Deutsch v. Human Resource Management, Inc.

Background

Helene Deutsch alleged violations of the Computer Fraud and Abuse Act (CFAA), a federal statute addressing fraud and related activity involving computers, against Rolfe I. Kopelan and The HRM Capstone Partnership, Inc. She also asserted various state-law claims against Human Resource Management, Inc., The HRM Capstone Partnership, Inc. (doing business as The Capstone Partnership), ADP TotalSource Co. XXI Inc., and Kopelan.

Deutsch alleged that she became a partner at Capstone in 2008 and worked as an executive recruiter. She alleged that, by February 2019, she had not received her semi-monthly draw or commissions. After being told that Capstone would close unless she accepted reduced compensation, she accepted employment with a third party when Capstone was allegedly going to cease operations.

On April 4, 2019, Deutsch’s personal telephone, which she also used to access Capstone email and applications, was remotely wiped and restored to factory settings. She alleged that she lost photographs, contacts, text messages, passwords, and software applications. She alleged that Kopelan authorized Capstone to wipe the phone in retaliation for her compensation demands and her complaint to ADP.

Motion and governing standards

The Capstone Defendants moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint states a legally sufficient claim, and Rule 12(b)(1), which addresses federal subject-matter jurisdiction. The court treated the request to decline supplemental jurisdiction over the state-law claims as also involving Rule 12(b)(1). ADP filed a separate Rule 12(b)(6) motion, but the court determined that it did not need to address that motion because granting the Capstone Defendants’ motion would dispose of the entire case.

At the motion-to-dismiss stage, the court accepted well-pleaded, nonconclusory factual allegations as true and drew reasonable inferences in Deutsch’s favor. It nevertheless did not have to accept conclusory statements or legal conclusions stated as facts.

CFAA claim

The court held that Deutsch failed to plead two required elements of the CFAA claim: unauthorized access and qualifying losses of at least $5,000.

Unauthorized access. The CFAA provision on which Deutsch relied requires intentional access to a protected computer without authorization that causes damage and loss. The court applied Second Circuit precedent holding that “without authorization” generally refers to a person lacking permission to access the computer or system at all. Merely misusing access that was authorized does not ordinarily satisfy that requirement.

The court concluded that Deutsch’s allegations described misuse of authorized access rather than access without authorization. She alleged that Capstone and Kopelan erased personal data on a telephone that she was required to use for work, but she did not allege that they lacked permission to access the telephone altogether, that portions of the telephone were technically restricted from them, or that they bypassed a firewall or other technological barrier. The absence of a policy allowing remote wiping did not establish that the defendants lacked authority to access the device.

The court also rejected Deutsch’s argument that authorization should have ended when her employment ended. The court noted that she had not alleged that her employment had ended before the April 4 wiping and that her allegations suggested she continued requesting compensation through April 15, 2019.

Qualifying loss. The court held that the losses alleged were not the type compensable under the CFAA. In the court’s view, qualifying loss generally includes costs of investigating or repairing computer damage or costs resulting from an interruption of computer service. Deutsch alleged the loss of personal data, but did not allege costs for restoring the data, investigating an intrusion, repairing the device, or restoring service. Her allegation that the loss exceeded $5,000 was conclusory because she did not identify the costs incurred.

Leave to amend

The court denied any further opportunity to amend because Deutsch had already amended her complaint once and the problems were substantive rather than merely drafting defects. The court concluded that another amendment could not cure the lack of allegations showing unauthorized access or CFAA-compensable losses. It also noted that the CFAA subsection Deutsch invoked addressed access without authorization, not access that exceeded authorization, and that the other statutory provisions would be poorly suited to her allegations.

State-law claims and disposition

After dismissing the federal CFAA claim, the court declined to exercise supplemental jurisdiction, meaning jurisdiction over related state-law claims, under 28 U.S.C. § 1367(c)(3). The court stated that when all federal claims have been dismissed at a relatively early stage, a district court should generally decline to retain the related state-law claims.

The court granted the Capstone Defendants’ motion to dismiss. It dismissed Deutsch’s CFAA claim with prejudice and without leave to amend, dismissed her state-law claims without prejudice, directed the Clerk to terminate all open motions, and closed the case. The court did not decide ADP’s separate motion to dismiss.