This misappropriation of trade secrets action requires us to decide two issues arising under the Computer Fraud and Abuse Act (CFAA) that have split the circuit courts and the Third Circuit has yet to address. First, can an employee who misuses information she was authorized to access be held liable? Second, may a plaintiff only recover losses caused by an interruption of service? Stated differently, can the plaintiff recover losses that are not linked to an interruption of service? We answer the first question in the negative, and the second in the affirmative.
Teva alleges that its former employee, Barinder Sandhu, passed trade secrets to her romantic partner, Jeremy Desai, the CEO of Apotex, its competitor. Tipped off that Sandhu had transmitted confidential documents to Apotex, Teva conducted an internal investigation that confirmed the tip. Teva then terminated her and filed this action against Sandhu, Apotex, and Desai for computer fraud under federal law, misappropriation of trade secrets under federal and state law, and state law tort claims.
Sandhu, Apotex, and Desai move to dismiss the complaint, arguing that Teva fails to allege facts giving rise to a claim for relief. Teva sufficiently pleads that its trade secrets were misappropriated; Sandhu converted its trade secrets and breached her employment contract and her fiduciary duty; and Desai and Apotex procured information by improper means, tortuously interfered with Sandhu's employment contract, and aided and abetted her breach of fiduciary duty owed to Teva. Because it fails to plead that Sandhu's accessing its computer system was without authorization or exceeded her authorization, Teva's claim under the CFAA against Sandhu is dismissed. Therefore, we shall grant the motions in part and deny them in part.
Factual Background
From June 25, 2012 until October 11, 2016, Sandhu worked at Teva in Regulatory Affairs.
Sometime in the summer of 2016, Teva learned from a former Apotex employee that Sandhu had shared confidential information about its products in development with Desai.
Teva then brought this action. It brings a claim under the CFAA for unauthorized access of its protected computers. It contends that Sandhu, Desai, and Apotex misappropriated its trade secrets in violation of the Defend Trade Secrets Act (DTSA) and the Pennsylvania Uniform Trade Secrets Act (PUTSA). Teva also asserts state law tort claims for conversion and procuring information by improper means against all defendants; breaches of contract and fiduciary duty against Sandhu; aiding and abetting a breach of fiduciary duty against Apotex and Desai, tortious interference with contractual relations against Apotex and Desai; and unfair competition against Apotex. In addition to demanding compensatory and punitive damages, Teva seeks to enjoin all defendants from retaining and using its improperly acquired trade secrets and confidential information.
Standard of Review
A Rule 12(b)(6) motion tests the sufficiency of the allegations contained in the complaint. In order to survive a Rule 12(b)(6) motion, "a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.' " Ashcroft v. Iqbal ,
A conclusory recitation of the elements of a cause of action is not sufficient. Phillips v. Cty. of Allegheny ,
All well-pleaded allegations of the complaint must be accepted as true and interpreted in the light most favorable to the plaintiff, and all inferences must be drawn in the plaintiff's favor. See McTernan v. City of York ,
Computer Fraud and Abuse Act (CFAA)
The CFAA imposes civil liability on anyone who knowingly "accesses a protected
The defendants argue that Teva has not stated a claim under the CFAA because it has failed to plead that Desai and Apotex accessed Teva's computers, that Sandhu exceeded her authorized access to Teva's computers, and that Teva suffered a recoverable loss. Desai and Apotex also contend that Teva fails to plead that its computers are statutorily protected.
Because Teva does not allege that Sandhu acted without authorization or exceeded her authorized access, the CFAA claim against her must be dismissed. On the other hand, the CFAA claims against Desai and Apotex survive under a theory of indirect unauthorized access.
Protected Computer
A protected computer is one that "is used in or affecting interstate or foreign commerce or communication."
The complaint clearly alleges that the computer Sandhu accessed was connected to the Internet and used in interstate communication. Teva's global headquarters is in Pennsylvania, where Sandhu resided and from where she transmitted the trade secrets to Desai in Canada. Apotex, the ultimate recipient of the information, is a Canadian corporation based in Toronto.
Access
The CFAA does not define "access." Nor does it define "without authorization." The statute defines "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter."
How to apply the definition of "exceeds authorized access" under section 1030(a)(4) of the CFAA when it is an employee who properly accessed and improperly used the information has split the circuit courts. The division has resulted in two views of the reach of the employee's authorization. Under the narrow approach, employees who misuse information they obtained through authorized access are not subject to liability. The broad approach holds them liable.
The First, Fifth, Seventh, and Eleventh Circuits interpret the statute broadly, treating employees the same as any other persons who misuse information obtained from a computer. They hold them liable even though they were authorized to obtain the information. See United States v. Rodriguez ,
The Third Circuit has yet to address the issue. Courts within this district universally subscribe to the narrow approach, barring liability where the employee has authorization to access the computer to obtain the information.
In interpreting a statute, we start with the plain language. Kingdomware Techs., Inc. v. United States , --- U.S. ----,
In determining whether language is ambiguous, we "read the statute in its ordinary and natural sense." In re Harvard Indus., Inc. v. IRS ,
The statute defines "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter."
Because the statute does not define "authorization," "we construe it in accordance with its ordinary meaning." United States v. Husmann ,
Applying this definition to the statutory framework, an employee is "authorized to access a computer when his employer approves or sanctions his admission to that computer." Dresser-Rand ,
The statute, read plainly, does not ensnare a person who was authorized to obtain information in the computer, but was not authorized to use it the way she did. Had Congress intended the statute to punish one who misuses information she was authorized to obtain, it knew how to do so. It could have added one word-"use"-to the statute, so it would read, "to access a computer with authorization and to use such access to obtain[, use, ] or alter information in the computer that the accesser is not entitled so to obtain[, use ,] or alter."
Courts subscribing to the broad approach expand the scope of the statute beyond what Congress intended. See, e.g. , S. Rep. 99-432, at 3 (1986); see also Nosal ,
"Exceeds authorized access" means obtaining information beyond what was authorized. It does not go to the improper use of the information validly accessed. WEC Carolina ,
In WEC Carolina , a WEC employee emailed confidential documents he had downloaded to his personal account before resigning from the company to work for a competitor.
The Fourth Circuit held that an employee exceeds his authorized access "when he has approval to access a computer, but uses his access to obtain or alter information that falls outside the bounds of his approved access."
Under this narrow approach we adopt, Teva fails to state a claim against Sandhu. She was permitted to access the Teva computer in the course of her employment to obtain information in its database, including the information she allegedly shared with Desai and Apotex. Because she was authorized to access Teva's computers when she did, any subsequent misuse of the information is not actionable. See, e.g. , id.; Brekka ,
Outsiders, like Apotex and Desai, are not treated the same as insiders. Rather, they are akin to hackers, those the CFAA aimed to hold criminally and civilly liable. They did not have authority to access the computers. But, they indirectly accessed Teva's protected computers through one who had the authority. They knew the information they obtained had been purloined through accessing Teva's computers.
A person who did not directly access the computer may still be liable under the CFAA if he "directs, encourages, or induces" someone else to access a computer that he himself is unauthorized to access. Brand Energy ,
Teva alleges that Desai and Apotex, who were not authorized to do so, acted in concert with Sandhu, an employee at Teva, to access its protected computers.
Loss
Loss under the CFAA "means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."
We agree with the circuit courts that interpret loss as composed of two distinct categories. Section 1030(e)(11) is comprised of two dependent clauses, separated by the word "and."
The different interpretations arise from the effect of the last five words of the definition, the phrase "because of interruption of service." What the phrase modifies is the source of the different interpretations. It is a postpositive modifier because it is positioned after what it modifies. A. Scalia & B. Garner, Reading Law: The Interpretation of Legal Texts at 148 (2012).
A postpositive modifier may not apply to multiple series when the statutory language also includes a determiner-a modifying word that introduces and provides context to the word or words it modifies. When a determiner, such as "any,"
Here, the definition of loss is comprised of two series, each beginning with the determiner "any." In other words, appearing a second time in the definition, "any" signals the beginning of a second series. The two series are separated by "and," and each is introduced by "any." The first series consists of "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense." In the first series, there are three examples of "any reasonable cost," which are introduced by "including," connoting a non-exhaustive list. The second series is "any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."
The postpositive modifier "because of interruption of service" appears at the end of the second series. The syntax suggests that it modifies only the second series because the determiner "any" signals the start of the second series, which begins after the word "and." See Scalia & Garner, Reading Law at 148-50 (citing Pritchett ,
Although we conclude the statutory language creates two categories of loss, there is reasonable disagreement as to its meaning. Accordingly, we examine the legislative history to discern congressional intent.
What Congress intended has also engendered disagreement. Courts examining the legislative history have reached opposite conclusions on Congress's intent in defining loss. Compare, e.g. , Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC , Civ. A. No. 3:10 CV 1590,
Unfortunately, the legislative history provides no guidance to discern Congress's intent in defining loss. Loss was not defined in the CFAA until the statute was amended in 2001. There is a dearth of legislative history associated with the 2001 amendment. In the only relevant statement describing the amendment, Congress discussed the scope of losses recoverable as those incurred "responding to a computer hacker." 147 Cong. Rec. S10990-02, 20 (2001).
Teva contends that the defendants' accessing its protected computers instigated the internal investigation into Sandhu. The investigation included searching her company-issued laptop and email account.
It does not matter that service continued uninterrupted. As we have determined, direct costs of responding to a violation or assessing the damage done are recoverable even without an interruption of service. E.g. , Brown Jordan Int'l ,
On the other hand, Teva cannot recover under the CFAA for lost revenue caused by misappropriation of confidential information. It has not alleged that any lost revenue was caused by a service interruption. Losses in the second category are recoverable only if they are related to an interruption of service. Lost revenue, which falls in the second category, is not recoverable under the CFAA unless it was caused by interruption of service. Nexans Wires ,
Defend Trade Secrets Act (DTSA)
The DTSA creates a private right of action for the misappropriation of trade secrets.
The defendants argue that the DTSA does not apply because it was enacted after the alleged misappropriation took place. Teva counters that although the defendants acquired and began using its trade secrets prior the effective date of the DTSA,
Because the misappropriated trade secrets were acquired and used before the enactment of the DTSA does not mean the statute does not apply when use continued after enactment. Misappropriation,
Teva alleges that the defendants continued to use its trade secrets after May 11, 2016, the date of the enactment of DTSA. Teva avers specifically that Apotex continues to use the information in the CRL to make purchasing decisions and set production goals that increase its profits and visibility in the marketplace.
Desai and Apotex also argue that Teva fails to state a claim under the DTSA and the PUTSA because the complaint does not identify what trade secrets were misappropriated. On the contrary, Teva's allegations are sufficient to put the defendants on notice of what Teva alleges the defendants purloined.
Although the DTSA and the PUTSA use different wording to define a trade secret, they essentially protect the same type of information. Both define a trade secret as information that: (a) the owner has taken reasonable means to keep secret; (b) derives independent economic value, actual or potential, from being kept secret; (c) is not readily ascertainable by proper means; and (d) others who cannot readily access it would obtain economic value from its disclosure or use.
The CRL contained confidential comments from the FDA regarding a drug application that Apotex used to "speed the regulatory approval" of its competing generic product.
These documents contain information that was not available outside Teva because it was classified as confidential and Teva took measures to restrict access to it. Its value was essential to Teva's maintaining an advantage over its competitors. Apotex can use it to gain a competitive edge on Teva.
Drawing all reasonable inferences in favor of Teva, we conclude it has identified documents that contain trade secrets. Thus, the misappropriation claims under the DTSA and the PUTSA may proceed.
PUTSA Preemption
The defendants argue that Teva's common law tort claims are preempted by PUTSA to the extent they are based on allegations of misappropriated trade secrets. The defendants are correct that PUTSA preempts "conflicting" state law tort claims that are "based on the same conduct that is said to constitute a misappropriation of trade secrets."
It is premature to determine whether the tort claims conflict with PUTSA because Teva may pursue alternative theories of liability at this stage. See Cenveo Corp. v. Slater , Civ. A. No. 06-2632,
If Teva is ultimately unsuccessful on its PUTSA claim, it may still pursue its common law tort claims. A jury could find that Teva has not proven one or more elements for PUTSA liability. If so, there is no PUTSA claim to preempt the tort claims. If the tort claims had been prematurely dismissed, Teva would have no remedy for tort claims and the misappropriation of its trade secrets that it may have proven. If Teva is successful on its PUTSA claim and the jury also finds for Teva on its common law tort claims, Teva will not be allowed to receive double recovery. See, e.g. , Cenveo Corp. ,
Tortious Interference
Apotex and Desai argue that even if Teva's tort claims are not preempted by PUTSA, it has not stated a tortious interference claim because it fails to allege that they took purposeful action. According to Teva's complaint, Desai received confidential data and trade secrets from Sandhu, knowing that her sharing the information violated her employment contract with Teva. As a result, Teva argues, Apotex is vicariously liable for Desai's tortious interference.
A plaintiff states a claim for tortious interference if: (1) there is a contract between the plaintiff and a third party; (2) the defendant intended to harm the plaintiff by interfering with the contract; (3) the defendant was not privileged or justified in doing so; and (4) the defendant's conduct caused the plaintiff damages. Phillips v. Selig ,
Teva alleges that Sandhu was party to a confidentiality agreement with her employer and Desai induced her to breach it by providing him with Teva's confidential information and trade secrets. Teva avers inferentially that Desai intended to use the materials to Apotex's advantage and Teva's disadvantage. As Desai's employer and beneficiary of the information, Apotex may be held liable for torts committed by its employee. These allegations sufficiently state a claim for tortious interference.
Breach of Fiduciary Duty and Aiding and Abetting Breach of Fiduciary Duty
Apotex and Desai contend that they cannot be held liable for aiding and abetting a
To establish a claim for aiding and abetting a breach of fiduciary duty, the plaintiff must show: (1) a third party breached a fiduciary duty owed to the plaintiff; (2) the aider and abettor knew of the breach; and (3) the aider and abettor substantially assisted or encouraged the other in effecting that breach. Chicago Title Ins. Co. v. Lexington & Concord Search & Abstract, LLC ,
Here, Teva alleges that Sandhu had a fiduciary duty to it, she breached her duty, Apotex and Desai knew she was breaching the duty owed to her employer, and they encouraged and substantially assisted her in the breach. These allegations sufficiently state claims for Sandhu's breach of her fiduciary duty to Teva, and for Desai and Apotex's aiding and abetting her breach.
Sandhu, Desai, and Apotex argue that the claims for Sandhu's breach of fiduciary duty and for Desai and Apotex's aiding and abetting that breach are barred by the "gist of the action" doctrine. They contend that these claims are premised on Sandhu's breach of her confidentiality agreement. Hence, according to the defendants, Teva's claim against Sandhu is essentially one for breach of contract, not an action in tort.
Pennsylvania's gist of the action doctrine precludes a plaintiff from bringing what is actually a breach of contract claim as a tort claim. Bruno v. Erie Ins. Co. ,
When the parties' obligations are defined by the terms of a contract and not by duties imposed by social policies, a plaintiff may assert only a contract claim. Bruno ,
In determining whether the gist of the action is based on a contract or a tort, we look to the nature of the duty allegedly breached. Id. at 63. If the claim arises directly from a breach of a contractual duty created by the parties, it is a contract action. If the claim arises from the violation of a broader social duty imposed by society and not by the parties to the action, it is a tort action. Id. Thus, the substance of the allegations in the complaint is of "paramount importance." Id. at 68.
The fact that there is a contract between the parties does not necessarily mean that a party's claim for injury or loss resulting from the other party's conduct in performing the contract is a claim for breach of contract. On one hand, a breach of contract cause of action is based on the breach of a specific executory promise in the contract. Id. at 70. On the other hand, a tort action
A claim for breach of fiduciary duty and a claim for breach of contract "can only coexist if the fiduciary duty is based on duties imposed as a matter of social policy and ... not based on a contractual agreement between the parties." Synthes,
Here, Teva contends that Sandhu's collaborating with Desai and Apotex creates tort liability, separate and apart from her contractual obligations not to disclose trade secrets to a competitor. We agree.
Sandhu's fiduciary duty was not created by her confidentiality agreement. Instead, it arose from her employment relationship. An employee owes the employer a duty of loyalty "to refrain from competing with the principal and from taking action on behalf of, or otherwise assisting, the principal's competitors throughout the duration of the agency relationship, as well as a duty not to use property or confidential information of the principal for the agent's own purpose or those of a third party." Synthes ,
Teva has sufficiently alleged that Apotex, through its agent Desai, encouraged Sandhu to share trade secrets with them in breach of her known duty. At this stage, that is enough. Therefore, we shall deny Apotex's motion to dismiss the claim for aiding and abetting Sandhu's breach of fiduciary duty.
Sandhu, Desai, and Apotex alternatively argue that both the breach of fiduciary duty and the aiding and abetting claims are barred by the economic loss doctrine. The economic loss doctrine provides that "no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage." Excavation Techs., Inc. v. Columbia Gas Co. of Pa.,
The claims for breach of fiduciary duty and for aiding and abetting that breach have as an element knowledge and intent on the part of the defendants. See Restatement (2d) of Torts § 876(b). They are intentional torts. They do not sound in negligence. Thus, the economic loss doctrine does not apply. See Knight v. Springfield Hyundai ,
Unfair Competition
Without analysis or explanation, Apotex argues that Teva fails to allege "substantial in[ter]ference" with its business "in a way that had tangible market
Although no Pennsylvania appellate court has formally recognized the common law tort of unfair competition, several lower state courts have, relying on the Restatement (3d) of Unfair Competition § 1 to define its elements. See, e.g. , Babiarz v. Bell Atl.-Pa., Inc. , No. 1863,
Under the Restatement, a defendant is liable for unfair competition if: (1) he engages in deceptive marketing, infringement of trademark or other protectable intellectual property, misappropriation of trade secrets, or acts or practices that are actionable under federal or state statutes; and (2) his conduct causes harm to the plaintiff's commercial relations. Restatement (3d) of Unfair Competition § 1 ;
Where the plaintiff claims the defendant misappropriated trade secrets, tortiously interfered with contract, improperly induced its employees, or unlawfully used its confidential information, the plaintiff states a claim for unfair competition. Restatement (3d) of Unfair Competition § 1 ; see also Synthes,
Conversion
Sandhu argues that intangible intellectual property cannot be converted. On the contrary, trade secrets are treated as convertible property under Pennsylvania law. Gladstone Tech., Partners, LLC v. Dahl ,
To state a claim for conversion of trade secrets, a plaintiff must allege that: (1) it owns a trade secret; (2) the trade secret was communicated to the defendant within a confidential relationship; and (3) the defendant used the trade secret to the plaintiff's detriment. Am. Hearing Aid Assocs. ,
Teva states a claim for conversion against Sandhu. It alleges that Sandhu knowingly provided its trade secrets, the CRL and other confidential materials, to Desai and Apotex, who used the trade secrets to compete with Teva, to its detriment. See Neopart Transit, LLC v. Mgmt. Consulting, Inc. , Civ. A. No. 16-3103,
Teva fails to state a claim for conversion against Desai and Apotex. Neither Desai nor Apotex was allegedly in a confidential relationship with Teva. Instead, they were competing with Teva. See Restatement of Torts § 757, cmt. j. Thus, we shall deny the motion to dismiss the conversion claim against Sandhu, but grant the motions as to Desai and Apotex.
Procuring Information By Improper Means
Finally, the defendants contend Teva has failed to state a claim for procuring information by improper means.
When the defendant, "for the purpose of advancing a rival business interest, procures by improper means information about another's business[, he] is liable to the other for the harm caused by his possession, disclosure or use of the information."
Teva alleges that Apotex, through Desai, improperly procured the CRL and other confidential information from Sandhu, and used that information to gain a competitive advantage. These allegations state a cause of action against Desai and Apotex for procuring information by improper means.
The claim against Sandhu, however, must be dismissed. Teva alleges that she procured the information while employed there. It does not allege that she got it by improper means. Indeed, as we have seen, she was authorized to procure the information.
Count Seeking Permanent Injunction
An injunction is a remedy rather than a cause of action. A separate claim for injunctive relief is unnecessary. See, e.g. , Birdman v. Office of the Governor ,
Notes
Compl. (Doc. No. 1) ¶¶ 33, 38, 81. The facts recited are those alleged in the complaint.
Id. ¶ 44.
Id. ¶¶ 48-53.
Id. ¶ 5.
Id. ¶ 56.
Id. ¶¶ 56-58.
Id. ¶¶ 59-61; Teva Resp. to Apotex Mot. to Dismiss (Doc. No. 47) at 7, ECF 15.
Compl. ¶¶ 64, 81.
Id. ¶ 66.
Id. ¶¶ 67-68.
Id. ¶¶ 75-80.
Id. ¶ 81.
Id. ¶¶ 25-28. Apotex's U.S. subsidiary is a Delaware corporation headquartered in Florida. Id. ¶ 29.
Apotex Mot. to Dismiss at 18, ECF 23. Desai "joins and incorporates" all of Apotex's arguments in its motion as they apply to him. See generally Desai Mot. to Dismiss (Doc. No. 49-1).
See, e.g. , Brand Energy & Infrastructure Servs., Inc. v. Irex Contracting Grp. , Civ. A. No. 16-2499,
Compl. ¶ 27.
Id. ¶¶ 104-05.
See, e.g. , Advanced Fluid Sys., Inc. v. Huber ,
They explain that interpreting loss as composed of two distinct categories reduces the second half of the definition to surplusage. See, e.g., Cont'l Grp. ,
Loss "means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."
"Any" is a determiner that quantifies the noun it modifies.
We also examined the legislative history prior to the 2001 amendment. According to the co-sponsor of the bill introducing the CFAA, the concept of loss was not meant to be limited solely to the cost of actual repairs. Instead, it includes "the cost of computer time necessitated while repairs are being made." 132 Cong. Rec. S14453 (daily ed. Oct. 1, 1986) (statement of co-sponsor Sen. Trible); see also In re DoubleClick Inc. Privacy Litig. ,
Compl. ¶ 64.
The DTSA became effective on May 11, 2016. Pub. L. No. 114-153, § 2,
See, e.g. , Compl. ¶ 70.
Apotex Mot. to Dismiss at 21-22, ECF 26-27.
Apotex Mot. to Dismiss at 22, ECF 27.
Section 1 states in full:
One who causes harm to the commercial relations of another by engaging in a business or trade is not subject to liability to the other for such harm unless:
(a) the harm results from acts or practices of the actor actionable by the other under the rules of this Restatement relating to:
(1) deceptive marketing ... ;
(2) infringement of trademarks ... ;
(3) appropriation of intangible trade values including trade secrets and the right of publicity ... ;
or from other acts or practices of the actor determined to be actionable as an unfair method of competition, taking into account the nature of the conduct and its likely effect on both the person seeking relief and the public; or
(b) the acts or practices of the actor are actionable by the other under federal or state statutes, international agreements, or general principles of common law apart from those considered in this Restatement.
Restatement (3d) of Unfair Competition § 1.
Compl. ¶¶ 59-61.
Apotex Mot. to Dismiss at 24, ECF 29.
Sandhu Mot. to Dismiss (Doc. No. 50) at 13, ECF 17.
