MOTOROLA, INC., Plaintiff,
v.
LEMKO CORPORATION, Shaowei Pan, Hanjuan Jin, Xiaohua Wu, Xuefeng Bai, and Xiaohong Sheng, Defendants.
Case No. 08 C 5427.
United States District Court, N.D. Illinois, Eastern Division.
February 11, 2009.*762 R. Mark Halligan, Deanna R. Swits, Kathryn Kristine Wycoff, Lovells LLP, Chicago, IL, for Plaintiff.
John Michael Riccione, Amy Michelle Rapoport, William J. Serritella, Jr., Aronberg, Goldgehn, Davis & Garmisa, Telly Stefaneas, Telly Stefaneas, Esq., Robert R. Cohen, Matthew Douglas Lango, Frankel & Cohen, Thomas Howard Geoghegan, Jorge Sanchez, Michael Paul Persoon, Despres Schwartz & Geoghegan, Chicago, IL, for Defendants.
MEMORANDUM OPINION AND ORDER
MATTHEW F. KENNELLY, District Judge:
Motorola, Inc. has sued Lemko Corporation, Shaowei Pan, Hanjuan Jin, Xiaohua Wu, Xuefeng Bai, and Xiaohong Sheng for alleged violations of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, and the Illinois Trade Secrets Act (ITSA), 765 ILCS 1065/3 & 4. Motorola has also sued Jin, Wu, Bai, and Sheng for alleged breaches of fiduciary duty. All defendants other than Jin have moved to dismiss Motorola's claims.[1] For the reasons set forth below, the Court grants the motions to dismiss in part and denies them in part.
Factual Background
When considering a motion to dismiss, the Court accepts as true the complaint's factual allegations and draws reasonable inferences in favor of the plaintiff. See, e.g., Killingsworth v. HSBC Bank Nevada, N.A., 507 F.3d 614, 617 (7th Cir.2007). Unless otherwise indicated, references to the "complaint" are to Motorola's Amended Complaint.
*763 Motorola is a global communications company. Its business includes a wide array of communication technologies and services. As part of its business, Motorola has developed a number of proprietary trade secrets as well as other confidential information. Motorola utilized various security measures to protect its trade secrets and other confidential information. The engineers it employed, including certain of the individual defendants, were required to sign confidentiality and employment agreements that restricted the disclosure and use of confidential information. Those restrictions are reflected in Motorola's internal policies.
Lemko is a privately held company with headquarters in Schaumburg, Illinois and additional offices in China and India. It competes with Motorola in the development and marketing of cellular infrastructure systems, voice and data services, and other wireless communication technologies.
Jin was employed at Motorola from 1998 until February 2007 as an engineer. Motorola claims that Jin secretly accepted employment with Lemko beginning in March 2005 and never disclosed to Motorola her simultaneous employment with Lemko. Motorola alleges that on a number of occasions, Jin, without authorization or in excess of her authorization, accessed Motorola's computers to obtain and transfer Motorola's trade secrets and other confidential information for the benefit of Lemko. Motorola provides several specific examples of this alleged conduct, including: (a) on March 24, 2005, Jin obtained from Motorola's computers, and transferred by e-mail to her own personal, non-secure e-mail account, Motorola's source code; (b) between February 2006 and February 2007, when she was on a leave of absence for alleged medical reasons, Jin accessed Motorola's computers to obtain confidential information and trade secrets regarding various technologies, including system architecture design, ICD specifications, push-to-talk, iDen, and WiMax; (c) Jin installed Motorola's proprietary VPN access software on a Lemko-owned computer to facilitate her unauthorized access to Motorola's computers; and (d) on February 26 and 27, 2007, Jin removed additional confidential files from Motorola's computers.
Defendants Wu and Pan are married to each other. Pan is Lemko's chief technology officer. Wu worked for Motorola as an engineer from 1995 until December 2007, when Motorola terminated her. Motorola alleges that Wu and Pan engaged in improper conduct, including: (a) in October 2006, at Pan's request, Wu obtained, without authorization or in excess of her authorization, confidential log files, dump files, and other proprietary software from Motorola computers and provided this information to Pan; (b) on December 1, 2006, Wu provided Pan with access to Motorola computers containing confidential information; and (c) Wu e-mailed Pan confidential documents from Motorola's computers on May 31, 2007.
Motorola hired Bai as an engineer in 2001 and terminated his employment in December 2007. Motorola alleges that Bai, without authorization or in excess of his authorization, accessed Motorola's computers to obtain and transfer Motorola's trade secrets and other confidential information. Motorola provides several examples of this alleged conduct, including: (a) Bai e-mailed subsidy unlock codes to Wu on October 8, 2005; (b) on April 17, 2006, Bai, in response to a request by Pan, accessed Motorola's computers to obtain a subsidy unlock code and e-mailed that information to Pan; (c) Pan asked Bai for Motorola dump files relating to W-CDMA technology that Bai obtained from Motorola computers and sent to Pan on September *764 1, 2006; and (d) Bai e-mailed links to Pan that provided him with access to Motorola computers containing confidential informationlinks that an unidentified user later used on multiple occasions.
Sheng started working at Motorola in November 2006. Prior to that time she was an engineer for Lemko. Motorola alleges that Sheng secretly continued to work for and/or assist Lemko after she began her employment at Motorola, an allegation Motorola supports by a January 29, 2007 e-mail in which Sheng makes reference to helping Lemko. Motorola also discovered Lemko-associated source code on Sheng's Motorola laptop computer, as well as evidence that the laptop had been connected to a USB drive containing folders titled "Lemko." On July 1, 2008, Motorola told Sheng to report for a meeting with Motorola management the next day. Motorola terminated Sheng at that meeting. Motorola claims that before the meeting, Sheng accessed Motorola's computers and downloaded a large number of files containing confidential information to a non-secure USB drive.
This conduct forms the basis for Motorola's various claims against the defendants. Motorola also alleges, with respect to each of the defendants, that their conduct caused Motorola to incur substantial expenses in excess of $5,000 in a one-year period.
Discussion
The parties spend a substantial amount of space in their briefs seemingly arguing over whether Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), applies to suits under the CFAA. As a decision of the Supreme Court that sets forth the standard for pleading claims in federal court, Twombly necessarily applies to this case. The Seventh Circuit has emphasized, however, that even after the Supreme Court's ruling in Twombly, federal courts continue to adhere to a notice pleading standard. E.g., Tamayo v. Blagojevich, 526 F.3d 1074, 1083-84 (7th Cir.2008). "A plaintiff must still provide only enough detail to give the defendant fair notice of what the claim is and the grounds upon which it rests ...." Id. at 1083 (quotation omitted); see also Limestone Dev. Corp. v. Village of Lemont, 520 F.3d 797, 803 (7th Cir.2008) (cautioning that Twombly should not be over-read because the Supreme Court has not required "heightened fact pleading of specifics") (quotation omitted). This requirement "simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence" of a plaintiff's claims. Twombly, 127 S.Ct. at 1965.
1. Computer Fraud and Abuse Act claims
The CFAA is primarily a criminal statute. It provides, however, for a private right of action: "Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief." 18 U.S.C. § 1030(g). The conduct proscribed by the statute is set forth in section 1030(a). Motorola attempts to state claims against each of the defendants under section 1030(g) for violating sections 1030(a)(2), (a)(4), and (a)(5).
a. Preliminary issues
The parties raise two preliminary matters regarding the CFAA. First, Congress recently amended several sections of the CFAA relevant to this case, effective September 2008. Motorola implies that it is appropriate to apply the current version of the CFAA, as opposed to the version of it that was operative during the course of defendants' alleged conduct. Ordinarily, absent an express statement by Congress, amendments to a statute that are substantive *765 in nature are not applied retroactively, though procedural or jurisdictional amendments may be. See, e.g., Turkhan v. Perryman, 188 F.3d 814, 826 (7th Cir.1999) (citing Landgraf v. USI Film Prods., Inc., 511 U.S. 244, 273-75, 280, 114 S.Ct. 1483, 128 L.Ed.2d 229 (1994)). Motorola has not provided any authority or legal argument indicating that the September 2008 amendments to the CFAA were merely procedural. Accordingly, the Court will apply the terms of the CFAA as they existed during the course of defendants' alleged conduct. See TEKsystems, Inc. v. Modis, Inc., No. 08 C 5476, 2008 WL 5155720, at *1 n. 1 (N.D.Ill. Dec. 5, 2008) (applying pre-September 2008 version of the CFAA to conduct that occurred before the recent statutory amendments). Citations to the CFAA contained in this opinion will refer to the statute as it existed prior to the September 2008 amendments.
Second, Wu and Sheng contend that the heightened pleading requirement of Federal Rule of Civil Procedure 9(b) applies to Motorola's CFAA claims. As noted earlier, Motorola has asserted claims under section 1030(g) for violation of sections 1030(a)(2), (a)(4), and (a)(5) of the CFAA. Sections 1030(a)(2) and (a)(5) do not contain any requirement that a plaintiff prove fraud. 18 U.S.C. §§ 1030(a)(2), (a)(5). Accordingly, Rule 9(b) does not apply to those sections. By contrast, section 1030(a)(4) is violated only if a defendant acts "with intent to defraud" and her conduct "furthers the intended fraud." Id. § 1030(a)(4). Intent to defraud need not be pleaded with particularity. Fed. R.Civ.P. 9(b). Rule 9(b)'s requirement that "[i]n alleging fraud ..., a party must state with particularity the circumstances constituting fraud," id., however, quite plainly applies to section 1030(a)(4)'s requirement that the defendant's acts further the intended fraud.
b. Wu
As noted earlier, section 1030(g) enables a person who suffers damage or loss due to a violation of some other provision of section 1030 to sue the violator. Because the statute is put together in a somewhat confusing way, it helps to begin with a full quotation of the relevant language in section 1030(g):
Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B).
18 U.S.C. § 1030(g). In short, a person suing under section 1030(g) must prove: (1) damage or loss (2) by reason of (3) a violation of some other provision of section 1030, and (4) conduct involving one of the factors set forth in section 1030(a)(5)(B)(i)-(v). Those factors describe various sorts of harm. In this case, the only applicable "factor" is the one identified in section 1030(a)(5)(B)(i): loss during a one-year period aggregating at least $5,000.
The question in this case is whether Motorola has adequately alleged each of those elements. To satisfy the third element identified above, Motorola alleges that Wu violated sections 1030(a)(2), (a)(4), and (a)(5). The Court addresses each of these underlying provisions in turn.
i. Violation of sections 1030(a)(2) and (a)(4)
A person violates section 1030(a)(2) if she "intentionally accesses a computer without authorization or exceeds authorized access and thereby obtains ... information from any protected computer if the conduct involved an interstate or foreign communication." 18 U.S.C. § 1030(a)(2). *766 The elements of a section 1030(a)(2) violation thus include (1) intentional access of a computer, (2) without or in excess of authorization, (3) whereby the defendant obtains information from the protected computer. Id.
The defendants contend that to state a claim under section 1030(g) for a violation of section 1030(a)(2), a plaintiff must allege both damage and loss. The uninitiated might have difficulty understanding the distinction. The CFAA, however, expressly defines the two terms differently. For purposes of the CFAA, "the term `damage' means any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). By contrast, "the term `loss' means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." Id. § 1030(e)(11).
The Court rejects defendants' contention. As noted above, section 1030(g) expressly provides that a person "who suffers damage or loss by reason of a violation of this section" may sue the violator, id. § 1030(g) (emphasis added); the word "or" means what it says. As noted earlier, section 1030(g) also requires proof that "the conduct [of the violator] involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B)." Id. As the Court has stated, the only one of those factors that conceivably applies here is the one requiring "loss to 1 or more persons during any 1-year period ... aggregating in at least $5,000 in value." Id. § 1030(a)(5)(B)(i). Nothing in that incorporated provision requires an allegation of "damage" (as defined by the CFAA) in addition to "loss."
The five factors listed in section 1030(a)(5)(B) are introduced by a sentence that refers to "conduct described in clause (i), (ii), or (iii) of subparagraph (A)" that caused the harm in one of the ways listed under subparagraph (B). Id. § 1030(a)(5)(B). Section 1030(a)(5)(A), in turn, describes various types of conduct that violate the CFAA if the conduct results in "damage" as the CFAA defines that term. Id. §§ 1030(a)(5)(A)(i)-(iii). This wording is what gives rise to the argument that "damage" is required in addition to "loss" in order to establish a claim under section 1030(g). District judges within the Seventh Circuit have reached opposite conclusions on this issue. Compare Sam's Wines & Liquors, Inc. v. Hartig, No. 08 C 570, 2008 WL 4394962, at *2 (N.D.Ill. Sept. 24, 2008) (concluding that "[t]o maintain a civil action under the CFAA, damage and loss under Sections (a)(5)(B) and (a)(5)(A) are required"); Garelli Wong & Assoc., Inc. v. Nichols, 551 F.Supp.2d 704, 708-10 (N.D.Ill.2008) (same), with TEKsystems, Inc., 2008 WL 5155720, at *5 (rejecting contention that damage is required element of claims under subsections 1030(a)(2) or (a)(4)); Patriot Homes, Inc. v. Forest River Housing, Inc., No. 05 CV 471, 2006 WL 1752143, at *3-4 (N.D. Ind. June 21, 2006) (same), rev'd in part on other grounds, 512 F.3d 412 (7th Cir.2008); C.H. Robinson Worldwide, Inc. v. Command Trans., LLC, No. 05 C 3401, 2005 WL 3077998, at *3 (N.D.Ill. Nov. 16, 2005).
Defendants' reading of the statute is not viable, in this Court's view. Every court of appeals to address the point has concluded that when section 1030(g) refers to the factors set forth in the clauses under section 1030(a)(5)(B), it does not also require a plaintiff to establish a violation of *767 section 1030(a)(5)(A), even though the lead-in language in section 1030(a)(5)(B) refers to that subparagraph. Specifically, the Third, Fifth, and Ninth Circuits have determined that to state a claim under section 1030(g) for violation of section 1030(a)(2) or (a)(4), a plaintiff is required to allege loss or damage, not both. See Fiber Sys. Int'l, Inc. v. Roehrs, 470 F.3d 1150, 1157 & n. 4 (5th Cir.2006); P.C. Yonkers, Inc. v. Celebrations The Party & Seasonal Superstore, LLC, 428 F.3d 504, 511-12 (3d Cir.2005); Theofel v. Farey-Jones, 359 F.3d 1066, 1078 n. 3 (9th Cir. 2004) ("[S]ubsection (g) applies to any violation of `this section' and, while the offense must involve one of the five factors in (a)(5)(B), it need not be one of the three offenses in (a)(5)(A)."). This Court agrees with those decisions.
In addition, section 1030(g) contemplates civil actions for "[a]ny person who suffers damage or loss by reason of a violation of this section," so long as one of the five factors listed in section 1030(a)(5)(B) is present. 18 U.S.C. § 1030(g) (emphasis added). If those five factors were construed to incorporate the requirements of section 1030(a)(5)(A), which contains a damage requirement, then the first sentence of section 1030(g), permitting civil actions for parties that suffer loss or damage, would be meaningless. Defendants' interpretation of the statute would provide a cause of action only for plaintiffs that were injured under section 1030(a)(5), as opposed to those who suffer loss by any violation of the statute. See Patriot Homes, Inc., 2006 WL 1752143, at *3-4. This would render portions of the CFAA meaningless and would lead to an absurd result, under which the CFAA would provide a cause of action for any violation of the statute, but only if the defendant also violates section 1030(a)(5)(A). In sum, the Court concludes that a plaintiff alleging violations of sections 1030(a)(2) or (a)(4) need only allege damage or loss, not both.
Turning to the elements of the alleged section 1030(a)(2) violation by Wu, there is no dispute that she is alleged to have intentionally accessed protected Motorola computers. Wu argues that her access was authorized and thus not in violation of the statute, because, as a Motorola employee, she had been granted access to those computers. In Int'l Airport Centers, LLC v. Citrin, 440 F.3d 418 (7th Cir.2006), the Seventh Circuit considered what constitutes unauthorized access by an employee who has been granted access to protected computers. The court held that an employee who breaches her duty of loyalty to an employer or acquires an adverse interest to her employer is no longer authorized to access the employer's computers. Id. at 420-21. Under the CFAA, the phrase "`exceeds authorized access' means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled to obtain or alter." 18 U.S.C. § 1030(e)(6). Allegations that an employee e-mailed and downloaded confidential information for an improper purpose are sufficient to state a claim that the employee exceeded her authorization. Mintel Int'l Group, Ltd. v. Neergheen, No. 08 C 3939, 2008 WL 2782818, at *3 (N.D.Ill. July 16, 2008).[2]
Motorola has sufficiently alleged that Wu accessed Motorola's protected computers without authorization or in excess of her authorization. Specifically, Motorola has identified three dates on *768 which Wu accessed its computers at Pan's request and sent Pan confidential information from those computers. Taking these allegations as true, as the Court must do at this stage of the case, Wu was allegedly accessing confidential Motorola computers to send Motorola's confidential information to its competitor's chief information officer. This is sufficient to describe the accessing of Motorola's computers without or in excess of Wu's authorization, satisfying the requirement that Motorola allege that Wu's unauthorized access resulted in her obtaining information from Motorola's protected computers. See 18 U.S.C. § 1030(a)(2)(C).
Wu also contends that Motorola has not sufficiently alleged loss. Motorola has alleged that Wu's acts, as well as those of all the defendants, caused it to incur losses of over $5,000 during a one-year period related to damage and security assessments. These allegations are sufficient to allege loss for purposes of the CFAA. See Patrick Patterson Custom Homes v. Bach, 586 F.Supp.2d 1026, 1036-37 (N.D.Ill.2008); Lockheed Martin Corp. v. Speed, No. 6:05 CV 1580, 2006 WL 2683058, at *3 (M.D.Fla. Aug. 1, 2006). The loss allegation also implicates the type of harm described in section 1030(a)(5)(B)(i), thereby satisfying the requirement of section 1030(g) that the alleged conduct implicate one of the five factors listed in section 1030(a)(5)(B)(i)-(v). Thus Motorola has stated a claim against Wu for violating section 1030(a)(2).[3]
Motorola has also stated a claim against Wu for violating section 1030(a)(4). That section requires a plaintiff to allege that the defendant (1) knowingly and with the intent to defraud, (2) accessed a protected computer, (3) without authorization or in excess of her authorization, and (4) by such conduct obtained something of value and furthered the intended fraud. 18 U.S.C. § 1030(a)(4). As detailed above, Motorola has alleged that Wu accessed a protected computer without or in excess of her authorization and thereby obtained a number of valuable confidential trade secrets and computer files. Motorola's allegations also are sufficient under Federal Rule of Civil Procedure 9(b) to support the fraud element of a section 1030(a)(4) claim. As discussed earlier, Motorola has alleged in detail that Wu's unauthorized access was at the behest of an officer of Motorola's competitor, Lemko, and that Wu sent the files to Lemko through its chief information officer.
Finally, Wu contends that any claims arising out of conduct occurring prior to September 23, 2006, should be dismissed as time-barred. The CFAA contains a two-year statute of limitations; the limitations period, however, incorporates the so-called discovery rule. 18 U.S.C. § 1030(g). The statute of limitations is an affirmative defense. See Fed.R.Civ.P. 8(c). The Seventh Circuit has consistently held that plaintiffs are not required to "plead around" possible affirmative defenses. E.g., Davis v. Ind. State Police, 541 F.3d 760, 763 (7th Cir.2008). Based on the facts stated in the complaint, the Court cannot say definitively that Motorola knew or should have known of Wu's alleged conduct more than two years before it filed suit. For this reason, dismissal under Rule 12(b)(6) would be improper. This does not preclude Wu from arguing the statute of limitations defense in a motion for summary judgment, if appropriate.
ii Claims under section 1030(a)(5)
In contrast to a claim under section 1030(g) based on a violation of section *769 1030(a)(2) or (a)(4), a plaintiff seeking to recover via section 1030(g) for a violation of section 1030(a)(5) of the CFAA must allege, and ultimately prove, the defendant's conduct resulted in damage as the CFAA defines that term. 18 U.S.C. §§ 1030(a)(5)(A)(i)-(iii). Each clause in section 1030(a)(5)(A) specifies "conduct" that constitutes a violation of the CFAA if such conduct "causes damage." Id. Accordingly, damage is an express requirement of section 1030(a)(5)(A).
As noted above, the CFAA defines damage as "any impairment to the integrity or availability of data, program, a system, or information." 18 U.S.C. § 1030(e)(8). Motorola's damage allegations as to all of the defendants are simply a restatement of the statutory definition of damage and an allegation that the defendants have caused damage. Unlike its allegations with respect to the elements of sections 1030(a)(2) and (a)(4), Motorola has not alleged any facts to give color to its claim that the defendants caused damage within the meaning of the CFAA. The only harm Motorola has alleged is the disclosure to a competitor of its trade secrets and other confidential information. The CFAA's definition of damage does not cover such harm; rather, damage under the statute is limited to the impairment of the integrity or availability of data and information. The plain language of the statutory definition refers to situations in which data is lost or impaired because it was erased or because (for example) a defendant smashed a hard drive with a hammer. See Patrick Patterson Custom Homes, Inc., 586 F.Supp.2d at 1035. Accordingly, the Court dismisses under Rule 12(b)(6) Motorola's claims against Wu, as well as those against the other defendants, for violating section 1030(a)(5).
c. Bai
Motorola has asserted claims against Bai for violating sections 1030(a)(2) and (a)(4) of the CFAA. On at least four separate occasions, Motorola alleges, Bai e-mailed confidential information, detailed above, from Motorola computers to Pan at Pan's request. In one instance, Bai allegedly provided Pan with a link that enabled outsiders to access Motorola computers. Motorola alleges that it has incurred losses investigating and conducting damage assessments in response to these actions. These allegations are sufficient to state a claim for violating sections 1030(a)(2) and (a)(4).
Bai's reliance on several cases that Wu did not cite does not save his motion. In one case, a court dismissed a CFAA claim because the plaintiff had failed to allege any information regarding how the defendants accessed the computers, when they did so, and what information they viewed or took. Atlantic Recording Corp. v. Serrano, No. 07 CV 1824, 2007 WL 4612921, at *6 (S.D.Cal. Dec. 28, 2007); see also Elektra Entertainment Group, Inc. v. Santangelo, No. 06 C 11520, 2008 WL 4452393, at *4-5 (S.D.N.Y. Oct. 1, 2008) (dismissing CFAA claim on a similar basis). Motorola has included detailed allegations of such conduct in its complaint. By providing such information concerning all of the individual defendants and their interactions with and relationship to Lemko, Motorola has satisfied Rule 9(b) to the extent it applies to claims for violation of section 1030(a)(4).
d. Sheng
Motorola has asserted claims against Sheng for violating sections 1030(a)(2) and (a)(4) of the CFAA. Motorola alleges that Sheng continued to work for and/or aid Lemko after she began her employment with Motorola. It also makes specific allegations *770 of at least two instances when Sheng improperly accessed Motorola computers and downloaded confidential information. Though the scope of Sheng's alleged conduct is arguably narrower than that of the other individual defendants, Motorola has alleged enough to support its claims against Sheng for violating sections 1030(a)(2) and (a)(4).
e. Pan
The allegations against Pan are different from those against the other individual defendants. Motorola alleges that Pan's improper conduct occurred after he had stopped working at Motorola and was employed at Lemko. Motorola alleges, however, numerous specific instances in which Pan asked Motorola employees to access protected computers on his behalf, after which the Motorola employees sent him the confidential information he requested. Additionally, Motorola alleges that Bai sent Pan links that provided him direct access to Motorola's computer. An unidentified user allegedly used those links to access Motorola computers. Motorola is entitled to the reasonable inference that Pan, or someone who got the links from Pan, was the user. In short, Motorola has alleged that Pan, both directly and by using Motorola employees, accessed Motorola computers on multiple occasions in order to obtain confidential information for Lemko's benefit. These allegations are sufficient to state claims against Pan for violating sections 1030(a)(2) and(a)(4).
f. Lemko
Lemko argues that the CFAA allegations against it are insufficient. The Court disagrees. A company, by nature, acts through its officers and employees. See Binary Semantics, Ltd. v. Minitab, Inc., No. 07 CV 1750, 2008 WL 763575, at *5 (M.D.Pa. Mar. 20, 2008) (finding plaintiff had stated a claim against corporation under the CFAA where it alleged that an individual accessed protected computers at the corporation's direction and on its behalf). Motorola has alleged a pattern of incidents of unauthorized access of its computers to obtain confidential information, carried out by Lemko's chief information officer, secret employees working on Lemko's behalf, and Motorola employees acting at Pan's request. The allegations against Lemko for violation of sections 1030(a)(2) and (a)(4) are sufficient.
2. Illinois Trade Secrets Act
Defendants also contend that Motorola has failed to state a claim under the ITSA. To state a claim under the ITSA, a plaintiff must allege that a trade secret, not generally known, was misappropriated, and that it was used by the defendant in its business. E.g., Learning Curve Toys, Inc. v. PlayWood Toys, Inc., 342 F.3d 714, 721 (7th Cir.2003).
Defendants first contend that Motorola has not sufficiently described its trade secrets. The Court disagrees. The ITSA defines a trade secret as:
[I]nformation, including but not limited to, technical or non-technical data, a formula, pattern, compilation, program, device, method, technique, drawing, process, financial data, or list of actual or potential customers or suppliers, that: (1) is sufficiently secret to derive economic value, actual or potential, from not being generally known to other persons who can obtain economic value from its disclosure or use; and (2) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy or confidentiality.
765 ILCS 1065/2(d). Motorola has identified a number of its technologies, programs, and similar materials that it has undertaken significant efforts to protect. This is the information that Motorola claims defendants improperly obtained, as *771 detailed above. Though Motorola does not disclose the precise details of its trade secrets in its complaint, it is not required to do so, as this would result in public disclosure of the alleged trade secret. See C.H. Robinson Worldwide, Inc., 2005 WL 3077998, at *6 (quoting AutoMed Techs., Inc. v. Eller, 160 F.Supp.2d 915, 920-21 (N.D.Ill.2001)).
Motorola has also alleged that defendants have used its trade secrets in their business, despite defendants' contentions to the contrary. As other courts have noted, ITSA plaintiffs are not required to plead highly specific facts on improper trade secret use, because such facts often will not be available before discovery. See Sentry Pool v. Wave Tec Pools, Inc., No. 07-4082, 2008 WL 3200837, at *3 (C.D.Ill. Aug. 6, 2008). Motorola has provided defendants with sufficient notice at this stage of the litigation to permit them to respond to its ITSA claims.
3. Beach of fiduciary duty
Finally, Sheng contends that Motorola's claim for breach of fiduciary duty should be dismissed because it is preempted by the ITSA. Sheng is correct that the ITSA abolishes common law claims contrary to its own provisions. See PepsiCo, Inc. v. Redmond, 54 F.3d 1262, 1269 (7th Cir.1995). Preemption exists to the extent that Motorola's fiduciary duty claims are based on the same conduct that constitute its ITSA claims. C.H. Robinson Worldwide, Inc., 2005 WL 3077998, at *6. If, however, Motorola ultimately is unable to prove the existence of a trade secret as defined by the ITSA, there would be no preemption. Thus it is premature to dismiss the breach of fiduciary duty claims.
Conclusion
For the reasons stated above, the Court grants defendants' motions to dismiss [docket nos. 57, 59 & 61] with respect to plaintiff's claims for violation of 18 U.S.C. § 1030(a)(5) but otherwise denies the motions to dismiss. The defendants other than Jin are directed to answer the remaining claims by March 4, 2009. Plaintiff is directed to respond to Jin's motion to stay by February 25, 2009, and Jin is directed to reply by March 4, 2009. The Court sets the case for a status hearing on March 11, 2009 at 9:30 a.m. Counsel are directed to confer prior to that date to develop a proposed schedule for completing discovery.
NOTES
[1] Jin is the defendant in a related criminal case, United States v. Jin, No. 08 CR 192, pending in this district. She has moved to stay Motorola's claims against her in this case due to the pendency of the criminal case. Unless otherwise indicated, the term "defendants" as used in this opinion refers to all defendants other than Jin.
[2] Defendants' reliance on Shamrock Foods Co. v. Gast, 535 F.Supp.2d 962 (D.Ariz.2008), and similar cases is misplaced. Those courts expressly disagreed with the Seventh Circuit's holding in Citrin and adopted narrower definitions with respect to the authorization element. Id. at 966-67. This Court is bound by the Seventh Circuit's decision in Citrin.
[3] The Court disagrees with Wu's contention that Motorola has not alleged the relevant computers and communications were involved in interstate or foreign commerce. See Am. Compl. ¶ 92.