a claim[.]"). That this Court has held that the "categories" of damages Hately alleged in his previous complaint are actionable under the Virginia Computer Crimes Act, see infra Part II.B, supports this reading of the Hately I court&#39;s order, as we presume that the district court correctly applied this Court&#39;s precedent. Accordingly, at a minimum, it is unclear whether the Hately I court dismissed the prior action ...