143143

Sewellv.Bernardin

1
2

UNITEDSTATESCOURTOFAPPEALS
FORTHESECONDCIRCUIT

AugustTerm,2014
(Argued:February18,2015

Decided:August4,2015)

DocketNo.143143

6
7
8

ChantaySewell,
PlaintiffAppellant,

v.

10
11

PhilBernardin,
DefendantAppellee.

12
13
14

Before:

POOLER,SACK,andDRONEY,CircuitJudges.

Theplaintiff,ChantaySewell,appealsfromanAugust2,2014,judgmentof

15

theUnitedStatesDistrictCourtfortheEasternDistrictofNewYork(ArthurD.

16

Spatt,Judge)dismissingherclaimsundertheComputerFraudandAbuseAct,18

17

U.S.C.1030,andtheStoredCommunicationsAct,18U.S.C.2701,etseq.,for

18

failuretoinitiateheractionwithintheActstwoyearlimitationsperiods.Her

19

claimsaroseinconnectionwiththedefendant,PhilBernardins,allegedactsof

20

gainingunlawfulaccesstoSewellsAOLemailandFacebookaccounts.We

21

concludethatthedistrictcourtcorrectlyappliedthetwoyearstatutesof

22

limitationstoSewellsclaimsforunlawfulaccesswithrespecttoheremail

No.143143
Sewellv.Bernardin

account,butthatiterredinholdingthatherclaimswithrespecttoherFacebook

accountweretimebarred.
WethereforeAFFIRMinpart,andVACATEandREMANDinpartfor

3
4

furtherproceedingsasindicatedinthisopinion.

5
6
7

HARVEYS.MARS,LawOfficeofHarvey
S.MarsLLC,NewYork,NY,forPlaintiff
Appellant.

8
9
10

GARYT.CERTAIN,LawOfficeofCertain
&Zilberg,PLLC,NewYork,NY,for
DefendantAppellee.

11

SACK,CircuitJudge:
Inordertoresolvethisappeal,weaddressamatteroffirstimpressionin

12
13

thisCircuit:theoperationofthestatutesoflimitationsapplicableunderthecivil

14

enforcementprovisionsoftheComputerFraudandAbuseAct(CFAA),18

15

U.S.C.1030,andtheStoredCommunicationsAct(SCA),18U.S.C.2701,et

16

seq.AplaintiffbringinganactionundertheCFAAscivilenforcementprovision

17

mustdosowithin2yearsofthedateoftheactcomplainedoforthedateofthe

18

discoveryofthedamage.18U.S.C.1030(g).TheSCAprovidesthat[a]civil

19

actionunderthissectionmaynotbecommencedlaterthantwoyearsafterthe

20

dateuponwhichtheclaimantfirstdiscoveredorhadareasonableopportunityto

21

discovertheviolation.18U.S.C.2707(f).
2

No.143143
Sewellv.Bernardin

Theplaintiff,ChantaySewell,filedsuitunderbothstatutesallegingthat

1
2

herformerboyfriend,defendantPhilBernardin,hadgainedaccesstoheremail

andFacebookaccountswithoutherpermissionandthereforeinviolationofthe

CFAAandtheSCA.Sheassertsthatshediscoveredthatshecouldnotloginto

herwww.aol.com(AOL)emailaccountonoraboutAugust1,2011because

herpasswordwasaltered.Compl.11(J.A.5).Morethansixmonthslater,on

oraboutFebruary24,2012,shecontends,shediscoveredthatshecouldnotlog

intoherwww.facebook.com(Facebook)accountbecauseherpasswordwas

altered.Compl.12(J.A.5).ThedistrictcourtgrantedBernardinsmotionto

10

dismissSewellsclaimsasuntimely,andSewellappealed.BecauseSewellfiled

11

suitonJanuary2,2014,weconcludethatherclaimsrelatingtoBernardins

12

allegedunlawfulaccessofheremailaccountaretimebarred,butthatherclaims

13

relatingtohisallegedunlawfulaccessofherFacebookaccountweretimelyfiled.

14

BACKGROUND
Weacceptastrueatthisstageoftheproceedingsallfactsallegedin

15
16

Sewellscomplaint.SeeTownofBabylonv.Fed.Hous.Fin.Agency,699F.3d221,

17

227(2dCir.2012).Accordingtothoseallegations,SewellandBernardinwere

No.143143
Sewellv.Bernardin

involvedinaromanticrelationship1frominorabout2002until2011.Sewell

maintainedaprivateemailaccountwithAOLandaprivatesocialmedia

accountwithFacebook,includingin2011and2012.Shedidnotknowinglyshare

heraccountpasswordswithBernardinoranyotherpersonandwastheonly

authorizeduserofeachaccount.
OnoraboutAugust1,2011,SewelldiscoveredthatherAOLpassword

6
7

hadbeenaltered,andshewasthereforeunabletologintoherAOLemail

account.Thatsamemonth,maliciousstatementsabouthersexualactivities2

wereemailedtovariousfamilymembersandfriendsviaSewellsowncontacts

10

listmaintainedprivatelywithinheremailaccount.Compl.19(J.A.6).
OnFebruary24,2012,SewellfoundherselfunabletologintoherFacebook

11
12

account.Then,onMarch1,2012,someoneotherthanshepostedapublic

13

messagefromherFacebookaccountcontainingmaliciousstatements,again

14

concerningSewellssexlife.

SewellscharacterizationofherrelationshipwithBernardiniscontainedinan
affidavitfiledwiththedistrictcourtonFebruary14,2014.

2Inhercomplaint,SewelldescribesanemailsentinoraroundAugust2011usingher
1

personalcontactslistascontainingmaliciousstatementstowardSewellregarding
certainsexuallytransmitteddiseasesandsexualactivities.Compl.19(J.A.6).

No.143143
Sewellv.Bernardin

SewellallegesthatBernardinobtainedherAOLandFacebookpasswords

1
2

withoutherpermissionwhilehewasaguestinherhome.VerizonInternet

recordsconfirmedthatBernardinscomputerwasusedtogainaccesstothe

serversonwhichSewellsaccountswerestored.HethenchangedherAOLand

Facebookpasswords.BernardinallegedlytherebyobtainedaccesstoSewells

electroniccommunicationsandotherpersonalinformationandsentmessages

purportingtobefromher.
OnMay15,2013,SewellfiledaseparatesuitagainstBernardinswife,Tara

8
9

Bernardin,andJohnDoes#15,apparentlybelievingthatTaraBernardinand

10

othersunknowntoherhadgainedaccesstoherInternetaccounts.The

11

complaintraisedclaimsstrikinglysimilartothosethatsheispursuinginthe

12

instantaction.TaraBernardinsettledhersuitwithSewellonSeptember27,2013,

13

andthecourtaccordinglyenteredjudgmentinSewellsfavorshortlythereafter.

14

Severalmonthslater,onJanuary2,2014,Sewellfiledtheinstantactionagainst

15

PhilBernardin,allegingviolationsoftheSCAandCFAA.OnAugust2,2014,the

16

UnitedStatesDistrictCourtfortheEasternDistrictofNewYork(ArthurD.

17

Spatt,Judge)grantedBernardinsmotiontodismiss,holdingthatSewellsclaims

No.143143
Sewellv.Bernardin

weretimebarredundertheCFAAsandSCAsapplicabletwoyearstatutesof

limitations.Thisappealfollowed.

DISCUSSION

3
4

WereviewthegrantofamotiontodismissunderFederalRuleofCivil

Procedure12(b)(6)3denovo,acceptingastruefactualallegationsmadeinthe

complaint,anddrawingallreasonableinferencesinfavoroftheplaintiff[].

TownofBabylon,699F.3dat227.DismissalunderFed.R.Civ.P.12(b)(6)is

appropriatewhenadefendantraisesastatutorybar,suchaslackoftimeliness,

asanaffirmativedefenseanditisclearfromthefaceofthecomplaint,and

10

mattersofwhichthecourtmaytakejudicialnotice,thattheplaintiffsclaimsare

11

barredasamatteroflaw.Staehrv.HartfordFin.Servs.Grp.,547F.3d406,425(2d

12

Cir.2008)(internalquotationmarks,alterations,andemphasisomitted).
I.TheApplicableStatutesofLimitations

13
14

A.TheComputerFraudandAbuseAct

Thedefendantstyledhismotionbeforethedistrictcourtasamotionpursuantto
FederalRuleofCivilProcedure12(c).Thedistrictcourt,however,treatedthemotionas
amotiontodismisspursuanttoRule12(b)(6).Thepartiesdonotraisethisasanissue
onappealand,inanyevent,[t]hestandardforgrantingaRule12(c)motionfor
judgmentonthepleadingsisidenticaltothatofaRule12(b)(6)motionforfailureto
stateaclaim.Patelv.ContemporaryClassicsofBeverlyHills,259F.3d123,126(2dCir.
2001).
3

No.143143
Sewellv.Bernardin

TheCFAAcriminalizes,interalia,intentionallyaccess[ing]acomputer

1
2

withoutauthorizationorexceed[ing]authorizedaccess,andthereby

obtain[ing]...informationfromanyprotectedcomputer,18U.S.C.

1030(a)(2)(C),andintentionallyaccess[ing]aprotectedcomputerwithout

authorization,andasaresultofsuchconduct,caus[ing]damageandloss,id.

1030(a)(5)(C).
Thestatutealsoprovidesacivilcauseofactionto[a]nypersonwho

7
8

suffersdamageorlossbyreasonofaviolationofthissection.Id.1030(g).To

betimely,suchacivilsuitmustbefiledwithin2yearsofthedateoftheact

10

complainedoforthedateofthediscoveryofthedamage.Id.Damage,in

11

turn,isdefinedasanyimpairmenttotheintegrityoravailabilityofdata,a

12

program,asystem,orinformation.Id.1030(e)(8).Thestatuteoflimitations

13

undertheCFAAaccordinglyranfromthedatethatSewelldiscoveredthat

14

someonehadimpairedtheintegrityofeachofherrelevantInternetaccounts.

15

B.TheStoredCommunicationsAct

16

UndertheSCA,itisacrimeto:

17
18

(1) intentionally access[] without authorization a facility through

whichanelectroniccommunicationserviceisprovided;or

19

(2)intentionallyexceed[]anauthorizationtoaccessthatfacility;
7

No.143143
Sewellv.Bernardin

andtherebyobtain[],alter[],orprevent[]authorizedaccesstoawire
orelectroniccommunicationwhileitisinelectronicstorageinsuch
system....

1
2
3
4

18U.S.C.2701(a).
AswiththeCFAA,theSCAestablishesacivilcauseofaction.[A]ny...

5
6

personaggrievedbyanyviolationofthischapterinwhichtheconduct

constitutingtheviolationisengagedinwithaknowingorintentionalstateof

mindmayfilesuit.Id.2707(a).Acivilactionunderthissectionmustbe

commencednolaterthantwoyearsafterthedateuponwhichtheclaimantfirst

10

discoveredorhadareasonableopportunitytodiscovertheviolation.Id.

11

2707(f).Inotherwords,thelimitationsperiodbeginstorunwhentheplaintiff

12

discoversthat,orhasinformationthatwouldmotivateareasonablepersonto

13

investigatewhether,someonehasintentionallyaccessedthefacilitythrough

14

whichanelectroniccommunicationserviceisprovidedandtherebyobtained

15

unauthorizedaccesstoastoredelectroniccommunication.Id.2701(a).

16
17
18

II.SewellsDiscoveryofDamageandUnauthorizedAccesstoHerAOL
andFacebookAccounts

19

ThedistrictcourtgrantedBernardinsmotiontodismissSewellsclaimsas

20

untimelybasedonthecourtsconclusionthatSewellwasawarethatthe

21

integrityofhercomputerhadbeencompromisedasofAugust1,2011.Sewellv.
8

No.143143
Sewellv.Bernardin

Bernardin,50F.Supp.3d204,212(E.D.N.Y.2014).Thecourtreasonedthat

SewellsAugust1,2011,discoverywhichrelatedtotheunauthorizeduseofher

AOLaccountprovidedherwithareasonableopportunitytodiscoverthefull

scopeofBernardinsallegedillegalactivitymorethantwoyearsbeforeshe

broughtthissuitonJanuary2,2014.Weagreewiththedistrictcourtasits

decisionrelatedtoSewellsAOLaccount,butdisagreewithitasitrelatedtoher

Facebookaccount.
SewelldiscoveredthedamagetoherAOLaccountforCFAApurposes

8
9

onAugust1,2011,whenshelearnedthatshecouldnotlogintoherAOLemail

10

account.Thatshemaynothaveknownexactlywhathappenedorwhyshe

11

couldnotloginisofnomoment.TheCFAAsstatuteoflimitationsbegantorun

12

whenSewelllearnedthattheintegrityofheraccounthadbeenimpaired.
TheSCAsstatuteoflimitationsbegantorunwhenSewellfirst...hada

13
14

reasonableopportunitytodiscover,18U.S.C.2707(f),thatsomeonehad

15

intentionallyaccess[ed][herAOLaccount]withoutauthorization,id.2701(a).

16

Shehadsuchanopportunityassoonasshediscoveredthatshecouldnotobtain

17

accesstothataccountbecauseherpasswordhadbeenalteredinasmuchas,

No.143143
Sewellv.Bernardin

acceptingherotherallegationsastrue,furtherinvestigationwouldhaveledher

toBernardin.4
SewellsCFAAandSCAclaimswithregardtoherAOLaccountwerefirst

3
4

madeonJanuary2,2014,andwerepremisedondamageandunauthorized

accesstoherAOLaccountwhichshehadorshouldhavediscoveredsometwo

yearsandfivemonthsearlier.Thetwoyearstatutesoflimitationshadtherefore

run.5

SewellsFacebookrelatedclaims,bycontrast,appeartohaveaccruedonor

aboutFebruary24,2012.Hercomplaintallegesthatshewasthesoleauthorized

10

userofherFacebookaccount.Compl.10(J.A.4).OnoraboutFebruary24,

11

2012,[she]discoveredthatshecouldnolongerlogintooraccessheraccount

12

withwww.facebook.combecauseherpassword[hadbeen]altered.Compl.12

13

(J.A.5).Thereisnothinginthefactsasallegedinthecomplaintfromwhichto

Weexpressnoviewastowhether,inadifferentcaseunderdifferentfacts,themere
inabilitytoaccessanaccountwithoutknowledgethatonespasswordhadbeen
alteredwouldprovideaplaintiffwithareasonableopportunitytodiscoveranSCA
violation.

5AlthoughthecomplaintallegesthatSewellsAOLaccountwasimproperlyaccessed
onmultipleoccasionssubsequenttoAugust1,2011,Sewelldoesnotraiseany
argumentsonappealwithrespecttotheseallegedviolations.Wethustakenoposition
astowhetherclaimsbasedonthosesubsequentviolationswouldbetimelyunderthe
CFAAortheSCA,orwhethersuchclaimswouldotherwisesurviveBernardinsmotion
todismiss.
4

10

No.143143
Sewellv.Bernardin

inferthatanyonegainedunauthorizedaccesstoherFacebookaccountbefore

then.Thus,takingtheseallegationsastrue,therewouldhavebeennodamage,

forCFAApurposes,orviolation,forSCApurposes,forSewelltodiscoverwith

respecttoherFacebookaccountbeforethatdate,whichwaslessthantwoyears

beforethesuitwasbrought.
ThefactthatSewellhaddiscovereddamagetoherAOLaccountbased

6
7

onherinabilitytoaccessAOLscomputerserversatanearlierdatedoesnotlead

toadifferentresult.Contrarytothedistrictcourtsremark,Sewelldidnot

allegedlydiscoverthattheintegrityofhercomputerhadbeencompromisedas

10

ofAugust1,2011.Sewell,50F.Supp.3dat212(emphasisadded).She

11

discoveredonlythattheintegrityofherAOLaccounthadbeencompromisedas

12

ofthattime.HerCFAAclaimaccordinglyispremisedonimpairmenttothe

13

integrityofacomputerownedandoperatedbyAOL,notofherownphysical

14

computer.6Asaresult,SewellhastwoseparateCFAAclaims,onethataccrued

15

onAugust1,2011,whenshefoundoutthatshecouldnotaccessherAOL

16

account,andonethataccruedonFebruary24,2012,whenshefoundoutthatshe

17

couldnotaccessherFacebookaccount.

SewellassertsthattheAOLandFacebookcomputerstowhichBernardinallegedly
gainedunauthorizedaccesswereprotectedundertheCFAA.Compl.15(J.A.5).
Bernardindoesnotargueotherwise.
6

11

No.143143
Sewellv.Bernardin

LikeherFacebookrelatedCFAAclaim,SewellsFacebookrelatedSCA

1
2

claimisalsotimely.UndertheSCA,acivilplaintiffmustfileherclaimwithin

twoyearsofdiscoveryorareasonableopportunitytodiscoverintentionaland

unauthorizedaccesstoanelectroniccommunicationfacility.Thedistrictcourt

concludedthatSewellhadareasonableopportunitytodiscovertheDefendants

illegalactivityvisvisherFacebookaccountasofAugust1,2011.Sewell,50F.

Supp.3dat213(internalquotationmarksandbracketsomitted).Butaswehave

noted,thereisnoallegationinthecomplaintthatSewellsFacebookaccountand

thecomputerserversonwhichherinformationwasstoredweretamperedwith

10

beforeFebruary24,2012,whensheallegesthatshewasunabletologintoher

11

Facebookaccount.Shecouldnotreasonablybeexpectedtohavediscovereda

12

violationthat,underthefactsasallegedinthecomplaint,hadnotyetoccurred.

13

Thedistrictcourtsconclusionmayrestontheassumptionthataplaintiff

14

isonnoticeofthepossibilitythatallofherpasswordsforalloftheInternet

15

accountssheholdshavebeencompromisedbecauseonepasswordforone

16

Internetaccountwascompromised.Wedonotthinkthatthatisareasonable

17

inferencefromthefactsallegedinthecomplaint.Wetakejudicialnoticeofthe

18

factthatitisnotuncommonforonepersontoholdseveralormanyInternet

12

No.143143
Sewellv.Bernardin

accounts,possiblywithseveralormanydifferentusernamesandpasswords,less

thanallofwhichmaybecompromisedatanyonetime.Atleastonthefactsas

allegedbytheplaintiff,itdoesnotfollowfromthefactthattheplaintiff

discoveredthatonesuchaccountAOLemailhadbeencompromisedthatshe

therebyhadareasonableopportunitytodiscover,orshouldbeexpectedtohave

discovered,thatanotherofheraccountsFacebookmightsimilarlyhave

becomecompromised.
Wepausetoacknowledgethatthestatutesoflimitationsgoverningclaims

8
9

undertheCFAAandSCA,asweunderstandthem,mayhavetroubling

10

consequencesinsomesituations.Evenafteraprospectiveplaintiffdiscoversthat

11

anaccounthasbeenhacked,theinvestigationnecessarytouncoverthehackers

12

identitymaybesubstantial.Inmanycases,wesuspectthatitmighttakemore

13

thantwoyears.Butitwouldappearthatifaplaintiffcannotdiscoverthe

14

hackersidentitywithintwoyearsofthedateshediscoversthedamageor

15

violation,herclaimsundertheCFAAandSCAwillbeuntimely.
TheplaintiffdoeshavetheoptionofinitiatingalawsuitagainstaJaneor

16
17

JohnDoedefendant,butshemuststilldiscoverthehackersidentitywithintwo

18

yearsofdiscoveryorareasonableopportunitytodiscovertheviolationtoavoid
13

No.143143
Sewellv.Bernardin

dismissal.ThisisbecausewehaveconcludedthatRule15(c)doesnotallowan

amendedcomplaintaddingnewdefendantstorelatebackifthenewlyadded

defendantswerenotnamedoriginallybecausetheplaintiffdidnotknowtheir

identities.Barrowv.WethersfieldPoliceDept,66F.3d466,470(2dCir.1995).7

CONCLUSION

Fortheforegoingreasons,thejudgmentofthedistrictcourtisAFFIRMED

6
7

inpartandVACATEDandREMANDEDinpartforfurtherproceedings.

Sewellalsopurportstoappealfromthedistrictcourtsdenialofherrequestforleave
toamend,butthedistrictcourtdidnotexplicitlydenyorotherwiseruleonthisrequest.
WecanimaginenoplausibleamendmentthatwouldrenderherAOLclaimstimelybut
neverthelessinstructthedistrictcourttoconsiderandexpresslyruleonSewells
motion,shouldshechoosetoreviveit,onremand.SeeJinv.Metro.LifeIns.Co.,310F.3d
84,101(2dCir.2002)(Outrightrefusaltogranttheleave[toamend]withoutany
justifyingreasonforthedenialisanabuseofdiscretion.).
7

14