A.J. TRUCCO, INC. v. REDCELL CORP.

Background

A.J. Trucco, Inc. alleged that Redcell Corp. and Redcell Systems, LLC unlawfully used Trucco’s confidential and proprietary data. Redcell had provided software development, information-technology support, maintenance, and logistics services to Trucco from 2008 through 2019. Trucco alleged that Redcell had administrative access to Trucco’s server and was authorized to make backup copies, but was not authorized to view or copy the confidential information itself.

Trucco alleged that, after the business relationship ended, a program continued making copies of folders on its server. Trucco later learned during discovery in an earlier related proceeding that Redcell had accessed more than 10,000 documents and retained a backup copy and access codes. Trucco also alleged that Redcell’s expert had reviewed documents that appeared to be from 2020 and 2021.

Claims and Motion

Trucco asserted a claim under the Computer Fraud and Abuse Act, a federal statute that provides a limited private right of action for certain unauthorized computer access. It also asserted claims under the New Jersey Computer Related Offenses Act and New Jersey law for invasion of privacy. Redcell moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), arguing that the complaint failed to state a legally sufficient claim. Redcell also argued that the CFAA claim was barred by claim preclusion, a rule that can prevent relitigation of matters resolved in an earlier case.

CFAA Analysis

To state a civil CFAA claim, Trucco had to adequately allege that Redcell accessed a protected computer, did so without authorization or exceeded its authorized access, and caused more than $5,000 in loss. The court addressed the authorization requirement and did not reach the other CFAA elements.

The court concluded that Redcell’s access to Trucco’s server before the relationship ended was authorized. Trucco alleged that Redcell was a system administrator whose access was not limited and that Redcell was authorized to make backup copies. Under the Supreme Court’s interpretation of the CFAA, a person exceeds authorized access when authorized access is used to obtain information located in areas of a computer that are off limits. The court found that Trucco had not identified any such off-limits area because Redcell’s access was not limited.

The court also found that Trucco had not adequately pleaded unauthorized access after the relationship ended. Trucco did not explain what ending the relationship meant, whether Redcell’s authorization was clearly revoked, or whether Redcell had post-relationship obligations such as deleting installed programs, providing passwords, or destroying backup copies. Trucco also did not allege that Redcell was responsible for the FileZilla program, that Redcell used the remote-access system after the relationship ended, or facts sufficiently connecting Redcell to the later documents.

The court further held that Trucco had not adequately alleged unauthorized access to the backup copy. Trucco alleged that Redcell created the backup copy during the relationship, when that activity was authorized, and did not allege that Redcell was required to return or destroy the copy. The court rejected the argument that restoring the backup copy necessarily constituted unauthorized computer access, reasoning that this alleged conduct involved misuse of a permitted backup copy rather than entry into a forbidden area of a computer.

State-Law Claims and Disposition

Because Trucco failed to state its only federal claim, the court declined to exercise supplemental jurisdiction—the federal court’s authority to hear related state-law claims—over the New Jersey statutory and invasion-of-privacy claims. The court stated that those claims could be renewed in state court.

The court granted Redcell’s motion to dismiss Trucco’s CFAA claim and dismissed that claim with prejudice. The court granted Redcell’s motion to dismiss Trucco’s state-law claims and dismissed those claims without prejudice. The court did not reach the res judicata argument. It directed the clerk to enter judgment, terminate the motion, and close the case.