Philips North America LLC v. Advanced Imaging Services, Inc.

8 UNITED STATES DISTRICT COURT 9 EASTERN DISTRICT OF CALIFORNIA PHILIPS NORTH AMERICA LLC, No. 2:21-cv-00876-JAM-AC 12 Plaintiff, 13 v. ORDER GRANTING IN PART AND DENYING IN PART DEFENDANTS’ ADVANCED IMAGING SERVICES, MOTION TO DISMISS INC., d/b/a Advanced Imaging Parts; and WANG XIUYUAN a/k/a Sean Wang, Defendants.

18 I. FACTUAL ALLEGATIONS AND PROCEDURAL BACKGROUND1 19 Philips North America LLC (“Philips” or “Plaintiff”) develops, manufactures, and sells medical imaging systems, including x-ray, magnetic resonance (“MR”), computer tomography (“CT”), ultrasound, and advanced molecular imaging systems.

23 Compl. ¶ 19, ECF No. 1. To support and maintain those systems, Philips has developed proprietary information, documentation, and software for servicing, which it refers to as its Customer 1 This motion was determined to be suitable for decision without oral argument. E.D. Cal. L.R. 230(g). The hearing was scheduled for August 24, 2021.

1 Service Intellectual Property (“CSIP”). Id. ¶ 20.

2 Philips grants individuals varying levels of access to its CSIP depending on their position and contractual terms. Id. ¶ 23. CSIP Level 0 materials are available to anyone in the United States who request access. Id. Level 1 materials are available to Philips employees and customers with a valid contract and non-disclosure agreement. Id. Philips reserves CSIP Level 2 access for authorized Philips employees and specific trade partners under contract, and Level 3 access for only a subset of service specialists within Philips. Id. 11 Philips has developed and implemented measures to protect the confidentiality of its CSIP. Id. ¶¶ 24-26. For example, Philips’ Integrated Security Tool (“IST”), a digital rights management solution, prevents unauthorized access to Philips’ CSIP. Id. ¶ 27. Philips generates a user-specific IST certificate that controls the documents and service tools the user is entitled to access. Id. Each IST certificate is valid for 30 days and must be renewed, otherwise the IST certificate expires. Id. ¶ 29. Thus, a customer who enters into a service contract with non-disclosure terms may access certain service tools not available to a customer who has not. Id. ¶ 30.

22 Advanced Imaging Services Inc has never been issued an IST certificate beyond CSIP Level 0. Id. ¶ 36. However, a Philips employee observed Sean Wang, on behalf of Advanced Imaging Services, using false login credential to access Philips’ restricted CSIP materials in order to service the Philips systems. Id. ¶¶ 34-36. Philips’ subsequent investigation uncovered that Advanced Imaging Services has used false IST accounts to gain unauthorized access to Philips’ proprietary CSIP a few times. Id. ¶ 35.

3 In response, Philips filed this action against Advanced Imaging Services and Sean Wang (“Defendants”) alleging: (1) violation of the Computer Fraud and Abuse Act; (2) violation of California’s Comprehensive Computer Data Access and Fraud Act; (3) violation of the Digital Millennium Copyright Act; (4) violation of the Defend Trade Secrets Act; (5) violation of California’s Uniform Trade Secrets Act; (6) violation of the California Unfair Trade Practices Act; and (7) fraud. See generally Compl. Defendants now move to dismiss the first, second, fourth, fifth, and seventh causes of action. See generally Def.’s Mot, ECF No. 37. Plaintiff opposed this motion.

14 See Opp’n, ECF No. 61. Defendants replied. Reply, ECF No. 62.

15 For the reasons set forth below the Court grants in part and denies in part Defendants’ motion.

17 II. OPINION 18 A. Legal Standard 19 A Rule 12(b)(6) motion challenges the complaint as not alleging sufficient facts to state a claim for relief. Fed. R. Civ. P. 12(b)(6). “To survive a motion to dismiss [under 12(b)(6)], a complaint must contain sufficient factual matter, accepted as true, to state a claim for relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks and citation omitted). While “detailed factual allegations” are unnecessary, the complaint must allege more than “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements.”

1 Id. “In sum, for a complaint to survive a motion to dismiss, the non-conclusory ‘factual content,’ and reasonable inferences from that content, must be plausibly suggestive of a claim entitling the plaintiff to relief.” Moss v. U.S. Secret Serv., 572 F.3d 962, 969 (9th Cir. 2009).

6 B. Analysis 7 1. Computer Fraud and Abuse Act 8 Philips alleges Defendants violated § 1030(a)(2)(c) and § 1030(a)(4) of the Computer Fraud and Abuse Act (“CFAA”).

10 Compl. ¶¶ 52, 54. To successfully bring an action under 18 11 U.S.C. § 1030(a)(2)(c), a plaintiff must establish that the defendant: “(1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that he (3) thereby obtained information (4) from any protected computer [. . .], and that (5) there was loss to one or more persons during any one-year period aggregating at least $5,000 in value.” LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). To bring a claim under 18 U.S.C. § 1030(a)(4), a plaintiff must establish the defendant “(1) accessed a protected computer, (2) without authorization or exceeding such authorization that was granted, (3) knowingly and with intent to defraud, and thereby (4) furthered the intended fraud and obtained anything of value, causing (5) a loss to one or more persons during any one-year period aggregating at least $5,000 in value.” Id. (internal quotation marks and citation omitted).

26 Defendants argue Plaintiff has failed to state a claim under the CFAA as it failed to allege any facts regarding the information obtained by Defendants. Def.’s Mot. at 11.

1 Defendants contend the only plausible allegation of anything Defendants may have obtained is the fake IST certificates which Plaintiff acknowledges came from a third-party. Id. at 11-12.

4 Not so. Plaintiff alleges that Defendants obtained information from the Philips systems when they used the fake IST certificates to gain a higher level of authorization. Compl.

7 ¶ 35. Specifically, Defendants obtained Philips’ proprietary information, documentation, and software for servicing its medical imaging systems otherwise known as its CSIP. Id. ¶¶ 20, 35, 40 (“Philips’ subsequent investigation has uncovered that Defendants have been obtaining false IST certificates to hack through Philips’ access controls to gain unlicensed and unauthorized access to Philips’ proprietary CSIP.”). Plaintiff alleges that not only did Defendants obtain this information but that they actually used the information to perform maintenance and other services. Id. ¶ 52. This is sufficient to state a claim under the CFAA. See United States v. Drew, 259 F.R.D.

18 449, 457 (C.D. Cal. 2009) (noting that “obtaining information from a computer” has been described as including mere observation of the data.). Accordingly, Defendants’ motion to dismiss Plaintiff’s CFAA claim is denied.

22 2. Defend Trade Secrets Act and California Uniform 23 Trade Secrets Act Claims 24 Courts often analyze Defend Trade Secrets Act (“DTSA”) and California Uniform Trade Secrets Act (“CUTSA”) claims together.

26 See InteliClear, LLC v. ETC Global Holdings, Inc., 978 F.3d 653, 657 (9th Cir. 2020) (noting courts have analyzed DTSA and CUTSA claims together as the elements are substantially similar). For both claims a plaintiff must allege that: (1) the plaintiff owned trade secrets; (2) the defendant misappropriated the trade secrets; and (3) the defendant’s actions damaged the plaintiff.

4 Space Data Corp. v. X, 16-cv-03260-BLF, 2017 WL 5013363, at *1 (N.D. Cal. Feb. 16, 2017). At the pleading stage, a plaintiff need not “spell out the details of a trade secret.” Alta Devices, Inc. v. LG Elecs., Inc., 343 F.Supp.3d 868, 881 (N.D. 8 Cal. 2018) (internal quotations and citation omitted). However, “the complaint must do more than describe the subject matter of the trade secrets in a ‘vague and conclusory’ manner.” E. & J.

11 Gallo Winery v. Instituut Voor Landbouw-En Visserijonderzoek, 17-cv-00808, 2018 WL 2463869, at *3 (E.D. Cal. June 1, 2018) (internal citations omitted).

14 Defendants argue Plaintiff has failed to identify its trade secret with sufficient particularity. Def.’s Mot. at 12-15.

16 Plaintiff describes its trade secret as “Customer Service Intellectual Property (CSIP)”, encompassing the “proprietary information, documentation, and software for servicing its medical imaging systems.” Compl. ¶ 20. The Court finds Plaintiff has provided sufficient specificity in the allegations of its complaint for Defendants “to be on notice of what trade secrets are at issue.” Synopsys, Inc. v. ATopTech, Inc., 13-cv- 02965 SC, 2013 WL 5770542, at *6 (N.D. Cal. Oct. 24, 2013).

24 Plaintiff specifies that the trade secrets relate to how to service their medical imaging systems, including x-ray, MR, CT, ultrasounds, and advanced molecular imaging systems. Compl.

27 ¶¶ 19, 20, 33, 78. This is sufficient to survive a motion to dismiss. See Autodesk, Inc. v. ZWCAD Software Co., 14-cv-01409, 2015 WL 2265479, at *5 (N.D. Cal. May 13, 2015) (finding sufficient particularity where plaintiff pled trade secret as “portions of [source] code that underlie the commands, interfaces and program files associated with the dozens of specific features.”) Requiring Plaintiff to go into more detail risks compelling public disclosure of the same trade secrets Plaintiff seeks to protect. See Diodes, Inc. v. Franzen, 260 8 Cal. App. 2d 244, 252 (Ct. App. 1968) (“One who seeks to protect his trade secrets from wrongful use or disclosure does not have to spell out the details of the trade secret to avoid a demurrer to a complaint. To so require would mean that the complainant would have to destroy the very thing for which he sought protection by making public the secret itself.”)

14 Defendants also argue Plaintiff has failed to adequately allege they misappropriated the trade secrets. Def.’s Mot. at 15-16. Under both the DTSA and the CUTSA “misappropriation” means either (1) the “[a]cquisition of a trade secret by another person who knows or has reason to know that the trade secret was acquired by improper means” or (2) the “[d]isclosure or use of a trade secret of another without express or implied consent.” 18 21 U.S.C. § 1839(5); Cal. Civ. Code § 3426.1(b). But Plaintiff does allege that Defendants used the trade secret without consent. Specifically, Plaintiff claims that Defendants used their trade secret to service the Philips systems without permission. Compl. ¶ 34 (“Defendants have serviced the Philips systems in the Los Angeles, California area, and specifically the Philips systems at Providence St. John’s Healthcare Center and SimonMed Beverly Hills, by using false login credentials to access Philips’ restricted CSIP materials.”) (emphasis added).

2 Accordingly, the Court denies Defendants’ motion to dismiss Plaintiff’s DTSA and CUTSA claims.

4 3. Preemption Under California’s Uniform Trade 5 Secrets Act 6 California’s Uniform Trade Secrets Act (“CUTSA”) “occupies the field” of common law claims based on the misappropriation of a trade secret. K.C. Multimedia, Inc. v. Bank of America Tech.

9 & Operations, Inc., 171 Cal.App.4th 939, 954 (2009). The Act, however, does not supersede “(1) contractual remedies, whether or not based upon misappropriation of a trade secret, [and] (2) other civil remedies that are not based upon misappropriation of a trade secret.” Cal. Civ. Code § 3426.7(b). The Act’s language “implicitly preempts alternative civil remedies based on trade secret misappropriation.” K.C. Multimedia, 171 Cal.App.4th at 954 (citation omitted). A claim cannot simply depend on a “different theory of liability” to survive CUTSA’s preemptive effect. See id. at 957-59 & n. 7. Rather, CUTSA preempts “common law claims that are based on the same nucleus of facts as the misappropriation of trade secrets claim for relief.” Id. at 958 (internal quotation marks and citation omitted).

23 Here, Plaintiff’s CUTSA claim alleges Defendants accessed its network and trade secrets through improper means using fake credentials. Compl. ¶¶ 35, 40, 94. Plaintiff’s fraud claim also rests on the misrepresentation Defendants made in using fake credentials. Id. ¶ 107. Thus, the CUTSA and fraud claims all arise from Defendants’ unauthorized access to Plaintiff’s system. Accordingly, these claims are based on the same “nucleus of facts” and Plaintiff’s fraud claim is preempted by CUTSA. K.C. Multimedia, 171 Cal.App.4th at 958. The Court therefore grants Defendants’ motion to dismiss the fraud claim with prejudice. See Gompper v. VISX, Inc., 298 F.3d 893, 898 (9th Cir. 2002) (finding leave to amend need not be granted when amendment would be futile). Because the Court finds dismissal of Plaintiff’s fraud claim is warranted on this ground, it does not reach the parties’ additional arguments regarding dismissal under Rule 9(b). See Def.’s Mot. at 16-19; Opp’n at 11-13.

11 Defendants also argue Plaintiff’s California Comprehensive Computer Data Access and Fraud Act claim arises from the same nucleus of facts as the CUTSA claim and is, therefore, preempted. Def.’s Mot. at 20-22. Plaintiff argues this claim is not subject to preemption under CUTSA because it is brought pursuant to statute. Opp’n at 14. As this Court recently noted California district courts are divided on the issue. See R.R. Donnelley & Sons Company v. Pappas, 21-cv-00753-JAM-AC, 2021 WL 19 3488502, at *3 (E.D. Cal. Aug. 9, 2021) (collecting cases). “As such, the Court errs on the side of caution and does not find that the claim is preempted.” Id. Thus, Defendants’ motion to dismiss this claim is denied.

23 III. Sanctions 24 Defendants exceeded the Court’s 5-page limit on reply memoranda. See Reply; see also Order re Filing Requirements (“Order”), ECF No. 3-2. Violations of the Court’s standing order require the offending counsel, not the client, to pay $50.00 per page over the page limit to the Clerk of Court. Order at 1. ———— mm DEINE II IE IIE IIE IRI I EIEIO IERIE IIE OS ESE IE OSE IR EE ee Moreover, the Court did not consider arguments made past the page limit. Id. Defendants’ reply brief exceeded the Court’s page limit by five pages.* Accordingly, Defendants’ counsel must send a check payable to the Clerk for the Eastern District of California for $250.00 no later than seven days from the date of | this order.

7 Iv. ORDER 8 For the reasons set forth above, the Court GRANTS IN PART | AND DENIES IN PART Defendants’ Motion to Dismiss. The Court: 10 1. DENIES Defendants’ Motion to Dismiss Plaintiff’s CFAA 11 claim (first claim); California Comprehensive Computer Data | Access and Fraud Act claim (second claim); DTSA Claim (fourth 13 claim); and CUTSA claim (fifth claim).

14 2, GRANTS Defendants’ Motion to Dismiss Plaintiff’s fraud 15 claim (seventh claim) with prejudice.

16 3. For violating the Court’s standing order, Defendants’ 17 counsel must send a check payable to the Clerk for the Eastern 18 District of California for $250.00 no later than seven days from | the date of this order.

20 IT IS SO ORDERED.

21 Dated: October 29, 2021 22 kA 23 teiren staves odermacr 7008 27 2 The Court notes the parties stipulated to other page limits with respect to a different motion but not for this motion to | dismiss. See Stipulation and Order at 4, ECF No. 47.