CCDAFA 9 properly applies to network engineer who configured county computer system to restrict 10 access to anyone but himself
How later courts described this case
- CCDAFA 9 properly applies to network engineer who configured county computer system to restrict 10 access to anyone but himself
Written by the judges who cited it.
The opinion
1
2
3
4
5 IN THE UNITED STATES DISTRICT COURT
6 FOR THE NORTHERN DISTRICT OF CALIFORNIA
7
8 TRUSTLABS, INC., Case No. 21-cv-02606-CRB
9 Plaintiff,
ORDER GRANTING IN PART AND
10 v.
DENYING IN PART MOTION FOR
SUMMARY JUDGMENT
11 DANIEL JAIYONG AN,
12 Defendant.
13 Defendant Daniel Jaiyong An is the cofounder and former CEO of Plaintiff
14 TrustLabs, Inc., a cryptocurrency company. Just before An was fired as CEO, he deleted
15 TrustLabs’ account with Slack, an electronic messaging service that TrustLabs employees
16 frequently used to communicate with one another. TrustLabs sued An under two federal
17 statutes, the Computer Fraud and Abuse Act and the Stored Communications Act, and one
18 California statute, the Comprehensive Computer Data Access and Fraud Act. TrustLabs
19 also seeks punitive damages against An.
20 TrustLabs now moves for summary judgment. The Court finds the matter suitable
21 for resolution without oral argument pursuant to Local Civil Rule 7-1(b), GRANTS the
22 motion as to liability under the California statute, and otherwise DENIES the motion.
23 I. BACKGROUND1
24 Leading up to July 2023, Defendant An was the CEO of Plaintiff TrustLabs.
25 Alexader de Lorraine Decl. (dkt. 140-3) ¶ 4. Rafael Cosman was TrustLabs’ other
26
27
1 The Court views the evidence in the light most favorable to An as the party opposing
1 cofounder, see Alexander de Lorraine Dep. (dkt. 143, Ex. C) at 23:25–24:1, and Alexander
2 de Lorraine was TrustLabs’ Director of Finance and Operations, see de Lorraine Decl. ¶ 2.
3 Cosman and de Lorraine met with An during the last week of June 2023 to discuss their
4 concerns about his performance, and on July 2 de Lorraine told An that TrustLabs’
5 shareholders “would like to remove [him] from the board” and from his position as CEO.
6 de Lorraine Dep. at 14:7–8. An does not remember these conversations but does not
7 contest that they occurred. Daniel Jaiyong An Dep. (dkt. 140-1, Ex. 1) at 156:2–6.
8 Soon after, on July 6, Cosman emailed An:
9 At the end of your conversation with Alex de Lorraine, you
mentioned that you would step down as CEO of TrustLabs, Inc.
10 We have not received your official resignation letter and ask that
you forward it by 4pm PST today, the 6th of July 2020. Please
11 note that if we do not receive your answer at or before 4 pm we
are forced to enact a stockholder consent which will replace the
12 board of TrustLabs, Inc. and hire a new CEO.
13 …
14 If you choose to resign, the Company is agreeable to treating
your resignation as a termination by you for Good Reason and
15 working with you to communicate the decision to the public. If
you do not provide an answer by 4 pm and the Company enacts
16 the stockholder consent, the public narrative will necessarily
change.
17
18 Id. Exh. 5 (Cosman email) (emphasis omitted). An denies that he ever told de Lorraine
19 that he would resign as CEO. Id. at 156:10–13.
20 An did not tender a resignation letter by 4 p.m. on July 6 or otherwise respond to
21 Cosman’s email. Instead, at 6:36 p.m. he deleted TrustLabs’ Slack account. Def.’s Am.
22 Resps. to Pl.’s Requests for Admission (dkt. 140-1, Ex. 6) at 4. Slack was “one of
23 [TrustLabs’] main means of communication,” Anna Arpilleda Dep. (dkt. 140-1, Ex. 4) at
24 18:12–14, and a “critical piece of company infrastructure,” de Lorraine Dep. at 37:5–6.
25 While TrustLabs’ Slack account was inactive, “[b]usiness pretty much ground to a halt”
26 and “[f]orward progress on company initiatives … was little to none.” Id. at 37:6–16.
27 TrustLabs was able to secure Slack access approximately 12 hours later. Id. at 32:6–12.
1 Decl. (dkt. 140-2) ¶¶ 6–7; de Lorraine Decl. ¶ 8.
2 After An deleted TrustLabs’ Slack account, TrustLabs conducted an emergency
3 stockholder vote, called an emergency session of its board of directors, and voted to
4 remove An from the company board and as CEO. An Dep. Exh. 6 (termination letter).
5 TrustLabs formally terminated An’s employment on July 7. Id. Several days later, an
6 individual using An’s name and email address tried to access TrustLabs’ email marketing
7 list and social media accounts. Id. Exh. 13 (cease and desist letter). And on July 24 An
8 emailed the legal counsel of one of TrustLabs’ clients to propose details for an upcoming
9 deal. Id. Exh. 11 (An email).
10 TrustLabs sued An under three statutes: the federal Computer Fraud and Abuse Act,
11 18 U.S.C. § 1030; the federal Stored Communications Act, 18 U.S.C. § 2701, et seq.; and
12 California’s Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502.
13 Compl. (dkt. 1) ¶¶ 26–40. Before the Court is TrustLabs’ motion for summary judgment
14 on all three counts. MSJ (dkt. 140).
15 II. LEGAL STANDARD
16 Summary judgment is proper when there is “no genuine dispute as to any material
17 fact and the [moving party] is entitled to judgment as a matter of law.” Fed. R. Civ. P.
18 56(a). Material facts are those that may affect the outcome of the case. Anderson v.
19 Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A dispute is genuine if “the evidence is
20 such that a reasonable jury could return a verdict for the nonmoving party.” Id.
21 The moving party bears the initial burden of identifying those portions of the
22 pleadings, discovery, and affidavits that demonstrate the absence of a genuine issue of
23 material fact. Celotex Corp. v. Cattrett, 477 U.S. 317, 323 (1986). Once the moving party
24 meets its initial burden, the nonmoving party must go beyond the pleadings to demonstrate
25 the existence of a genuine dispute of material fact by “citing to particular parts of materials
26 in the record” or “showing that the materials cited do not establish the absence or presence
27 of a genuine dispute.” Fed. R. Civ. P. 56(c). If the nonmoving party fails to do so, “the
1 III. DISCUSSION
2 TrustLabs brings against An two federal statutory claims and one state statutory
3 claim. Though the three statutes at issue regulate different conduct, for purposes of this
4 case they apply in similar ways.
5 A. Statutory Standing
6 TrustLabs has established that it suffered over $6,000 in damages when An deleted
7 the company’s Slack account. That is sufficient under all three statutes. See 18 U.S.C.
8 § 1030(c)(4)(A)(i)(I), (g) ($5,000 threshold for private suit under the CFAA); Hahn v.
9 Rothman, No. CV 09-249 ODW, 2010 WL 11507395, at *4–5 (C.D. Cal. Oct. 8, 2010)
10 (citing 18 U.S.C. § 2707(c)) (no damages threshold under the SCA); Mintz v. Mark
11 Bartelstein & Assocs. Inc., 906 F. Supp. 2d 1017, 1032 (C.D. Cal. 2012) (citing Cal. Penal
12 Code § 502) (no damages threshold under the CCDAFA).
13 For his part, An fails to offer any evidence to meaningfully contest the amount of
14 damages. He points to deposition testimony that it took “less than 12 hours” to restore
15 Slack access, de Lorraine Dep. at 32:6–12, but that testimony is consistent with TrustLabs’
16 assertion that it took over 50 hours to “recover[] the Company’s Slack account” and also
17 “ensur[e] the security of TrustLabs’ remaining digital resources” by “reintegrat[ing] all
18 Slack connections to Company systems, review[ing] access to shared channels, and
19 updat[ing] administrative access credentials.” MSJ at 7 (citing Moore Decl. ¶¶ 4–7). An
20 also argues that TrustLabs’ request for over $6,000 in damages is “convenient” (because it
21 is just slightly over the CFAA’s $5,000 damages threshold) and that TrustLabs’ litigation
22 strategy “suggests that [its] true motive is not to recover minimal losses, but rather to use
23 the legal system as a weapon for retaliation or harassment.” MSJ Opp. (dkt. 143) at 6–7.
24 Yet such “speculation and guesswork” is not enough to create a genuine dispute of
25 material fact. Guidroz-Brault v. Mo. Pac. Ry. Co., 254 F.3d 825, 829 (9th Cir. 2001).
26 B. Qualifying Conduct
27 An concedes that he deleted TrustLabs’ Slack account. This is qualifying conduct
1 First, deleting TrustLabs’ Slack account implicates the CFAA, which prohibits
2 “knowingly caus[ing] the transmission of a program, information, code, or command … to
3 a protected computer.” 18 U.S.C. § 1030(a)(5)(A). An’s computer qualifies as a
4 “protected computer” because TrustLabs operates nationally and internationally.
5 de Lorraine Decl. ¶ 10; see also 18 U.S.C. § 1030(e)(2)(B) (a “protected computer” is one
6 that “is used in or affecting interstate or foreign commerce or communication”).
7 Second, An’s conduct implicates the SCA, which prohibits “intentionally
8 access[ing] … a facility through which an electronic communication service is provided …
9 and thereby obtain[ing], alter[ing], or prevent[ing] authorized access to a wire or electronic
10 communication while it is in electronic storage in such system.” 18 U.S.C. § 2701(a).
11 TrustLabs’ Slack account is a “facility through which an electronic communication service
12 is provided” as it “provides to users [] the ability to send or receive wire or electronic
13 communications.” Id. § 2510(15); see also In re iPhone Application Litig., 844 F. Supp.
14 2d 1040, 1057 (N.D. Cal. 2012) (“the computer systems of an email provider, a bulletin
15 board system, or an ISP are uncontroversial examples of facilities that provide electronic
16 communications services”).2
17 Third, An’s conduct falls under several provisions of the CCDAFA. As relevant
18 here, that statute prohibits (1) knowingly “alter[ing], damage[ing], delet[ing], or
19 destroy[ing] any data, computer software, or computer programs which reside or exist
20 internal or external to a computer, computer system, or computer network”; (2) knowingly
21 “disrupt[ing] or caus[ing] the disruption of computer services”; and (3) knowingly
22 “den[ying] or caus[ing] the denial of computer services to an authorized user of a
23 computer, computer system, or computer network.” Cal. Penal Code § 502(c)(4)–(5).
24 Slack, an “electronic message service,” is a “computer service” for purposes of
25 California’s statute. Id. § 502(b)(4).
26 An does not contest that these statutes apply to deleting TrustLabs’ Slack account.
27
1 C. Authorization or Permission
2 The core dispute in this action is An’s status with respect to TrustLabs when he
3 deleted the company’s Slack account. Both the CFAA and the SCA prohibit conduct that
4 is without authorization or in excess of authorization. See 18 U.S.C. §§ 1030(a)(5)(A),
5 2701(a). California’s CCDAFA, meanwhile, prohibits conduct undertaken “without
6 permission.” Cal. Penal Code § 502(c)(4), (5).
7 Federal Claims. TrustLabs primarily relies on Cosman’s July 6, 2020 email to An
8 as proof that An deleted the company’s Slack account without authorization. TrustLabs
9 argues that An’s “authorization to access TrustLabs’ Slack account was revoked—at the
10 latest—upon the Company’s formal notice that his employment would be involuntarily
11 terminated if he did not provide a resignation letter by 4 p.m. on July 6, 2020.” MSJ at 12.
12 But Cosman’s email does not conclusively establish that An’s authority as CEO—and with
13 it, his authority to delete TrustLabs’ Slack account—was revoked at 4 p.m. on July 6,
14 2020. In his email, Cosman explained that “if we do not receive your answer at or before 4
15 pm we are forced to enact a stockholder consent which will replace the board of TrustLabs,
16 Inc. and hire a new CEO.” An Dep. Exh. 5. While that statement could mean that An’s
17 authority as CEO expired at 4 p.m. on July 6 whether or not he tendered his resignation, it
18 could also mean that An’s failure to tender his resignation by 4 p.m. on July 6 would
19 merely cause Cosman and de Lorraine to seek his termination through other means.
20 Indeed, that is what seems to have played out: by refusing to resign, An initiated a
21 sequence of events that ultimately culminated in the board firing him as CEO. It is at least
22 possible that An’s authority as CEO did not expire until the board actually fired him—
23 which it did only after An deleted the company’s Slack account. Additionally, it is not
24 clear that Cosman (or de Lorraine, for that matter) himself had authority to strip An of his
25 CEO role, so his email might not be of any legal significance.
26 For these same reasons, TrustLabs’ reliance on Astec America LLC v. Li,
27 No. 14CV1457 JLS, 2014 WL 12516024 (S.D. Cal. Nov. 17, 2014), is misplaced. That
1 after the company had informed the employee of his pending termination and demanded
2 the return of the laptop. Id. at *3. The court rejected the employee’s argument that he had
3 authorization to access the laptop while his termination was pending and he was still an
4 employee, holding that “once he went on medical leave and [the company] demanded the
5 laptop be returned, his authority was revoked.” Id. Cosman’s email, by contrast, is more
6 ambiguous. It contains no language equivalent to the demand in Astec America that the
7 employee return the laptop. Nor does it establish that Cosman (or de Lorraine) even could
8 revoke An’s authority as CEO—something not at issue in Astec America. This case is
9 therefore unsuitable to resolving at summary judgment.3
10 To be clear, the Court does not hold that Cosman’s July 6, 2020 email is insufficient
11 to establish that An’s authority was revoked as a matter of law. Context—such as details
12 about the stockholder consent process or Cosman and de Lorraine’s authority—might be
13 sufficient for a finder of fact to conclude that An’s authority as CEO was in fact revoked
14 before he deleted TrustLabs’ Slack account. All the Court now holds is that the email is
15 not enough, standing alone, to conclusively establish that An’s authority had been revoked.
16 TrustLabs’ secondary argument is that An had agreed to resign as CEO at some
17 point before July 6, 2020. MSJ Reply (dkt. 144) at 6. But An clearly disputes this: he
18 declared under oath that he “never agreed nor provided indication that [he] would provide
19 notice of resignation as CEO of TrustLabs ever.” Daniel Jaiyong An Decl. (dkt. 143) ¶ 3.
20 TrustLabs tries to write off An’s declaration as “self-serving” and “conclusory,” MSJ
21 Reply at 6 n.2, but it is of no legal significance that a declaration is self-serving, see Nigro
22 v. Sears, Roebuck & Co., 784 F.3d 495, 497 (9th Cir. 2015), and it is not conclusory for
23 An to deny that he made a specific statement. (Perhaps An’s additional statement that he
24 never “provided indication” that he would resign is conclusory, but the Court need not, and
25 does not, rely on that statement to deny summary judgment.) The finder of fact may well
26 reject An’s testimony as to what he did or did not say leading up to July 6, 2020, but such a
27
1 classic credibility determination is an issue for trial, not summary judgment.
2 The Court therefore denies the motion for summary judgment with respect to
3 TrustLabs’ federal claims.
4 State Claim. Unlike the federal CFAA and SCA, California’s CCDAFA prohibits
5 conduct undertaken “without permission,” rather than without authorization. California’s
6 statute is thus more expansive, as it “may properly be applied to an employee who uses his
7 or her authorized access to a computer system to disrupt or deny computer services to
8 another lawful user.” People v. Childs, 220 Cal. App. 4th 1079, 1104 (2013) (CCDAFA
9 properly applies to network engineer who configured county computer system to restrict
10 access to anyone but himself); see also Cal. Pen. Code § 502(b)(10) (“‘Injury’ means …
11 the denial of access to legitimate users of a computer system, network, or program.”).
12 That said, California’s statute also includes a defense that the defendant acted “within the
13 scope of [his] lawful employment”—that is, that his actions were “reasonably necessary to
14 the performance of [his] work assignment.” Cal. Pen. Code § 502(h)(1); Childs, 220 Cal.
15 App. 4th at 1102–03 (describing the “scope of employment” defense).
16 TrustLabs has shown that when An deleted Slack, he denied access to that program
17 to the entire company, including many legitimate users. And An fails to identify any
18 evidence that deleting Slack was within the scope of his lawful employment.” He states in
19 his brief that his “management of company communication systems, including the decision
20 to transition away from Slack, falls within [the] scope” of his lawful employment, MSJ
21 Opp. at 11, but he does not support this assertion with evidence, and “[u]nsupported
22 allegations made in briefs are not sufficient [] to defeat a motion for summary judgment.”
23 Stanley v. Univ. of S. Cal., 178 F.3d 1069, 1076 (9th Cir. 1999).
24 At bottom, An points to no evidence, and the Court could not find any, to suggest
25 that it was reasonably necessary for him to delete TrustLabs’ Slack account when he did
26 so. The Court therefore GRANTS summary adjudication against An as to An’s liability
27 under the CCDAFA.
1 D. Punitive Damages
2 The final issue is the question of punitive damages. TrustLabs argues that An not
3 only acted knowingly (the requisite intent for liability under all three statutes)4 but that he
4 also acted intentionally and with malice and therefore owes punitive damages. MSJ at 19–
5 20. As evidence of An’s intent and malice, TrustLabs points to An’s post-termination
6 conduct—specifically, his purported attempts to log into several of the company’s
7 accounts and his communications with one of the company’s clients. Id.
8 An vigorously contests TrustLabs’ assertion that he acted maliciously. In doing so,
9 he raises various allegations of misconduct on the part of TrustLabs, apparently for the
10 purpose of portraying himself as a sort of whistleblower acting with pure intentions. See
11 MSJ Opp. at 6, 10–11, 23.5 While An failed to properly substantiate most of these
12 allegations, and any evidence on this topic would be irrelevant to determining An’s
13 statutory liability, TrustLabs’ alleged misconduct around the time that An was terminated
14 may have some limited relevance to the question of punitive damages. So there is a
15 genuine dispute of material fact as to whether punitive damages are appropriate, and the
16 Court DENIES TrustLabs’ motion for summary judgment as to punitive damages on all
17 counts.6
18
4 See 18 U.S.C. §§ 1030(a)(5), 2701(a); Cal. Pen. Code § 502(c)(4), (5). An does not
19
seriously dispute that he acted knowingly when he deleted TrustLabs’ Slack account;
indeed, he concedes that he did so and suggests only that his motive may have been
20
legitimate. See MSJ Opp. at 6, 11.
5 An attempted to file supplemental authority consisting of an SEC complaint against
21
TrustLabs and a press release regarding the parties’ subsequent settlement. Mot. for Leave
to File Supp. Evid. (dkt. 145). This motion would be procedurally improper under either
22
Local Civil Rule 7-3(d)(2), which applies only to “relevant judicial opinion[s]” (emphasis
added), or Local Civil Rule 7-11, which requires a stipulation or a declaration explaining
23
the absence of one. The authority itself is irrelevant in any case, as “a consent judgment
between a federal agency and a private corporation [] is not the result of an actual
24
adjudication of any of the issues.” Twin City Fire Ins. Co. v. SLRA Inc., No. 19-cv-6131-
JSC, 2020 WL 3035793, at *4 (N.D. Cal. June 5, 2020) (quoting Lipsky v. Commonwealth
25
United Corp., 551 F.2d 887, 893 (2d Cir. 1976)). An’s motion is therefore DENIED.
6 TrustLabs’ federal claims will go to trial regardless, so it is in the interest of judicial
26
economy for the finder of fact to evaluate punitive damages for all three claims at the same
time. See United Energy Trading, LLC v. Pac. Gas & Elec. Co., No. 15-cv-2383-RS, 2018
27
WL 11431182, at *6 n.6 (N.D. Cal. Jan. 22, 2018) (“Where an issue is closely intertwined
1 IV. CONCLUSION
2 For the foregoing reasons, the Court vacates the hearing set for November 15, 2024
3 at 10 a.m. and
4 • GRANTS summary adjudication in favor of TrustLabs and against An as to
5 liability under the Comprehensive Computer Data Access and Fraud Act;
6 • DENIES summary adjudication as to liability under the Computer Fraud and
7 Abuse Act and the Stored Communications Act; and
8 • DENIES summary adjudication as to damages on all counts.
9 IT IS SO ORDERED.
10 Dated: November 13, 2024
CHARLES R. BREYER
11 United States District Judge
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27