By Mark Engstrom, J.D.
Facebook was entitled to $79,641 in compensatory damages, $39,797 in discovery sanctions, and permanent injunctive relief in its computer trespass case against the operator of a website that violated the Computer Fraud and Abuse Act (CFAA) and Section 502 of the California Penal Code by "scraping" proprietary material from the Facebook website using the accounts of Facebook users who were induced to disclose their login information, the federal district court in San Jose, California, has ruled (Facebook, Inc. v. Power Ventures, Inc., May 2, 2017, Koh, L.).
Lawsuit/appeal/remand. Facebook sued Power Ventures Inc. and its CEO for violations of the CFAA, Section 502 of the California Penal Code, and other federal and state laws. According to Facebook, the defendants used its proprietary data, without permission, by inducing Facebook users to provide their login information and then using that information to "scrape" Facebook’s proprietary material. The defendants then displayed Facebook’s material on their power.com website. Facebook alleged that it never gave the defendants its permission to use its material in that way. It also alleged that the defendants had sent unsolicited and deceptive email messages to Facebook users.
In 2012, the district court granted summary judgment to Facebook on its §502 and the CFAA claims. In September 2013, a magistrate judge issued an order that required the CEO of Power Ventures to pay Facebook $39,796.73 as a discovery sanction based on noncompliance during a Rule 30(b)(6) deposition. On September 25, 2013, the court ruled that Power Ventures and the CEO were liable, as a matter of law, for violations of the CFAA and the California Penal Code. Damages and permanent injunctive relief were awarded to Facebook.
The Ninth Circuit dismissed the CEO’s appeal of the discovery sanctions, and it affirmed in part and reversed in part the district court’s grant of summary judgment. The Ninth Circuit found that the defendants had violated the CFAA, but only for the period that followed their receipt of a cease and desist letter from Facebook on December 1, 2008.
Regarding damages, the Ninth Circuit found that Facebook employees had spent "many hours, totaling more than $5,000 in costs, analyzing, investigating, and responding to Power’s actions." However, in light of the Ninth Circuit’s finding that the relevant violation began only after Facebook had sent its cease and desist letter, the issue of damages was remanded so the district court could: (1) recalculate damages "for the period after Power received the cease and desist letter, when Power continued to access data contained in Facebook’s servers and memory banks" and (2) consider "appropriate remedies," including injunctive relief, under the CFAA and §502.
Starting date of nonuse period. The defendants argued that Facebook did not actually deny permission to use its website until December 26, 2008. According to the defendants, Facebook’s outside counsel had given them until that date to bring their software into full compliance with Facebook’s requirements.
The court rejected that argument because: (1) it was flatly contradicted by the Ninth Circuit’s ruling that Facebook had, through the written cease and desist letter of December 1, 2008, "expressly rescinded" permission to use the Facebook website and (2) giving the defendants two weeks before Facebook took further action was not a temporary grant of permission to access and use the website.
The defendants argued in the alternative that the "allowable period" began "at the earliest" on December 4, 2008, when Facebook "directly" made its cease and desist demand for the first time. That argument, however, was inconsistent with the Ninth Circuit’s ruling that Facebook had revoked its authorization on December 1, 2008. Because the defendants had not argued—before the district court or the Ninth Circuit—that the allowable period had begun on December 4, 2008, the argument was waived.
For those reasons, the court concluded that, for the purpose of damages calculations, Facebook had revoked the defendants’ authorization to use its website on December 1, 2008.
End date of applicable period. The defendants argued that the last date of "unauthorized access" to the Facebook website was December 30, 2008, because that was the day that: (1) the lawsuit was filed and (2) the defendants had ceased all unauthorized interaction with the website.
However, the Ninth Circuit had ruled that Power Ventures had "ended its campaign" near the end of "January 2009." In addition, the defendants had again accessed Facebook’s computers—despite the cease and desist letter—on February 5, 2009. Finally, the full extent of the defendants’ activities after December 2008 was "unknown" to the court because the CEO of power.com had testified that, in April 2011, he destroyed a logging database that contained evidence about the scope of the defendants’ activities after December 2008.
Even if the defendants had indeed ceased their active interaction with Facebook computers on December 30, 2008, nothing in the Ninth Circuit’s order suggested that the court should consider that issue on remand. Ultimately, the court’s ruling on the end of the applicable period was the law of the case.
For those and other reasons, the court rejected the defendants’ argument that Facebook could recover only those damages that were suffered on or before December 30, 2008. Facebook was entitled to compensation for all of the costs that it had suffered after December 1, 2008, in response to the defendants’ CFAA violations, and not merely for costs that were incurred while the defendants were actively interacting with Facebook’s website, the court concluded.
Over-inclusive damages. The defendants argued that Facebook’s claimed damages of $79,640.50 included damages that were attributable to a CAN-SPAM Act violation that the Ninth Circuit had reversed. However, that issue had already been resolved, prior to appeal, and the defendants failed to raise it in their appeal. The court’s previous decision was therefore law of the case.
In addition, all of Facebook’s investigation and enforcement efforts were reasonable responses to the CFAA violation, according to the court, and all of its investigation and enforcement costs were compensable under the CFAA. The court rejected the defendants’ argument that Facebook had insufficiently separated its CAN-SPAM Act damages from its CFAA damages.
Inadequate documentation. The defendants argued that Facebook failed to adequately document or justify the salary and hours of Facebook employee RyanMcGeehan. Facebook’s claim that it had incurred an estimated $5,000 in damages—because McGeehan had spent a considerable amount of time investigating and responding to Power’s activities—was "utterly unsupported by evidence," according to the defendants.
The court had previously ruled that Facebook’s damages calculations were fully justified by undisputed testimony, and the Ninth Circuit did not reverse that ruling on appeal. Instead, the appellate court had affirmed the district court’s finding that Facebook employees had "spent many hours, totaling more than $5,000 in costs, analyzing, investigating, and responding to Power’s actions." Consequently, the court’s earlier ruling on the adequacy of Facebook’s proof of damages was the law of the case.
Damages. The defendants’ objections to the $79,640.50 damages award were unpersuasive. The Ninth Circuit had ordered the district court to calculate CFAA damages for the period after December 1, 2008, when Facebook sent its cease and desist letter. In all other respects, the Ninth Circuit left the district court’s CFAA damages award undisturbed. Accordingly, the district court’s earlier rulings on those issues was the law of the case.
Pursuant to the Ninth Circuit’s order, the district court determined what damages were incurred after Facebook had sent its cease and desist letter on December 1, 2008. Facebook had established through undisputed evidence that, of the $80,543 in damages that the court had granted prior to appeal, only $902.50 was incurred on or before December 1, 2008. Subtracting that amount from the $80,543 award that the court had previously granted, the court found that Facebook had incurred $79,640.50 in losses on December 2, 2008 or later. Therefore, the court awarded Facebook $79,640.50 in compensatory damages under the CFAA.
Permanent injunction. In the court’s September 25, 2013 order, the court granted a permanent injunction to cure violations of the CAN-SPAM Act, the CFAA, and §502. However, the Ninth Circuit ordered that the court to "reconsider appropriate remedies under the CFAA and section 502, including any injunctive relief."
The permanent injunction that Facebook requested on remand was narrower than the court’s prior injunction in two significant ways. First, Facebook no longer sought the inclusion of two provisions that were specific to the CAN-SPAM Act violation that prohibited the defendants from sending unsolicited messages to Facebook users, or from making misleading statements about the defendants’ affiliation with Facebook in commercial messages. Second, the previous injunction prohibited the defendants from accessing the Facebook website, without permission, for "any" purpose, but Facebook asked that the language be narrowed to prohibit the defendants from accessing the Facebook website, without prior permission, for any "commercial" purpose.
The court found that the revised injunction was narrowly tailored to the defendants’ violations of the CFAA and §502 of the California Penal Code. After conducting a permanent injunction analysis, the court found that: (1) Facebook showed that irreparable harm from the defendants’ unauthorized access to its computer systems and illegal possession of its information; (2) remedies available at law, such as monetary damages, were inadequate to compensate Facebook for its injury; (3) in the absence of an injunction, the defendants would likely engage in similar conduct in the future, causing Facebook to suffer significant hardship, but an injunction would not cause a substantial hardship to the defendants; and (4) the public had an interest in ensuring that computers were not accessed without authorization. Because those four factors strongly supported injunctive relief, the court permanently enjoined the defendants from accessing or using, without prior permission, data from Facebook’s website or computer network.
Discovery sanctions. The court previously ordered the defendants to pay $39,796.73 as a discovery sanction by March 15, 2017, and even invited Facebook to file a motion for contempt based on the defendants’ failure to pay that sanction. In addition, the defendants offered no explanation or authority for their position that the discovery sanction should not be included in the judgment.
The court noted that its prior orders requiring the defendants to pay the sanction were "effective on [their] own." Nevertheless, to ensure that the record was clear, and in light of the defendants’ ongoing failure to pay the discovery sanction, the court decided to include the $39,796.73 discovery sanction in its judgment.
The case is No. 08-CV-05780-LHK.
Attorneys: David P. Chiappetta (Perkins Coie LLP) for Facebook, Inc. Scott A. Bursor (Bursor & Fisher PA) and Alan R. Plutzik (Bramson, Plutzik, Mahler & Birkhaeuser, LLP) for Power Ventures, Inc.
Companies: Facebook Inc.; Power Ventures, Inc.
MainStory: TopStory Advertising Privacy CaliforniaNews
Interested in submitting an article?
Submit your information to us today!Learn More