UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA
BREAKING CODE SILENCE, a California 501(c)(3) nonprofit,
Plaintiff, vs.
KATHERINE MCNAMARA, an Individual; JEREMY WHITELEY, an individual; and DOES 1 through 50, inclusive,
Defendants.
Case No. 2:22-cv-002052-SB-MAA
DEFENDANT JEREMY WHITELEY’S NOTICE OF MOTION AND MOTION FOR SUMMARY JUDGMENT OR IN THE ALTERNATIVE PARTIAL SUMMARY JUDGMENT; MEMORANDUM OF POINTS AND AUTHORITIES[SUPPORTING DECLARATIONS, INDEX OF EXHIBITS, AND PROPOSED ORDER FILED HEREWITH]
Date: January 2, 2024 Time: 10:00 a.m. Crtrm: 690[Assigned to the Hon. Maria A. Audero]
1 WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 2 of 34 Page ID #:4335
TO PLAINTIFF, ALL COUNSEL OF RECORD, AND THE COURT:
PLEASE TAKE NOTICE THAT at 10:00 a.m. on January 2, 2024, or as soon thereafter as counsel may be heard in Courtroom 690 of the Roybal Federal Building and United States Courthouse, located at 255 E Temple St, Los Angeles, California, Defendant JEREMY WHITELEY (“Whiteley”) will, and hereby does, move, pursuant to Federal Rule of Civil Procedure 56, for summary judgment on the Complaint filed herein by Plaintiff BREAKING CODE SILENCE (“BCS;” Dkt. 2), as modified by the stipulation of the parties. (Dkts. 146 and 147.) Whiteley seeks summary judgment on the ground that, based on the uncontroverted evidence, BCS is not entitled to the relief requested in its Complaint, and Whiteley is entitled to judgment, as a matter of law. In the alternative, Whiteley moves for partial summary judgment on the following issues and claims:
1. Whiteley is entitled to judgment on the First Claim for violation of the Computer Fraud & Abuse Act (18 U.S.C. §1030 et seq.) (the “CFAA” or “§1030”) and the Second Claim for violation of California Penal Code § 502 (the “CDAFA” or “§502”) because Whiteley did not deindex BCS’s website from Google.
2. Whiteley is entitled to judgment on the First Claim for violation of the CFAA and the Second Claim for Violation of the CDAFA because he did not intentionally access without authorization, or exceed authorized access to, any BCS protected computer or account.
3. Whiteley is entitled to judgment on the First Claim for violation of the CFAA and the Second Claim for violation of the CDAFA because BCS cannot establish that Whiteley acted in conspiracy or concert with, aided, or assisted Defendant KATHERINE MCNAMARA (“McNamara”) in intentionally accessing a BCS protected computer or account without authorization, or in exceeding authorized access, and causing BCS’s website to be deindexed from Google.
4. Whiteley is entitled to judgment on the First Claim for violation of the CFAA because BCS cannot establish resulting loss or damage of at least $5,000.00
2
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 3 of 34 Page ID #:4336
within the meaning of the CFAA.
5. Whiteley is entitled to judgment on the Second Claim for violation of
the CDAFA because BCS cannot establish any resulting loss or damage within the meaning of the CDAFA.
This Motion is based on: this Notice of Motion; the attached Memorandum of Points and Authorities; the supporting Declarations of Noelle Beauregard, Bobby Cook, Katherine McNamara, Jeremy Whiteley, Catherine A. Close, M. Adam Tate, Clark Walton, and Brian Bergmark; the accompanying Index of Exhibits; the accompanying Separate Statement of Uncontroverted Facts and Law; the Request for Judicial Notice filed concurrently herewith; the papers and records on file in this action; and such further evidence and argument as may be presented at or before the hearing on this matter.
This Motion is made following the conference of counsel pursuant to L.R. 7-3 which took place on October 12 and 17, 2023, and resulted in a Joint Stipulation to narrow the claims alleged in the Complaint. (Tate Decl., ¶39, Exs. 97-98; Dkts. 146- 147.)
DATED: November 22, 2023
JULANDER, BROWN & BOLLARD
By:
/s/ M. Adam Tate
M. Adam Tate
Catherine Close Attorneys for Defendants
KATHERINE MCNAMARA and JEREMY WHITELEY
3
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 4 of 34 Page ID #:4337
TABLE OF CONTENTS
Page I. INTRODUCTION…………………………………………………………………………………….1 II. RELEVANT FACTS……………………………………………………………………………….2
A. McNamara Buys the .Org Domain …………………………………………………….2
B. Whiteley Relinquished All Access to BCS’s Computers/Accounts Upon Resignation ……………………………………………………………………………………..4
C. McNamara Protects the .Org Domain From BCS’s Efforts to Overtake Control of Her Domain …………………………………………………………………….4
D. BCS “Investigation” Into the Deindex Requests ………………………………….6
III. LEGAL ARGUMENT……………………………………………………………………………8
A. Legal Standard…………………………………………………………………………………8
B. BCS Cannot Show That Whiteley Deindex the Website……………………..10
1. The Evidentiary Burden Shifts to BCS to Prove its Claims…………10
2. BCS’s Deindexing Theory is Impossible…………………………………..10
3. BCS’s Circumstantiatl Evidence is Insufficient to Defeat Summary Judgment ……………………………………………………………………………..13
4. BCS’s Own Volunteers Likely Caused the Deindexing ………………15
C. BCS Cannot Show Unauthorized Access or the Requisite Mens Rea……18
D. Whiteley Did Not Conspire With or Aid McNamara in Accessing a BCS Account Without Authorization or Deindexing BCS’ Website…………….19
E. BCS’s Cannot Establish Damages and Lacks Standing to Maintain a CFAA Claim …………………………………………………………………………………20 1. Law Regarding Losses and Damages………………………………………20 2. BCS Has Not Identified Any Cognizable Loss or Damage………….21
IV. CONCLUSION…………………………………………………………………………………….25
i
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 5 of 34 Page ID #:4338
CASES
TABLE OF AUTHORITIES
Page
Anderson v. Liberty Lobby, Inc.
477 U.S. 242, 252 (1986) …………………………………………………………………. 9, 11
Andrews v. Sirius XM Radio Inc.
932 F.3d 1253, 1262-63 (9th Cir. 2019) …………………………………………………21
Celotex Corp. v. Catrett
477 U.S. 317, 330 (1986) ………………………………………………………………………. 9
Craigslist Inc. v. 3Taps Inc.
942 F.Supp.2d 962, 981 (N.D. Cal. 2013) …………………………………………19, 20
ExactLogix, Inc. v. JobProgress, LLC
508 F.Supp.3d 254, 267 (N.D. Ill. 2020) ………………………………………………..22
Facebook, Inc. v. Power Ventures, Inc.
844 F.3d 1058, 1066 (9th Cir. 2016)………………………………………………………22
Flynn v. Liner Grode Stein Yankelevitz Sunshine Regenstreif & Taylor LLP
No. 3:09-CV-00422-PMP, 2011 WL 2847712, at *3 (D. Nev. July 15,
2011) …………………………………………………………………………………………………. 20
Fresno Motors, LLC v. Mercedes Benz USA, LLC
771 F.3d 1119, 1125 (9th Cir. 2014)………………………………………………………..9
In re 3Com Securities Litigation
761 F.Supp. 1411, 1418 (N.D. Cal. 1990) ………………………………………………19
In re Google Android Consumer Priv. Litig.
2013 WL 1283236, at *6 (N.D. Cal. Mar. 26, 2013)………………………………..21
Kimberlite Corp. v. Does
No. C08–2147 TEH, 2008 WL 2264485, at *1-2 (N.D. Cal. 2008)……………23
Lateral Link Grp., LLC v. Springut
No. CV145695JAKJEMX, 2015 WL 12552055, at *3 (C.D. Cal. July
17, 2015)…………………………………………………………………………………………….21
LVRC Holdings, LLC v. Brekka
581 F.3d 1127, 1132 (9th Cir. 2009)……………………………………………10, 14, 17
Mandel v. Hafermann
503 F.Supp.3d 946, 985 (N.D. Cal. 2020) ………………………………………………19
Matsushita Elec. Indus. Co. v. Zenith Radio Corp.
475 U.S. 574, 586 (1986) ………………………………………………………………………. 9
Meta Platforms, Inc. v. BrandTotal Ltd.
2022 WL 1990225, at *24 (N.D. Cal.)……………………………………………………10
ii
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 6 of 34 Page ID #:4339
Mintz v. Mark Bartelstein and Associates, Inc.
906 F.Supp.2d 1017 (C.D. Cal. 2012)……………………………………………….22, 24
Nissan Fire & Marine Ins. Co. v. Fritz Cos.
210 F.3d 1099, 1106 (9th Cir. 2000)………………………………………………………..9
Novelposter v. Javitch Canfield Group
140 F.Supp.3d 954, 964 (N.D. Cal. 2014………………………………………………..10
Nowak v. Xapo, Inc.
No. 5:20-CV-03643-BLF, 2020 WL 6822888, at *4 (N.D. Cal. Nov.
20, 2020)…………………………………………………………………………………………….20
Resdev, LLC v. Lot Builders Ass’n, Inc.
No. 6:04-CV-1374ORL31DAB, 2005 WL 1924743, at *4
(M.D. Fla. Aug. 10, 2005)…………………………………………………………………….21
Salinas v. Cornwell Quality Tools Co.
No. 519CV02275FLASPX, 2022 WL 3130875, at *6 (C.D. Cal. June
10, 2022)……………………………………………………………………………………….18, 19
Thurmond v. Compaq Computer Corp.
171 F.Supp.2d 667 (E.D. Texas 2001)……………………………………………………23
United Fed’n of Churches, LLC v. Johnson
598 F.Supp.3d 1084, 1097 (W.D. Wash. 2022)……………………………………….24
United States v. Millot
433 F.3d 1057, 1061 (8th Cir. 2006)………………………………………………………22
Van Buren v. U.S.
141 S.Ct. 1648, 1660 (2021………………………………………………………..18, 19, 21
STATUTES
18 U.S.C. §1030……………………………………………………………………………..2, 18, 20, 21 Cal. Penal Code §502 ……………………………………………………………………………………10 Fed. R. Civ. P. 56………………………………………………………………………………………9, 11
OTHER AUTHORITIES
Cal. Code Regs., tit. 11, §999.9.4……………………………………………………………………25 COST, Black’s Law Dictionary (8th ed. 2004)…………………………………………………21
iii
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 7 of 34 Page ID #:4340
MEMORANDUM OF POINTS AND AUTHORITIES I. INTRODUCTION
According to BCS, in March, 2022, someone went on the Google Search Console and directed Google to remove the domain www.breakingcodesilence.org (the .Org Domain) from Google Search. BCS believes that its own volunteers never would have submitted such a request, and ergo, it must have been Defendants.
BCS has no proof substantiating this claim. The only evidence that BCS has presented in support of its belief that Defendants are responsible is that: (1) a screenshot from the Google Search Console suggests that someone may have submitted a request to remove the domain from Google Search on March 9, 2022; and (2) McNamara gave Whiteley permissions to access the Google Search Console on March 11, 2022 – two days later. That is not enough. Absent some actual evidence that Defendants were the ones who submitted the request to Google, summary judgment is appropriate.
Even if BCS could somehow show that Defendants were the ones who submitted the request to Google (which it cannot), summary judgment would still be appropriate because BCS cannot show any losses or damages. It is undisputed that BCS’s investigation into the alleged deindexing was conducted by unpaid volunteers and pro bono attorneys. Thus, BCS never paid anyone anything to investigate its claims. The only other potential loss that BCS has identified is the speculative belief that BCS may have missed out on some donations due to the website not appearing on Google Search. There is no actual evidence that BCS can point to that would substantiate this theory. In sum, BCS cannot show that Whiteley was the one who submitted the deindex request and, even if it could, BCS cannot show that it suffered any losses or damages.
Discovery has revealed that this lawsuit is no more than retribution. BCS’s principals had been plotting to sue Defendants long before the alleged deindexing of BCS’s website in an effort to: (1) trigger an insurance payout which BCS could then
1
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 8 of 34 Page ID #:4341
use to pay the attorneys’ fees of Chelsea Papciak and others (see Ex. 50, pp. 118:6- 121:22, 130:21-133:18, 213:5-215:9; Ex. 46, pp. 59:25-60:20, 61:17-63:3; (2) see Defendants “destroyed financially and socially” (Cook Decl., ¶3; Ex. 4); (3) capture McNamara’s .Org Domain (McNamara Decl., ¶¶41, 43; Ex. 17); and (4) avoid repaying McNamara over $100,000 in loans McNamara made to BCS (Ex. 17).
BCS took advantage of a fortuitous situation – the alleged deindexing of its website, most likely caused by BCS’s internal IT volunteers – to manufacture career-damaging “cyberhacking” claims against Defendants. Based on the foregoing, Whiteley respectfully requests summary judgment.
II. RELEVANT FACTS
Every year, thousands of children branded as “problem children” for a variety of reasons are sent, often against their wills, to congregate care facilities. Although these facilities market themselves as providers of therapeutic treatment, many simply collect public funding and abuse and mistreat the children. (McNamara Decl., ¶2; Whiteley Decl., ¶2.)
For decades, advocates have sought to raise attention to these issues, reform the congregate care facilities, and stop the institutional child abuse. The phrase “Breaking Code Silence” is commonly used by those involved in this movement because “Code Silence” is a common punishment used by congregate care facilities. (Ibid.)
A. McNamara Buys the .Org Domain
In 2019, McNamara, Chelsea Papciak, and others, originally collaborated to form an advocacy campaign and in so doing purchased the domain name “breakingcodesilence.net” (the “.Net Domain”). (McNamara Decl., ¶5; Ex. 50, pp. 19:6-22:19; 41:8-17; 55:22-60:8.) In March 2020, to prevent anyone else from purchasing and co-opting a similar domain ending in “.org,” McNamara purchased the “breakingcodesilence.org” domain name (the “.Org Domain”), using her own personal domain registrar account (Hover.com) and her own funds. (UMF 12.)
2
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
J•D JULANDERBROWN tD – &BOLLARD-
2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 9 of 34 Page ID #:4342
McNamara has since renewed the .Org Domain each year with her own funds, and never transferred or assigned ownership of the .Org Domain to anyone else. (UMF 13-14.) The .Org Domain has always been registered under McNamara’s personal Hover.com domain registrar account, which she has owned since 2016. (UMF 19.) Because McNamara has been verified through Google as the domain owner, she has access to all domain-related Google services for the .Org Domain through her own Google account. (UMF 20.)
In mid-March 2021, a schism developed among the original collaborating advocacy group. Papciak and other survivors separated, keeping the .Net Domain. (McNamara Decl., ¶¶8-10; Ex. 50, pp. 93:21-96:14.) Meanwhile, McNamara retained ownership of the .Org Domain. (McNamara Decl., ¶10.)
Thereafter, on March 22, 2021, McNamara, Whiteley, Vanessa Hughes, and Jennifer Magill, collectively incorporated BCS and became its interim board members. (UMFs 15-16.) Because they were technology professionals, Defendants helped BCS set up its information technology and security infrastructure and helped create its website and underlying support accounts, such as the WordPress account. (UMFs 17-18.)
At the founding of BCS, McNamara allowed the .Org Domain to direct to BCS’s WordPress website, thereby granting BCS permissions to access the domain- related services for the .Org Domain through its Google account. (UMFs 21, 23.) BCS never provided McNamara any consideration for that use of the domain. (UMF 22.) In April 2021, BCS also purchased the “breakingcodesilence.com” domain (the “.Com Domain”) and initially housed it in McNamara’s Hover account. (UMF 46.) BCS continues to own the .Com Domain, and has since moved the domain into its own Hover account. (McNamara Decl., ¶¶43, 45, 46(b)(i); Ex. 19; Close Decl., ¶4; Ex. 44.)
3
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 10 of 34 Page ID #:4343
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
B. Whiteley Relinquished All Access to BCS’s Computers/Accounts Upon Resignation
On June 26, 2021, after only three months with BCS, Whiteley resigned as a BCS interim director. (UMF 24.) Whiteley resigned because Hughes, and others, harassed, discriminated against, and acted abusively towards, Whiteley due to his sexual orientation. (McNamara Decl., ¶¶21-22; Whiteley Decl., ¶¶17-18; Ex. 49, pp. 12:15-23, 55:24-62:4; Ex. 76.) After his resignation, Whiteley transferred to BCS his ownership and administrative credentials to all of BCS’s web accounts that he had set up or could access. (UMFs 25-29.) Notwithstanding, on July 10, 2022, Whiteley received a notification that someone had added him to one of BCS’s Google Webservice account and then immediately revoked his access seconds later. (Whiteley Decl., ¶21(g); Exs. 36-37.)
C. McNamara Protects the .Org Domain From BCS’s Efforts to Overtake Control of Her Domain
Following Whiteley’s resignation, Hughes increased her hostility towards McNamara, describing her to new BCS volunteers as a “problem lesbian board member.” (McNamara Decl. ¶25.) Having enough, McNamara resigned on December 9, 2021. (UMF 30.) Bill Boyles immediately revoked McNamara’s BCS’s WordPress Admin Dashboard/Console authorization by deleting her account. (UMF 31.) Since her resignation, McNamara has never logged into or otherwise accessed BCS’s WordPress account. (UMF 32.)
Shortly after her resignation, BCS requested that McNamara execute an Intellectual Property Assignment Agreement which would transfer ownership of the .Org Doman to BCS, but McNamara refused. (UMF 33.)
Two months later, on March 11, 2022, McNamara received email alerts from Google informing her that a BCS email address she did not recognize was added to the Google Webmaster Central/Google Search Console (collectively the “Google
4
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
I 19 20 21 22 23 24 25 26 27 28
Tools”)1 for the .Org Domain. (UMF 35.)
Feared that someone was trying to steal her .Org Domain, on March 11, 2022,
McNamara used her own personal Google credentials at iristheangel@gmail.com to sign into her own Google account, navigated her web browser to the Google Tools, and gave Whiteley at jeremy@medtexter.com “ownership” permissions for the .Org Domain as depicted below (UMF 36):
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 11 of 34 Page ID #:4344
Users and permi
ions > Ownership history
Ev nts
Calo
00
Later that day, one of BCS’s representatives revoked Whiteley’s ownership permissions. (UMF 38.) Over the next 24 hours, McNamara and BCS’s representatives engaged in a back in forth in which BCS would repeatedly revoke Whiteley’s ownership permissions on the Google Tools and McNamara would reinstate Whiteley’s permissions. (UMF 39.)
Other than delegating ownership permissions to the Google Tools, McNamara
1
,,.
Google Webmaster Central and Google Search Console are free services that Google provides to domain owners and webmasters so they can monitor how their site interacts with Google. Anyone who owns domains that are indexed on Google has access. At the time, Google Webmaster Central and Google Search Console were different, but related, services. Google has since consolidated both services into Google Search Console. (McNamara Decl., ¶37.)
5
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 12 of 34 Page ID #:4345
1 took no action whatsoever with respect to the .Org Domain or BCS’s website. (UMF
2 40.) Specifically, McNamara did not request that the BCS website be deindexed,
3 change or alter any portion of BCS’s website after her resignation, and did not aid,
4 assist, or conspire with anyone else in doing so. (UMF 41.)
5 During the back and forth between McNamara and BCS, McNamara called
6 Whiteley and asked him to log on to the Google Tools and witness what was going
7 on. (Whiteley Decl., ¶26.) Using his jeremy@medtexter.com email address,
8 Whiteley signed on to his own personal Google account, navigated his browser to
9 the Google Webmaster Central and viewed the display which showed the ownership
10 history for the .Org Domain. (UMF 42.) Other than viewing the ownership history,
11 Whiteley took no action. (UMF 43.) Specifically, Whiteley did not request that the
12 BCS website be deindexed, took no action which would cause or contribute to the
13 deindexing of BCS’s website, did not access any BCS account or computer, and did
14 not aid, assist, or conspire with anyone to do so. (UMFs 3, 43, 49-51.)
15 D. BCS’s “Investigation” Into the Deindex Requests
16 According to BCS’s Complaint, in early March 2022, one of BCS’s board
17 members was making changes to BCS’s website. (Dkt. 2, ¶36, fn. 1; Beauregard
18 Decl., ¶3.) The board member searched for BCS’s website on Google Search to see
19 how the changes looked. However, when she searched for the website on Google,
20 she could not find it. (Dkt. 2, ¶36, fn. 1.)
21 BCS then launched an improper forensic investigation as to why the website
22 was not appearing on Google Search and failed to preserve the necessary evidence
23 to determine who was responsible for the deindexing. (UMF 5.)
24 The first primary investigator was Noelle Beauregard. Beauregard is a self-
25 taught webmaster who admits having no qualifications relevant to forensic
26 investigations. (Walton Decl., ¶19; Ex. 47, pp. 18:14-20:3; Ex. 48, pp. 32:7-12.)
27 Beauregard’s investigation was simple. First, she signed onto the Google Tools and
28 saw that herself, Megan Hurwitt, and Jeremy Whiteley each were listed as having
6
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
00
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 13 of 34 Page ID #:4346
1 “ownership” access. (Ex. 47, pp. 22:7-23:12.) Beauregard took the following
2 screenshot of what she saw:
3 4
Users
5 6 7 8 9
10
11
12
13
14
15
16
17
18
I 19 20 21 22 23 24 25 26 27 28
Name 1′
Jer yWl’lt fey
NoalloBoal.l’ogard(you)
mhurwitt
Email
Jere,n~@m tl: x1 rcom
nbeauregara~breakin codesilenco.org
mh l’l il1′-‘dlbfeaki ngcod-esilence.org
Perm,suon
Owner
O.vner
Owner
..
(Id., p. 50:21-51:12; Ex. 68.)
Second, Beauregard also saw on the Google Search Console that two requests
to temporarily remove the .Org Domain from Google Search were submitted on March 8, 2022, but were cancelled, and that a third request was made on March 9, 2022, resulting in a temporary removal. (Id., pp. 49:5-50:17.) She again took a screenshot (Id.; Ex. 67):
1-3o 3 >
Nwtrg n•iy lt’lllOVw CCll’t’i11 frrt1 GoogJ,-, S..,11ch?
ffatf;jj,\ijfif
Submitted requests (z)
U L
Star.s .vith h:tps://breakingoodesilence org/
Stan,ih ,ps:l1treakingoodesilence.org/
–=-
httpsJ/1:,reakrngcodesrle
o,g/
Reques ca
1-3 o’ 3
ed
l11>e(!)
Temporarily remove URL
TemporarilyremoveURL
Tffllporari,yremoveURL
Requasied -4-
Mar 9, 2022
Mar6,2022
Mar8,2022
status
Temporarily removed
eaues canceled
Beauregard never saw anything that informed her who the person was who submitted the deindex requests. (Id., p. 62:2-24; Beauregard Decl., ¶7.)
7
<
>
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 14 of 34 Page ID #:4347
1 The second primary investigator was Jesse Jensen. Jensen is a purported
2 “forensic data privacy analyst,” a technology position that Defendants’ expert has
3 never heard of. (Walton Decl., ¶¶35-37; Ex. 48, pp. 31:10-45:3.) Jensen also lacks
4 the qualifications to do a forensic investigation. (Walton Decl., ¶¶35-37.)
5 Jensen began his investigation on March 11, 2022. (Ex. 48, pp. 90:6-91:4.)
6 Like Beauregard, Jensen looked at the Google Search Console to see that requests to
7 temporarily remove the .Org Domain from Google Search were made on March 8
8 and 9. (Id., p. 93:8-13.) Jensen also saw that when he signed on to the Google Tools
9 on March 11 (two days after the request was allegedly submitted), Whiteley had
10 ownership access. Based on these facts and, having been told that Defendants were
11 known to be “hostile” to BCS, Jensen concluded that it must have been Defendants
12 who submitted the deindex request. (Id., pp. 100:16-101:10; 154:16-25.)
13 On March 12, Jensen was able to cause the website to appear on Google
14 Search again. (UMF 53.) Jensen produced a one-page report attaching no evidence
15 and containing no discernable analysis, accusing Defendants of using the Google
16 Search Console to deindex the website. (Walton Decl., ¶¶9, 38-41; Ex. 48, pp.
17 81:13-82:21; Ex. 65.)
18 In conducting its “investigation,” BCS failed to take the necessary steps to
19 collect and preserve the digital evidence necessary to determine whether someone
20 accessed a BCS account without authorization and, if so, who. (UMF 5.) While
21 speaking to Google support, Jensen did not even ask who made the deindexing
22 request because he already presumed it was Defendants. (Ex. 48, pp. 100:16-
23 101:10.)
24 III. 25
26
27 any material fact and the movant is entitled to judgment as a matter of law.” (Fed. R.
28 Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 330 (1986).) “A fact is
LEGAL ARGUMENT
A. Legal Standard
Summary judgment is appropriate where “there is no genuine dispute as to
8
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 15 of 34 Page ID #:4348
1 ‘material’ only if it might affect the outcome of the case, and a dispute is ‘genuine’
2 only if a reasonable trier of fact could resolve the issue in the non-movant’s favor.”
3 (Fresno Motors, LLC v. Mercedes Benz USA, LLC, 771 F.3d 1119, 1125 (9th Cir.
4 2014); citing Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986).)
5 The movant meets its burden of establishing the absence of a genuine issue of
6 material fact by “produc[ing] evidence negating an essential element of the
7 nonmoving party’s case.” (Nissan Fire & Marine Ins. Co. v. Fritz Cos., 210 F.3d
8 1099, 1106 (9th Cir. 2000); see also Celotex, supra, 477 U.S. at 322-23.) There is no
9 genuine issue for trial where the record taken as a whole could not lead a rational
10 trier of fact to find for the nonmoving party. (See Matsushita Elec. Indus. Co. v.
11 Zenith Radio Corp., 475 U.S. 574, 586 (1986); see also Nissan, supra, 210 F.3d at
12 1106.)
13 Where the movant satisfies the burden, the opponent must do more than
14 simply point to the complaint or assert disagreement. (See Matsushita, supra, 475
15 U.S. at 587.) The opponent must identify “specific facts showing that there is a
16 genuine issue for trial.” (Fed. R. Civ. P. 56(e) (emphasis added); see also
17 Matsushita, supra, 475 U.S. at 587.) Satisfying the opponent’s burden requires it to
18 show more than the “mere existence of a scintilla of evidence;” the opponent must
19 put forth “evidence on which the jury could reasonably find for [it].” (Anderson v.
20 Liberty Lobby, Inc., 477 U.S. 242, 252 (1986).)
21 Section 1030(g) of the CFAA provides a restricted right of private action
22 under a narrow portion of a criminal statute. To meet its burden on its CFAA claim,
23 BCS must establish that Whiteley (1) intentionally accessed a protected computer,
24 (2) without authorization or exceeding authorized access, and as a result of that
25 access he (3) intentionally or recklessly caused damage or loss (4) to one or more
26 persons during any one-year period aggregating at least $5,000 in value. (See LVRC
27 Holdings, LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009) (“Brekka”).)
28
9
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 16 of 34 Page ID #:4349
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
The CDAFA is California’s counterpart to the CFAA. (Cal. Penal Code §502.) CDAFA claims rise or fall with CFAA claims because the necessary elements do not materially differ, except in terms of damages. (Meta Platforms, Inc. v. BrandTotal Ltd., 2022 WL 1990225, at *24 (N.D. Cal.).) As to damages, the CDAFA does not have a minimum amount of required damages. (Novelposter v. Javitch Canfield Group, 140 F.Supp.3d 954, 964 (N.D. Cal. 2014); see Cal. Penal Code §502(e).)
Because BCS cannot meet any of the required elements for either of its claims, summary judgment is appropriate.
B. BCS Cannot Show That Whiteley Deindexed the Website
1. The Evidentiary Burden Shifts to BCS to Prove its Claims
Following the Court’s Order adopting the parties’ Stipulation to Strike Allegations and Limit Claims (the “Stipulation”), the only claim left is that Defendants “accessed a BCS computer or account without authorization, or in excess of authorized access, and caused BCS’s website to be de-indexed.” (UMF 1.)
However, neither of the Defendants deindexed BCS’s website. (UMFs 3, 41.) Defendants have each submitted a declaration affirmatively stating that they did not deindex BCS’s website. (McNamara Decl., ¶42; Whiteley Decl., ¶28.) Moreover, Defendants’ expert Clark Walton declares that, based on his review of the evidence produced and forensic analysis, there is no evidence that Defendants deindexed BCS’s website. (UMF 4.)
Accordingly, the evidentiary burden shifts to BCS. To avoid summary judgment, BCS must point to specific facts and evidence that show Whiteley deindexed the website, or worked in concert with McNamara to do so. (Fed. R. Civ. P. 56(e); Anderson, supra, 477 U.S. at 252.) BCS cannot meet this burden, particularly after it failed to conduct a proper forensic investigation to determine the cause of the deindexing or preserve the relevant digital evidence. (UMF 5.)
10
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 17 of 34 Page ID #:4350
1 2. BCS’s Deindexing Theory is Impossible
2 BCS contends that Defendants signed on to the Google Search Console using
3 Whiteley’s administrative credentials and submitted a request to deindex the
4 website. (UMF 2.) Although the Stipulation implies that the website might have
5 been deindexed by other means, such as through the WordPress or Hover accounts,
6 the only theory BCS put forth in discovery was that Defendants deindexed the
7 website through the Google Search Console. (Id.) Notably, the only people that
8 could have inserted an HTML “no index” tag on a page of BCS’s website are people
9 with access to BCS’s WordPress account. (UMF 6.) After their respective
10 resignations, Defendants had no access to any BCS WordPress account, and
11 Whiteley never had access to, or accessed, any Hover domain registrar account that
12 housed either the .Org Domain or the .Com Domain. (UMFs 7, 48.) Jensen,
13 speaking as BCS’s PMQ, admitted that he was unable to unearth any evidence that
14 Defendants improperly accessed the WordPress account. (Ex. 48, pp. 82:23-83:16.)
15 And it is not possible to deindex a website from Google Search directly through a
16 Hover account. (McNamara Decl., ¶42.)
17 Regardless, BCS’s version of the facts is impossible. When Whiteley
18 resigned in the Summer of 2021, he relinquished his access to the Google Tools.
19 (UMF 25.) The Google ownership history shows that Whiteley’s access was not
20 reinstated until March 11, 2022 – two days after the deindex request was allegedly
21 submitted – when McNamara added Whiteley to witness BCS’s attempts to steal her
22 domain as shown below (UMF 45):
23
24
25
26
27
28
11
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA
Document 152
Filed 11/22/23
Page 18 of 34
Page ID #:4351
1
2 Users and permi 3
4
5
6
7
8
9
·ons
Ownership history
I 19
20 admitted it (Id., p. 159:5-14):
Ev nts
,…, ,,
“‘
Own• o ,,., de O<J•led
‘6•01~Pl,I
00
10 (See Exs. 73-75; Walton Decl. ¶43, Ex. 79; see also Walton Decl. ¶¶44-45, Exs. 80-
11 81 [showing failed automated reverification attempts between May 2021 and March
12 2022].)
13 At his PMQ deposition, Jensen was questioned on the fatal temporal flaw in
14 BCS’s theory. Jensen admitted that the ownership logs show that Whiteley was not
15 delegated ownership access to the Google Tools until March 11, 2022. (Ex. 48, pp.
16 148:22-149:22.) When Jensen was asked whether he ever saw anything in the
17 Google Search Console that showed that Whiteley had access to the Google Tools
18 on March 9, Jensen said no. (Id., pp. 128:12-129:3.) Finally, when asked to admit
that BCS has no evidence whatsoever that Whiteley had access on March 9, Jensen
21 Q. CAN YOU POINT TO A SINGLE PIECE OF EVIDENCE
22 THAT MR. WHITELEY HAD ACCESS ON MARCH 9TH WHEN
23 THE DEINDEXING REQUEST WAS MADE?
24 A. WE’VE PRODUCED AMPLE EVIDENCE THAT MR.
25 WHITELEY HAD ACCESS EVENTUALLY. AND LIKE I SAID, I
26 KNOW THAT HE HAD ACCESS BEFORE I DID. I CAN’T SPEAK
27 SPECIFICALLY TO MARCH 9TH, BUT I KNOW HE HAD ACCESS
28 BEFORE I DID. AND AS FAR AS I KNOW, DR. HUGHES NEVER
12
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 19 of 34 Page ID #:4352
1 HAD ACCESS.
2 Q. LET’S BE VERY CLEAR HERE BECAUSE YOU ARE THE
3 REPRESENTATIVE OF BCS. BCS HAS NO EVIDENCE THAT MY
4 CLIENTS HAD ACCESS ON MARCH 9TH, DOES IT?
5 [OBJECTIONS OMITTED]
6 A. WITH THE CLARIFICATIONS I PROVIDED, THE ANSWER
7 TO YOUR QUESTION IS YES. WE HAVE NO EVIDENCE
8 SPECIFICALLY POINTING TO MARCH 9TH.
9 In summary, BCS claims that Defendants deindexed the website on March 8
10 or 9 by signing on to the Google Search Console with Whiteley’s administrative
11 permissions; however, the undisputed evidence proves that Whiteley did not have
12 administrative permissions to the Google Search Console until March 11. (UMFs
13 44-45.) BCS’s version of events is temporally impossible.
14 3. BCS’s Circumstantial Evidence is Insufficient to Defeat
15
16 Ordinarily, where a proper forensic investigation has been performed, the
17 plaintiff is able to collect and produce hard evidence of unauthorized access. As
18 explained by Clark Walton: “Typical data in that regard could include access logs,
19 screen shots, forensic examiner notes, original emails or text messages bearing on
20 access, results of any investigation such as IP (Internet Protocol) address tracing
21 and/or correlation . . . .” (Walton Decl., ¶9.) Here, BCS cannot point to any such
22 evidence. As explained by Mr. Walton, nothing that BCS has produced in this action
23 identifies the person who submitted the deindex request. (Id., ¶23 [“[b]eyond
24 Plaintiff’s own speculation, I am unaware of any proof that Plaintiff has put forward
25 showing who may have submitted the alleged Google deindexing request . . .”].)
26 As near as can be determined, the only reason BCS believes Whiteley was
27 involved in the deindex request is because when Jensen logged on to the Google
28 Tools on March 11, he saw that Whiteley already had ownership permissions.
Summary Judgment
13
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 20 of 34 Page ID #:4353
1 Jensen then compared the likelihood that Defendants deindexed the website to the
2 possibility that it was deindexed by the small handful of other people who had
3 ownership access and concluded that it must have been Defendants because they are
4 “known hostiles” to BCS. (Ex. 48, pp. 100:16-101:10; 154:16-25 [“[I]t’s a necessary
5 conclusion at that point for me to make that it is the hostile individuals who are most
6 likely to have placed the deindex request versus those people who called me in a
7 panic earnestly asking me to do everything I can to help them remove it.”].)
8 Thus, BCS’s entire case rests on the belief that (1) only a handful of people
9 had the administrative access necessary to submit a deindex request, and (2) of those
10 people, Defendants are the most likely persons in that group to have done it. As
11 shown in the preceding section, BCS’s argument falls apart because Whiteley did
12 not have administrative permissions at the time of the deindexing. (UMFs 44-45.)
13 However, even if Whiteley did have administrative permissions at the time of the
14 deindexing (which he did not), BCS’s evidence is thinly circumstantial at best and
15 insufficient to overcome summary judgment.
16 The Brekka case, widely considered to be one of the leading authorities on the
17 CFAA in the Ninth Circuit, drives this point home. In Brekka, an employee was
18 accused of logging into his employer’s website after his termination. (Brekka, supra,
19 581 F.3d at 1129.) Specifically, two months after the employee’s termination, the
20 company’s marketing consultant saw that someone was logged into the website
21 using the employee’s email address. (Id., p. 1130.) The consultant was also able to
22 see the IP address of the login as well as the location of the internet service provider
23 from which the access occurred, and noted that the location matched the employee’s
24 known location. (Id.) Notwithstanding this evidence, the court granted summary
25 judgment finding that the employer failed to raise a genuine issue of material fact.
26 (Id., p. 1136.) The Brekka court found that the evidence of the employee’s email and
27 password being used was insufficient because someone other than the employee
28 may have used the employee’s email credentials. (Id.) The court further found that
14
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 21 of 34 Page ID #:4354
1 the location of the internet service provider was insufficient because it did not
2 necessarily show where the person accessing the website was physically located.
3 (Id.)
4 The parallels between Brekka and the instant case are plain. In Brekka, there
5 was insufficient evidence to survive summary judgment even though the plaintiff
6 was able to definitively show that the unauthorized access was made by someone
7 using the employee’s credentials. Here, BCS cannot even demonstrate that
8 Whiteley’s permissions were used to access the Google Search Console and deindex
9 its website, but rather, assumes that Whiteley’s permissions were used because
10 Whiteley is a “known hostile.” Like the employer in Brekka, BCS has not
11 eliminated the possibility that someone else accessed the Google Search Console.
12 Critically, BCS cannot eliminate the possibility that its own volunteers inadvertently
13 deindexed the website.
14 Further, unlike Brekka, BCS did not identify the IP address or the internet
15 service provider location which supposedly accessed the Google Console. As Clark
16 Walton observed, BCS has put forward nothing beyond mere speculation. (Walton
17 Decl., ¶23.) If the circumstantial evidence was insufficient to survive summary
18 judgment in Brekka, it is beyond insufficient here.
19 4. BCS’s Own Volunteers Likely Caused the Deindexing
20 Significant evidence, and the only expert analysis, shows that, more likely
21 than not, BCS’s own carelessness caused the deindexing. Specifically:
22 • As alleged in the Complaint, BCS was making changes to its website
23 the week that the deindexing is alleged to have occurred. (Dkt. 2, ¶36, fn. 1; see
24 also, Beauregard Decl., ¶3.)
25 • Around the time of the alleged deindexing, BCS requested that Google
26 not “index” certain pages of its website. (UMF 8.) In connection with BCS’s
27 investigation, Beauregard took a screenshot of a “submitted URL marked noindex”
28 error:
15
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA
Document 152
Filed 11/22/23
Page 22 of 34
Page ID #:4355
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
r,
0
936
6.64K
0 npr
I IJ 1
Details
A I
I I
• S o f l ” 0 4
r
R
_,,.,,
0
0
S u b m ~ t . . t VRL . . . , _ t o
(Beauregard Decl., ¶4, Ex. 1.) This error indicates that someone at BCS had submitted a WordPress command that was marking webpages as “noindex” while making changes to the website. (Id.; Walton Decl., ¶¶47-48.) Similar to a deindex request, marking a webpage as “noindex” through WordPress also tells Google not to include certain webpages on Google Search. (Walton Decl., ¶¶47- 48.) And BCS did not do any investigation into the “noindex” error that Beauregard discovered. (Beauregard Decl., ¶5; Ex. 59, Response No. 15.)
16
0
WHITELEY MOTION FOR SUMMARY JUDGMENT
9 10 11 12 13 14 15 16 17 18 I 19 20 21 22 23 24 25 26 27 28
Sled,I,lrd SI
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 23 of 34 Page ID #:4356
1 • On March 7, 2022, mere days before the alleged deindexing, BCS also
2 submitted several “broken” sitemaps to Google that could not be fetched, which
3 can affect a website’s indexing and trigger an automated Google deindexing
4 response. (UMF 9.) BCS’s sitemap issues were corrected on March 12, the same
5 day its website started appearing on Google Search again as shown below (UMFs
6 10, 53):
7 8
submitted sitemaps
00
@gor
ges
S I
tr72022 IrZ.2022
~ ar, 2022
/$ l
ml
31).indt• <
S NTl!P ndt
~ ar 2 202Z
Jun 22. W23 SUCC
r1Z.2022 C ldri
9-12 0
93 0
0
122 0
n 0
so 0
/S.’,- .ust S!,- p
,p cnl
ml
S; ap
‘ ap
, 2, 2 22
r12 202
p
p
=•P
,, 2022
~’
For purposes of summary judgment, Whiteley need not prove that either of these theories is the reason BCS’s website failed to appear on Google Search. Rather, it is sufficient for Whiteley to show that BCS cannot prove its case simply by implying that it must have been Whiteley who caused the deindexing because he had the permissions to access the Google Tools for the .Org Domain. (See Brekka, supra, 581 F.3d at 1136.)
17
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 24 of 34 Page ID #:4357
1 C. BCS Cannot Show Unauthorized Access or the Requisite Mens Rea
2 As shown above, Whiteley did not access a protected computer and cause
3 BCS’s website to be deindexed. Although entirely academic, had Whiteley caused
4 the website to be deindexed with the permissions delegated by McNamara (which
5 never happened), summary judgment would still be appropriate.
6 Two related legal principles are important in analyzing liability in
7 CFAA/CDAFA cases. First, under Van Buren v. U.S., 141 S.Ct. 1648, 1660 (2021),
8 liability is limited to access without authorization or in excess of authorization. If an
9 individual has legitimate access to a computer or account, he cannot be held liable
10 for violating the CFAA, even if he uses that access for improper purposes. (Id.) In
11 Van Buren, the Supreme Court held that a police officer did not violate the CFAA
12 by illegally running a license plate search in a law enforcement computer database
13 in exchange for money because the officer had legitimate access to the computer
14 database. (Id.)
15 Second, as this Court has recognized, the CFAA includes a mens rea
16 requirement of intentionality. (18 U.S.C. §1030(a)(2); Salinas v. Cornwell Quality
17 Tools Co., No. 519CV02275FLASPX, 2022 WL 3130875, at *6 (C.D. Cal. June 10,
18 2022).) This standard requires the defendant to have intended to access a computer
19 or account knowing that he did not have the authority to do so. (Id.) For instance, in
20 Salinas, this Court declined to find liability where the defendant mistakenly or
21 carelessly believed that he was permitted to download documents that he should not
22 have. (Id., p. *7.)
23 In this case, McNamara purchased the .Org Domain more than a year prior to
24 the founding of BCS. (UMFs 12, 15.) She paid for the domain with her own money,
25 placed the domain in her own personal Hover domain registrar account, and paid for
26 the renewal each year. (UMFs 12, 13.) McNamara never transferred or assigned the
27 ownership of domain to BCS, and even refused to do so when asked. (UMFs 14,
28 33.) Whether or not McNamara legally owns the domain (and Defendants believe
18
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 25 of 34 Page ID #:4358
1 that she does), Whiteley at all times believed that McNamara was the domain owner
2 and had the authority to legitimately delegate permissions to him to access the
3 Google Tools for the .Org Domain. (UMF 37.)
4 Per the authorities above, if Whiteley was given legitimate access to the
5 Google Tools by McNamara, it would not matter if Whiteley used that access
6 improperly to deindex the website. (See Van Buren, supra, 141 S.Ct. at 1660.)
7 Moreover, as long as Whiteley believed that he was given legitimate access by
8 McNamara, even if that belief was mistaken, Whiteley lacked the requisite intent to
9 be held liable. (See Salinas, supra, at *7.)
10 D. Whiteley Did Not Conspire With or Aid McNamara in Accessing a
11
12 BCS alleges that Whiteley conspired with and/or aided McNamara in
13 deindexing BCS’s website, and that while he may not have actually made the
14 deindexing request, his participation with McNamara makes him liable. (Dkt. 2,
15 ¶14.)
16 Civil conspiracy is not an independent tort. (See Mandel v. Hafermann, 503
17 F.Supp.3d 946, 985 (N.D. Cal. 2020).) It is a “doctrine that imposes liability on
18 persons who, although not actually committing a tort themselves, share with the
19 immediate tortfeasors a common plan or design in its perpetration.” (Id.)
20 California’s requirements are, “(1) the formation and operation of the conspiracy,
21 (2) wrongful conduct in furtherance of the conspiracy, and (3) damages arising from
22 the wrongful conduct.” (Craigslist Inc. v. 3Taps Inc., 942 F.Supp.2d 962, 981 (N.D.
23 Cal. 2013).) Similarly, “[a] claim for aiding and abetting requires (1) the existence
24 of an independent primary wrong, (2) actual knowledge by the alleged aider and
25 abettor of the wrong and his or her role in furthering it, and (3) substantial assistance
26 in the wrong.” (In re 3Com Securities Litigation, 761 F.Supp. 1411, 1418 (N.D. Cal.
27 1990).) In CFAA cases specifically, in order for a defendant to be liable for the
28 actions of others, the defendant must have “substantially assisted in the hacking
BCS Account Without Authorization or Deindexing BCS’ Website
19
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 26 of 34 Page ID #:4359
1 itself.” (Nowak v. Xapo, Inc., No. 5:20-CV-03643-BLF, 2020 WL 6822888, at *4
2 (N.D. Cal. Nov. 20, 2020); Flynn v. Liner Grode Stein Yankelevitz Sunshine
3 Regenstreif & Taylor LLP, No. 3:09-CV-00422-PMP, 2011 WL 2847712, at *3 (D.
4 Nev. July 15, 2011).)
5 BCS cannot establish that Defendants conspired, or that Whiteley aided and
6 abetted hacking, because there was no agreement between Defendants to access any
7 BCS account without authorization, or to deindex BCS’s website. (UMF 49.) Both
8 unequivocally state they did not conspire with each other or any other person to
9 access BCS’s accounts without authorization. (UMFs 50-51.) In reality, Whiteley
10 and McNamara rarely communicated privately between the time Whiteley left BCS
11 in June 2021 and March 2022, and their communications never involved gaining
12 unauthorized access to a BCS account or computer. (See Whiteley Decl. ¶25;
13 McNamara Decl. ¶24.) Simply put, Defendants never formed or operated a
14 conspiracy and Whiteley did not engage in any wrongful conduct, let alone provide
15 substantial assistance, in deindexing BCS’s website. (See Craigslist, 942 F.Supp.2d
16 at 981; see UMFs 49-51.)
17 E. 18
19
20 While the CFAA is primarily a criminal statute, §1030(g) authorizes a civil
21 lawsuit if one of factors set forth in §1030(c)(4)(A)(i) are met. The only one of these
22 factors alleged by BCS is in its Complaint is that BCS claims to have suffered more
23 than $5,000 in losses. (Dkt. 2, ¶47.) Thus, in order to prove its CFAA claim, BCS
24 must prove a “loss” of at least $5,000 in value. (18 U.S.C. §1030(c)(4)(A)(i)(1).)
BCS’s Cannot Establish Damages and Lacks Standing to Maintain a CFAA Claim
1. Law Regarding Losses and Damages
25 The CFAA defines “loss” as “any reasonable cost to the victim, including the
26 cost of responding to an offense, conducting a damage assessment, and restoring the
27 data, program, system, or information to its condition prior to the offense, and any
28 revenue lost, cost incurred, or other consequential damage incurred because of
20
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 27 of 34 Page ID #:4360
1 interruption of service.” (Id., §1030(e)(11); emphasis added.) The Ninth Circuit has
2 explained that the CFAA maintains a “narrow conception of ‘loss’” and that the
3 term is limited to harms caused by computer intrusions, not general injuries
4 unrelated to the hacking itself. (Andrews v. Sirius XM Radio Inc., 932 F.3d 1253,
5 1262-63 (9th Cir. 2019) [“[A]ny theory of loss must conform to the limited
6 parameters of the CFAA’s definition.”].) Section 1030’s definition of harm,
7 therefore, “focus[es] on technological harms—such as the corruption of files—of
8 the type unauthorized users cause to computer systems and data.” (Van Buren,
9 supra, 141 S.Ct. at 1660.) “Limiting ‘damage’ and ‘loss’ in this way makes sense in
10 a scheme ‘aimed at preventing the typical consequences of hacking.’” (Id.)
11 Unlike §1030, §502 does not include a monetary threshold for losses.
12 However, §502 still requires some showing of damage or loss beyond the mere
13 invasion of statutory rights. (Lateral Link Grp., LLC v. Springut, No.
14 CV145695JAKJEMX, 2015 WL 12552055, at *3 (C.D. Cal. July 17, 2015); In re
15 Google Android Consumer Priv. Litig., 2013 WL 1283236, at *6 (N.D. Cal. Mar.
16 26, 2013).)
17 2. BCS Has Not Identified Any Cognizable Loss or Damage
18 BCS cannot show any losses or damages. In response to discovery, BCS
19 identified three potential sources of losses: (1) volunteer time; (2) attorney hours;
20 and (3) potential lost donations. (UMF 52.) As shown below, none of these are
21 cognizable losses or damages here.
22 (a) Volunteer Time and Pro Bono Attorney Hours Do Not
23
24 The CFAA defines “loss” in terms of an “any reasonable cost.” (18 U.S.C.
25 §1030(e)(11).) The plain and ordinary meaning of the word “cost” is an “amount
26 paid or charged for something; price or expenditure.” (COST, Black’s Law
27 Dictionary (8th ed. 2004); Resdev, LLC v. Lot Builders Ass’n, Inc., No. 6:04-CV-
28 1374ORL31DAB, 2005 WL 1924743, at *4 (M.D. Fla. Aug. 10, 2005).) Thus, the
Qualify as Loss or Damage
21
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 28 of 34 Page ID #:4361
1 term loss is synonymous with “expenditure.” (See ExactLogix, Inc. v. JobProgress,
2 LLC, 508 F.Supp.3d 254, 267 (N.D. Ill. 2020) [“‘Costs’ are expenditures to address
3 or remedy the violation, which has a reasonable causal connection.”].)
4 BCS admits that it has never paid anyone anything to investigate the
5 allegations of the Complaint. (UMF 56.) All of the time spent in the investigation
6 was by unpaid volunteers or pro bono attorneys. (UMFs 54-55.) Because BCS did
7 not pay its volunteers or attorneys, the time that the volunteers and counsel have
8 spent are not “costs” or “losses” within the meaning of §1030.
9 It is expected that BCS will argue the line of cases finding that the value of
10 the time spent by employees investigating a cyber-attack are “losses” within the
11 meaning of §1030. (See, Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058,
12 1066 (9th Cir. 2016); United States v. Millot, 433 F.3d 1057, 1061 (8th Cir. 2006).)
13 These cases are distinguishable because the employees were all paid employees, so
14 there was still a “cost” or an “expenditure” incurred to pay the employees who
15 performed the investigation.
16 BCS may also attempt to show that someone other than BCS, such as one of
17 its volunteers or DLA Piper, might have incurred some costs. This argument would
18 also fail. This Court’s decision in Mintz v. Mark Bartelstein and Associates, Inc.,
19 906 F.Supp.2d 1017 (C.D. Cal. 2012), is instructive. In Mintz, the plaintiff
20 contended that the defendants violated the CFAA by hacking into his Gmail
21 account. (Id., p. 1029.) The plaintiff attempted to satisfy the $5,000 loss threshold
22 by showing that he incurred $27,796.25 in attorney’s fees in order to identify the
23 party responsible for the hacking. This Court rejected the argument that attorney’s
24 fees were losses under §1030 because the legal fees were paid by someone other
25 than the plaintiff. (Id.) In his opinion, the Honorable Stephen V. Wilson explained:
26 [A] “loss” is defined as “any reasonable cost to any
27 victim.” 18 U.S.C. § 1030(e)(11) (emphasis added). It is
28 undisputed, however, that the legal fees in question were
22
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 29 of 34 Page ID #:4362
1 paid not by Plaintiff, but by CAA, which is not a victim of
2 this offense. Moreover, Plaintiff has cited no evidence that
3 he will be required to repay CAA in part or in full.
4 Accordingly, there is no basis to conclude that Plaintiff
5 has personally suffered a loss as a result of the offense.
6 (Id.)
7 The Texas District Court came to a similar conclusion in Thurmond v.
8 Compaq Computer Corp., 171 F.Supp.2d 667 (E.D. Texas 2001). In Thurmond, the
9 plaintiffs in a class action alleged a §1030 violation against Compaq Computer
10 Corporation. In order to satisfy the $5,000 loss threshold, the plaintiffs alleged that
11 they retained an expert witness to investigate and analyze the problem and that over
12 $100,000 was incurred in the investigation. (Id., p. 683.) The District Court granted
13 summary judgment in favor of Compaq finding that (1) the consultant was retained
14 in preparation of litigation and (2) “Plaintiffs have offered no summary judgment
15 evidence that they personally incurred the costs of retaining [the expert].” (Id.)
16 Notably, the Court was specifically unwilling to consider the costs that the
17 plaintiffs’ law firm incurred to hire the expert. (Id., fn. 26.)
18 It is undisputed that BCS did not pay its volunteers or its attorneys to
19 investigate the allegations of the Complaint. (UMFs 54-56.) Accordingly, their time
20 is not a considered a loss under §1030.
21 (b) BCS’s Investigative Hours Were Not Essential to
22
23 Even if BCS’s employees and attorneys had been paid, BCS still would not be
24 able to satisfy the $5,000 requirement. “Costs associated with investigating
25 intrusions into a computer network and taking subsequent remedial measures are
26 losses within the meaning of the statute.” (Kimberlite Corp. v. Does, No. C08–2147
27 TEH, 2008 WL 2264485, at *1-2 (N.D. Cal. 2008).) However, once the harm from
28 the intrusion has been remediated, any subsequent investigation is no longer
Remediating the Harm
23
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 30 of 34 Page ID #:4363
1 “essential to remedying the harm” and costs relating to such investigation are not
2 recoverable. (Mintz, supra, 906 F.Supp.2d at 1030-1031 [costs associated with
3 subpoenas to discover the identity of the person who hacked a Gmail account were
4 not essential to remediating the harm and therefore not losses within the meaning of
5 the CFAA].)
6 Here, BCS claims to have learned that its website was not appearing on
7 Google Search sometime on March 11 and that Jensen resolved the issue by 3:00 or
8 4:00 the next day. (Ex. 48, pp. 89:4-92:4; Ex. 54.) Yet, Plaintiff is claiming more
9 than 800 hours in investigative time for Hughes, Jensen, and Magill alone. (Ex. 52,
10 Response No. 2.) Clearly, BCS is including in its calculation hours not spent to
11 remediate to the harm.
12 Likewise, BCS claims more than 560 attorney hours were spent by its
13 attorneys at DLA Piper. (Id.) However, even a cursory review of DLA’s time entries
14 show that DLA was not seeking to remediate the harm caused by the alleged
15 deindexing, it was preparing for litigation against Defendants. (Ex. 56.) Such
16 “costs” are not recoverable. (United Fed’n of Churches, LLC v. Johnson, 598
17 F.Supp.3d 1084, 1097 (W.D. Wash. 2022) [“[L]itigation expenses are not ‘losses’
18 that are cognizable under the CFAA.”].)
19 (c) BCS’s Lost Donations Theory is Fatally Speculative and
20
21 BCS’s final attempt to establish losses is the theory that it may have lost
22 donations when its website not appearing on Google Search for a brief time between
23 March 11 and March 12. (Ex. 52, Response No. 2.) BCS’s lost donations theory is
24 fatally speculative.
25 First, BCS did not have the ability to track its web traffic around the time of
26 the alleged deindexing, having disabled the Google Site Kit that allowed it to track
27 its website traffic. (Beauregard Decl., ¶6, Ex. 3; Walton Decl., ¶34.) Accordingly, it
28 is unknown whether BCS even lost web traffic.
Unrealistic
24
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 31 of 34 Page ID #:4364
1 Second, as explained by Brian Bergmark, the donations that BCS has
2 historically received are sporadic in nature. (Bermark Decl., ¶19, Exs. 82, 104-105.)
3 BCS’s PayPal records show that from June 19, 2021 through March 9, 2022, BCS
4 only received donations on 59 out of 264 days, approximately 22% of the days. (Id.)
5 Thus, even assuming that BCS did not receive any donations for some indeterminate
6 period of time between March 9 and 12, there is no evidence that the lack of
7 donations was the result of the website not appearing on a Google Search, as
8 opposed to the normal variability in donations BCS historically received. (Id.)
9 Moreover, when you average the donations BCS received during that same
10 time period, BCS only received an average of $37.62 in donations and $6.59 in
11 subscriptions daily. (Id.) The notion that BCS would have received thousands of
12 dollars in donations on March 11 and/or 12 is improbable.
13 Regardless, at the time, BCS was not authorized to legally accept donations
14 having failed to properly register with the California Attorney General’s Registry of
15 Charitable Trusts. (UMF 58; see Cal. Code Regs., tit. 11, §999.9.4 [“A person or
16 entity subject to the registration requirements of Government Code section 12580 et
17 seq., must be registered and in good standing with the Registry of Charitable Trusts
18 to operate or solicit for charitable purposes.”].)
19 IV. CONCLUSION
20 As set forth herein, Whiteley requests summary judgment on the Complaint
21 or, alternatively, partial summary judgment on the issues and claims set forth in the
22 Notice of Motion.
23
24 25 26 27 28
25
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152
Filed 11/22/23 Page 32 of 34 Page ID #:4365
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
DATED: November 22, 2023
JULANDER, BROWN & BOLLARD
By:
/s/ M. Adam Tate
M. Adam Tate
Catherine Close Attorneys for Defendants
KATHERINE MCNAMARA and JEREMY WHITELEY
26
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 33 of 34 Page ID #:4366
L.R. 11-6.2 CERTIFICATION
The undersigned, counsel of record for Defendants certifies that this brief contains 6,868 words, which complies with the word limit of L.R. 11-6.1.
Date: November 22, 2023
/s/ M. Adam Tate
M. Adam Tate
27
J•D JULANDERBROWN tD – &BOLLARD-
WHITELEY MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152 Filed 11/22/23 Page 34 of 34 Page ID #:4367
1 2 3 4 5 6 7 8 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
CERTIFICATE OF SERVICE
I hereby certify that on this 22nd day of November, 2023, I electronically filed the foregoing paper(s) with the Clerk of the Court using the ECF system which will send notification to all parties of record or persons requiring notice.
/s/ Helene Saller
Helene Saller
J•D JULANDERBROWN tD – &BOLLARD- CERTIFICATE OF SERVICE
