1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 LEONARD DUPRAZ, et al., Case No. 4:22-cv-07709-KAW

8 Plaintiffs, ORDER TO SHOW CAUSE TO PLAINTIFFS; ORDER VACATING 9 v. 8/17/23 HEARING

10 DOES 1-10,, Re: Dkt. No. 1 11 Defendant.

12 13 On December 7, 2022, Plaintiffs Leonard Dupraz and Celeste Lee filed this lawsuit against 14 Doe Defendants alleging that their respective Instagram accounts were “hacked,” which led to the 15 accounts being disabled. (Compl., Dkt. No. 1 ¶¶ 1, 8-11, 14-15.) Plaintiffs have not been able to 16 reactivate their accounts. (FAC ¶¶ 12, 14-15.) In February 2023, Plaintiffs served an amended 17 subpoena on nonparty Meta Platforms, Inc., which owns Instagram. On July 6, 2023, Meta filed a 18 motion to quash the subpoena. (Dkt. No. 20.) 19 Plaintiff’s complaint alleges four causes of action; only one of which is a federal claim. 20 The Computer Fraud and Abuse Act (“CFAA”),

, generally attaches criminal 21 penalties to cyber-based crimes. Even so, subsection (g) provides a limited private right of action 22 if the violation causes a loss of at least $5,000 in value. See

(g). Here, the crux 23 of Plaintiffs’ federal claim involves the disabling of their social media accounts. (See Compl. ¶¶ 8- 24 15.) The CFAA, however, prohibits actual damage or impairment of a protected computer, such 25 as the corruption of files. See Van Buren v. United States,

,

(2021). The Ninth Circuit explicitly declined to extend CFAA civil liability to public websites 27 such as Instagram. hiQ Labs, Inc. v. LinkedIn Corp.,

(9th Cir. 2022) 1 In the operative complaint, Plaintiffs allege that 2 Doe Defendants accessed Plaintiffs’ computers and/or cellular phones. They did so with the intent to manipulate various hardware 3 and/or software in order to limit or restrict their access to online accounts, with the primary intention to have their Instagram accounts 4 be disabled. Doe Defendants also retrieved data from Plaintiffs’ computers and/or cellular phones without Plaintiffs’ knowledge or 5 consent. They also accessed various online accounts maintained by Plaintiffs and attempted to have them altered in a way that would 6 [sic?] Plaintiffs from accessing their own data. 7 (Compl. § 29.) Plaintiffs’ conclusory allegations fail to provide any factual basis for the allegation 8 that their protected devices were accessed or that files located on those devices were altered or 9 || corrupted. See id. To the contrary, the factual allegations concern improperly accessing 10 Instagram—a public website—which, on its face, does not constitute a CFAA violation. As courts 11 of limited jurisdiction, “federal courts have an independent obligation to ensure that they do not a 12 exceed the scope of their jurisdiction.” Henderson ex rel. Henderson v. Shinseki,

,

& 13 || 434 2011); Valdez v. Allstate Ins. Co.,

(9th Cir. 2004) (noting that district

14 || courts are “obligated to consider sua sponte whether [they] have subject matter jurisdiction’’). 15 Accordingly, by August 31, 2023, Plaintiffs are ordered to show cause why federal 16 || question jurisdiction exists. Specifically, Plaintiffs must identify facts that plausibly suggest that

= 17 their cell phones and/or computers were improperly accessed, rather than their social media

18 || accounts. In doing so, Plaintiff must either cite to facts contained in the original complaint or they 19 || must file and cite to an amended complaint. Alternatively, Plaintiffs may voluntarily dismiss this 20 || lawsuit and refile it in state court. After review of Plaintiffs response, the Court may set a hearing 21 or reassign this case to a district judge with the recommendation that the case be dismissed for 22 || lack of subject matter jurisdiction. 23 Finally, the August 17, 2023 hearing on Meta’s motion to quash the subpoena is 24 || VACATED. The Court will reset the hearing once the jurisdictional issue is resolved. 25 IT IS SO ORDERED. 26 Dated: August 11, 2023 . 27 ut A. WESTMORE 28 United States Magistrate Judge