Thurmond v. Compaq Computer Corp.Thurmond v. Compaq Computer Corp.
MEMORANDUM OPINION AND ORDER GRANTING SUMMARY JUDGMENT ON SECTION 1030 DAMAGES 1
I.Introduction
Before the Court are: (1)
Defendant Compaq Computer Corporation’s Motion to Dismiss Plaintiffs’ Fourth Amended Original Complaint for Lack of Subject Matter Jurisdiction and Failure to State a Claim
(Doc. No. 283); (2)
Defendant Compaq Computer Corporation’s Motion to Dismiss Plaintiffs’ Fifth Amended Complaint for Lack of Subject Matter Jurisdiction and Failure to State a Claim
(Doc. No. 368); (3)
Defendant Compaq Computer Corporation’s Supplement to its Motion to Dismiss for Lack of Subject Matter Jurisdiction and Failure to State a Claim or, alternatively, Compaq’s Motion for Summary Judgment on Plaintiffs’ Claim under the Computer Fraud and Abuse Act
(Doc. No. 428); and (4)
Defendant Compaq Computer Corporation’s Motion for Summary Judgment on Plaintiffs’ Breach of Warranty Claims and 1030 Damages
(Doc. No. 389.)
2
Having considered the arguments of counsel, the summary judgment evidence, and the applicable law, the Court finds that neither Charles Thurmond, Hal LaPray, Tracy D. Wilson, Jr., nor Alisha Seale Owens has offered sufficient evidence of “damage” to maintain a claim under the Computer Fraud and Abuse Act (“CFAA”),
II. Background and Procedural History
On October 31, 1999, Plaintiffs Charles Thurmond and Hal LaPray filed this class action lawsuit on behalf of themselves and all others similarly situated against Compaq Computer Corporation (“Compaq”). 3 In their class complaint, Plaintiffs allege Compaq “designed, sold, manufactured, transmitted or created” certain computers that contain floppy diskette controllers (“FDC”) with infected FDC microcode. (Doc No. 353 at 1.) What is an FDC?
The FDC directs the transfer of data from the floppy disk drive to the computer’s memory and vice versa. For example, each time the Court saves this opinion to floppy disk the data travels along the computer’s bus system to the FDC. 4 The FDC then writes the data to a designated location on a floppy disk (“write operation”). “If a defective FDC is made to wait a few microseconds too long, the FDC can write the delayed data as the first byte of the next physically adjacent data sector of a *670 floppy diskette and destroy or ‘zero out’ the remainder of the data in that sector or transfer an incorrect number of bytes.” (Id. at 10.) Plaintiffs term this condition a “boundary error.” (See id.) The likelihood of boundary errors increased with the advent of multitasking computers; this in turn “aggravated the severity of the problem caused by infected FDCs.” (Id.) Ordinarily, the FDC will detect delays (“underruns” or “overruns”) during a write operation, and trigger a flag that notifies the control program to rewrite the data correctly. In this case, Plaintiffs allege the defective FDCs in certain Compaq computers are incapable of detecting boundary errors. (See id.) Plaintiffs allege Compaq’s “infected FDCs instead verify erroneous results without an error status, resulting in the storage of corrupt data or the destruction of data without notice to the control program or operating system and without the operator’s knowledge.” (Id. at 9.)
In February, 2000, Compaq released a software patch (“SoftPaq”) to remedy the alleged boundary errors caused by defective FDCs. (See id. at 15.) The SoftPaq was made available to computer owners by either internet download, CD ROM, image installation, or warranty service, and at least one Plaintiff actually installed the patch. (See id. at 16.) However, Plaintiffs allege the SoftPaq does not cure the defective FDCs, but instead, corrupts data and degrades computer performance. (See id. at 15.)
Plaintiffs maintain they suffered damages as a result of Compaq “distributing, selling, or otherwise transmitting” allegedly infected FDCs and the SoftPaq.
(Id.
at 20.) Moreover, Plaintiffs allege Compaq’s conduct violates the CFAA,
On January 28, 2000, Compaq filed Defendant Compaq Computer Corporation’s Motion to Dismiss for Lack of Subject Matter Jurisdiction and Failure to State a Claim. (Doc. No. 11.) In its initial motion, Compaq argued that Plaintiffs’ claim under the CFAA could not support federal subject matter jurisdiction. The Court disagreed and denied Compaq’s motion on February 28, 2000. (Doc. No. 71.) Further, the Court noted “Compaq’s ‘motion to dismiss’ raises matters outside the pleadings and is, in fact, a premature motion for summary judgment.” (Id.)
Months later, Compaq filed
Defendant Compaq Computer Corporation’s Motion to Dismiss Plaintiffs’ Fourth Amended Original Complaint for Lack of Subject Matter Jurisdiction and Failure to State a Claim.
(Doc. No. 283.) Plaintiffs subsequently amended their complaint
(see
Doc. No. 353), at which time Compaq filed
Defendant Compaq Computer Corporation’s Motion to Dismiss Plaintiffs’ Fifth Amended Original Complaint for Lack of Subject Matter Jurisdiction and Failure to State a Claim.
(Doc. No. 368.)
6
In its
*671
new motions, Compaq urges the Court to reconsider its earlier denial of Compaq’s Motion to Dismiss for Lack of Subject Matter Jurisdiction and Failure to State a Claim.
7
Again, Compaq argues Plaintiffs’ CFAA claim cannot support federal subject matter jurisdiction. In the alternative, Compaq moves the Court to dismiss Plaintiffs’ federal claim on the merits. Additionally, Compaq filed
Defendant Compaq Computer Coloration’s Motion for Summary Judgment on Plaintiffs’ Breach of Warranty Claims and Section 10S0 Damages.
(Doc. No. 389.) In its motion, Compaq urges the Court to grant summary judgment on Plaintiffs’
III. Jurisdiction AND Venue
The Court has subject matter jurisdiction over this case pursuant to
IV. Legal Standards
A.
A district court’s federal question jurisdiction is limited to cases arising under the Constitution, a federal law, or a treaty.
However, where issues of jurisdiction and substance are intertwined “[t]he relatively expansive standards of a 12(b)(1) motion are not appropriate.”
Roberts,
As noted, Compaq urges the Court to dismiss Plaintiffs’ complaint for lack of federal subject matter jurisdiction.
(See
Doc. No. 368.) Specifically, Compaq contends Plaintiffs’ claim under
B.
Dismissal of an action is appropriate where the complaint fails to state a claim upon which relief may be granted. FED. R.- CIV. P. 12(b)(6). Several well settled principles guide the 12(b)(6) inquiry.
When considering a motion to dismiss, the Court must construe the complaint in the light most favorable to the plaintiff, accepting as true the material allegations in the complaint as well as any reasonable inferences to be drawn therefrom.
Kaiser
*673
Aluminum & Chem. Sales v. Avondale Shipyards, Inc.,
General allegations suffice at the pleading stage since it is presumed that general allegations embrace those specific facts necessary to support the claim.
National Org. for Women v. Scheidler,
As a practical matter, a 12(b)(6) dismissal should only be granted where the plaintiff pleads himself out of court on the face of the complaint. 5A WRIGHT & MILLER, FEDERAL PRACTICE AND PROCEDURE: CIVIL § 1357 (2d ed.1990). It must appear beyond doubt that the plaintiff can prove no set of facts in support of the claim entitling him to relief.
Conley,
In this case, Compaq’s 12(b)(6) motion raises matters outside the pleadings. The Court has discretion either to consider or reject these matters when making its 12(b)(6) determination.
“If, on a motion asserting the defense numbered (6) to dismiss for failure of the pleading to state a claim upon which relief can be granted, matters outside the pleadings are presented to and not excluded by the court, the motion shall be treated as one for summary judgment and disposed of as provided in Rule 56, and all parties shall be given reasonable opportunity to present all materials made pertinent to such a motion by Rule 56.”
The Court elects to look beyond the pleadings and treat Compaq’s 12(b)(6) motion as one for summary judgment under
B.
Summary judgment is appropriate if no genuine issue of material fact exists and the moving party is entitled to judgment as a matter of law.
Procedurally, the party moving for summary judgment bears the initial burden of “informing the district court of the basis for its motion, and identifying those portions of [the record] which it believes demonstrates the absence of a genuine issue of material fact.”
Celotex Corp.,
If the nonmoving party fails to make a sufficient showing of an essential element of a claim to which it has the burden of proof at trial, then the moving party is “entitled to judgment as a matter of law.”
Celotex Corp.,
*675 Mindful of these considerations, the Court now turns to the substantive arguments of Compaq’s motions.
V. Discussion
“The widespread and increasing use of computers by organizations of all types, and by individuals, engaged in interstate or foreign commerce or communication promises a large and increasing role for § 1030. Where misuse of a computer is to be attacked, both prosecutors and civil plaintiffs are likely to find it often a useful addition to the array of fraud statutes in title 18.”
13
Compaq’s motions raise several novel issues concerning the necessary elements of Plaintiffs’ civil claim under the CFAA,
A. Plaintiffs’ Civil Claim under the CFAA
In their complaint, Plaintiffs contend Compaq distributed, sold, or otherwise transmitted infected FDCs and the Soft-Paq in violation of
As noted, Plaintiffs predicate their civil claim on a violation of
There is no need for the Court to address every element of
B. Plaintiffs’ “Damage” under
In their complaint, Plaintiffs allege they have suffered damage and loss as a result of the SoftPaq and infected FDCs “designed, manufactured, created, distributed, sold and marketed” by Compaq. (Doc. No. 353 at 10 & 16.) Compaq raises two objection to Plaintiffs’ allegations in its motion for summary judgment. First, Compaq contends Plaintiffs cannot show an “impairment to the integrity or availability of data.” (Doc. No. 389 at 39.) Second, Compaq argues Plaintiffs are unable to show “damage” that meets the statutory threshold amount of $5,000. (See id.) Under the CFAA, the term “damage” is defined as “any impairment to the integrity or availability of data, a program, a system, or information that—
(A) causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals;
(B) modifies or impairs, or potentially modifies or impairs, the medical exami *677 nation, diagnosis, treatment, or care of one or more individuals;
(C) causes physical injury to any person; or
(D) threatens public health or safety.”
To interpret statutory terms, the Court looks first to the plain language of the statute, examining “the statute as a whole, including its design, object, and policy.”
New York Life Ins. Co. v. Deshotel,
Plaintiffs first argue they are not bound by the statutory definition of “damage” under
*678
Regardless whether Plaintiffs plead “loss,” “damage” or both, they are required to prove “damage” as an integral element of the violation alleged under
Plaintiffs next argue they can prove statutory “damage” under
Plaintiffs’ summary judgment evidence is sufficient to raise a genuine issue of fact on their claim concerning “impairment to the integrity or availability of data.” In
Shurgard Storage Centers, Inc. v. Safeguard Self Storage, Inc.,
Plaintiffs’ sworn affidavits demonstrate an issue of fact regarding the “impairment to the availability of a system”
(i.e.
use of their personal computers). Each Plaintiff declares that upon learning of the allegedly defective FDC they stopped using their computers, and turned the computers over to their attorneys for investigation.
(See
Thurmond Aff. ¶ 8 at 2; LaPray Aff. ¶ 8 at 2; T. Wilson Aff. ¶ 13 at 3; Owens Aff. ¶ 14 at 4.) Furthermore, the deposition testimony of Plaintiffs raises questions of fact on the issue of “impairment to the
*679
integrity of data.”
19
Plaintiff Thurmond testified he had problems “backing up and reading to and from a floppy.” (Thurmond Dep. at 38:22-23.) Likewise, Plaintiff LaPray testified he experienced data loss saving a legal motion to floppy disk. (LaPray Dep. at 53:1-54:7.)
20
Finally, Plaintiff Wilson testified he could not open up or read floppy disks. (T. Wilson Dep. at 32:21-25.) The Court finds that Plaintiffs have offered sufficient summary judgment evidence of “impairment to the integrity [and] availability” of their computers.
In their complaint, Plaintiffs allege Compaq’s conduct resulted in “damage” that: “[i] caused and is causing loss aggregating at least $5,000 in value during any one-year period to one or more individuals; [ii] modifies, impairs, or potentially modifies or impairs, the medical examination, diagnosis, treatment, or care of one or more individuals; and [iii] threatens public health or safety.” (Doc. No. 353 at 13.)
21
In addition, Plaintiffs allege that some putative class members use Compaq computers in “doctors offices, hospitals, banks, governmental installations, air traffic control systems, and medical laboratories.”
(Id.
at 2.) Plaintiffs, however, offer no summary judgment evidence that the SoftPaq or FDCs in their personal computers caused “damage” that “modifies, impairs, or potentially modifies or impairs, the medical examination, diagnosis, treatment, or care of one or more individuals.”
Subsection 1030(e)(8)(A) applies to “damage” that “causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals.”
Plaintiffs argue that the definition allows aggregation of “damage” to “one or more individuals,” and not just the “damage” to an individual plaintiff.
(Id.)
According to Plaintiffs’ interpretation of
First, Plaintiffs’ interpretation wrongfully assumes the existence of a certified class. Where, as here, there has been no certification, the Court treats the case as one brought by Plaintiffs individually, not as members of a putative class.
See Tuchman v. DSC Communications Corp.,
Second, the plain language of
As Attorney General Janet Reno recently explained to a congressional subcommittee considering amending
We also need to consider additional tools to locate and identify cybercriminals. For example, we may need to strengthen the Computer Fraud and Abuse Act by closing a loophole that allows comput *681 er hacker who have caused a large amount of damage to a network of computers to escape punishment if no individual computer sustained over $5,000 worth of damage.
Hearing Before the Subcomm. on Commerce, Justice and State; Judiciary and Related Agencies of the Senate Comm, on Appropriations,
106th Cong. (2000) (Statement of Janet Reno Attorney General of the United States, “Cybercrime”),
available at
Sen. Thurmond: Mr. Holder, as you know, to violate the Computer Fraud and Abuse Act, perpetrators must cause over $5,000 in damage to an individual computer. Has this standard for damages, and the actual definition of ‘damages,’ caused problems in prosecutions? Mr. Holder: Yeah, I think there is a potential problem there.
Internet Denial of Service Attacks and Federal Response: Joint Hearing of Crime Subcomm. of the House Judiciary Comm, and the Criminal Justice Oversight Comm, of the Sen. Judiciary Comm.,
106th Cong. (2000) (Testimony of Erie Holder, Esq., United States Deputy Attorney General, Dept, of Justice) (emphasis added). The Justice Department’s understanding of the statute suggests “damage” must be to an individual computer. Plaintiffs interpretation allows aggregation of loss caused by a “transmission” to more than one computer. However, the language of
In this case, Plaintiffs’ claims are expressly limited to monetary damages “equal to the cost of repair, replacement, or a refund of the purchase price, and the cost of investigating, analyzing, and dealing with [Compaq’s] prohibited transmission of the FDC microcode.” (Doc. No. 353 at 20.) Even if Plaintiffs received full refund of the purchase price paid, they still would not meet the $5,000 threshold. (See Thurmond Dep. at 57:18-25 (total cost of computer was approximately $1,500); La-Pray Dep. at 33:5-12 (total cost of computers was between $1,100 and $1,200); T. Wilson Dep. at 24:6-25:14 (total cost after rebate was approximately $900); Bart Owens Dep. at 20:6 (total cost of computer was “around $1,200”).) Additionally, the individual costs of repairing Plaintiffs’ computers does not satisfy the $5,000 minimum. Plaintiffs’ economic expert, Dr. Ra-jendra K. Srivastava, testified that “[t]he cost of repairing the defective FDCs (and the motherboard) will be the cost of materials (the motherboard with embedded components, including the FDC) and la *682 bor.” (Srivastava Decl. ¶ 2 at 2-3.) According to Dr. Srivastava’s best estimate, the maximum repair costs (material and labor) is $500-$600 per computer. (,See id.)
Finally, Plaintiffs argue that the expenses attributed to investigating and analyzing the allegedly defective FDCs “easily” satisfy the $5,000 obligation under
Here, Plaintiffs suggest
Middleton
applies to the costs of hiring their technical expert, Dr. W. Udo Pooch.
(See
Doc. No. 470 at 39.) “The costs incurred by plaintiffs with Dr. Pooch, alone, would meet the $5,000 threshold, if a threshold is required.”
(Id.)
Plaintiffs urge the Court to consider such costs when calculating “damage” under
In
Middleton,
the district court’s jury instruction focused on measures “reasonably necessary” to “restore” and “rese-cure” damaged “data, program[s], system[s], or information.”
Middleton,
For the reasons stated above, the Court finds that Plaintiffs have not come forward with sufficient evidence of “damage” to survive summary judgment on their individual CFAA claims. Therefore, Compaq is entitled to judgment as a matter of law.
C. Class Representation
Plaintiffs come before this Court as proposed representatives of a nationwide class of computer owners who allegedly suffer damages as a result of infected FDC microcode. (Doc. No. 425). The Court is aware that a determination of whether a class meets the requirements of
Notwithstanding, the Court has great discretion in determining whether to certify a class.
Mullen v. Treasure Chest Casino, LLC,
To maintain a class action, a proposed representative must satisfy the prerequisites of
*684
The Court doubts whether Charles Thurmond, Hal LaPray, Tracy D. Wilson, Jr., Alisha Seale Owens, or anyone similarly situated could satisfy
VI. CoNClusion
Based on the summary judgment evidence presented, and the reasons set out above, the Court concludes that no genuine issue of material fact exists concerning “damage” as defined by
Therefore, the Court GRANTS
Defendant Compaq Computer Corporation’s Motion for Summary Judgment on Section 10S0 Damages
[389], and DISMISSES Plaintiffs’ civil action under
SO ORDERED.
Notes
. The Court's Memorandum Opinion and Order supplements the earlier Order (Doc. No. 497), dated March 7, 2001.
. Because the arguments in Compaq’s motions overlap considerably, the Court consolidates the submissions for consideration.
. Plaintiffs subsequently added Tracy D. Wilson, Jr. and Alisha Seale Owens (collectively, "Plaintiffs”). (See Doc No. 123.)
. The data travels along the bus system one byte at a time. A "byte” is an eight-bit segment of data. In typical computer usage, it usually represents one character such as “A” or "7” or "z.”
.
. As noted, Compaq also filed Defendant Compaq Computer Corporation's Supplement to its Motion to Dismiss Plaintiffs’ Fifth Amended Complaint for Lack of Subject Matter Jurisdiction and Failure to State a Claim or, alternatively, Compaq’s Motion for Summary Judgment on Plaintiffs' Claim under the Computer Fraud and Abuse Act. (Doc. No. 428.)
. The arguments in Compaq’s Motion to Dismiss Plaintiffs’ Fourth Amended Complaint (Doc. No. 283) are incorporated by reference in Compaq’s Motion to Dismiss Plaintiffs’ Fifth Amended Complaint (Doc. No. 368.)
. “The questions of subject matter jurisdiction and the merits will normally be considered intertwined where the statute provides both the basis of federal court subject matter jurisdiction and the cause of action.’’
Clark,
. "Federal judges today face cases involving complicated statutes and factual assertions, many of which straddle the intersection of law, technology, and the physical, biological and social sciences.” Chief Justice Rehnquist’s 2000 Year-End Report on the Federal Judiciary.
. The Court referred all pretrial matters in this case to United States Magistrate Judge Wendell C. Radford. As always, the Court appreciates Judge Radford's insight and the assistance of his staff.
. The deadline for filling dispositive motions (including summary judgment motions) in this matter was January 12, 2001. Plaintiffs' deadline to respond was February 19, 2001. (See Doc. No. 393.)
. To date, discovery in this matter has yielded millions of pages of documents, the deposition testimony of numerous witnesses, and answers to countless interrogatories. The sealed documents alone attest to the amount of discovery conducted.
. Richard Cooper, Business Crime; Computer Fraud, NAT'L L.J., February 26, 2001, at A11.
. Plaintiffs submit the same allegations regarding the SoftPaq. (See id. at 15-17.)
. Subsection 1964(c) of RICO provides, in part: “Any person injured in his business or property
by reason of a violation
of section 1962 of this chapter may sue therefor in any appropriate United States district court and shall recover threefold the damages he sustains and costs of the suit, including a reasonable attorney’s fee.”
. Obviously, proof of an indictment or conviction would conclusively establish the elements of
. The Court has already written at length on the statutory interpretation of "transmission” in
Shaw v. Toshiba America Information Systems, Inc.,
. If one "hangs one's hat,” so to speak, on a violation of
. Plaintiff Owens testified she personally never experienced a problem with her computer other than the computer "freezing up and running slow.” (Owens Dep. at 48:20-23.) This testimony suggests an "impairment to the availability” of Plaintiffs Owens’ computer, but is not evidence that her computer failed "to maintain data in a protected state.”
Shurgard,
. Interestingly, Plaintiff LaPray cannot remember the length of the motion; the nature of the motion; the court in which the motion was filed; or who actually signed the motion. (LaPray Dep. at 54:8-24.)
. Plaintiffs explicitly deny any claim for consequential damages as a result of actual loss or corruption of data. (Doc. No. 353 at 15.) Therefore,
.Plaintiff Wilson testified that his wife used their computer for entering medical transcriptions. "She does some stuff for PTA; and also, she does some medical transcription stuff she uses it for.” (T. Wilson Dep. at 29:2-4.) One might argue that Plaintiff Wilson’s testimony raises an issue of fact on "damage” as defined under
. Defendant, an ex-employee of Slip.net, accessed the computer responsible for Slip.net's internal administrative functions. Once inside Slip.net’s system, defendant altered administrative passwords, reconfigured the system's registry, deleted internal databases, and eliminated the entire billing system.
Middleton,
. Repair to the Slip.net system included restoring access to the computer system, assigning new passwords, reloading the billing software, and recreating the deleted databases. See id.
. Plaintiffs suggest Dr. Pooch was hired as an outside consultant like the one hired in Middleton. (Doc. No. 470 at 39.)
. The Court will not consider the costs incurred by Plaintiffs' attorneys related to Dr. Pooch.
. Indeed, this Court certified a settlement class action in a similar lawsuit. See
Shaw v. Toshiba Am. Info. Sys., Inc.,
. The Supreme Court noted that "a different case would be presented if the District Court had certified a class and only later had it appeared that the named plaintiffs were not class members or were otherwise inappropriate class representatives.”
Id.
at 406, n. 12,
.Parker & Parsley Pet. Co.
v.
Dresser Indus. Inc.,