Opinion ID: 2816279
Heading Depth: 1
Heading Rank: 3

Heading: Counts 3 and 4: SCA and MCTA Claims

Text: We next address Anzaldua’s argument that it was error for the district court to deny him leave to amend his SCA claims. Anzaldua alleged in his proposed first amended complaint that Chief Farwell and Welge, acting together or alone, accessed his Gmail account through Gmail’s server and: (1) obtained the email Anzaldua had prepared but not sent to Dr. Tan, which at the time was stored on Gmail’s server as a draft message, and sent the email to Dr. Tan; and (2) obtained the email Anzaldua had sent to Holland, which at the time was stored on Gmail’s server as a sent message, and forwarded the email to Chief Farwell. Anzaldua further alleged Chief Farwell and Welge deleted the Dr. Tan and Holland emails after they sent them. Anzaldua alleged he believed Chief Farwell and Welge accessed his Gmail account because he traced access of the account to an IP address at or near Chief Farwell’s restaurant, where Welge worked. Anzaldua further explained how Chief Farwell and Welge allegedly accessed his account: -22- While Defendant Welge and Anzaldua were in a romantic relationship, on one occasion prior to the termination of that relationship, Anzaldua gave Defendant Welge his Gmail password so that she could email his resume on his behalf to prospective employers. Anzaldua did not give Defendant Welge general permission to access his personal Gmail account and did not realize she had continued to access his personal Gmail account until he investigated how his personal emails were being provided to the Fire District. [Anzaldua] and Defendant Welge’s romantic relationship ended in July of 2011 and Anzaldua did not know, nor did he authorize Defendant Welge to access his personal Gmail account at any time before or after that relationship ended, except to send the resumes on his behalf as set forth above. First Amended Complaint, R. Doc. 29-1, at ¶ 50. Finding Anzaldua’s proposed first amended complaint failed to state an SCA claim, the district court denied leave to amend on the ground that amendment would be futile. See United States ex rel. Roop v. Hypoguard USA, Inc., 559 F.3d 818, 822 (8th Cir. 2009) (“Futility is a valid basis for denying leave to amend.”). The district court reasoned that “the alleged improper use of [Anzaldua’s] information was not a SCA violation, because [Anzaldua] gave Welge access to his Gmail account.” R. Doc. 49, at 19. On appeal, Anzaldua argues he sufficiently alleged unauthorized access of his Gmail account. Although we agree with Anzaldua that his proposed first amended complaint sufficiently alleged unauthorized access, see Roop, 559 F.3d at 822 (stating that we review the district court’s futility determination de novo and its denial of leave to amend for abuse of discretion), we affirm the district court on the alternative ground that amendment would be futile because neither of Anzaldua’s emails was in “electronic storage” within the meaning of the SCA. See Interstate Bakeries Corp. v. OneBeacon Ins. Co., 686 F.3d 539, 542 (8th Cir. 2012) (“‘We may affirm the judgment of the district court on any basis disclosed in the record, whether or not the -23- district court agreed with or even addressed that ground.’” (internal quotation marks omitted) (quoting Warner Bros. Entm’t, Inc. v. X One X Prods., 644 F.3d 584, 591 (8th Cir. 2011))). The SCA provides a civil cause of action against anyone who “(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. § 2701; id. § 2707 (providing for civil cause of action). Contrary to the district court, we believe Anzaldua’s proposed first amended complaint sufficiently alleged that Chief Farwell’s and Welge’s access was without authorization or exceeded authorization. Taking Anzaldua’s allegations as true, Anzaldua gave Welge his password so she could access his Gmail account one time and for the limited purpose of sending resumes on his behalf. Given these facts, we conclude Chief Farwell and Welge at least exceeded the expressly limited authorization Anzaldua gave Welge when they accessed Anzaldua’s Gmail account over a year later for wholly different purposes. See Theofel v. Farey-Jones, 359 F.3d 1066, 1072 (9th Cir. 2004) (reasoning that principles of common law trespass guide scope of access under SCA); Restatement (Second) of Torts § 168 (1965) (“A conditional or restricted consent to enter land creates a privilege to do so only in so far as the condition or restriction is complied with.”); cf. Johnson v. U.S. Bancorp Broad-Based Change in Control Severance Pay Program, 424 F.3d 734, 740 (8th Cir. 2005) (interpreting employment contract that forbade unauthorized access and reasoning that “the district court’s determination that ‘Johnson was authorized to access the files,’ because ‘nothing prevented her access whatsoever,’ mistakenly equated ability to access a file with authorization to access the file”). This conclusion is supported by the fact that Chief Farwell and Welge deleted the Dr. Tan and Holland emails after they sent them, which suggests they knew they lacked authorization. -24- Even if Anzaldua sufficiently alleged unauthorized access, though, the SCA also required him to allege that the emails were in “electronic storage.” This he failed to do. See William Jeremy Robison, Note, Free at What Cost?: Cloud Computing Privacy Under the Stored Communications Act, 98 Geo. L.J. 1195, 1206 (2010) (“[The ‘electronic storage’] requirement is commonly misunderstood because the statutory definition of ‘electronic storage’ is much narrower than its name suggests.”); see also Orin S. Kerr, A User’s Guide to the Stored Communications Act, and A Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208, 1214 (2004) (“[T]here are many problems of Internet privacy that the SCA does not address. The SCA is not a catch-all statute designed to protect the privacy of stored Internet communications; instead it is narrowly tailored to provide a set of Fourth Amendment-like protections for computer networks.”). Under the statute, “electronic storage” means (1) “any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof,” or (2) “any storage of such communication by an electronic communication service for purposes of backup protection of such communication.” 18 U.S.C. § 2510(17).4 5 4 We recognize authorities are divided on whether these two definitional provisions must be read together or apart. Compare Jennings v. Jennings, 736 S.E.2d 242, 247-48 (S.C. 2012) (Toal, C.J., concurring in result) (together); with Theofel, 359 F.3d at 1075-76 (apart). Although we present the provisions in the disjunctive, in part because that is how the parties argued them, we express no opinion on this issue. 5 It is not always easy to square the decades-old SCA with the current state of email technology. One commentator has observed that the definition of “electronic storage” “is better understood in light of the e-mail delivery system in place at the time [of the SCA’s enactment in the mid-1980s], which required multiple service providers to store communications briefly before forwarding them on to their next destination or while awaiting download by the recipient.” Robison, Free at What Cost?, 98 Geo. L.J. at 1206. By contrast, today’s predominant web-based email services, like Gmail, allow users to “access their email over the web from any computer, and [users] do not automatically download their messages to their own -25- Anzaldua first claims his draft email to Dr. Tan was in “temporary, intermediate storage.” While this argument appeals to our everyday understanding of a “draft,” it fails to meet the statutory definition. Even assuming an unsent draft email qualifies as an electronic communication, see 28 U.S.C. § 2510(12) (“‘[E]lectronic communication’ means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part . . . .”) (emphasis added), because the email had not been sent, its storage on the Gmail server was not “temporary, intermediate,” and “incidental to the electronic transmission thereof.” 18 U.S.C. § 2510(17)(A); see United States v. Councilman, 418 F.3d 67, 81 (1st Cir. 2005) (en banc) (“The first category . . . refers to temporary storage, such as when a message sits in an e-mail user’s mailbox after transmission but before the user has retrieved the message from the mail server.”); In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d 497, 512 (S.D.N.Y. 2001) (“[The SCA] only protects electronic communications stored ‘for a limited time’ in the ‘middle’ of a transmission, i.e. when an electronic communication service temporarily stores a communication while waiting to deliver it.”). Anzaldua next claims his sent Holland email was stored “for purposes of backup protection.”6 Courts most often discuss the backup protection provision as computers as non-web-based email service users do. Instead, if [web-based] users save a message, they generally leave it on the [web-based email] server and return to [the email service] via the web to access it on subsequent occasions.” United States v. Weaver, 636 F. Supp. 2d 769, 772 (C.D. Ill. 2009) (citation omitted). Of course, web-based email users may still download emails to their computers through email client programs, which complicates the picture. See Cheng v. Romo, 2013 WL 6814691, at -5 (D. Mass. Dec. 20, 2013) (slip copy). 6 Anzaldua does not argue that his draft email was stored for backup protection purposes or that his sent email was in temporary, intermediate storage, and we note he did not allege the sent email was unopened when Chief Farwell and Welge allegedly obtained it. Thus we decline to consider these arguments. -26- it pertains to copies of opened emails that remain on email servers. A principal case in the area—and the case Anzaldua relies on—is Theofel, where the Ninth Circuit held that such copies would be deemed stored for backup protection purposes until “the underlying message . . . expired in the normal course” because “[a]n obvious purpose for storing a message on an [internet service provider’s (“ISP”)] server after delivery [from the server to the user] is to provide a second copy of the message in the event that the user needs to download it again—if, for example, the message is accidentally erased from the user’s own computer.” 359 F.3d at 1075-76. Although several courts have followed Theofel, see, e.g., Pure Power Boot Camp v. Warrior Fitness Boot Camp, 587 F. Supp. 2d 548, 555 (S.D.N.Y. 2008) (citing cases); Bailey v. Bailey, No 07-11672, 2008 WL 324156, at  (E.D. Mich. Feb. 6, 2008), the decision has been subject to criticism. See United States v. Warshak, 631 F.3d 266, 291 (6th Cir. 2010) (noting criticism); Kerr, A User’s Guide, 72 Geo. Wash. L Rev. at 1217 (“[T]he Ninth Circuit’s analysis in Theofel is quite implausible and hard to square with the statutory text.”).7 Some cases openly disagree with Theofel’s reasoning. See Lazette v. Kulmatycki, 949 F. Supp. 2d 748, 758 & n.13 (N.D. Ohio 2013) (“E-mails which an 7 Kerr further explained: “An understanding of the structure of the SCA indicates that the backup provision of the definition of electronic storage exists only to ensure that the government [or the defendants, as relevant here,] cannot make an end-run around the privacy-protecting [electronic communication service (“ECS”)] rules by attempting to access backup copies of unopened e-mails made by the ISP for its administrative purposes. ISPs regularly generate backup copies of their servers in the event of a server crash or other problem, and they often store these copies for the long term. Section 2510(17)(B) provides that backup copies of unopened e-mails are protected by the ECS rules even though they are not themselves incident to transmission; without this provision, copies of unopened e-mails generated by this universal ISP practice would be unprotected by the SCA.” Kerr, A User’s Guide, 72 Geo. Wash. L. Rev. at 1217 n.61 (citation omitted). -27- intended recipient has opened may, when not deleted, be ‘stored,’ in common parlance. But in light of the restriction of ‘storage’ in [the SCA] solely for ‘backup protection,’ e-mails which the intended recipient has opened, but not deleted (and thus which remain available for later re-opening) are not being kept ‘for the purposes of backup protection.’”); Jennings v. Jennings, 736 S.E.2d 242, 245 (S.C. 2012) (“We decline to hold that retaining an opened email constitutes storing it for backup protection under the [SCA]. The ordinary meaning of the word ‘backup’ is ‘one that serves as a substitute or support.’ Thus, Congress’s use of ‘backup’ necessarily presupposes the existence of another copy to which this e-mail would serve as a substitute or support. We see no reason to deviate from the plain, everyday meaning of the word ‘backup,’ and conclude that as the single copy of the communication, Jennings’ e-mails could not have been stored for backup protection.” (citation omitted) (quoting Merriam-Webster Dictionary, http://www.merriam-webster.com/dictionary/backup)). Other authorities dispute Theofel by insisting that the two definitional provisions in section 2510(17) be read together. See Jennings, 736 S.E.2d at 248 (Toal, C.J., concurring in result) (“[E]lectronic storage refers only to temporary storage, made in the course of transmission, by an [electronic service communication] provider, and to backups of such intermediate communications.”); Kerr, A User’s Guide, 72 Geo. Wash. L. Rev. at 1214 (“[The SCA] defines ‘electronic storage’ as ‘any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof,’ plus any backup copies of files in such temporary storage.” (footnote omitted) (quoting 18 U.S.C. § 2510(17))). Still other cases distinguish Theofel on the ground that it addressed non-web-based email technology: [Theofel] held that once a user receives an email, any version on the ISP’s server is a copy that is being stored for backup until the user’s -28- version expires in the normal course. [Theofel] relies on the assumption that users download emails from an ISP’s server to their own computers. That is how many email systems work, but a Hotmail account is web-based and remote. Hotmail users can access their email over the web from any computer, and they do not automatically download their messages to their own computers as non-web-based email service users do. Instead, if Hotmail users save a message, they generally leave it on the Hotmail server and return to Hotmail via the web to access it on subsequent occasions. The distinction between web-based email and other email systems makes Theofel largely inapplicable here. United States v. Weaver, 636 F. Supp. 2d 769, 772 (C.D. Ill. 2009) (internal quotation marks, citations, and footnote omitted); see also Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965, 984-85 (C.D. Cal. 2010) (acknowledging that Weaver and Theofel are not inconsistent because Weaver “confronted a situation not previously considered by” Theofel); but see Cheng v. Romo, 2013 WL 6814691, at  (D. Mass. Dec. 20, 2013) (slip copy) (noting that under Weaver’s reasoning a defendant’s legal liability for accessing a plaintiff’s emails “turn[s] on what piece of software (i.e., web browser vs. email client) [the plaintiff] happened to use to access his email account”); Jennings, 736 S.E.2d at 246-47 (Toal, C.J., concurring in result) (same). If we adopted the reasoning of any of the cases criticizing Theofel, we likely would not find that the Holland email was stored for backup protection purposes. Ultimately, however, we need not decide whether Theofel or one of its critics is correct because even if we adopted Theofel’s reasoning we still would conclude that the sent Holland email was not stored on the Gmail server for backup protection purposes. Theofel acknowledged “the mere fact that a copy could serve as a backup does not mean it is stored for that purpose.” 359 F.3d at 1076. Thus its holding relied on a functional distinction that tied “the lifespan of a backup . . . to that of the underlying message.” Id. And “[w]here the underlying message has expired in the normal course, any copy is no longer performing any backup function.” Id. -29- Here, Anzaldua simply alleged that his sent email remained on Gmail’s server as a matter of course. We hold that once Anzaldua successfully sent the email to Holland, as he alleged he did, the copy Gmail retained on its server as a sent message did not perform a backup function.8 See id. (“An [email service] that kept permanent copies of temporary messages could not fairly be described as ‘backing up’ those messages.”); see also Kerr, A User’s Guide, at 1218 (“Although it is unclear what ‘normal course’ the Ninth Circuit has in mind, the apparent test is whether the user or employees of the service provider have reason to believe that they may need to access an additional copy of the file in the future.”). If Theofel has any application here, it would be to protect a copy of the email stored with Holland’s email service, not Anzaldua’s. See Theofel, 359 F.3d at 1075 (stating that a backup copy would “provide a second copy of the message in the event that the user needs to download it again—if, for example, the message is accidentally erased from the user’s own computer”). Accordingly, neither the draft of the Dr. Tan email nor the sent Holland email falls within the protection afforded by the SCA.9
Finally, we address Anzaldua’s argument that it was error for the district court to deny him leave to amend his MCTA claims. In advancing these claims, Anzaldua’s proposed first amended complaint relied on the same factual allegations 8 Other provisions of the SCA, see 18 U.S.C. §§ 2702(a) and 2703(b), protect copies of emails held by remote computing services, which “provi[de] to the public . . . computer storage or processing services by means of an electronic communications system.” Id. § 2711(2). 9 Anzaldua argues the district court erred in dismissing his SCA claims in the original complaint. Because those claims suffer the same defect as the SCA claims in the proposed first amended complaint, there was no error. -30- as his SCA claims. He additionally alleged that he owned the Dr. Tan and Holland emails, that Chief Farwell and Welge took and disclosed the emails from a computer, computer system, or computer network, and that Chief Farwell and Welge received, retained, used, or disclosed the emails, which they knew or believed had been obtained in violation of the MCTA. As it did with Anzaldua’s SCA claims, the district court found amendment of Anzaldua’s MCTA claims would be futile because Anzaldua failed to allege unauthorized taking, disclosure, or use of the emails, as required by the MCTA. On appeal, Anzaldua argues he sufficiently alleged such unauthorized conduct. We agree. See Kingman v. Dillard’s, Inc., 643 F.3d 607, 615 (8th Cir. 2011) (“‘When determining the scope of Missouri law, we are bound by the decisions of the Supreme Court of Missouri. If the Supreme Court of Missouri has not addressed an issue, we must predict how the court would rule, and we follow decisions from the intermediate state courts when they are the best evidence of Missouri law.’” (quoting Eubank v. Kan. City Power & Light Co., 626 F.3d 424, 427 (8th Cir. 2010))). Under the MCTA, a person commits the crime of computer tampering if he “knowingly and without authorization or without reasonable grounds to believe that he has such authorization: . . . (3) Discloses or takes data . . . residing or existing internal or external to a computer, computer system, or computer network; or . . . (6) Receives, retains, uses, or discloses any data he knows or believes was obtained in violation of this subsection.” Mo. Rev. Stat. § 569.095. The statute provides a civil cause of action for “the owner . . . of the . . . data.” Id. § 537.525. Few cases discuss the MCTA, and the ones that do are not relevant here. Nevertheless, for the reasons provided in our discussion of Anzaldua’s SCA claims, we have no difficulty predicting that the Missouri Supreme Court would find that Anzaldua sufficiently alleged Chief Farwell and Welge acted “knowingly and without authorization or without reasonable grounds to believe that [they had] such -31- authorization.” We further find that Anzaldua’s proposed first amended complaint satisfies the other elements of the MCTA because Anzaldua alleged facts supporting that he owned the emails and that Chief Farwell and Welge took and later disclosed the emails, which they knew had been obtained without authorization. Accordingly, we find the district court erred in denying Anzaldua leave to amend his MCTA claims.10