Opinion ID: 4076467
Heading Depth: 4
Heading Rank: 1

Heading: Evidence of Unlawful Activity

Text: The first method TLI used to hack into its clients’ Avaya systems was hiring former Avaya employee Dave Creswick to crack logins and passwords. Creswick knew that TLI needed the passwords “[t]o do their maintenance” in competition with Avaya. (J.A. 2277.) He would hack into systems and activate MSPs on TLI’s clients’ systems, and he also activated DADMIN login access several times. The evidence introduced at trial of the Creswick hacking scheme was copious, and came mostly from the testimony of TLI executives themselves. Chief Technology Officer Scott Graham acknowledged that TLI paid Creswick to “enable some logins and MSPs” (J.A. 2292) and that it 26 began paying Creswick for this service while TLI was still under contract as an Avaya Business Partner. CEO Douglas Graham acknowledged using Creswick as an “ex-Avaya employee [to] create a new password for the system[s].” (J.A. 2747.) Avaya introduced an email in which Douglas Graham offered Creswick “a flat rate of $300 a password for single situations and $200 a password if you do more [than] one password at a time.” (J.A. 6117.) In another email, Creswick bragged to Douglas Graham that “there has not been [an Avaya PBX] system created that I cannot get into.” (J.A. 6059.) TLI eventually developed additional means to access Avaya PBXs, and by 2008, it had begun to “read [] passwords” for itself, using a method similar to (but simpler than) Creswick’s. (J.A. 2361.) TLI also hacked Avaya systems by hiring another former Avaya employee, Harold Hall, who used software “provided by Avaya” during his time as an Avaya employee to “beat” Avaya’s security systems. (J.A. 2293). Hall had taken the software, called an “ASG key,” with him when he left Avaya’s employment. He acknowledged at trial that he did not receive permission from Avaya to do so. Scott Graham admitted that Hall’s method was necessary to overcome “an additional security method that was implemented by Avaya on certain releases of the ... PBX software.” (J.A. 2365.) He conceded that he knew “Hall had [software] provided to him by Avaya” and that he “believe[d] [Hall] used it through most of his career at Avaya” before using that software “subsequently as a contractor.” (J.A. 2366.) In his own testimony, Hall estimated that he had used the ASG key for TLI “40 [to] 60” times. (J.A. 3057.) 27
Requests The second way that TLI gained access to Avaya’s PBX systems was to cajole Avaya Business Partners into submitting deceptive requests for login access. As Scott Graham characterized it, TLI would “work[] with several Business Partners” to have them “submit[] a DADMIN form at the customer’s request” – but, unbeknownst to Avaya, TLI would be the ultimate user. (J.A. 2293.) Graham acknowledged that, if Avaya had known that TLI was behind the request, it would not have enabled the DADMINs because Avaya was “doing everything [it] could to put [TLI] out of the maintenance business.” (J.A. 2338.) Therefore, as Graham put it, the submissions “did not identify [TLI] on there” and “did not have [TLI’s] name on there to identify to Avaya that [the customer] was also a customer of [TLI’s].” (J.A. 2338.) In response to an interrogatory, TLI identified seven Business Partners who cooperated in the scheme to send access requests “that resulted in the activation of DADMIN logins” that were used by TLI. (J.A. 3041.)
Knowledge Gained As Avaya Business Partner TLI’s third method for surreptitiously gaining access to Avaya systems was to rely on proprietary information learned when it was under contract as an Avaya Business Partner. Scott Graham testified that “108 locations or about 8 percent” of the PBX systems that TLI serviced “were systems for which TLI provided maintenance using a login that it had obtained from Avaya when TLI was a Business Partner.” 28 (J.A. 2423.) An additional “17 percent” of TLI’s maintenance business was for “systems that were ... using a default login or password.” (J.A. 2424.) TLI “did indeed learn of [those default passwords] during the time that [TLI was] a Business Partner.” (J.A. 2332.)
Wrongful Conduct Avaya also presented evidence that TLI knew that Avaya considered maintenance access to be proprietary and that TLI deliberately acted in secret to gain system access, from which a jury could infer malice or bad faith. Scott Graham admitted in his testimony that TLI “hid [its] activities from Avaya” and that the information about how TLI gained access was “carefully guarded” when dealing with customers – though he denied providing customers with affirmatively false information. (J.A. 2293-94.) TLI actually went to great lengths to conceal its activities from Avaya. Scott Graham acknowledged that if Avaya knew that TLI was behind the vicarious DADMIN login requests, it would not have provided them. Accordingly, TLI would have customers sign blank request forms and would not disclose to them the identity of the Business Partner that would actually submit the form, because “if the Business Partner was identified to the customer, that could get back to Avaya.” (J.A. 2345.) TLI believed (no doubt rightly) that if Avaya learned of that practice, it would have intervened to stop the unauthorized access. As for the hacking schemes, Douglas Graham acknowledged that “it was very important to [TLI] that Avaya 29 didn’t know about Mr. Creswick.” (J.A. 2748.) In an email, Graham wrote that one way TLI got “access to [Avaya] systems” was “having an ex-Avaya employee create a new password for the system,” and he suggested that “[i]f [Avaya] knew of” the manner in which TLI was getting access, it “would probably be raising it” in litigation. (J.A. 6363-64.) TLI executive Bruce Shelby testified that TLI would make customers sign non-disclosure agreements before revealing who its subcontractors were, for fear that Avaya would find out and “put pressure on all the Business Partners that were on our subcontractor list not to work with us.” (J.A. 2986.) He also testified that TLI did not want Avaya “to find out ... how TLI was gaining access to the on-demand maintenance commands.” (J.A. 2997-98.) Testimony also established that TLI acted to obfuscate its practices when dealing with its own customers. For example, when Avaya changed its customer contract language regarding DADMIN access, Scott Graham sent an email to TLI leadership suggesting a tactic to conceal the firm’s methods: In light of Avaya’s recent changes in contract language regarding [DADMIN] specifically, we want to eliminate that word from our vocabulary when talking to customers. When we refer to logins - we want to simply refer to them as “service logins[.”] ... Obviously, some customers will ask pointed enough questions, that we will need to 30 be more descriptive, but as a default we want to change our message. (J.A. 5817.) The obfuscation apparently worked; in fact, two of TLI’s customers testified that they did not know that TLI was not an authorized maintenance provider when they hired the firm. TLI also took preemptive actions to prevent Avaya from interrupting its activities. According to Scott Graham’s testimony, TLI knew that the MSPs were licensed by Avaya to each customer and that the licenses “all implied” that “Avaya could shut [the MSPs] off” at the end of a customer’s contractual relationship with Avaya. (J.A. 2382.) Therefore, as Douglas Graham put it in an email, TLI would “tak[e] over the system” of a customer it had successfully solicited, “before Avaya ha[d] time to turn the [MSPs] off, or change the passwords,” which was “simply done by disconnecting the phone line that links Avaya to the customer’s system.” (J.A. 6363.) Similarly, Harold Hall testified that he would access the Avaya systems using the DADMIN logins he had cracked with the software he had walked away with when he quit Avaya, and then he would change the DADMIN password. He testified that the practice was a “routine thing” that TLI did, and that it ensured that “nobody other than [TLI could] access that [system] using the DADMIN login.” (J.A. 3055.) One TLI employee testified that she was instructed to tell customers who were cancelling a contract with Avaya to “change the line that they had in place” and to “change a password,” all “so that Avaya couldn’t access the system.” (J.A. 2463.) 31