DCR Marketing Inc. v. Pereira

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK DCR MARKETING INC. et al., Plaintiffs, 19-CV-3249 (JPO) -vOPINION AND ORDER JOSEPHINE LEE PEREIRA, Defendant. J. PAUL OETKEN, District Judge: In this case, two corporations seek recovery of funds transferred out of their bank accounts by Josephine Lee Pereira. Pereira, who was entrusted with online login credentials for all three accounts, allegedly used the access to change the login credentials and to redirect funds to her personal accounts. The corporations bring claims under both federal and state law. For the reasons that follow, the federal causes of action are dismissed for failure to state a claim. And the Court declines to exercise supplemental jurisdiction over the remaining state-law claims. Accordingly, the complaint is dismissed in its entirety. I. Background The following facts are taken from the operative complaint (Dkt. No. 21 (“Compl.”)) and are assumed true for purposes of this motion to dismiss. Plaintiffs DCR Strategies Legal Inc. and DCR Marketing Inc. (collectively, “DCR”) are both New York corporations that provide prepaid card services to merchants. (Compl. ¶¶ 1–2.) DCR formerly employed Defendant Josephine Lee Pereira, a resident of New York, as an attorney. (Compl. ¶ 3.) DCR maintained bank accounts with Citibank, Bank of America, and PNC Financial Services Group. (Compl. ¶¶ 14, 29, 40.) Pereira possessed online login credentials for all three bank accounts. (Compl. ¶¶ 16, 31, 42.) Between 2017 and 2019, Pereira changed the login credentials for all three accounts and transferred money from those accounts to her personal accounts. (Compl. ¶¶ 21, 34, 44.) She did so without authority or permission from DCR. (Compl. ¶¶ 22, 34, 44.) Across the three accounts, the transferred amounts totaled over $500,000. (Compl. ¶¶ 26, 38, 48.) DCR has commenced suit against Pereira, bringing claims under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 et seq. DCR also brings state-law claims for conversion. Finally, DCR seeks declaratory and injunctive relief. Pereira has moved to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). II. Legal Standard “A case is properly dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) when the district court lacks the statutory or constitutional power to adjudicate it.” Makarova v. United States, 201 F.3d 110, 113 (2d Cir. 2000). A court lacks federal-question jurisdiction under 28 U.S.C. § 1331 if the plaintiff has failed to plead a colorable claim arising under the Constitution or laws of the United States. A claim is not “colorable” if it is “immaterial and made solely for the purpose of obtaining jurisdiction” or “wholly insubstantial and frivolous.” Bell v. Hood, 327 U.S. 678 , 682–83 (1946). To withstand a motion to dismiss under Rule 12(b)(6), a plaintiff must plead sufficient factual allegations “to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is plausible if the well-pleaded factual allegations of the complaint, presumed true, permit the court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556 ). III. Discussion Pereira has moved to dismiss the CFAA claims both under Rule 12(b)(1) for lack of subject-matter jurisdiction and under Rule 12(b)(6) for failure to state a claim. And Pereira has urged this Court to decline to exercise supplemental jurisdiction over the state-law claims under 28 U.S.C. § 1367 (c)(3). Each ground for dismissal is discussed in turn. A. CFAA Claims 1. Lack of Subject-Matter Jurisdiction This Court’s jurisdiction over the CFAA claims is premised on 28 U.S.C. § 1331 . (Compl. ¶ 4.) As an initial matter, Pereira contends that DCR’s CFAA claims are so insubstantial that they fail to support federal-question jurisdiction. (Dkt. No. 19 at 2.) Specifically, Pereira argues that DCR has failed, as a matter of law, to plead two elements necessary to state a cause of action under the CFAA. (Dkt. No. 19 at 3–4.) Generally, however, “[w]hen a claim allegedly based on a federal statute must be dismissed because of the statute’s inapplicability to the facts alleged, . . . the dismissal is more accurately described as based on failure to state a claim upon which relief may be granted” rather than “as jurisdictional.” Schwartz v. Gordon, 761 F.2d 864 , 867 n.4 (2d Cir. 1985). If “the right of the petitioners to recover under their complaint [can] be sustained [under] one construction [of federal law] and . . . defeated [under] another,” then “the district court has jurisdiction.” Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 89 (1998). That is the case here. Accordingly, the Court does not lack subject-matter jurisdiction. 2. Failure to State a Claim The CFAA creates a private right of action for “[a]ny person who suffers damage or loss by reason of a violation of [the CFAA],” but “only if the conduct involves,” as relevant here, “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.” 18 U.S.C. § 1030 (c)(4)(A)(i)(I), (g). Pereira argues that DCR’s complaint is doubly defective, both because it fails to allege a “loss” and because it fails to allege a “violation” of the CFAA. a. “Loss” The CFAA glosses “loss” to mean “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030 (e)(11). Courts in this jurisdiction have construed “loss” narrowly, holding that “the types of costs which the CFAA allows recovery for [must be] related to fixing a computer.” Nexans Wires S.A. v. Sark-USA, Inc., 319 F. Supp. 2d 468, 475 (S.D.N.Y. 2004), aff’d, 166 F. App’x 559 (2d Cir. 2006).1 Here, the only “losses” alleged by DCR are the funds transferred by Pereira out of DCR’s bank accounts at Citibank, Bank of America, and PNC. (Dkt. No. 26 at 4–5.) Those funds are not cognizable “losses” under the CFAA. The transfers of those funds do not qualify as “remedial costs of investigating the computer for damage.” Nexans, 319 F. Supp. 2d at 474 . Nor do the transfers qualify as “remedial costs of . . . remedying the damage.” Id. Nor are they “costs incurred because the computer cannot function while or until repairs are made.” Id. 1 See also Garland-Sash v. Lewis, No. 5-CV-6827, 2011 WL 6188712 , at *4 (S.D.N.Y. Dec. 6, 2011) (“‘[L]oss’ under the CFAA means ‘any remedial costs of investigating the computer for damage, remedying the damage and any costs incurred because the computer cannot function while or until repairs are made.’” (quoting Nexans, 319 F. Supp. 2d at 474 )); Civic Ctr. Motors, Ltd. v. Mason St. Imp. Cars, Ltd., 387 F. Supp. 2d 378, 382 (S.D.N.Y. 2005) (“[C]osts not related to computer impairment or computer damages are not compensable under the CFAA.”); Tyco Int’l (US) Inc. v. John Does, No. 1-CV-3856, 2003 WL 21638205 , at *1 (S.D.N.Y. July 11, 2003) (“[T]he CFAA allows recovery for losses beyond mere physical damage to property, [but] the additional types of damages awarded by courts under the Act have generally been limited to those costs necessary to assess the damage caused to the plaintiff’s computer system or to resecure the system in the wake of a hacking attack.”). Accordingly, DCR has failed to plead a cognizable “loss,” which dooms its claim under the CFAA. b. “Exceeds Authorized Access” In addition to the requirement of a “loss,” the CFAA applies only if, as relevant here, the defendant “exceeds authorized access” to a computer. 18 U.S.C. § 1030 (a)(2). The Second Circuit has read this provision narrowly, holding that it applies only when a defendant “obtains or alters information that he does not have authorization to access for any purpose which is located on a computer that he is otherwise authorized to access.” United States v. Valle, 807 F.3d 508, 511 (2d Cir. 2015). Accordingly, “the CFAA does not apply to a so-called faithless or disloyal employee — that is, an employee who has been granted access to an employer’s computer and misuses that access, either by violating the terms of use or by breaching a duty of loyalty to the employer.” Fischkoff v. Iovance Biotherapeutics, Inc., 339 F. Supp. 3d 408, 419 (S.D.N.Y. 2018) (internal quotation marks omitted) (quoting Chefs Diet Acquisition Corp. v. Lean Chefs, LLC, 2016 WL 5416498 , at *6 (S.D.N.Y. Sept. 28, 2016)). In this case, DCR alleges that Pereira had authorization to access all three bank accounts at issue. (Compl. ¶¶ 16, 31, 42.) By modifying the login information for those bank accounts, then, Pereira did not “alter information that [s]he . . . [lacked] authorization to access for any purpose.” Valle, 807 F.3d at 511 . Accordingly, in light of Valle and subsequent case law, DCR’s complaint fails to state a claim under the CFAA. In response, DCR first argues that Pereira “exceed[ed] authorized access” because DCR “had no permission” from DCR to access the bank accounts and convert funds to her own use. (Dkt. No. 26 at 8.) That argument runs headlong into Valle, which precludes the extension of liability under the CFAA to disloyal employees. Fischkoff, 339 F. Supp. 3d at 419 . Under Valle, “[i]f an employer has given an employee access to the computer and to the relevant files, the employee’s subsequent misuse of the information or misappropriation . . . is not sufficient to violate the CFAA.” Apple Mortg. Corp. v. Barenblatt, 162 F. Supp. 3d 270, 286 (S.D.N.Y. 2016). DCR’s fallback position is to “[a]dmit[]” that “the Second Circuit has interpreted the language ‘exceeds authorized access’ narrowly in [Valle]” and to avow that, “[s]hould this Court determine it is bound by that precedent, DCR will seek en banc review before the Second Circuit.” (Dkt. No. 26 at 8 n.2.) This Court is — horresco referens — indeed bound by the decisions of the Second Circuit. That leaves en banc review as DCR’s only recourse. In the meantime, however, DCR’s CFAA claim is dismissed. B. State-Law Claims This Court’s jurisdiction over the remaining state-law claims is premised solely on 28 U.S.C. § 1367.2 Under § 1367, a district court “may decline to exercise supplemental jurisdiction” if — as here — “the district court has dismissed all claims over which it had original jurisdiction.” § 1367(c)(3). The Supreme Court has instructed that “in the usual case in which all federal-law claims are eliminated before trial, the balance of factors to be considered . . . will point toward declining to exercise jurisdiction over the remaining state-law claims.” Carnegie-Mellon Univ. v. Cohill, 484 U.S. 343 , 350 n.7 (1988). Thus, pursuant to § 1367(c)(3), the Court declines jurisdiction over the remaining state-law claims. 2 Jurisdiction under 28 U.S.C. § 1332 cannot lie because of the absence of diversity. (Compl. ¶¶ 1–3.) IV. Conclusion For the foregoing reasons, Defendant’s motion to dismiss is GRANTED. The federal claim under the CFAA is dismissed with prejudice. The state-law claims are dismissed without prejudice. The Clerk of Court is directed to close the motion at Docket Number 17 and to close this case. SO ORDERED. Dated: January 8, 2020 New York, New York United States District Judge