Not All Unauthorized Computer Conduct May Violate Delaware Statute
The plaintiff in Base Optics v. Liu (Del. Ch. May 29, 2015) asserted numerous claims against its former director and part owner arising from a series of agreements related to the operation of the company. In addition to claims for breach of contract and business torts, Base Optics Inc. alleged that defendant Yaping Liu committed computer-related offenses under Title 11, Sections 932-935 of the Delaware Code. Base Optics alleged Liu changed the passwords to certain email accounts, signed in and read certain emails and used her control of certain email accounts to forward emails and attachments to a different email account in her name. Although Liu admitted to engaging in this conduct, she argued it did not constitute a computer-related offense under the express provisions of the statute. Of the four computer-related offenses alleged, the court only considered and found a violation of Section 934, which prohibits the "interruption of computer services."
Before this action was initiated, Liu was a one-third owner and former chief financial officer and director of Base Optics, a Delaware corporation involved in optics design and sales. Liu was also the sole owner of defendant Argus International Ltd., which was a smaller optics sales company incorporated in the state of Washington. Although Argus had an established customer base, it had significant debt and had experienced financial and operational difficulties. To address the situation at Argus, Liu agreed to an arrangement with the co-owners of Base Optics, John Myrick and Lars Sandstrom, by which Base Optics would service Argus' customers and share the royalties received. Under the initial arrangement, Liu retained the Argus debt, Base Optics assumed operation of the Argus business and Liu received two-thirds of the profits generated.
Shortly after formalizing the above-described arrangement, Liu became dissatisfied with the deal and requested an amendment. Liu, Myrick and Sandstrom thereafter entered into an amended agreement by which Argus waived its right to royalties and Base Optics received the right to service all of Argus' customers, with the exception of Argus' largest customers. Under the parties' initial and amended arrangements, it was necessary for Base Optics to conduct business through Argus, as only Argus was qualified to service the "vast majority" of its customers, which were defense contractors and government bodies. This meant that Liu remained the administrator of the email system by which Base Optics communicated with Argus' customers.
After entering into the amended agreement, the relationship between the parties began to sour. Initially, Liu began to pursue and service certain of Argus' former customers contrary to the parties' agreement. Liu also failed to remit to Base Optics certain payments she received from Argus' former customers. As the situation grew worse, Myrick and Sandstrom called a special meeting of the board of directors. Liu did not attend that meeting, and Myrick and Sandstrom voted to remove her from the board. Liu also suspected that Sandstrom restricted Liu's access to Argus' QuickBooks account.
In apparent retaliation for Myrick's and Sandstrom's actions, Liu contacted Network Solutions, the company hosting Argus' website and email accounts, and reset the email passwords for Myrick, Sandstrom and another employee. The email accounts were important to servicing Argus' former customers, and Liu testified at trial that she changed the passwords in an effort to take back those customers. While Base Optics attempted to deal with the loss of email service, Liu began combing through the email accounts for customer information she could forward to those assisting her at Argus. Using the information obtained from the email accounts, Liu and her associates began to contact Argus' former customers primarily in an effort to transition business from Base Optics back to Argus. It appeared that Liu and her associates also deleted a large number of emails from those accounts.
On June 20, 2014, Base Optics filed its complaint, along with a motion for temporary restraining order. The court granted a temporary restraining order and later held the defendants in contempt of that order for continuing to solicit the former Argus customers. Thereafter, the court held a two-day trial, followed by the submission of written closing arguments.
In its opinion, the court first found that Liu had breached the amended agreement between the parties when she solicited and serviced customers she agreed would be transitioned to Base Optics. However, in analyzing the alleged computer-related offenses, the court seemed to be restricted by the language of the Delaware statute. Sections 932-935 prohibit the following conduct: unauthorized access to a computer system (Section 932), theft of computer services (Section 933), interruption of computer services (Section 934) and misuse of computer system information (Section 935). The court noted that, although the parties agreed that Liu engaged in the conduct alleged, they disagreed on whether the conduct was prohibited by the express language of the statute and, in particular, the way certain terms are defined.
According to the defendants, the access, interruption and misuse governed by Sections 932-935 all relate to a "computer system," not an email account. The defendants argued that, because the term "email" is defined separately from "computer system," the legislature intended "that conduct related to email is not within the purview of" the computer crimes statute. Without analyzing the other sections of the statute, the court found that the defendants' conduct constituted, "at the least, interruption of computer services pursuant to Section 934." Section 934 provides that: "A person is guilty of the computer crime of interruption of computer services when that person, without authorization, intentionally or recklessly disrupts or degrades or causes the disruption or degradation of computer services or denies or causes the denial of computer services to an authorized user of a computer system."
The court expressly stated the other computer crimes alleged by Base Optics were not considered, and "nothing in this memorandum opinion should be construed as a determination of liability as to these other computer crimes."
In determining that Section 934 applied, the court carefully reviewed the defined terms to determine whether the conduct at issue was prohibited. In its analysis, the common thread running through the definitions was the use of "data." The court concluded that the Argus email accounts consisted of "data, both in terms of the information comprising the messages stored in those accounts and of the computer software that causes the email system to operate." The court further found that the "data is stored on computer systems—email servers owned and operated by third parties, which email servers the users of the Argus [e]mail [a]ccounts must 'access' in order to utilize the accounts." Next, the court found that the "process of using" the Argus email accounts—"of communicating with, retrieving data from, storing data on, and instructing data to be sent from, the email servers—is a computer service." As such, the court concluded that "Liu's actions to block the Base Optics employees—indisputably, authorized users—from accessing the Argus [e]mail [a]ccounts by changing the accounts' passwords constitutes both disrupting computer services and causing the denial of computer services as contemplated under Section 934."
The court also found that Liu's conduct was not authorized, even though technically she remained the administrator of Argus' website and email accounts. It was important to the court that Liu had agreed that Base Optics was to service the former Argus customers and knew that access to the email accounts was critical to its operations. Additionally, although Liu owned Argus, Base Optics paid Network Solutions for providing the email accounts. Together, these facts demonstrated that Liu was not authorized to block Base Optics' access to the Argus email accounts. As such, the court awarded Base Optics the damages resulting from Liu's interruption of the Argus email accounts.
Although Liu was ultimately found to have violated Section 934 of the computer crimes statute, the question remains whether her access and misuse of the emails within the Argus email accounts constituted violations of Sections 932, 933 and 935. The defendants appeared to make at least a colorable argument that the computer crimes statute was not designed to address the unauthorized access to, and copying of emails from, individual email accounts. In this case, it appeared clear that Liu interrupted Argus' computer services by changing the email passwords. As such, the court did not need to address the remaining sections of the statute to award Base Optics damages. Under the express language of the statute, it may have been a closer question had Liu not changed the passwords and simply accessed the email accounts and forwarded information she discovered in those accounts.