Jiang v. Jiang

Background

Plaintiff Run The World, Inc. (RTW) is a software startup incorporated in Delaware in July 2019 that provided online video-conferencing software. Defendant Xuan Jiang was a co-founder, Director of Engineering, and Chief Technical Officer of RTW. As part of her stock purchase agreement dated July 10, 2019, Jiang transferred and assigned to RTW all right, title, and interest in intellectual property related to the company's business, including domain names. She reaffirmed this in an October 4, 2019 Letter Agreement and in a Proprietary Information and Inventions Agreement attached to her October 14, 2019 employment offer. In September 2019, Jiang registered the domains "rtw.team" and "rtw.today" (the RTW Domains) with the domain registrar GoDaddy, which RTW used for its customer-facing website, products, and internal tools.

On April 3, 2023, Jiang emailed RTW's investor announcing her decision to step down. On April 12, 2023, RTW's counsel confirmed acceptance of her resignation by email. The following day — April 13, 2023 — RTW experienced an outage of its website, products, and internal tools traced to the rtw.today domain. GoDaddy activity logs showed a sign-in to the GoDaddy account from near San Jose, California (where Jiang resides) at 4:40 p.m. on April 13, 2023; Jiang admitted in her deposition that she made this sign-in. On April 14, 2023, Jiang again accessed the account shortly before noon, changed the account password, removed her work email as access, and added multi-factor authentication restricting access to herself. Later that afternoon, GoDaddy notified RTW that both RTW Domains had been deleted or canceled. Jiang admitted in her answer to the complaint that she removed the domains from the GoDaddy account, though she disputed the date. RTW's web-based business was effectively shut down for more than a week.

RTW filed this lawsuit on June 23, 2024, asserting six causes of action: (1) violation of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030; (2) violation of California's Comprehensive Computer Data Access and Fraud Act; (3) breach of contract; (4) breach of fiduciary duty; (5) trespass to chattels; and (6) conversion of intellectual property. RTW moved for partial summary judgment on only the CFAA claim.

Deemed Admissions

RTW served Jiang with two sets of requests for admission (written requests that, under Federal Rule of Civil Procedure 36, are automatically deemed admitted if not answered within 30 days). Jiang did not respond to either set. RTW's second set expressly warned Jiang of the automatic-admission consequence. As a result, all matters in both sets were deemed admitted. Jiang, representing herself without an attorney (proceeding pro se), sought to withdraw the deemed admissions, arguing she had not understood the consequences of failing to respond.

The court analyzed the two-part test under Rule 36(b) for withdrawal of admissions: (1) whether withdrawal would promote presentation of the merits, and (2) whether the requesting party would suffer prejudice. On the first prong, the court found withdrawal unnecessary because, even without the deemed admissions, RTW had submitted independent unrebutted evidence sufficient to establish the elements of its CFAA claim. On the second prong, the court found clear prejudice to RTW: discovery had closed, the dispositive motion deadline had passed, and RTW had relied on the admissions throughout, similar to the situation in Conlon v. United States, 474 F.3d 616 (9th Cir. 2007). The court also noted Jiang's repeated failures to comply with court deadlines and orders as weighing against relief. Exercising its discretion, the court declined to permit withdrawal of the deemed admissions.

CFAA Analysis

To prevail on a civil CFAA claim under 18 U.S.C. §§ 1030(a)(5)(B) and (C), a plaintiff must show: (a) the defendant intentionally accessed a "protected computer" without authorization; (b) the defendant thereby caused "damage"; and (c) the plaintiff suffered "loss" aggregating at least $5,000 in a one-year period.

(a) Protected Computer

Jiang argued that GoDaddy's servers were not RTW's computers and that RTW's own servers were never directly accessed. The court rejected this argument, consistent with its prior ruling at the pleading stage, holding that disabling RTW's website and services by deleting the domains constitutes damage to a "protected computer" under 18 U.S.C. § 1030(e)(1), regardless of whether the hosting server is owned by a third party. The court cited HiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), and Skyhop Techs., Inc. v. Narra, 58 F.4th 1211 (11th Cir. 2023).

(b) Ownership of the RTW Domains

Jiang argued the domains were her personal property. The court found no genuine dispute of material fact: the July 10, 2019 Purchase Agreement expressly transferred all intellectual property related to RTW's business — defined to include domain names — from Jiang to RTW. This was reaffirmed in the October 2019 Letter Agreement and the Proprietary Information and Inventions Agreement. The court rejected three specific arguments Jiang raised: (1) that GoDaddy's terms of service vested control in the account holder — the court found this distinction legally irrelevant to ownership; (2) that because the domains were registered after the Purchase Agreement was signed, they fell outside its scope — the court found the agreement's transfer language was not limited to property existing at signing, and Jiang herself admitted she registered the domains on RTW's behalf; and (3) that the absence of the domains from the non-exhaustive list in Exhibit A to the Letter Agreement showed no transfer occurred — the court found that list was explicitly labeled "Certain RSPA Materials," not a comprehensive inventory.

(c) Access Without Authorization

The court found no genuine dispute that Jiang's access was without authorization. Under Ninth Circuit precedent (LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009)), authorization depends on the employer's permission; once employment ends, access is unauthorized. RTW's April 12, 2023 email confirmed Jiang's separation. Her subsequent access on April 13 and 14, 2023 — after that separation — was therefore without authorization, regardless of her stated belief that she was protecting her account from fraud. The court noted the CFAA provisions at issue (§§ 1030(a)(5)(B) and (C)) require only intentional access without authorization, not proof that the defendant subjectively knew she lacked authorization.

The deemed admissions further established liability, as Jiang was deemed to have admitted that she or someone on her behalf caused or contributed to the April 13–14 outages.

(d) Damage and Loss

The court found RTW suffered "damage" (harm to computers or networks, as defined by 18 U.S.C. § 1030(e)(8)) because Jiang deleted RTW's domain names, which constitute intangible property. The court cited CRS Recovery, Inc. v. Laxton, 600 F.3d 1138 (9th Cir. 2010), and Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003). RTW also established "loss" totaling at least $17,703.25, comprising: $1,896.00 in customer refunds; at least $10,307.25 in legal fees incurred responding to the breach; at least $5,000 in employee time; and at least $500 in contractor costs.

Jiang sought additional discovery under Federal Rule of Civil Procedure 56(d), arguing RTW had waived attorney-client privilege by submitting redacted billing records and that she was entitled to complete unredacted records. The court denied this request, finding Jiang failed to identify specific facts she expected the unredacted records to reveal or explain how they would preclude summary judgment — a required showing under Fam. Home & Fin. Ctr., Inc. v. Fed. Home Loan Mortg. Corp., 525 F.3d 822 (9th Cir. 2008).

Supplemental Jurisdiction

Having resolved the only federal claim, the court declined to exercise supplemental jurisdiction over RTW's five remaining state law claims under 28 U.S.C. § 1367(c)(3). The court found that the balance of judicial economy, convenience, fairness, and comity weighed against retaining jurisdiction, particularly because the parties were already actively litigating in the California Superior Court.

Disposition

The court granted RTW's motion for partial summary judgment on the CFAA claim and ordered Jiang to pay RTW $17,703.25 in CFAA damages. RTW was directed to file a proposed form of judgment within two weeks; Jiang may respond within seven days of that submission. The court dismissed RTW's remaining state law causes of action without prejudice to refiling in state court.