Argued: October 30, 2018
from the United States District Court for the Eastern
District of Virginia, at Alexandria. Anthony J. Trenga,
District Judge. (1:17-cv-00502-AJT-JFA)
James Menhart, LEXERO LAW, Washington, D.C., for Appellant.
Jonathan David Frieden, ODIN, FELDMAN & PITTLEMAN, P.C.,
Reston, Virginia, for Appellee.
P. Miller, ODIN, FELDMAN & PITTLEMAN, P.C., Reston,
Virginia, for Appellee.
F. Belcher, James R. Batchelder, Monica A. Ortel, James H.
Rickard, East Palo Alto, California, Evan Gourvitz, Lance W.
Shapiro, New York, New York, Kathryn C. Thornton, ROPES &
GRAY LLP, Washington, D.C.; Gregory T. Nojeim, CENTER FOR
DEMOCRACY & TECHNOLOGY, Washington, D.C.; Andrew Crocker,
ELECTRONIC FRONTIER FOUNDATION, San Francisco, California;
Kevin Bankston, NEW AMERICA'S OPEN TECHNOLOGY INSTITUTE,
Washington, D.C., for Amici The Center for Democracy &
Technology, The Electronic Frontier Foundation, and New
America's Open Technology Institute. Andrew Grimm,
DIGITAL JUSTICE FOUNDATION, Omaha, Nebraska, for Amicus The
Digital Justice Foundation.
GREGORY, Chief Judge, MOTZ and WYNN, Circuit Judges.
Hately brought this action alleging that David Watts
unlawfully accessed messages in Hately's web-based email
account in violation of the Virginia Computer Crimes Act and
the federal Stored Communications Act. But the district court
found that Hately failed to demonstrate the requisite
statutory injury under state law, and that Hately's
previously opened and delivered emails stored by a web-based
email service were not in statutorily protected
"electronic storage" under federal law. We disagree
with both determinations and therefore reverse and remand
this case to the district court for further proceedings
consistent with this opinion.
August 2008, Hately enrolled at Blue Ridge Community College
("Blue Ridge College"), a constituent institution
of the Virginia Community College System. At Blue Ridge
College, Hately had a student email account that he continued
to use after he graduated in 2013.
Ridge College uses a web-based email client with branding
specific for Blue Ridge College. Google hosts all
emails. Account holders can access the copies
stored on their web-based email page as long as the student
does not delete those copies. Blue Ridge College also stores
at least one additional copy of all student emails, which can
be used to recover any email that is accidentally deleted.
Students may access these stored copies only by requesting
them from Blue Ridge College's technical support
August 2011 to February 2015, Hately had an intimate
relationship with Nicole Torrenzano ("Nicole"),
with whom Hately has two children. During their relationship,
Hately and Nicole shared login and password information for
their email accounts-including Hately's Blue Ridge
College email account. But when, about March 2015, Nicole
informed Hately that she also was involved in an intimate
relationship with Watts, who was her co-worker and married to
Audrey Hallinan Watts ("Audrey"), Hately and Nicole
separated. Pertinent to this action, Hately did not change
the password that he shared with Nicole for his Blue Ridge
College email account.
and Nicole continued their personal relationship, and during
the fall of 2015, Watts and Audrey initiated divorce
proceedings. In an effort to help Watts in his divorce
proceedings, Nicole told Watts that Hately and Audrey were
having an affair. Nicole said she knew of emails between
Hately and Audrey that Watts could obtain by using the
password that she had to Hately's Blue Ridge College
stated that he used the password Nicole gave him to browse
through Hately's emails but contended that he "did
not open or view any email that was unopened, marked as
unread, previously deleted, or in the [student email
account]'s 'trash' folder." J.A. 506. Watts
also said that he did not "change the status of, or
modify, any email in any way." Id.
September 2016, Hately filed his first lawsuit against Watts
and Nicole in the United States District Court for the
Eastern District of Virginia ("Hately I"),
alleging that they unlawfully accessed his email, in
violation of: (1) the federal Computer Fraud and Abuse Act,
18 U.S.C. § 1030; (2) the federal Stored Communications
Act, 18 U.S.C. § 2701, et seq.; and (3) the
Virginia Computer Crimes Act, Va. Code Ann. §
18.2-152.1, et seq. Shortly after filing suit,
Hately voluntarily dismissed his claims against Watts,
without prejudice, and amended his complaint against Nicole.
In his amended complaint, Hately alleged that he
"incurred actual damages by the illicit access because
[he] was forced to incur damages in time invested, software
purchases to track and prevent future access, and
more[.]" J.A. 39 ¶ 93. He further alleged that he
had "incurred many hours of valuable time away from
day-to-day responsibilities in attempting to determine the
source of the computer breach." J.A. 37 ¶ 76.
order dated December 2, 2016, the district court in
Hately I dismissed "without prejudice"
Hately's Computer Fraud and Abuse Act and Virginia
Computer Crimes Act claims against Nicole. The order provided
no explanation as to why the court dismissed those claims.
But in a subsequent opinion addressing a different issue, the
court explained: "[a]lthough [Nicole] moved to dismiss
the [Virginia Computer Crimes Act] Claims on multiple
grounds, the Court dismissed the [Virginia Computer Crimes
Act] Claims because [Hately] failed to sufficiently allege
how he sustained any injury to person or property by reason
of a violation of the [Virginia Computer Crimes Act]."
Hately v. Torrenzano, No. 1:116-CV-01143 (GBL/MSN),
2017 WL 2274326, at *3 (E.D. Va. May 23, 2017). The district
court did not dismiss Hately's Stored Communications Act
February 13, 2017, Hately moved to amend his complaint for a
second time. This time, Hately sought to rename Watts as a
defendant and to reinstate his Computer Fraud and Abuse Act
and Virginia Computer Crimes Act claims against Nicole. The
district court denied the motion solely on grounds
that Hately's "attempt to amend the complaint would
cause undue prejudice to [Nicole]." Hately v.
Torrenzano, No. 1:16-CV-01143 (GBL/MSN), 2017 WL
1428712, at *1 (E.D. Va. Apr. 20, 2017). According to the
court, amending the complaint "would certainly require
the Court to reopen discovery for Watts" and would
"change the nature of this litigation" by
"add[ing claims] to what would otherwise be a narrow
case involving a single cause of action under the Stored
Communications Act[.]" Id. Hately did not
appeal the Hately I court's denial of his motion
April 2017, Hately refiled his action against Watts, again
alleging that Watts unlawfully accessed his email, in
violation of the Computer Fraud and Abuse Act, the Stored
Communications Act, and the Virginia Computer Crimes Act.
his initial action against Watts, which was voluntarily
dismissed without prejudice, Hately's refiled action
supported his Virginia Computer Crimes Act claims by reciting
additional factual allegations bearing on damages.
Hately, 2017 WL 2274326, at *3. For example, whereas
Hately's initial complaint alleged that Hately
"incurred many hours of valuable time away from
day-to-day responsibilities in attempting to determine the
source of the computer breach," J.A. 37 ¶ 76,
Hately's complaint in the refiled action provided greater
detail as to the time he lost as a result of the breach,
alleging that he "was forced to identify" and make
"several calls to" Blue Ridge College's
technical support personnel "in order to ascertain the
individual(s) that owns the domain for his school-related
email account, as well as the individual(s) that manages the
exchange servers for his school-related email account."
J.A. 165 ¶¶ 94-96. And Hately's refiled
complaint alleged that he "review[ed]"
"hundreds or thousands of email messages" and
"restore[d]" "deleted but unread email
messages" that "were previously unknown to
[Hately]." J.A. 166 ¶¶ 97-98. Also, the
refiled complaint alleged that Hately was "forced to
download and run programs that scanned his mobile telephone
for viruses." J.A. 170 ¶ 115.
conducting a hearing on July 6, 2017, the district court
dismissed the Virginia Computer Crimes Act claims against
Watts for two independent reasons. First, the court held that
the Virginia Computer Crimes Act claims were barred by
collateral estoppel. The court explained in an oral ruling
that "[a]ll of the damages that [Hately] alleges in this
[instant] action . . . were the subject of [a prior motion to
dismiss in Hately I], and that issue was fully
briefed and argued in open court in the prior
proceedings." J.A. 377. Even though the Hately
I court dismissed the Virginia Computer Crimes Act
claims "without prejudice," the district court
concluded that the previous dismissal had "finally
determined" that Hately had not "sustained injury
to person or property" under the Virginia Computer
Crimes Act. J.A. 382. Accordingly, the district court held
that Hately was "estopped from relitigating those injury
claims." Id. Second, the district court
concluded that, even if collateral estoppel did not apply,
Hately failed to plausibly allege statutory injury,
notwithstanding that Hately's new complaint included
additional factual allegations bearing on injury. J.A. 383
(holding that Hately had "not alleged facts that make
plausible his claim that he has sustained injury to person or
property as those terms have been construed under the
[Virginia Computer Crimes Act]").
in January 2018, Hately and Watts filed cross-motions for
summary judgment on the remaining Stored Communications Act
claim. In an order entered March 14, 2018, the district court
denied Hately's motion, granted Watts' motion, and
dismissed the case. In an accompanying opinion, the court
held that "previously opened and delivered emails"
stored "in a web-based email client" were not in
protected "electronic storage" for purposes of the
Stored Communications Act. Hately v. Watts, 309
F.Supp.3d 407, 408, 410-14 (E.D. Va. 2018). According to the
court, the statutory definition of "electronic
storage" "covers emails only up to the point where
the emails have been initially transmitted to their recipient
and read or initially downloaded." Id. at 410.
district court also held that Hately's emails were not
protected under the statute because they were not stored by
an "electronic communication service" and were not
stored "for purposes of backup protection."
Id. at 412-413 (quoting 18 U.S.C. §
2510(17)(B)). According to the court, Blue Ridge College was
acting, for purposes of the Stored Communications Act, as a
"remote computing service"-not as an
"electronic communication service"-because the
emails Watts accessed were "service copies"
maintained by Blue Ridge College "for the purposes of
transmitting them to a single user's account upon that
user's command." Id. at 413. Furthermore,
the emails were not stored for purposes of backup protection
because, the court maintained, they were stored for
Hately's backup purposes rather than Blue
Ridge College's "own backup or administrative
purposes." Id. Because Hately's accessed
emails were not protected "electronic storage,"
Watts was entitled to judgment as a matter of law on the
Stored Communications Act claim. Id.
timely appealed the dismissal of his Virginia Computer Crimes
Act claims and the grant of summary judgment on the Stored
Communications Act claim. We address each claim in turn.
the district court's dismissal of his Virginia Computer
Crimes Act claims, Hately contends that the district
court's error was twofold. First, that the court
improperly applied the doctrine of collateral estoppel, also
referred to as "issue preclusion," to bar
reconsideration of whether he adequately alleged that his
"property or person [was] injured" within the
meaning of the Virginia Computer Crimes Act. See Va.
Code Ann. § 18.2-152.12(A). And second, that the court
incorrectly determined that he failed to plausibly allege
injury to person or property within the meaning of the
Virginia Computer Crimes Act. We agree, and therefore
conclude that the district court erred in dismissing
Hately's Virginia Computer Crimes Act claims.
district court applied the doctrine of issue preclusion to
bar reconsideration of whether Hately's complaint
adequately alleged his "property or person [was]
injured" within the meaning of the Virginia Computer
Crimes Act. Va. Code Ann. § 18.2-152.12(A). Issue
preclusion bars "successive litigation of an issue of
fact or law actually litigated and resolved in a valid court
determination essential to the prior judgment, even if the
issue recurs in the context of a different claim."
Taylor v. Sturgell, 553 U.S. 880, 892 (2008)
(citation and alterations omitted); see also Angstadt v.
Atlantic Mut. Ins. Co., 457 S.E.2d 86, 87 (Va. 1995)
("The doctrine of collateral estoppel precludes parties
to a prior action and their privies from litigating in a
subsequent action any factual issue that actually was
litigated and essential to a valid, final judgment in the
prior action."). We review the application of issue
preclusion de novo. United States v. Fiel, 35 F.3d
997, 1005 (4th Cir. 1994).
determine whether the district court properly applied issue
preclusion, we must determine which jurisdiction's
preclusion law governs. See Semtek Int'l v. Lockheed
Martin Corp., 531 U.S. 497, 506-09 (2001) (citing, among
others, Erie R. Co. v. Tompkins, 304 U.S. 64, 78-80
(1938)). Neither the Supreme Court nor this Court has ever
addressed what law governs the issue-preclusive effect of a
federal court disposition of a state law claim rendered in a
case in which the federal court exercised supplemental
jurisdiction over the state law claim. However, in Semtek
International v. Lockheed Martin, the Supreme Court held
that when a federal court exercises diversity jurisdiction
over a state law claim, "federal common law governs the
claim-preclusive effect of a dismissal" of the state law
claim by the federal court. 531 U.S. at 508. The federal
preclusion rule in such cases is to apply "the law that
would be applied by state courts in the State in which the
federal diversity court sits" as long as the state rule
is not "incompatible with federal interests."
Id. at 508-09 (citations omitted). Federal courts
apply state preclusion law because "there is no need for
a uniform federal rule" in a state-law cause of action,
the Court explained. Id. Indeed, an alternative
federal rule would "produce the sort of forum shopping
and inequitable administration of the laws that Erie
seeks to avoid, since filing in, or removing to, federal
court would be encouraged by the divergent effects that
litigants would anticipate from likely grounds of
dismissal." Id. (internal quotations and
justifications are equally persuasive in cases in which
federal courts exercise supplemental, as opposed to
diversity, jurisdiction over state law claims. Accordingly,
we hold that when a federal court exercises supplemental
jurisdiction over a state law claim, federal common law
governs the preclusive effect of the federal court's
disposition of that claim. Cf. id. The federal rule
of decision in such cases is to apply state preclusion law,
unless the state preclusion law is incompatible with federal
interests. Cf. id.; accord Access 4 All Inc. v.
Trump Int'l Hotel & Tower Condo., No.
04-CV-7497KMK, 2007 WL 633951, at *3 (S.D.N.Y. Feb. 26,
we discern no reason why Virginia preclusion law is
incompatible with federal interests. Applying state
preclusion law here would not undermine "federal
courts' interest in the integrity of their own
processes." See Semtek Int'l., 531 U.S. at
509 (providing, as an example, that a state's failure to
estop "willful violation[s] of discovery orders . . .
might justify a contrary federal rule"). On the
contrary, applying Virginia preclusion law furthers the
"federalism principle of Erie" by ensuring
there are not "substantial variations in outcomes
between state and federal litigation which would likely
influence the choice of a forum." Id. at 504
(internal quotations and alterations omitted); see also Q
Int'l Courier Inc. v. Smoak, 441 F.3d 214, 218, 218
n.1 (4th Cir. 2006) (finding Virginia's claim preclusion
law was "not incompatible with any federal
interest" when state law would bar the plaintiff from
relitigating a "common core of operative facts").
apply Virginia preclusion law to determine whether the
doctrine of issue preclusion barred Hately from litigating
the adequacy of his allegations as to damages in his new
complaint. Under Virginia law, a party asserting defensive
issue preclusion has "the burden of proving that the
claim or question had been in issue and determined in [a]
prior . . . action." Scales v. Lewis, 541
S.E.2d 899, 901 (Va. 2001). Specifically, the proponent of
issue preclusion must demonstrate that: "(1) the parties
to the two proceedings, or their privies, be the same; (2)
the factual issue sought to be litigated must have been
actually litigated in the prior action and must have been
essential to the prior judgment; and (3) the prior action
must have resulted in a valid, final judgment against the
party sought to be precluded in the present action."
Weinberger v. Tucker, 510 F.3d 486, 491 (4th Cir.
2007) (citing TransDulles Ctr., Inc. v. Sharma, 472
S.E.2d 274, 275 (Va. 1996)). Also, "in Virginia, [issue
preclusion] requires a fourth element, mutuality."
Id. (citing TransDulles Ctr., 472 S.E.2d at
under federal preclusion law, Virginia applies the doctrine
of issue preclusion only when the decided issue is
"essential to the prior judgment." See
TransDulles Ctr., 472 S.E.2d at 275. Thus, when, as
here, issue preclusion is "considered in the context of
two separate litigations[, ] if a judgment in the prior case
is supported by either of two findings, neither finding can
be found essential to the judgment." In re Microsoft
Corp. Antitrust Litig., 355 F.3d 322, 328 (4th Cir.
2004); see Scales, 541 S.E.2d at 901; cf. Reid
v. Ayscue, 436 S.E.2d 439, 441 (Va. 1993) (holding that
issue preclusion was appropriate when there was only one
"rational interpretation" of a prior jury verdict).
the Hately I dismissal order did not explain why
Hately's Virginia Computer Crimes Act claims were
dismissed, the court later elaborated that Hately had
"failed to sufficiently allege how he sustained any
injury to person or property by reason of a violation of the
Virginia Computer Crimes Act." Hately, 2017 WL
2274326, at *3. In rendering its oral ruling on issue
preclusion, the district court in the instant case appears to
have read this sentence as a determination that the three
"categories" of damages Hately alleged-(1)
"expenses incurred in connection with evaluating the
defendant's alleged wrongful conduct," (2) expenses
incurred in "reporting the alleged hacking to law
enforcement," and (3) the cost of time spent
"reviewing records, restoring e-mails, and researching
and implementing security enhancements"-were not, as a
matter of law, actionable under the Virginia Computer Crimes
Act. See J.A. 375-77 (holding that in his current
"complaint, [Hately] alleged damages that fall within
the three categories of damages" he set forth in his
Hately I court's explanation for its decision to
dismiss the Virginia Computer Crimes Act claims is as-if not
more-plausibly read as holding not that the three
"categories" of damages alleged were not actionable
under the Virginia Computer Crimes Act, but rather, in the
court's own words, that Hately's complaint failed to
include "sufficien[t]," nonconclusory factual
allegations establishing such damages to satisfy the
requirements of Federal Rule of Civil Procedure 12(b)(6).
Hately, 2017 WL 2274326, at *3; see also Aziz v.
Alcolac, Inc., 658 F.3d 388, 391 (4th Cir. 2011)
("[S]tatements of bare legal conclusions are not
entitled to the assumption of truth and are insufficient to
state a claim[.]"). That this Court has held that the
"categories" of damages Hately alleged in his
previous complaint are actionable under the Virginia
Computer Crimes Act, see infra Part II.B, supports
this reading of the Hately I court's order, as
we presume that the district court correctly applied this
Court's precedent. Accordingly, at a minimum, it is
unclear whether the Hately I court dismissed the
prior action ...