Court Opinion

ID: 4574072
Source: CourtListenerOpinion
Date Created: 2020-10-07 20:01:45.747053+00
Date Added: 2024-06-11T13:32:16.117538
License: Public Domain

UNITED STATES DISTRICT COURT
                                  FOR THE DISTRICT OF
                                       COLUMBIA

 NEW TOUCH DIGITAL INC,

                Plaintiff,
        v.
                                                           No. 20-cv-1878 (DLF)
 VICTOR CHRISTOPHER CABRAL,

                Defendant.

                         MEMORANDUM OPINION AND ORDER

       Before the Court is defendant Victor Cabral’s Motion to Dismiss, Dkt. 12. For the

reasons that follow, the Court will deny the motion.

       This case arises out of a dispute between New Touch Digital and its former Chief

Technology Officer, Victor Cabral. Compl. ¶ 1, Dkt. 1. While at New Touch Digital, Cabral

used his personal laptop for company-related work. Id. ¶ 22. After he resigned from his

position, he took important company data stored on the laptop with him. Id. ¶¶ 76–79. New

Touch Digital repeatedly asked Cabral to return the company’s intellectual property. Id. ¶¶ 79,

81, 85. However, Cabral did not turn over certain identification numbers and passwords.

Id. ¶¶ 78–80, 82–83. Instead, his counsel responded to New Touch Digital with the following:

“in response to your letter claiming [Cabral] tortuously retained Company property, he wiped

his personal laptop clean of any and all New Touch data, passwords, and other claimed

proprietary information.” Id. ¶¶ 86–87.

       New Touch Digital alleges that it has suffered substantial harm because of this

“wiping” of its data, including a significant delay in New Touch Digital’s clinical trials for one

of its products. Id. ¶ 91. Thus, New Touch Digital brought this suit alleging that Cabral
 violated the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, along with several

 state law claims. Compl. ¶ 1.

        Cabral has filed a motion to dismiss under Rule 12(b)(6) of the Federal Rules of Civil

Procedure, alleging that New Touch Digital failed to state a claim upon which relief can be

granted. Fed. R. Civ. P. 12(b)(6). To survive a Rule 12(b)(6) motion, a complaint must contain

factual matter sufficient to “state a claim to relief that is plausible on its face.” Bell Atl. Corp. v.

Twombly, 550 U.S. 544, 570 (2007). A facially plausible claim is one that “allows the court to

draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v.

Iqbal, 556 U.S. 662, 678 (2009). This standard does not amount to a specific probability

requirement, but it does require “more than a sheer possibility that a defendant has acted

unlawfully.” Id.; see also Twombly, 550 U.S. at 557 (“Factual allegations must be enough to raise

a right to relief above the speculative level.”). A complaint need not contain “detailed factual

allegations,” but alleging facts that are “merely consistent with a defendant’s liability . . . stops

short of the line between possibility and plausibility.” Iqbal, 556 U.S. at 678 (internal quotation

marks omitted).

        Well-pleaded factual allegations are “entitled to [an] assumption of truth,” id. at 679, and

the court construes the complaint “in favor of the plaintiff, who must be granted the benefit of all

inferences that can be derived from the facts alleged,” Hettinga v. United States, 677 F.3d 471, 476

(D.C. Cir. 2012) (internal quotation marks omitted). The assumption of truth does not apply,

however, to a “legal conclusion couched as a factual allegation.” Iqbal, 556 U.S. at 678 (quotation

marks omitted). An “unadorned, the defendant-unlawfully-harmed-me accusation” is not credited;

likewise, “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory

statements, do not suffice.” Id. Ultimately, “[d]etermining whether a complaint states a plausible

claim for relief [is] a context-specific task that requires the reviewing court to draw on its judicial

                                                    2
experience and common sense.” Id. at 679. When deciding a Rule 12(b)(6) motion, the court may

consider only the complaint itself, documents attached to the complaint, documents incorporated

by reference in the complaint, and judicially noticeable materials. EEOC v. St. Francis Xavier

Parochial Sch., 117 F.3d 621, 624 (D.C. Cir. 1997).

       New Touch Digital alleges that Cabral violated section 1030(a)(5)(A) of the CFAA, which

makes it unlawful to “knowingly cause[] the transmission of a program, information, code, or

command, and as a result of such conduct, intentionally cause[] damage without authorization, to a

protected computer.” 18 U.S.C. § 1030(a)(5)(A). “The CFAA is a criminal statute; however,

subsection (g) of the statute provides a civil cause of action to any person who suffers damage or

loss by reason of a violation’ of the CFAA.” Lewis-Burke Assocs., LLC v. Widder, 725 F. Supp.

2d 187, 191 (D.D.C. 2010) (internal quotation marks omitted). The term “protected computer” is

defined in the statute as “a computer” “which is used in or affecting interstate commerce or

communication.” 18 U.S.C. § 1030(e)(2)(B). Courts have agreed that “effectively all computers

with Internet access” constitute “protected computers” under this broad definition. See, e.g.,

United States v. Nosal, 676 F.3d 854, 859 (9th Cir. 2012) (en banc); United States v. Yücel, 97 F.

Supp. 3d 413, 418–19 (S.D.N.Y. 2015) (noting “widespread agreement in the case law on the

meaning of ‘protected computer’”); Hedgeye Risk Mgmt., LLC v. Heldman, 271 F. Supp. 3d 181,

192 (D.D.C. 2017) (same). The term “damage” means “any impairment to the integrity or

availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8).

        Cabral’s primary argument is that the “purpose of the CFAA is to target hackers,”

 Def.’s Mot. to Dismiss at 5, Dkt. 5-1 (quoting Hedgeye, 271 F. Supp. 3d at 195), and that the

 circuits are split over what it means for an employee to access a computer without

 authorization or in excess of authorization. See Def.’s Mot. to Dismiss. It is true that the

 circuits are split on this interpretive question. Some courts hold that an employee’s

                                                  3
authorization to access a computer only extends so far as the employee acts according to the

interests of her employer. See Int’l Airport Ctrs., LLC v. Citrin, 440 F.3d 418, 420–421 (7th

Cir. 2006); see also Widder, 725 F. Supp. 2d at 191 (noting this line of cases). Meanwhile,

another line of cases takes a broader view of authorization to access, holding that the plain

language of the CFAA requires that when “an employer gives an employee permission to use

[a computer],” the employer is giving that “employee ‘authorization’ to access,” regardless of

whether the employee acts contrary to the employer’s interest. LVRC Holdings LLC v. Brekka,

581 F.3d 1127, 1133 (9th Cir. 2009).

       Yet this circuit split on the meaning of authorized access under CFAA § 1030(a)(2) and

(a)(4) is inapposite because New Touch Digital did not bring a suit under either of those

statutory provisions. Rather, its federal claim centers solely on § 1030(a)(5)(A)—an entirely

different provision. This distinction is important because while the other sub-sections make it

unlawful simply to access a computer without authorization, section (a)(5)(A) does not.

Instead, section (a)(5)(A) makes it unlawful to “intentionally cause[] damage without

authorization.” Id. It has nothing to do with mere access. For this reason, any debate amongst

the circuits over the meaning of authority to access a computer is not relevant. The relevant

question is not whether Cabral had authorization to access his personal computer with company

data on it, but whether he had authorization to damage it—defined by the statute as causing

“impairment to the integrity or availability of data.” Id. § 1030(e)(8). Thus, although courts in

this district have ruled along with the Brekka line of cases, see, e.g., Widder, 725 F. Supp. 2d at

194, defining authorization to access broadly, these cases concern a different question than the

one currently before the Court and, as a result, provide no basis to dismiss the complaint.

       As to the supposed purpose of the CFAA, courts have held that the CFAA protects

against both “attacks by virus and worm writers, on the one hand, which come mainly from the

                                                 4
outside, and attacks by disgruntled programmers who decide to trash the employer’s data

system on the way out (or threaten to do so in order to extort payments), on the other.” Citrin,

440 F.3d at 420. In any case, broad overtures to statutory purpose cannot narrow the CFAA’s

plain text.

        Alternatively, Cabral argues that New Touch Digital has not adequately pled that it

suffered a legal loss under the CFAA. See 18 U.S.C. § 1030(e)(11). Legal loss is defined as

“any reasonable cost to any victim, including the cost of responding to an offense, conducting a

damage assessment, and restoring the data, program, system, or information to its condition

prior to the offense, and any revenue lost, cost incurred, or other consequential damages

incurred because of interruption of service.” Id. New Touch Digital has adequately pled legal

loss to survive a motion to dismiss. The complaint states that New Touch Digital “has suffered

and will continue to suffer damages in the form of lost profits relating to the delay in clinical

trials, delay in FDA approval, and delay in NTD’s ability to bring, to market, NTD’s mobile

health and data analytics platform, and monetary damages for the costs and expenses incurred

by NTD in replicating and replacing the passwords, code, and other intellectual property that

Cabral failed and refused to return to NTD, and that he eventually destroyed by ‘wiping’ his

computer clean of that intellectual property.” Compl. ¶ 107. This resulted in damages “over a

one-year period, aggregating well in excess of $5,000.00.” Id. ¶ 105. To the extent that Cabral

raises potential factual disputes as to whether New Touch Digital indeed suffered that damage,

see Def.’s Mot. to Dismiss at 6–8, those disputes are properly considered at a later stage of this

litigation.

                                                 5
        Accordingly, it is

        ORDERED that the defendant’s Motion to Dismiss, Dkt. 12, is DENIED.

                                                      ________________________
                                                      DABNEY L. FRIEDRICH
October 7, 2020                                       United States District Judge

                                            6