OPINION
Defendants Sark-USA, Inc. (“Sark-USA”) and Sarkuysan Elektrolitik Bakir Sanayii Ve Ticaret A.S. (“Sarkuysan”) have moved to dismiss this action under Fed.R.Civ.P. 12(b)(6) and 12(b)(1). Specifically, defendants contend that plaintiffs Nexans Wires S.A. (“Nexans”) and Lacroix
&
Kress GmbH (“L
&
K”) lack standing to sue under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030. By order of October 16, 2003, defendants’ motion to dismiss was converted into a motion for summary judgment. Plaintiffs were
BACKGROUND
Plaintiffs filed this action against their wire and cable industry competitors Sark-USA and Sarkuysan for unfair competition. Plaintiff L & K, a German corporation, is wholly owned by plaintiff Nexans, a French corporation. Defendant Sark-USA is a Delaware corporation with its principal place of business in North Carolina and is the wholly owned subsidiary of defendant Sarkuysan, a Turkish corporation. The complaint 1 asserts claims of misappropriation of trade secrets under New York and North Carolina law, unfair competition under New York, North Carolina and South Carolina law, tortious interference with prospective economic advantage and conversion under New York law, and five claims under thе CFAA. Federal jurisdiction is based on the CFAA claims.
All of plaintiffs’ claims arise out of the subject of a related action, A.E.B. International, Inc. and Atlantic Specialty Wire, Inc. v. Myron Daniel Schatzberg, Sark-USA Inc., Brigit Sheet Finley, and Sarkuysan Elektrolitik Bakir Sanayii Ve Ticaret A.S., 02 Civ. 6312(MGC). In that action, the plaintiffs, A.E.B. International, Inc. (“AEB”) and its sister company, Atlantic Specialty Wire, Inc. (“ASW”), sue defendants Sarkuysan and Sark-USA and two former employees, Myron Daniel Schatzberg (“Schatzberg”) and Brigit Skeet Finley (“Finley”) for misappropriation of trade secrets, tortious interference with prospective economic advantage, unfair competition and violations of the CFAA.
According to the complaint in this action, plaintiffs Nexans and L & K manu-facturé and supply “advanced copper and optical fiber wire and cable solutions to the infrastructure, industry and building markets.” Compl. ¶ 13. Plaintiffs are a major supplier of AEB and produce products which AEB then distributes throughout the United States. Plaintiffs assert that in order to maintain this relationship with AEB, it was necessary for plaintiffs to store much of their “confidential proprietary information” on the computers of AEB and ASW. This information consisted of plaintiffs’ pricing schedules as well as manufacturing information. The information was stored in AEB’s secure centralized computer system in New York and in ASW’s computer system in South Carolina. Plaintiffs’ information was segregated from other files and password protected to insure confidentiality.
Sarkuysan manufactures wire and cable products to be sold in the United States in direct competition with plaintiffs and AEB. Plaintiffs allege that at sometime prior to the departure of Schatzberg' and Finley from AEB and ASW, Schatzberg, Finley and Sarkuysan, agreed to establish a new company, Sark-USA. The organization of Sark-USA enabled Sarkuysan to operate directly in the United States and- to serve as the “repository” of plaintiffs’ “stolen and misappropriated confidential, proprietary information.” Compl. ¶ 28.
The essence of plaintiffs’ complaint is that . defendants induced Finley and Schatzberg to steal plaintiffs’ proprietary information from AEB and ASW. Specifically, the complaint alleges that Finley had
In addition to the alleged misappropriation of plaintiffs’ information from the computers of AEB and ASW, plaintiffs assert that Schatzberg misappropriated information gleaned from a visit to L & K’s factory. In March 2002, Schatzberg traveled to L & K’s factory in Germany with the. Chairman of AEB, A. Erkan Buyuksoy (“Buyuksoy”) where the two toured the L & K factories and learned detailed information about the manufacturing process, which each agreed to keep confidential. However, Schatzberg’ allegedly violated this agreement and divulged all that he had learned from the trip to defendants.
DISCUSSION
1. Basis for Jurisdiction
Defendants moved under both Fed. R.Civ.P. 12(b)(1) and Fed. R.Civ.P. 12(b)(6) to dismiss the complaint. “A ease is properly dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) when the court lacks the statutory or constitutional power to adjudicate the case. In contrast, a dismissal under Rule 12(b)(6) is a dismissal on the merits of the action — a determination that the facts alleged in the complaint fail to state a claim upon which relief can be granted.”
Nowak v. Ironworkers Local 6 Pension Fund,
II. Conversion of Defendants’ Motion to Dismiss into, a Motion for Summary Judgment
“If, on a motion ... to dismiss for failure of the pleading to state a claim upon which relief can bé granted, matters outside the pleading are presented to and not excluded by the court, the motion shall
III. Standard for Summary Judgment
Where there áre no material facts in dispute, a motion for summary judgment should be granted. Fed.R.Civ.P. 56(c). “Rule 56(c) mandates the entry of summary judgment ... against a party who fails to make a showing sufficient to establish the existence of an element essential to that party’s case, and on which that party will bear the burden of proof at trial.”
Celotex Corp. v. Catrett, 477
U.S. 317, 322,
The issue in dispute is whether plaintiffs can prove an essential element of their CFAA claims, i.e. a “loss ... aggregating at least $5,000 in value.” 18 U.S.C. § 1030(g),(a)(5)(B)®.
IV. The Computer Fraud and Abuse Act Claims
Plaintiffs allege that defendants Sark-USA and Sarkuysan violated the CFAA by inducing Schatzberg and Finley to copy and delete the computer files of AEB and ASW, files which contained plaintiffs’ “confidential proprietary information.”.
The CFAA is a criminal statute, but it also provides for a civil right of action. 18 U.S.C. § 1030(g). Plaintiffs have alleged that the acts of defendants violated § 1030(a)(2)(C), (a)(4), (a)(5)®, (a)(5)(ii), and (a)(5)(iii).
4
Undér § 1030(a)(2)(C), “[wjhoever ... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer if the conduct involved an interstate or foreign communication” may be punished. Section 1030(a)(4) prohibits accessing a protected computer without authorization “knowingly and with intent to defraud”
Section 1030(g) provides that a civil action may only be brought if the conduct involves one of the factors set forth in clause (i), (ii), (iii), (iv) or (v) of subsection (a)(5)(B). 18 U.S.C. § 1030(g)! Here, the only applicable section of (a)(5)(B) is (a)(5)(B)(i): “loss to 1 or more persons during any 1-year period ... aggregating at' least $5,000 in value.” Section 1030(e)(ll) defines “loss” as:
any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.
Plаintiffs must meet this jurisdictional threshold in order to sue on any of the five CFAA claims they assert.
Theofel v. Farey-Jones,
It is clear from the complaint that AEB and ASW, not plaintiffs, own the computers which were allegedly unlawfully accessed. This raises the question of whether a third-party who does not own or control the unlawfully accessed computer has standing to bring suit under the Act. At least one court has specifically held that there is no ownership or control requirement in the CFAA.
Theofel,
The case defendants cite to support their argument that a corporation cannot be found liable under the CFAA for the actions of its employees is inapposite. In
Doe v. Dartsmouth-Hitchcock Medical Center,
No. Civ. 00-100-M,
A. Plaintiffs’Alleged “Loss”
1. Travel Expenses-
■Plaintiffs’ allegation of “loss” in their complaint simply tracks the language of the statute, and states that they have suffered a “loss” of at least $5,000 in value. In response to the order directing plaintiffs to submit the facts upon which the alleged loss is based, plaintiffs submitted two affidavits of Wolfgang Plаcke, the General Manager of L & K. The “loss”
Placke asserts that the second trip, made by Maerker in February 2003, was prompted by the resignation of Finley. The affidavit does not state when Placke received this information. But, according to the complaint, Finley resigned in June 2002, seven months before the February trip. The total cost of these two trips was $8,007.14, which plaintiffs argue meets the jurisdictional threshold of a “loss” of at least $5,000.
Defendants make several arguments as to why the cost of these business trips does not constitute “loss” within the meaning of the CFAA. 5 The most compelling argument is that neither trip’s cost constitutes “loss” because the cost was unrelated to investigating or remedying damage to a computer. Placke’s affidavit does not assert that he or Maerker or even Buyuksoy ever examined a computer or made a computer assessment. Moreover, Placke clarifies in his second affidavit that when he stated in his first affidavit that Buyuksoy checked thе AEB computer system after Schatzberg’s departure, he is not actually sure who checked the computer nor is he sure whether it was an AEB or ASW computer. In sum, defendants argue that plaintiffs’ executives did not engage in any activity on their trips that could not have just as easily taken place over the telephone.'
In response, plaintiffs assert that they have established a prima facie case of standing by alleging that they, incurred $8,007.14 in costs in responding to CFAA violations. Placke’s affidavits describe the meetings which took place, including one at ,Le Cirque restaurant, as well as a confidential meeting between Plaсke, Maerker, and Buyuksoy where they “discussed what proprietary and confidential information was believed to have been stolen, how-that proprietary and confidential information had been stolen, and what steps we could take in the future to prevent [ ] such computer-based theft.” • Aff. Dec. 8, 2003, ¶ 9.
Placke also states that his belief in having meetings such as this conducted in person, made it impossible for these conversations to have taken place over the telephone. In sum, plaintiffs state that the expenses incurred by their senior executives in traveling to a meeting to discuss confidential information stolen by a customer’s faithless employees constitutes “loss” within the meaning of the CFAA.
Prior to the clarifying amendment of 2001, “loss” was not defined. “Damage” was defined as “any impairment to the integrity or availability of data, a- program, a system, or information that (A) causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals...” Since the first, sentence of § 1030(g) provides a right of action for anyone who suffers “damage or loss,” Judge Buchwald considered whether “loss,” as well as “damage,” was subject to the $5,000 statutory minimum.
See In re DoubleClick Inc. Privacy Litigation,
The In re Doubleclick court examined the legislative history of the statute in order to understand the meaning of'the then undefined term “loss”:
The 1994 amendment [to § 1030(g) ] required both “damage” and “loss,” but it is not always clear what constitutes “damage.” For example, intruders often alter existing log-on programs so that user passwords are copied to a file which the hackers can retrieve later. After retrieving the newly created password file, the intruder restores the altered log-on file to its original condition. Arguably, in such a situation, neither the computer nor its information is damaged. Nonetheless, this conduct allows the intruder to accumulate valid user passwords to the system, requires all system users to change their passwords, and requires the system administrator to devote resources to resecuring the system. Thus, although there is argü-ably no “damage, ” the victim does suffer “loss.” In re DoubleClick154 F.Supp.2d at 521 (quoting S.Rep. No. 104-357, at 11 (1996) (emphasis added)).
From this, the court concluded that: “Congress intended the term ‘loss’ to target remedial expenses borne by victims that could not properly be considered direct damage caused by a computer hacker.” Id. at 521.
It is also clear that the remedial costs contemplated by “loss” are not limited to the cost of actual repairs themselves, but incurred “because of interruption of service.” Id. at 522 n. 29 (citing 132 Cong. Rec. S14453 (daily ed. Oct. 1, 1986)(state-ment of co-sрonsor Sen. Trible): “[i]n addition; the concept of ‘loss’ embodied in this paragraph will not be limited solely to the cost of actual repairs. The Justice Department has suggested that other costs, including the cost of lost computer time necessitated while repairs are being made, be permitted to count toward the [then] $1,000 valuation. I and the other sponsors of this bill agree.”). Therefore, it seems that “loss” means any remedial costs of investigating the computer for damage, remedying the damage and any costs incurred because the computer cannot function while or until repairs are made. However, thеre is nothing to suggest that the “loss” or costs alleged can be unrelated to the computer.
Although the court was examining a slightly different issue, the
In re DoubleClick
court’s analysis is especially helpful because it examined a proposed definition of “loss” which is virtually identical to the current definition.
Id.
at 522 n. 29.
6
The
In 2001, 1030(g) and the definition of “damage” were amended, and a definition of “loss” was added. Nothing in the legislative history of the 2001 amendment suggests that the costs incurred in “responding to an offense” or in “conducting a damage assessment” can be- unrelated to a computer. See Cong. Rec. S 10913, 106th Cong (Oct. 24, 2000)(noting the inclusion of the definition of “loss” and the intent to incorporate the $5,000 jurisdictional threshold into a description of the offense). Therefore, the meaning of “loss,” both before and after the term was defined by statute, has consistently meant a cost of investigating or remedying damage to a computer, or a cost incurred because the computer’s service was interrupted.
Another decision sheds additional light on the types of harm the statute contemplates. In
Tyco Int’l Inc. v. John Does,
No. 01 Civ. 3856,
[w]hile it is true, ... that the CFAA allows recovery for losses beyond mere physical damage to property, the additional types of damages awarded by courts under the Act have generally been limited to those costs necessary to assess the damage caused to the plaintiffs computer system or to resecure the system in the wake of a hacking attack. See EF Cultural Travel BV v. Explorica, Inc.,274 F.3d 577 , 584-85 (1st Cir. 2001) (awarding costs of assessing- damage); United States v. Middleton,231 F.3d 1207 ,1213-14 (9th Cir.2000)(awarding costs of “investigating and repairing the damage” FN3 ); In re DoubleClick Inc. Privacy Litigation,154 F.Supp.2d 497 , 524-25 (S.D.N.Y.2001)(recognizing only costs in remedying damage as recoverable under CFAA).
Even cases'which have taken an expansive view of the CFAA jurisdictional threshold have not suggested that “loss” can include a cost unrelated to the computer. In
Pacific Aerospace & Electronics, Inc. v. Taylor,
b. Plaintiffs’ Travel Expenses Do Not Constitute “Loss”
Quoting the language of the statute, Placke’s affidavits assert that the two trips were for the purpose of “conducting a damage assessment” and “responding to the offense.” 18 U.S.C. § 1030(e)(ll). However, the affidavits do not allege any facts showing that this assessment or response was in any way related to a computer. It was undoubtedly necessary for plaintiffs to speak with AEB and ASW about the business repercussions of the alleged actions оf Schatzberg and Finley. Plaintiffs have a close working relationship with AEB and ASW and the activities of faithless employees would be cause for alarm and discussion. These employees had substantial rara-computer information, which had been gleaned from Schatzberg’s trip to L & K and his photocopying of AEB and ASW files. However, nothing in the two affidavits indicates that during these meetings computers were being investigated or repaired. In fact, one of the meetings took place at an expensive restaurant and.another was strictly between Maerker, Placke and Buyuksoy, which eliminates the possibility that they were working with a computer technician or consultant. It is clear that these meetings were held to discuss the problem of the information of AEB and ASW getting into the hands of competitors. However, nothing suggests that the trips were taken to engage in any type of computer investigation or repair. Furthermore, no facts are alleged showing that preventive measures were added to the computers or that the system was augmented to tighten security — after all, these were discussions between senior executives — not computer experts. Placke states that the meeting was held at AEB’s offices because of his belief in having meetings conducted in person. He does not suggest that the meetings were held at AEB so that he and Maerker could inspect or repair the computers.
In the related action, AEB has asserted that it incurred costs in investigating the unauthorized access and in making repairs, and has also asserted claims under the CFAA. However, Nexans & L & K do not allege that they were required to contribute to any such costs incurred by AEB, nor do they state that they paid technicians to conduct, a computer investigation or make repairs to AEB’s computers.
Plaintiffs do not cite any case which holds that the travel expenses of these
2. Lost Revenue
Finally, at oral argument, plaintiffs contended that the revenue they lost as a result of defendants’ use of their information to unfairly compete for business constitutes “loss” within the meaning of § 1030(e)(ll) and gives them standing under § 1030(g). Placke asserts that at trial, plaintiffs will be able to prove the loss of two specific business opportunities. However, plaintiffs state in a later submission, that they are not arguing that the revenue they lost as a result of the alleged unfair competition alone satisfies the CFAA’s “loss” requirement. It is not clear whether plaintiffs continue to press their argument that revenue lost as a result of lost business opportunities may be counted toward the $5,000 threshold. Nevertheless, their argument is unpersuasive.
First, the “revenue lost” which constitutes “loss” under § 1030(e)(ll) appears from the plain language of the statute to be revenue lost “because of [an] interruption of service.” § 1030(e)(ll). Therefore, if Nexans and L & K had lost revenue because the computer systems of AEB and ASW were down, that would seem to be the type of lost revenue contemplated by the statute. However, plaintiffs are not claiming to have lost money because the computers of AEB or ASW were inoperable, but rather because of the way the information was later used by defendants.
Second, persuasive authority suggests that plaintiffs’ lost revenue due to lost business opportunity does not constitute “loss” under the statute. In
Register.com, Inc. v. Verio, Inc.,
lost good will [sic] or business could provide the [$5,000 amount, however,] it could only do so if it resulted from the impairment or unavailability of data or systems. The good will lоsses cited by [the plaintiff] are not the result of harm addressed by 1030(a)(5)[ (iii) ]. How [the defendant] uses the [] data, once extracted,. has no bearing on whether [defendant] has impaired the availability or integrity of [plaintiffs] data or computer systems in extracting it.
Thus, the court found that the loss of business due to defendants’ eventual use of the information, rather than a loss of business because of computer impairment, was too far removed from computer damage to count toward the jurisdictional threshold.
Lastly, the cases on which plaintiffs rely are not persuasive. In
Four Seasons Hotels and Resorts BV v. Consorcio Barr, S.A.,
Plaintiffs do not cite any case which lends support to finding a “loss” of $5,000 based on (1) travel costs of senior executives or (2) loss of revenue unrelated to interruption of computer service. Therefore, defendants’ motion 'for summary judgment dismissing plaintiffs’ five claims under the CFAA is granted.
V. Plaintiffs’ State Law Claims
Plaintiffs also assert state law claims for misappropriation of trade secrets under New York and North Carolina law, unfair competition under New York, North Carolina and South Carolina law, and tortious interference with prospective economic advantage and conversion under New York lаw. Supplemental jurisdiction over these claims is appropriate since they arise out óf the same nucleus of operative facts as the federal claims.
United Mine Workers v. Gibbs,
CONCLUSION
Plaintiffs have not raised any factual dispute and have not shown that they can prove an essential element of their federal claims, namely, that plaintiffs suffered a “loss” of $5,000 within the meaning of the CFAA, 18 U.S.C. § 1030. Accordingly, defendants’ motion for summary judgment dismissing the CFAA claims is granted. In the interest of judicial economy, I retain jurisdiction over plaintiffs’ state law claims.
SO ORDERED.
Notes
. Plaintiffs submitted a proposed amended complaint with their opposition papers to defendants’ motion to dismiss. That is the complaint under consideration.
. This also resolves the parties’ dispute concerning the appropriateness of a 12(b)(1) evi-dentiary hearing.
. Pursuant to the order of October 16, 2003, plaintiffs made their first submission regarding the facts which they rely on for standing on October 30, 2003 and defendants made their initial response on November 13, 2003. Plaintiffs replied on November 18, 2003, which prompted a November 21, 2003 rebuttal from defendants. Plaintiffs submitted a Supplemental Affidavit on December 12, 2003 and defendants responded on December 19, 2003.
. Plaintiffs' complaint actually alleges viola- ■ tions of 18 U.S.C. § 1030(a)(5)(A), (a)(5)(B) and (a)(5)(C). Pursuant to the 2001 amendments to the CFAA, these subsections are now (a)(5)(i), (a)(5)(h), and (a)(5)(iii).
. Defendants submitted deposition testimony and affidavits of Buyuksoy and Finley which contradict plaintiffs’ assertion of the purpose of the two trips. However, credibility may not be determined on a motion for summary judgment.
.
The court examined the "Enhancement of Privacy and Public Safety Act, S. 3083, 106th Cong (Sept. 20, 2000) which stated: (10) the term ‘loss’ includes — (A) the reasonable costs to any victim of — (i) responding to the offense; (ii) conducting a damage assessment; and (iii) restoring the system and data to their condition prior to the offense; and (B) any lost revenue or costs incurred by the victim as
. Although the court in Middleton uses the word "investigating,” it is clear from both the court's language ("investigating ... the damage ”) and the facts of the case that this investigation involved only assessing the damage to the system — not locating and collecting information about the hacker.