A.J. TRUCCO, INC. v. REDCELL CORP.

UNITED STATES DISTRICT COURT USDC SDNY SOUTHERN DISTRICT OF NEW YORK DOCUMENT AJ. TRUCCO. INC. ELECTRONICALLY FILED DOC #: Plaintiff, DATE FILED: _ 09/07/2023 _ -againstREDCELL CORP., and REDCELL SYSTEMS, 22 Civ. 7732 (AT) LLC, ORDER Defendants. ANALISA TORRES, District Judge: Plaintiff, A.J. Trucco, Inc. (“Trucco”), brings this action against Defendants Redcell Corp. and Redcell Systems, LLC (together, “Redcell”), alleging that Redcell unlawfully used confidential and proprietary data belonging to Trucco. Trucco asserts claims under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 (a)(2)(C); the New Jersey Computer Related Offenses Act (“NJCROA”), N.J.S.A. 2A:38A-3; and New Jersey state law. Compl., ECF No. 1. Defendants move to dismiss the complaint for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6). ECF No. 30. For the reasons stated below, Defendants’ motion is GRANTED. BACKGROUND 1. Factual Background! Trucco, a New York corporation, is an agricultural product wholesaler that imports branded and unbranded produce from around the world. Compl. § 14. Trucco’s principal place of business is New York, and it also operates a facility in New Jersey. Jd. Redcell is a “technology computer company that .. . develops computer software and provides [information ! The following facts are taken from the complaint and “are presumed to be true for purposes of considering a motion to dismiss for failure to state a claim.” Fin. Guar. Ins. Co. v. Putnam Advisory Co., 783 F.3d 395, 398 (2d Cir. 2015). technology (“IT”)] services.” Id. ¶ 15. Between 2008 and 2019, Redcell provided “software development, IT support maintenance, and logistic[s] services” to Trucco. Id. ¶¶ 4, 16. Redcell had “administrative access to Trucco’s systems and was instructed to install and maintain a backup system for Trucco’s data, which included specific folders containing sensitive financial and other sensitive information.” Id. ¶ 17. Trucco owned and used a server located in New York that contained its confidential and proprietary data and information. Id. ¶ 2. Redcell was a system administrator, and its access to Trucco’s server was, “by default, not limited.” Id. ¶ 23; see also id. ¶¶ 4, 39, 46. Although Redcell had access to an electronic folder that contained Trucco’s most sensitive business information (the “Exclusive Folder”), id. ¶¶ 21–23, Redcell was “never authorized, explicitly or implicitly, to view or copy this confidential information, only to make backup copies,” id. ¶ 18; see also id. ¶ 23. Trucco claims that the backup database “could not be simply accessed” but would have “to be specifically restored.” Id. ¶ 37. Toward the end of 2019, Trucco’s relationship with Redcell “began to sour.” Id. ¶ 24. In September 2019, Trucco’s president Nick Pacia “noticed that the administrative password had been changed, without his permission, by a Redcell contractor named Hector Castro.” Id. ¶ 25; see id. ¶ 22. Pacia also became aware of a program that was “automatically running on the server” and “making copies of folders on the server.” Id. ¶ 26. Trucco’s relationship with Redcell “ended” at the close of 2019. Id. ¶ 27. On January 3, 2020, Redcell commenced a federal action in this District against Trucco and Trucconova, LLC (the “Redcell Action”).2 Redcell Corp. v. A.J. Trucco, Inc., No. 20 Civ. 18 (S.D.N.Y) (the “Redcell Action”); Compl. ¶ 27.3 In the Redcell Action, Redcell alleged that, 2 Trucconova, LLC, is not a party in this case. 3 Except as otherwise noted, ECF citations refer to the docket in the present action, No. 22 Civ. 7732. — 2 — inter alia, “Trucco misappropriated Redcell’s trade secrets relating to certain logistics software.” Id. ¶ 27. Several weeks after the Redcell Action began, an independent contractor working for Trucco noticed that “a program called FileZilla continued to automatically run on [Trucco’s] server” and was making backup copies of folders from the server. Id. ¶ 29. The contractor “eventually” realized that the Exclusive Folder was one of the folders being copied. Id. Trucco then changed the administrative passwords and “began the process” of changing the passwords to other folders and programs run on the server. Id. ¶ 31. Trucco removed Redcell’s access to a system through which Redcell could remotely access Trucco’s server. Id. ¶ 33. Trucco changed its server to a cloud-based server, which became fully operational in May 2020. Id. ¶ 34. During discovery in the Redcell Action, Trucco learned that Redcell had “accessed Trucco’s confidential and proprietary data and trade secrets stored in ‘the Cloud.’” Id. ¶ 41. Redcell’s president Helder Molina testified that Redcell had accessed more than 10,000 documents belonging to Trucco and still had the “backup copy and access to codes to retrieve such data.” Id. According to Trucco, Redcell’s litigation expert had reviewed “what appeared to be documents [from] 2020 and 2021.” Id. ¶ 44. In addition, Redcell’s counsel referred to a “joint database” generated during the companies’ relationship. Id. ¶ 36. Trucco understood this to be the backup copy that Redcell maintained. Id. ¶ 37. Trucco had authorized Redcell to make the backup copy but not to copy or access the files. Id. ¶ 46. Trucco states that, as a result of Redcell’s actions, Trucco “had to completely overhaul its data storage system.” Id. ¶ 48. II. Procedural Background A. The Redcell Action On May 28, 2021, in the Redcell Action, Trucco moved for leave to file an amended — 3 — answer and four counterclaims, including one CFAA counterclaim based on Redcell’s allegedly unlawful use of Trucco’s data during the Redcell Action. 20 Civ. 18, ECF No. 57-2 at 1–2. On July 20, 2021, the Honorable Sarah L. Cave issued a report and recommendation recommending that Trucco’s motion for leave to amend be denied. 20 Civ. 18, R&R at 1, ECF No. 65. Regarding the CFAA counterclaim, Judge Cave held that amendment would be futile because Trucco had failed to adequately plead each of the three elements of the claim: (1) access to a protected computer, (2) lack of authorization, and (3) loss exceeding $5,000. Id. at 19–22. On March 8, 2022, the Court adopted the R&R in part. Redcell Action Order, 20 Civ. 18, ECF No. 92 at 1, 6–12. The Court held that Trucco had sufficiently pleaded loss exceeding $5,000, id. at 11–12, but otherwise sustained Judge Cave’s recommendation that Trucco had failed to adequately plead the two other prongs of a CFAA claim, id. at 6–11. The Court, therefore, denied Trucco’s motion for leave to file the counterclaim on the ground of futility. Id. at 12. B. The Instant Litigation On May 17, 2022, Trucco commenced this action in the United States District Court for the District of New Jersey, again arguing that Redcell violated the CFAA. Compl. ¶¶ 1, 50–61. On September 2, 2022, the Honorable Renée Marie Bumb sua sponte transferred the matter to this District, determining that it was “directly related” to the Redcell Action and that transfer “would eliminate the risk of inconsistent rulings by different courts on substantially the same issues.” ECF No. 19, at 5–6. On September 12, 2022, the action was reassigned to the undersigned. Dkt. Entry 9/12/2022.4 4 The Redcell Action was assigned to the undersigned on January 7, 2020, and was pending before the undersigned at the time of reassignment. 20 Civ. 18, Dkt. Entry 1/7/2020. The Redcell Action has since been reassigned. On April 5, 2023, the Redcell Action was reassigned to the Honorable Jed S. Rakoff. 20 Civ. 18, Dkt. Entry 4/5/2023. On July 10, 2023, the Redcell Action was again reassigned to the Honorable Jessica G.L. Clarke. 20 Civ. 18, ECF — 4 — On November 3, 2022, Redcell moved to dismiss the complaint for failure to state a claim under Rule 12(b)(6) and on the ground of res judicata. ECF No. 30; Defs. Mem. at 1, ECF No. 33. DISCUSSION I. Legal Standard To survive a motion to dismiss under Rule 12(b)(6), a complaint must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A complaint is properly dismissed where, as a matter of law, “the allegations in a complaint, however true, could not raise a claim of entitlement to relief.” Twombly, 550 U.S. at 558 . The Court must assume all well-pleaded facts to be true, “drawing all reasonable inferences in favor of the plaintiff.” Koch v. Christie’s Int’l. PLC, 699 F.3d 141, 145 (2d Cir. 2012). That tenet, however, does not apply to legal conclusions. Iqbal, 556 U.S. at 678 . Pleadings that offer only “labels and conclusions” or “a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 . II. Analysis The CFAA is “principally a criminal statute” with a limited private cause of action. LivePerson, Inc. v. 24/7 Customer, Inc., 83 F. Supp. 3d 501, 511 (S.D.N.Y. 2015); see Hancock v. Cnty. of Rensselaer, 882 F.3d 58, 63 (2d Cir. 2018) (“The scope of the civil actions permitted under [the CFAA] . . . has always been limited.”). To state a claim under the private cause of action, Trucco must plead that Redcell “(1) accessed a protected computer; (2) without any No. 99. — 5 — authorization or exceeding its authorized access; and (3) caused loss in excess of $5,000.” LivePerson, 83 F. Supp. 3d at 511 (citing 18 U.S.C. § 1030 (g)) (quotation marks omitted). Because Trucco has not adequately pleaded that Redcell acted without authorization or in excess of its authorized access, Trucco has not stated a claim under the CFAA.5 The CFAA does not define “without any authorization” but does define “exceeds authorized access” to mean “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter.” 18 U.S.C. § 1030 (e)(6). The Supreme Court recently defined the scope of the two phrases, noting the “particularly probative” interplay between the “without authorization” and “exceeds authorized access” clauses. Van Buren v. United States, 141 S. Ct. 1648, 1658 (2021). The “without authorization” clause “target[s] so-called outside hackers,” while the “exceeds authorized access” clause “target[s] so-called inside hackers.” Id. The Supreme Court held that an individual exceeds authorized access “when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him.” Id. at 1662 . But individuals do not exceed authorized access when they “have improper motives for obtaining information that is otherwise available to them.” Id. at 1652 ; see also Redcell Action Order at 7–8 (citing JBC Holdings NY, LLC v. Pakter, 931 F. Supp. 2d 514, 523 (S.D.N.Y. 2013)). Redcell’s access to Trucco’s server prior to the end of the relationship with Trucco was authorized. See Compl. ¶¶ 17, 22–23. Trucco states that Redcell was never permitted to “view or copy this confidential information.” Id. ¶ 18. But Trucco admits that Redcell was a system administrator and that its access was “not limited.” Id. ¶ 23. And Redcell was authorized to 5 Because Trucco has not sufficiently pleaded the second prong of a CFAA claim, the Court shall not reach the other prongs. — 6 — “make backup copies.” Id. ¶ 18; see Defs. Mem. at 8, ECF No. 33. Accordingly, there were no areas of the computer that were “off limits” to Redcell. Van Buren, 141 S. Ct. at 1662 . Even if Redcell was instructed not to view certain information to which it had access, Redcell would only have misused information to which it had access, rather than exceeding its authorized access. See Univ. Sports Publ’n Co. v. Playmakers Media Co., 725 F. Supp. 2d 378 , 384–86 (S.D.N.Y. 2010) (concluding that CFAA liability did not exist where employee was authorized to access entire database for limited administrative role and subsequently acted outside job duties). Indeed, Trucco does not dispute that Redcell’s access to and use of Trucco’s server during its business relationship were authorized. See Pl. Opp. at 13, ECF No. 35 (arguing only that “Redcell’s access to the server after the relationship with Trucco had ended, was unauthorized” (emphasis in original)). Trucco argues that Redcell’s access to Trucco’s server following the end of the parties’ relationship was unauthorized. As was the case with the counterclaim, see Redcell Action Order at 10–11, Trucco does not allege what the end of its relationship with Redcell entailed. See Compl. ¶ 27. Trucco refers to caselaw in this district holding that post-termination access by an employee to an employer’s system may be inferred as unauthorized. See Pl. Opp. at 13; Redcell Action Order at 10 (citing Poller v. BioScrip, 974 F. Supp. 2d 204, 233 (S.D.N.Y. 2013)); see also Zap Cellular, Inc. v. Weintraub, No. 15 Civ. 6723, 2022 WL 4325746 , at *7–8 (E.D.N.Y. Sept. 19, 2022) (inferring that authorization was revoked upon termination of an employeremployee relationship). But without details about how the companies parted ways, the Court cannot conclude that the end of Trucco’s relationship with Redcell was akin to an employee’s termination. Specifically, Trucco does not explain whether it was self-evident that Redcell was no longer authorized to access Trucco’s server and whether Trucco imposed any — 7 — post-relationship obligations upon Redcell, such as deleting programs that it had previously installed on Trucco’s server, providing Trucco with information about passwords, or refraining from accessing backup copies that Redcell had made. Even if the Court inferred that it was obvious that Redcell was no longer authorized to access Trucco’s server, Trucco does not adequately plead that Redcell in fact accessed Trucco’s server after the end of their business relationship. Trucco claims that a program called FileZilla continued to automatically run on its server and make backup copies of Trucco’s server. Compl. ¶ 29 ; Pl. Opp. at 13. Trucco does not allege that Redcell was responsible for this program. Trucco also claims that Redcell had “installed software from a company called VMWARE to allow remote access to Trucco’s server” and that Trucco was “eventually able to access the VMWARE system and remove Redcell’s access.” Compl. ¶ 33. Trucco offers no timeframe for Redcell’s VMWARE installation and does not allege that Redcell utilized the remote access to Trucco’s server after the conclusion of the business relationship. And Trucco’s claim that Redcell’s expert had reviewed “what appeared to documents [from] 2020 and 2021,” id. ¶ 44 , is too vague to support Trucco’s claim of unauthorized access by itself, especially because Trucco states that it finished overhauling its server by May 2020, id. ¶ 34 , preventing Redcell’s access to the 2021 documents. See Defs. Reply at 4, ECF No. 35. Moreover, Trucco has not sufficiently pleaded that Redcell’s use of the backup copy that Redcell made of Trucco’s server was unauthorized. As alleged by Trucco, Redcell accessed Trucco’s server during the parties’ relationship, made a backup copy, and then viewed the copy after the parties’ relationship concluded. See Compl. ¶¶ 17–18, 22–23, 40–41. Notably, Trucco does not claim that it had sole ownership of the server where the backup copy was stored; Trucco in fact admits that Redcell considered this to be a “joint database.” Id. ¶¶ 36, 45 . Redcell is thus — 8 — similarly situated to the defendant in LVRC Holdings LLC v. Brekka, who accessed a company computer while he was an employee, emailed the information to himself and his wife, and then later viewed that information on his own computer after he was no longer an employee. 581 F.3d 1127 , 1132–33 (9th Cir. 2009). The Ninth Circuit held that the defendant was not liable under the CFAA because the relevant access occurred “during the term of his employment” and there was no evidence that he had agreed “to return or destroy those documents upon the conclusion of his employment.” Id. Although Trucco knew that Redcell made backup copies of its server throughout their relationship, Trucco does not claim that Redcell was required to return or destroy backup copies. Id.; see Defs. Mem. at 8. Because the relevant access here—namely, the creation of the backup copy—was authorized during the parties’ relationship, Trucco cannot state a claim under the CFAA. Trucco nevertheless argues that Redcell’s use of the information within the backup copy constituted access without permission because the copy “would have to be specifically restored and Redcell had never been authorized to do so.” Compl. ¶ 37. But Trucco does not allege that Redcell was required to receive Trucco’s authorization before restoring the backup copy. Further, a violation of such a requirement would not be entry into “some forbidden virtual space,” as required for a CFAA claim, but rather a misuse of a backup copy that Redcell was permitted to create and which included folders to which Redcell had access. Univ. Sports Publ’n Co., 725 F. Supp. 2d at 384–85; see Van Buren, 141 S. Ct. at 1662 (rejecting CFAA interpretations that turn too narrowly on the distinction between “access” and “use”). Because Trucco does not state a claim under the CFAA, the Court shall not reach the issue of res judicata. See Defs. Mem. at 8–11. However, Trucco has now presented its CFAA claim to the Court on two occasions. The “plaintiff’s failure to fix deficiencies in the previous — 9 — pleading, after being provided notice of them, is alone sufficient ground to deny leave to amend.” Kling v. World Health Org., 532 F. Supp. 3d 141 , 153-54 (S.D.N.Y. 2021); see Nat’l Credit Union Admin. Bd. v. U.S. Bank Nat'l Ass’n, 898 F.3d 243, 257-58 (2d Cir. 2018) (permitting the district court to deny “the presentation of theories seriatim’’). Accordingly, Redcell’s motion to dismiss Trucco’s CFAA claim is GRANTED, and Trucco’s CFAA claim is DISMISSED with prejudice. I. Supplemental Jurisdiction Over State Law Claims Because the Court dismisses Trucco’s only federal claim under Rule 12(b)(6), the Court declines to exercise supplemental jurisdiction over Trucco’s state law claims under the NJCROA and for invasion of privacy, and such claims shall be dismissed without prejudice to renewal in state court. See 28 U.S.C. § 1367 (c)(3); Heard v. MTA-Metro North Commuter R.R. Co., No. 02 Civ. 7565, 2003 WL 22176008 , at *3 (S.D.N.Y. Sept. 22, 2003) (“The interests of judicial economy, convenience, and fairness counsel against hearing state law claims when federal claims against a party are dismissed at an early stage in the litigation.”’). Accordingly, Redcell’s motion to dismiss Trucco’s state law claims is GRANTED. CONCLUSION For the reasons stated above, Defendants’ motion to dismiss is GRANTED. Trucco’s CFAA claim is DISMISSED with prejudice. Trucco’s state-law claims are DISMISSED without prejudice. The Clerk of Court is directed to terminate the motion at ECF No. 30, enter judgment, and close the case. SO ORDERED. Dated: September 7, 2023 United Stake Dana due New York, New York — 10 —