Broidy v. Global Risk Advisors LLC

Background

Elliott Broidy and Broidy Capital Management, LLC sued Global Risk Advisors LLC, related companies, and several individuals. The plaintiffs alleged that Qatar hired the defendants to hack Broidy’s and the company’s computer systems after Broidy publicly criticized Qatar. According to the First Amended Complaint, the alleged attackers used targeted phishing emails to obtain access to email accounts and then to the company’s servers, where they accessed confidential communications, business documents, trade secrets, and other information. The plaintiffs also alleged that stolen materials were distributed to media organizations and that the resulting publicity caused reputational and business harm.

The First Amended Complaint asserted ten claims. The claims included violations of the Stored Communications Act, the Computer Fraud and Abuse Act, the Defend Trade Secrets Act, and the Racketeer Influenced and Corrupt Organizations Act; California statutory claims concerning trade secrets, computer access, and stolen property; and claims for civil conspiracy and intrusion upon seclusion.

Defendants’ Arguments and the Court’s Rulings

The defendants moved to dismiss under Federal Rules of Civil Procedure 12(b)(1), 12(b)(2), and 12(b)(6). Rule 12(b)(1) concerns subject-matter jurisdiction, Rule 12(b)(2) concerns personal jurisdiction over a defendant, and Rule 12(b)(6) concerns whether the complaint states a legally sufficient claim.

The defendants first argued that they had derivative foreign sovereign immunity because they allegedly acted as Qatar’s agents. The court rejected that argument. It concluded that the alleged hacking was not shown to have been performed in an official capacity, that the defendants had not shown that Qatar had formally adopted or approved the conduct, and that a judgment against the defendants would not operate as a judgment against Qatar. The court therefore denied dismissal on the derivative-immunity ground.

The defendants also argued that the plaintiffs improperly split their claims between this case and a prior related proceeding involving other defendants. The court rejected that argument as well. It held that factual overlap was not enough because the defendants in this case were not shown to be legally connected to the defendants in the earlier proceeding in a way that would make them bound by the earlier case. The court therefore denied dismissal on the claim-splitting ground.

Failure to State a Claim

The court granted dismissal under Rule 12(b)(6). It held that the First Amended Complaint did not plausibly connect Global Risk Advisors or its agents to the alleged hacks. The complaint referred to internet-protocol addresses associated with activity in Vermont, Qatar, and New York, as well as an address associated with a University of North Carolina guest wireless network. But, in the court’s view, the complaint did not adequately explain why those addresses were connected to the defendants.

The court also considered allegations that Global Risk Advisors had a relationship with Qatar, possessed the skills to conduct the attack, and had a special-projects division allegedly involved in earlier Qatar-directed hacking. The court found that these allegations showed only that the defendants had the ability or capacity to conduct the hacks. They did not plausibly show that the defendants actually carried them out. Because all of the plaintiffs’ claims depended on the defendants’ responsibility for the hacking and dissemination of the information, the court concluded that the pleading deficiency affected the entire amended complaint.

Disposition

The court granted the defendants’ motion to dismiss the First Amended Complaint under Rule 12(b)(6) and dismissed the amended complaint without prejudice. The court denied the request for oral argument as moot. It did not decide the defendants’ personal-jurisdiction arguments or their arguments that particular claims independently failed, explaining that those issues could be addressed if the plaintiffs filed another amended complaint. The court stated that any motion for leave to file a Second Amended Complaint, with a marked-up proposed complaint, should be filed within thirty days.