TrustLabs, Inc. v. An

Background

Daniel Jaiyong An was TrustLabs, Inc.’s cofounder and former chief executive officer. Shortly before TrustLabs removed him, An deleted the company’s Slack account. TrustLabs employees frequently used Slack to communicate, and the company described it as critical infrastructure. TrustLabs regained access approximately 12 hours later, after business activity had substantially slowed.

TrustLabs sued An under the federal Computer Fraud and Abuse Act, the federal Stored Communications Act, and California’s Comprehensive Computer Data Access and Fraud Act. It also sought punitive damages. TrustLabs moved for summary judgment, which asks whether the evidence shows that no important factual dispute requires a trial and that the moving party is entitled to judgment under the law.

Court’s Analysis

The court found that TrustLabs established more than $6,000 in damages from deleting the Slack account. That amount satisfied the Computer Fraud and Abuse Act’s damages threshold, and An did not provide evidence creating a meaningful dispute about the amount.

An conceded that he deleted the Slack account, and the court concluded that the conduct potentially fell within all three statutes. The central dispute for the federal claims was whether An acted without authorization or beyond his authorization. TrustLabs relied mainly on an email stating that An had to resign by 4 p.m. or the company would take steps to replace the board and hire a new chief executive. The court found that the email did not conclusively establish that An’s authority ended at 4 p.m. It could have meant that the company would begin another process to terminate him, and An was not formally removed until after he deleted the account. An also denied agreeing to resign, creating a credibility dispute that could not be resolved on summary judgment.

The California statute uses a broader “without permission” standard and includes a defense for conduct within the scope of lawful employment when reasonably necessary to perform the employee’s work assignment. The court found that deleting Slack denied access to the company and its legitimate users. It also found that An identified no evidence showing that deleting Slack was reasonably necessary for his work. The court therefore granted summary adjudication against An on liability under the California statute.

As to punitive damages, TrustLabs argued that An acted intentionally and maliciously, relying in part on alleged post-termination attempts to access company accounts and communications with a client. An disputed that he acted maliciously. The court found a genuine dispute of material fact about whether punitive damages were appropriate and denied TrustLabs’s motion on punitive damages for all three claims.

Ruling

The court vacated the scheduled hearing. It granted summary adjudication in favor of TrustLabs and against An on liability under California’s Comprehensive Computer Data Access and Fraud Act. It denied summary adjudication on liability under the Computer Fraud and Abuse Act and the Stored Communications Act, and denied summary adjudication as to damages on all claims. The court also denied An’s motion to file supplemental authority.