Victim One v. Doe

Background

Victim One brought a single claim under the Computer Fraud and Abuse Act (CFAA) against an unidentified defendant, John Doe. Victim One alleged that Doe accessed a Juno email account, used it to reset and change the password for a Yahoo account, and then accessed and changed a Truist Bank account. Victim One also alleged that Doe accessed an Outlook account, used information from the compromised accounts to try to access other accounts, and created accounts purporting to be Victim One’s. The complaint alleged that an unauthorized $2,000 transfer was made from Victim One’s bank account through ZellePay.

Victim One requested expedited discovery from third parties, including Early Warning Services (Zelle), United Online (Juno), and Microsoft Corporation, to help identify Doe. The court decided the motion without a hearing.

The Court’s Analysis

Federal Rule of Civil Procedure 26(d)(1) generally allows a court to authorize discovery before the usual discovery period for good cause. For early discovery aimed at identifying an anonymous defendant, the court applied factors including whether the plaintiff identified the defendant with enough specificity to show that the defendant is a real person or entity subject to federal jurisdiction, whether the plaintiff described efforts already taken to locate the defendant, whether the lawsuit could withstand a motion to dismiss, and whether discovery was reasonably likely to identify the defendant so that service could be made.

The court found that Victim One had not shown that Doe was subject to jurisdiction in the Northern District of California. The court noted that the alleged activities appeared directed at Victim One, who did not appear to reside in California, and rejected the argument that using Yahoo and Gmail accounts hosted or maintained in California was enough by itself to establish jurisdiction.

The court also found it unclear whether Victim One’s CFAA claim could survive a motion to dismiss. Victim One relied on provisions concerning unauthorized access to obtain information, unauthorized access connected to fraud involving more than $5,000, and trafficking in passwords. The court explained that the CFAA addresses technological harm to protected computers and that unauthorized access involves bypassing generally applicable access rules, such as username and password requirements. But the court found that Victim One’s specific allegations described Doe accessing accounts through unfamiliar computers, rather than specifically accessing Victim One’s computer. The court therefore could not determine that the claim was adequately supported without more specific factual allegations or legal authority establishing that access to accounts alone was enough.

Ruling

The court DENIED Victim One’s motion for expedited discovery without prejudice. Judge Kandis Westmore signed the order dated December 20, 2023.