Facebook, Inc. v. Power Ventures, Inc.

• Decision Date: 12 July 2016
• Docket Number: No. 13-17102, No. 13-17154,13-17102
• Citation: 844 F.3d 1058
• Parties: Facebook, Inc., a Delaware corporation, Plaintiff–Appellee, v. Power Ventures, Inc., DBA Power.com, a California corporation; Power Ventures, Inc., a Cayman Island corporation, Defendants, and Steven Suraj Vachani, an individual, Defendant–Appellant. Facebook, Inc., a Delaware corporation, Plaintiff–Appellee, v. Power Ventures, Inc., DBA Power.com, a California corporation, Defendant, and Power Ventures, Inc., a Cayman Island corporation ; and Steven Suraj Vachani, an individual, Defendants Appellants.
• Court: U.S. Court of Appeals — Ninth Circuit

844 F.3d 1058

Facebook, Inc., a Delaware corporation, Plaintiff–Appellee,
v.
Power Ventures, Inc., DBA Power.com, a California corporation; Power Ventures, Inc., a Cayman Island corporation, Defendants,
and
Steven Suraj Vachani, an individual, Defendant–Appellant.

Facebook, Inc., a Delaware corporation, Plaintiff–Appellee,
v.
Power Ventures, Inc., DBA Power.com, a California corporation, Defendant,
and
Power Ventures, Inc., a Cayman Island corporation ; and Steven Suraj Vachani, an individual, Defendants Appellants.

No. 13-17102
No. 13-17154

United States Court of Appeals, Ninth Circuit.

Argued and Submitted December 9, 2015 San Francisco, California
Filed July 12, 2016
Amended December 9, 2016

844 F.3d 1062

Amy Sommer Anderson (argued), Aroplex Law, San Francisco, California; Steven Vachani (argued pro se), Berkeley, California, for Defendants–Appellants.

Eric A. Shumsky (argued), Orrick, Herrington & Sutcliffe LLP, Washington, D.C.; I. Neel Chatterjee, Monte Cooper, Brian P. Goldman, and Robert L. Uriarte, Orrick, Herrington & Sutcliffe LLP, Menlo Park, California, for Plaintiff–Appellee.

Jamie L. Williams (argued), Hanni M. Fakhoury, and Cindy A. Cohn, Electronic Frontier Foundation, San Francisco, California, as and for Amicus Curiae.

Before: Susan P. Graber, Kim McLane Wardlaw, and Mary H. Murguia, Circuit Judges.

ORDER

The opinion filed July 12, 2016, and published at 828 F.3d 1068, is amended by the opinion filed concurrently with this order.

With these amendments, the panel has voted to deny the petition for panel rehearing and rehearing en banc.

The full court has been advised of the petition for rehearing en banc, and no judge of the court has requested a vote on it.

The petition for panel rehearing and rehearing en banc is DENIED . No further petitions for panel rehearing or rehearing en banc shall be entertained.

OPINION

GRABER, Circuit Judge:

One social networking company, Facebook, Inc., has sued another, Power Ventures, Inc., over a promotional campaign. Power accessed Facebook users' data and initiated form e-mails and other electronic messages promoting its website. Initially, Power had implied permission from Facebook. But Facebook sent Power a cease and desist letter and blocked Power's IP address; nevertheless Power continued its campaign. Facebook alleges that Power's actions violated the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ("CAN–SPAM"), the Computer Fraud and Abuse Act of 1986 ("CFAA"), and California Penal Code section 502. We hold that Power did not violate the CAN–SPAM Act because the transmitted messages were not materially misleading. We also hold that Power violated the CFAA and California Penal Code section 502 only after it received Facebook's cease and desist letter and nonetheless continued to access Facebook's computers without permission. Accordingly, we affirm in part, reverse in part, and remand to the district court.

BACKGROUND

Defendant Power Ventures, a corporation founded and directed by CEO Steven Vachani, who also is a defendant here, operated a social networking website, Power.com. The concept was simple. Individuals who already used other social networking websites could log on to Power.com and create an account. Power.com would then aggregate the user's social networking information. The individual, a "Power user," could see all contacts from many social networking sites on a single page. The Power user thus could keep track of a variety of social networking friends through a single program and could click through the central Power website to individual social networking sites. By 2008, the website had attracted a growing following.

Plaintiff Facebook also operates a social networking website, Facebook.com. Facebook users, who numbered more than 130 million during Power's promotional campaign, can create a personal profile—a web page within the site—and can connect with other users. Facebook requires each user to register before accessing the website and requires that each user assent to its

844 F.3d 1063

terms of use. Once registered, a Facebook user can create and customize her profile by adding personal information, photographs, or other content. A user can establish connections with other Facebook users by "friending" them; the connected users are thus called "friends."

Facebook has tried to limit and control access to its website. A non-Facebook user generally may not use the website to send messages, post photographs, or otherwise contact Facebook users through their profiles. Instead, Facebook requires third-party developers or websites that wish to contact its users through its site to enroll in a program called Facebook Connect. It requires these third parties to register with Facebook and to agree to an additional Developer Terms of Use Agreement.

In December 2008, Power began a promotional campaign to attract more traffic to its website; it hoped that Facebook users would join its site. Power placed an icon on its website with a promotional message that read: "First 100 people who bring 100 new friends to Power.com win $100." The icon included various options for how a user could share Power with others. The user could "Share with friends through my photos," "Share with friends through events," or "Share with friends through status." A button on the icon included the words "Yes, I do!" If a user clicked the "Yes, I do!" button, Power would create an event, photo, or status on the user's Facebook profile.

In many instances, Power caused a message to be transmitted to the user's friends within the Facebook system. In other instances, depending on a Facebook user's settings, Facebook generated an e-mail message. If, for example, a Power user shared the promotion through an event, Facebook generated an e-mail message to an external e-mail account from the user to friends. The e-mail message gave the name and time of the event, listed Power as the host, and stated that the Power user was inviting the recipient to this event. The external e-mails were form e-mails, generated each time that a Facebook user invited others to an event. The "from" line in the e-mail stated that the message came from Facebook; the body was signed, "The Facebook Team."

On December 1, 2008, Facebook first became aware of Power's promotional campaign and, on that same date, Facebook sent a "cease and desist" letter to Power instructing Power to terminate its activities. Facebook tried to get Power to sign its Developer Terms of Use Agreement and enroll in Facebook Connect; Power resisted. Facebook instituted an Internet Protocol ("IP") block in an effort to prevent Power from accessing the Facebook website from Power's IP address. Power responded by switching IP addresses to circumvent the Facebook block. Through this period, Power continued its promotion even though it acknowledged that it took, copied, or made use of data from Facebook.com without Facebook's permission.

Power's campaign lasted less than two months. On December 20, 2008, Facebook filed this action. Toward the end of January 2009, Power ended its campaign. In April 2011, Power ceased doing business altogether. In total, more than 60,000 external e-mails promoting Power were sent through the Facebook system. An unknown number of internal Facebook messages were also transmitted.

In this action, Facebook alleged violations of the CFAA, the CAN–SPAM Act, and California Penal Code section 502 and moved for summary judgment. The district court granted summary judgment to Facebook on all three claims. The district court awarded statutory damages of $3,031,350, compensatory damages, and permanent injunctive relief, and it held that Vachani

844 F.3d 1064

was personally liable for Power's actions. Discovery disputes persisted after the judgment; a magistrate judge ordered Power to pay $39,796.73 in costs and fees for a renewed Federal Civil Procedure Rule 30(b)(6) deposition. Power filed a motion for reconsideration, which the district court denied. Defendants timely appeal both the judgment and the discovery sanctions.

STANDARD OF REVIEW

We review de novo a grant of summary judgment. Johnson v. Poway Unified Sch. Dist. , 658 F.3d 954, 960 (9th Cir. 2011). We may affirm the judgment on any ground supported by the record and presented to the district court. Venetian Casino Resort L.L.C. v. Local Joint Exec. Bd. , 257 F.3d 937, 941 (9th Cir. 2001).

DISCUSSION

A. CAN–SPAM Act

The CAN–SPAM Act grants a private right of action for a "provider of Internet access service adversely affected by a violation of section 7704(a)(1) of this title." 15 U.S.C. § 7706(g)(1). In relevant part, § 7704(a)(1) makes it unlawful for "any person to initiate the transmission, to a protected computer, of a commercial electronic mail message, or a transactional or relationship message, that contains, or is accompanied by, header information that is materially false or materially misleading."

The CAN–SPAM Act "does not ban spam outright, but rather provides a code of conduct to regulate commercial e-mail messaging practices." Gordon v. Virtumundo, Inc. , 575 F.3d 1040, 1047–48 (9th Cir. 2009). To prove a violation of the...