Volpe v. Abacus Software Sys. Corp.

MICHAEL VOLPE, Plaintiff, v. ABACUS SOFTWARE SYSTEMS CORPORATION, Defendant.

Civil No. 20-10108 (RMB/KMW)

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW JERSEY CAMDEN VICINAGE

June 15, 2021

[Docket No. 9]

OPINION

APPEARANCES:

Hinman, Howard & Kattell, LLP

By: Daniel Harris Roseman, Esq.

707 Westchester Ave

Suite 407

White Plains, NY 10604

Attorney for Plaintiff

Archer & Greiner PC

By: Michael S. Horn, Esq.

Court Plaza South

West Wing

21 Main Street, Suite 353

Hackensack, NJ 07081

Attorney for Defendants

BUMB, UNITED STATES DISTRICT JUDGE:

Before the Court is Defendant Abacus Software Systems Corporation's ("Defendant" or "Abacus") Motion to Dismiss Plaintiff Michael Volpe's ("Plaintiff" or "Volpe") Complaint. For the reasons set forth herein, the Court will deny this motion.

I. BACKGROUND

In October 2011, Plaintiff began working for Defendant as an information technology salesperson. [Docket No. 1, at ¶ 8]. At this time, both parties signed an Employment Agreement. [Id. at ¶ 9]. According to the Complaint, Defendant breached this agreement in 2016 by "unilaterally, and without justification or notice, reduc[ing] Plaintiff's salary from $72,000.00 to $50,000.00 per year." [Id. at ¶ 16]. Plaintiff alleges that Defendant breached the agreement because the agreement purportedly required any salary reduction to be in writing and agreed to by both parties, which did not happen. [Id. at ¶¶ 17-18]. Volpe also claims that he repeatedly objected to his salary reduction, and that those objections went unanswered. [Id. at ¶20].

Plaintiff's relationship with his employer then continued to deteriorate. In late 2018, Defendant allegedly stopped reimbursing Plaintiff for certain business expenses. [Id. at ¶ 21]. Previously, Defendant had allegedly reimbursed Plaintiff for all expenses incurred in connection with his employment. [Id. at ¶ 22].

About one year later, in October 2019, Defendant informed Plaintiff that he would be terminated. [Id. at ¶ 24]. Plaintiff alleges that, shortly after this meeting and without notice,Defendant remotely accessed Plaintiff's personal smart phone and erased "all of the data." [Id. at ¶¶ 25-26].

Defendant allegedly accessed Plaintiff's personal iPhone using a feature called "find my iPhone." [Id. at ¶ 26]. This feature allows a user to remotely delete data from a phone affiliated with their "Apple ID." [Id.]. Although Defendant did not have access to Plaintiff's Apple ID password, Plaintiff alleges that Defendant was able to reset the password using his employer-provided e-mail address, and then delete his personal data. [Id.]. According to Plaintiff, the erased data included "(1) Contacts, (2) Pictures and videos, (3) Data, (4) Applications, (5) Purchases, (6) E-mails, and (7) Settings." [Id. at ¶ 27]. Plaintiff's attempts to recover this data were unsuccessful. [Id. at ¶ 28].

Volpe asserts six causes of action. Plaintiff alleges that Defendant breached his contract by both reducing his pay (Count One) and by refusing to reimburse his business expenses (Count Two). Similarly, Plaintiff alleges that Defendant's actions constitute a breach of the Covenant of Good Faith and Fair Dealing (Count Three). Moreover, Plaintiff claims that Defendant's unilateral reduction of his pay violates N.J.S.A. § 34:11-4.6(b), which requires employers to provide advance notice of changes to employee pay (Count Four). The final two counts arise from Defendant's purportedly improper access toPlaintiff's phone, which led to the deletion of Plaintiff's data. Volpe claims that this action constitutes a violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (Count Five) and the New Jersey Computer Related Offenses Act, N.J.S.A. § 2A:38A-3 (Count Six).

Defendant now moves to dismiss Plaintiff's fifth count, the Computer Fraud and Abuse Act claim. Without this claim, Defendant argues, Plaintiff asserts only state law claims totaling less than $75,000. Moreover, Defendant contends that, after dismissing Plaintiff's only federal claim, the Court should decline to exercise supplemental jurisdiction, and instead dismiss the entire action for lack of jurisdiction. Thus, the Court turns its analysis to Plaintiff's fifth count.

II. STANDARD OF REVIEW

To withstand a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), "a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. at 662. "[A]n unadorned, the defendant-unlawfully-harmed-me accusation" does not suffice to survive amotion to dismiss. Id. at 678. "[A] plaintiff's obligation to provide the 'grounds' of his 'entitle[ment] to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly, 550 U.S. at 555 (quoting Papasan v. Allain, 478 U.S. 265, 286 (1986)).

In reviewing a plaintiff's allegations, the district court "must accept as true all well-pled factual allegations as well as all reasonable inferences that can be drawn from them, and construe those allegations in the light most favorable to the plaintiff." Bistrian v. Levi, 696 F.3d 352, 358 n.1 (3d Cir. 2012). The Court may consider only the allegations in the complaint, and "matters of public record, orders, exhibits attached to the complaint and items appearing in the record of the case." Oshiver v. Levin, Fishbein, Sedran & Berman, 38 F.3d 1380, 1384 n.2 (3d Cir. 1994) (citing Chester Cnty. Intermediate Unit v. Penn. Blue Shield, 896 F.2d 808, 812 (3d Cir. 1990)).

In addition, Defendant also argues that the Court should dismiss Plaintiff's Computer Fraud and Abuse Act claim pursuant to Fed. R. Civ. P. 12(b)(1). A motion to dismiss for lack of subject matter jurisdiction, pursuant to Fed. R. Civ. P. 12(b)(1), "may be treated as either a facial or factual challenge to the court's subject matter jurisdiction." See Mortensen v. First Fed. Sav. and Loan Ass'n, 549 F.2d 884, 891(3d Cir.1977). A facial attack "is an argument that considers a claim on its face and asserts that it is insufficient to invoke the subject matter jurisdiction of the court." Const. Party of Pennsylvania v. Aichele, 757 F.3d 347, 358 (3d Cir. 2014). In contrast, a factual attack "is an argument that there is no subject matter jurisdiction because the facts of the case. . . do not support the asserted jurisdiction." Id. Stated differently, "a facial attack contests the sufficiency of the pleadings, whereas a factual attack concerns the actual failure of a plaintiff's claims to comport factually with the jurisdictional prerequisites." Id. (cleaned-up).

When a motion to dismiss presents a facial attack, "the court must only consider the allegations of the complaint and documents referenced therein and attached thereto, in the light most favorable to the plaintiff." In re Schering Plough Corp., 678 F.3d 235, 243 (3d Cir. 2012). In other words, the Court applies "the same standard of review it would use in considering a motion to dismiss under Rule 12(b)(6), i.e., construing the alleged facts in favor of the nonmoving party[,]" when reviewing a facial attack. Const. Party of Pennsylvania, 757 F.3d at 358. But in reviewing a factual attack, the Court "may consider evidence outside the pleadings." Gould Elecs. Inc. v. United States, 220 F.3d 169, 176 (3d Cir. 2000).

III. ANALYSIS

Defendant argues that Plaintiff failed to state a claim under the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030. The CFAA was designed to create a cause of action against computer hackers. Dresser-Rand Co. v. Jones, 957 F. Supp. 2d 610, 613 (E.D. Pa. 2013). Although the CFAA was originally exclusively a criminal statute, it has been amended to include a civil cause of action. See Computer Abuse Amendments Act of 1994, Pub.L. No. 103-322, § 290001(d), 108 Stat. 1796 (codified at 18 U.S.C. § 1030(g)).

To state a civil CFAA claim, a plaintiff must establish that defendant (1) has accessed a "protected computer;" (2) has done so without authorization or by exceeding such authorization as was granted; (3) has done so "knowingly" and with "intent to defraud"; and (4) as a result has "further[ed] the intended fraud and obtain[ed] anything of value." P.C. Yonkers, Inc. v. Celebrations the Party & Seasonal Superstore, LLC., 428 F.3d 504, 508 (3d Cir. 2005) (quoting 18 U.S.C. § 1030(a)(4)).

The CFAA further provides that:

Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i).

18 U.S.C. § 1030(g). As relevant here, Plaintiff contends that he has satisfied this requirement by identifying "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value," in violation of § 1030(c)(4)(A)(i)(I). [See Docket No. 13, at 8].

A. Protected Computer

The CFAA defines a protected computer, as relevant here, as a computer "used in or affecting interstate or foreign commerce or communication." § 1030(e)(2)(B). Defendant argues that Plaintiff has not sufficiently alleged that his iPhone was a "protected computer" under this definition. The Court disagrees. Plaintiff has established that his phone was a "smart device" [Docket No. 1, at ¶ 53] capable of accessing the internet. [Id. at ¶¶ 26-27] Moreover, the very nature of Plaintiff's claim concerns remote access of information, via the internet, on his communications device. See United States v. MacEwan, 445 F.3d 237,...