William Gottlieb Management Co, LLC v. Carlin

Background

William Gottlieb Management Co., LLC (WGM) alleged that Allan H. Carlin improperly interfered with its computer files. WGM said Carlin had worked at times as outside legal counsel and received individual login credentials to WGM’s Dropbox account around September 2017. WGM ended Carlin’s work around October 24, 2018, but alleged that he continued accessing the account afterward on 11 occasions. WGM alleged that he accessed, viewed, added, edited, or deleted files and folders.

WGM retained NGH Group, Inc., a private investigation firm specializing in digital forensics, to investigate the access. WGM alleged that NGH confirmed Carlin’s access and that Carlin continued accessing the account after being notified that he was committing computer trespass. WGM alleged that it incurred more than $5,000 in internal and contractor costs to investigate the access, assess potential risks, and install stronger security measures.

WGM sued Carlin on October 23, 2020, asserting claims under the federal Computer Fraud and Abuse Act (CFAA) and Stored Communications Act (SCA), along with New York common-law claims for trespass to chattels and negligence. A default judgment had been entered earlier in the case, but the court later set aside the certificate of default and default judgment. Carlin then moved to dismiss all four claims under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint alleges enough facts to state a legally plausible claim.

Materials Outside the Complaint

Carlin submitted a declaration and 13 exhibits, including filings from a related state-court action, Dropbox information and correspondence, and affidavits from WGM’s forensic expert. The court held that these materials were not attached to, expressly incorporated into, or sufficiently integral to the complaint. The court could recognize that the state-court documents existed, but could not accept their contents as true based on judicial notice.

The court also declined to convert the motion to dismiss into a motion for summary judgment. It explained that the case was still at the pleading stage, discovery had not been completed, and the parties sharply disputed the circumstances and effects of Carlin’s access. The court therefore decided the motion based on the complaint and materials properly considered at that stage.

Computer Fraud and Abuse Act

The CFAA permits certain civil claims involving intentional unauthorized access to a protected computer that causes damage, and generally requires at least $5,000 in qualifying loss during a one-year period. The court explained that “loss” and “damage” under the statute focus on technological harms, such as corruption or impairment of computer files or systems.

The court held that WGM had not adequately pleaded either required element. WGM’s alleged investigation confirmed that Carlin accessed the Dropbox account, but the complaint did not connect the investigation costs to an effort to assess or repair damage to WGM’s computer system. The complaint also did not explain how Carlin’s access impaired WGM’s computers, data, or files. Although WGM argued that Carlin edited or deleted files, the complaint did not state which documents were involved, why those actions mattered, or how they affected WGM. The court therefore granted Carlin’s motion to dismiss the CFAA claim.

Stored Communications Act

The SCA allows a civil claim by a person harmed when someone intentionally accesses, without authorization or beyond authorized access, a facility providing electronic communications services and thereby obtains, alters, or prevents authorized access to an electronic communication in electronic storage.

The court held that WGM plausibly alleged that Carlin’s access became unauthorized after his professional relationship with WGM ended. The court distinguished a case in which the alleged facts supported the conclusion that access had been authorized. The court also declined to decide Carlin’s arguments based on statutory exceptions because those arguments depended on facts not apparent from the complaint. The court therefore denied Carlin’s motion to dismiss the SCA claim.

New York State-Law Claims

For trespass to chattels, a plaintiff must allege intentional, unjustified interference with personal property that causes harm to the property’s condition, quality, or value. The court held that WGM’s allegation that it suffered financial and other damages was conclusory and did not explain how Carlin harmed the condition, quality, or value of WGM’s files or computer. The court therefore granted the motion to dismiss the trespass-to-chattels claim.

For negligence, a plaintiff must establish a duty, breach of that duty, and injury caused by the breach. WGM alleged that Carlin breached a duty not to use its Dropbox account after his termination and that WGM was financially injured. The court held that WGM’s alleged expenses for investigating the scope of Carlin’s access were sufficient to plead injury for purposes of the negligence claim, even though similar expenses did not qualify as “loss” under the CFAA. The court therefore denied the motion to dismiss the negligence claim.

Disposition

Judge Victor Marrero ordered that Carlin’s motion to dismiss was granted in part and denied in part. The CFAA and trespass-to-chattels claims were dismissed, while the SCA and negligence claims remained. Carlin was ordered to respond to the portions of the complaint that had not been dismissed within 21 days after the March 26, 2024 order.