The opinion of the court was delivered by: Reggie B. Walton United States District Judge
Butera & Andrews ("the plaintiff") brings this action against International Business Machines Corporation ("IBM") and an unidentified John Doe defendant, seeking monetary damages and injunctive relief for alleged interference with the plaintiff's computer records in violation of the Computer Fraud and Abuse Act ("Computer Fraud Act"), 18 U.S.C. §§ 1030(a)(2), (a)(5) (2000), the Stored Wire and Electronic Communications Act ("Stored Wire Act"), 18 U.S.C. §§ 2701(a), 2707(a) (2000), and the Federal Wiretap Act, 18 U.S.C.A. §§ 2511(1)(a)-(b) (2002). Complaint ("Compl.") ¶¶ 15-20. The plaintiff contends that the alleged violations were committed "with IBM owned or operated equipment and were directed by IBM employees or agents." Id. ¶¶ 16, 18, 20. The plaintiff asks that "all information illicitly obtained from [the] plaintiff" be returned," id. at 9-10, and that the defendants pay the plaintiff for its damages, "including damages for items illicitly taken, the costs of investigation, the cost of additional security measures, statutory damages and attorney's fees for this action," id. at 10. Currently before the Court is IBM's motion to dismiss for failure to state a claim ("Def's Mot.").*fn1 For the reasons set forth below, the Court grants IBM's motion.
The plaintiff, a law firm located in the District of Columbia, alleges the following facts in support of its claims. Compl. ¶ 1. As part of its business activities, the plaintiff "makes extensive use of electronic mail ["e-mail"] to communicate with clients and others on behalf of clients." Id. ¶ 6. Sometime in October or November of 2005, the plaintiff became aware of certain facts suggesting that its e-mail server "had been compromised by unauthorized parties." Id. ¶ 7. To look into the matter, the plaintiff retained a private investigative firm specializing in computer forensics and security. Id. ¶ 8. A security review conducted by this firm revealed that "unauthorized personnel" had penetrated the plaintiff's e-mail server and left a series of instructions "which permitted [computer hackers] to enter the system surreptitiously" and download documents from the server. Id. ¶ 9.
On November 8, 2005, the firm monitored an attempt by an unauthorized party to obtain access to the plaintiff's e-mail server.*fn2 Id. ¶ 11. While the attempt was unsuccessful, the firm was able to determine that it originated from a specific Internet Protocol ("IP") address. Id. An IP address is a "unique identifying number for a particular computer" that "serve[s] as locational information for the receipt and transmission of information over the [I]nternet." Id. ¶ 10. According to the plaintiff, the IP address involved in the alleged November 8th attack on its server was "registered to the [d]efendant IBM and . . . located at the IBM facility on Cornwallis Road in Durham, North Carolina." Id. ¶ 11.
The security firm allegedly found evidence of other attacks as well. From November 12, 2005, to November 25, 2005, a computer maintained by the firm's investigators was allegedly subjected to multiple "denial of service" attacks, all "originat[ing] from IP addresses which are registered to the [Durham] IBM facility." Id. ¶ 12. The plaintiff also alleges that the firm's "review of computer logs for a client of [the plaintiff] revealed over 42,000 attempts by 80 different IP addresses registered to the IBM Durham controlled machines to penetrate the [client's] internal computer server during the twelve-month period beginning on January 1, 2005."*fn3 Id. ¶ 13. The plaintiff does not contend that its servers, or those of its clients or the security firm, have been the subject of any attacks since January 1, 2006.
On April 7, 2006, the plaintiff initiated this action against IBM and the John Doe defendant, identified as "a person who is employed by Defendant IBM at its Durham, North Carolina facility," id. ¶ 3, alleging violations of the Computer Fraud Act, the Stored Wire Act, and the Federal Wiretap Act resulting from the above-mentioned attacks, id. ¶¶ 15-20. Significantly, the plaintiff does not allege that defendant IBM orchestrated, authorized, or was otherwise aware of these attacks. See id. ¶ 16 (alleging that the violations were committed by "a person or persons whose identity is unknown at this time"). Rather, the plaintiff claims "upon information and belief" that "[d]efendant John Doe, in his capacity as IBM employee or agent, initiated, directed and managed" all attacks from January 2005 onward "from the Durham, North Carolina [IBM] facility," id. ¶¶ 11, 12, 13, and contends that the attacks "were made with IBM owned or operated equipment and were directed by IBM employees or agents," id. ¶¶ 16, 18.*fn4 The plaintiff seeks monetary damages, including the $60,000 it has allegedly "expended . . . in the investigation, surveillance, and repair of its e-mail systems," id. at 9, as well as injunctive relief (1) "ordering . . . IBM and any of its officers, agents, servants, employees and other persons in active concert or participation with any of them to cease violations of statutory and common law"; (2) "requiring the return of all information illicitly obtained from [the] plaintiff that resides in any of the computer equipment . . . owned or maintained by . . . IBM"; and (3) "directing the disclosure of information under [IBM's] control which may reflect on who may have caused the placement of unauthorized code, unauthorized entries, denial of service attacks and theft of electronic information," id. at 9-10.
IBM now moves to dismiss the complaint, arguing that "[the] plaintiff's legal theory against [it] is fatally flawed as a matter of law." Def.'s Mot. at 2. Specifically, IBM contends, inter alia, that "[the] [p]laintiff fails to allege that IBM acted 'intentionally' as that term is intended under the operable statutes, and in fact makes allegations that are entirely inconsistent with intentional conduct on the part of IBM." Id. In response, the plaintiff argues (1) that IBM's motion is properly resolved as a matter of summary judgment rather than pursuant to a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6); (2) that it has alleged sufficient facts to support its statutory causes of action against IBM; and (3) that limited, expedited discovery is necessary to resolve the issues raised by IBM. Pl.'s Opp. at 1. IBM opposes the plaintiff's motion for expedited discovery, asserting that "[w]hile [the] [p]laintiff may need limited discovery from IBM to assist it in identifying the potential culprits, the appropriate way to get that discovery is not by initiating a frivolous lawsuit against IBM that is not justified by either the facts or the law." Def.'s Opp. at 2. Rather, IBM suggests that the plaintiff's proper course is to "issue third party subpoenas to the registered holders of the IP addresses to determine the identity of the customers who had used those addresses." Id. (citation omitted).
When evaluating a motion for failure to state a claim upon which relief can be granted pursuant to Federal Rule of Civil Procedure 12(b)(6), the Court "must treat the complaint's factual allegations as true and must grant [the] plaintiff the benefit of all inferences that can be derived from the facts alleged." Sparrow v. United Airlines, Inc., 216 F.3d 1111, 1113 (D.C. Cir. 2000) (internal quotation marks and citations omitted). "Given the Federal Rules' simplified standard for pleading," a complaint may be dismissed under Rule 12(b)(6) "only if it is clear that no relief could be granted under any set of facts that could be proved consistent with the allegations." Swierkiewicz v. Sorema, 534 U.S. 506, 514 (2002) (internal quotation marks and citation omitted). However, the Court need not accept "inferences drawn by [the] plaintiff if such inferences are unsupported by the facts set out in the complaint, nor legal conclusions cast in the form of factual allegations." Browning v. Clinton, 292 F.3d 235, 242 (D.C. Cir. 2002) (internal quotation marks and citation omitted).
The Court notes at the outset that, contrary to the plaintiff's suggestion, it need not wait until the completion of discovery to decide IBM's dispositive motion. See Pl.'s Opp. at 1 (asserting that "[the] Defendant's argument that the Plaintiff is unable to prove facts sufficient . . . to include them within the statutory causes of action . . . is one that can only be cured by limited discovery to resolve those issues"); id. at 11 (contending that "all of the cases upon which [IBM] relies . . . were summary judgment requests decided after discovery had been completed"); id. at 13 (claiming that it "does not presently have all the facts to support its claims" because IBM "has in the past declined to reveal the [necessary] information"); Pl.'s Reply at 3 (stating that discovery is necessary in order to adduce "the answers that will either confirm IBM's claims of complete innocence or implicate them in procedures and knowledge which they are understandably reluctant to reveal"). If IBM's motion were predicated upon the argument that the plaintiff has failed to prove IBM's involvement in the alleged attacks, then the plaintiff's contention that this is a matter appropriately resolved by way of summary judgment would have some merit. However, this is not what IBM argues in support of its motion. Rather, IBM contends that the plaintiff "has [not] even alleged the essential elements of its claim." Def.'s Opp. at 3 (emphasis added). IBM's motion is therefore appropriately brought as a motion to dismiss pursuant to Rule 12(b)(6). See Swierkiewicz, 534 U.S. at 514 (holding that Rule 12(b)(6) dismissal is proper where "it is clear that no relief could be granted under any set of facts that could be proved consistent with the allegations") (internal quotation marks and citation omitted).
A. The Plaintiff's Statutory Violation Claims
The plaintiff alleges that the attacks enumerated in its complaint are "connected to" IBM because the attempts to gain access to its computer server "were made with IBM owned or operated equipment and were directed by IBM employees or agents." Compl. ¶ 16. In moving to dismiss the claims against it, IBM argues that the plaintiff "has failed to state a claim . . . because it has not alleged any knowing, intentional or deliberate actions by IBM," Def.'s Mem. at 4, which is a necessary predicate here given that the relevant statutes "each require a showing of knowing or intentional conduct in order for a violation to occur," id. at 5 (citing the Computer Fraud Act, 18 U.S.C. §§ 1030 (a)(2), (a)(5); the Stored Wire Act, 18 U.S.C. §§ 2701(a), 2707(a); and the Federal Wiretap Act, 18 U.S.C.A. §§ 2511(1)(a)-(b)). According to IBM, "[the] [p]laintiff admits that it has no idea who attacked its computer systems," Def. Mem. at 1, and does not allege "that IBM knew about or authorized the attacks . . . or that it had any conceivable motive to do so," id. at 2. Consequently, even "assum[ing] the truth of the plaintiff's . . . allegation that an IBM employee was involved," IBM asserts that "the only inference permitted from the facts alleged in the complaint is that the attacks were conducted by a rogue employee acting outside the scope of his or her employment and without authorization." Id. In response, the plaintiff argues that "[t]he inference from the use ...