DCR Marketing Inc. v. Pereira

Background

DCR Strategies Legal Inc. and DCR Marketing Inc. alleged that Josephine Lee Pereira, their former employee, had online login credentials for the corporations’ accounts at Citibank, Bank of America, and PNC Financial Services Group. According to the complaint, between 2017 and 2019, Pereira changed the login credentials and transferred money from those accounts to her personal accounts without authorization. The alleged transfers totaled more than $500,000.

DCR asserted claims under the Computer Fraud and Abuse Act (CFAA), a federal computer-access statute, and state-law claims for conversion. DCR also sought declaratory and injunctive relief. Pereira moved to dismiss under Federal Rule of Civil Procedure 12(b)(1), which concerns subject-matter jurisdiction, and Rule 12(b)(6), which concerns whether a complaint states a legally sufficient claim.

Federal Claims

Pereira argued that the CFAA claims were too weak to support federal-question jurisdiction. The court rejected that argument. It held that the issue was whether the complaint stated a claim under the CFAA, not whether the court had subject-matter jurisdiction. The court therefore did not dismiss the CFAA claims under Rule 12(b)(1).

The court nevertheless dismissed the CFAA claims under Rule 12(b)(6). It identified two defects. First, the CFAA allows a private lawsuit only when the alleged conduct involves at least $5,000 in qualifying “loss” during a one-year period. The court explained that, in this context, qualifying loss generally involves costs related to investigating, repairing, or restoring a computer system, or costs caused by an interruption in service. The funds transferred from DCR’s bank accounts were not that type of loss, so DCR had not pleaded a qualifying loss.

Second, the CFAA provision at issue applies when a person obtains or changes information that the person was not authorized to access for any purpose, even if the person otherwise had authorization to access the computer. The court held that DCR alleged Pereira was authorized to access all three bank accounts. Under controlling Second Circuit precedent, an employee’s misuse of authorized access or disloyal transfer of information or funds does not establish that the employee exceeded authorized access under the CFAA. The court therefore held that DCR had not stated a CFAA claim for this additional reason.

State-Law Claims

After dismissing the federal claims, the court considered whether to exercise supplemental jurisdiction, meaning jurisdiction over related state-law claims. Because no diversity jurisdiction was available and the federal claims had been dismissed, the court declined to exercise supplemental jurisdiction over the remaining state-law claims.

Disposition

Judge J. Paul Oetken granted Pereira’s motion to dismiss. The federal CFAA claim was dismissed with prejudice. The state-law claims were dismissed without prejudice. The court directed the Clerk of Court to close the motion and the case.