Williams v. AT&T Mobility, LLC ( 2022 )

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF NORTH CAROLINA WESTERN DIVISION No. 5:19-cv-00475-BO JASON WILLIAMS ) ) Plaintiff, ) ) V. ) ORDER ) ) AT&T MOBILITY, LLC ) Defendant. ) This matter comes before the Court on defendant’s motion for summary judgment. [DE 118]. Plaintiff has responded in opposition [DE 141], and the matter is ripe for disposition. For the following reasons, defendant’s motion [DE 118] is GRANTED in part and DENIED in part. BACKGROUND A SIM (“subscriber identify module”) card is a removable chip that allows a cell phone to communicate with the wireless carrier. Each SIM card is associated with a customer’s phone number. AT&T records which phone number is paired with which SIM card, and if the customer wants to swap their SIM card to another phone, AT&T must perform a “SIM swap.” Sometimes, a hacker successfully convinces AT&T, usually through a customer service call center or face-to-face in a retail store, to swap the victim’s SIM card for a SIM card in the hacker’s control. After an unauthorized SIM swap, the victim’s texts and phone calls are rerouted to the hacker’s phone. So anyone dialing the victim’s number would be rerouted to the hacker’s phone. This allows the hacker to change the victim’s passwords because most accounts □□□ protected by SMS two-factor authentication. Before allowing a user to change their password, the site sends the user a unique one-time passcode via text message. Using the codes sent to the “victim’s phone,” a hacker can change passwords to the victim’s email accounts, financial accounts, and other online platforms. Mr. Williams and AT&T entered into a typical user-carrier phone contract in Raleigh, NC, in 2000. Sometime later, Mr. Williams invested $1,600,000 in Apollo Kids Mining (“AKM”), an LLC that mined Bitcoin. He is the sole shareholder of AKM. On November 5, 2018, a hacker convinced AT&T to perform a SIM swap on Mr. Williams’s cell phone. After Mr. Williams reversed the SIM swap, the hacker texted him, “Answer the phone or your daughter will go missing tonight.” Mr. Williams called the police and subsequently bought a gun. AT&T promised not to perform any more SIM swaps unless Mr. Williams personally appeared in a particular Raleigh AT&T store with two forms of identification. On November 30, 2018, AT&T authorized a second SIM swap. This time, the hacker personally appeared at the Raleigh AT&T store and presented an employee with fake identification. Mr. Williams quickly reversed the swap, but the very next day, AT&T performed a third SIM swap. After Mr. Williams reversed that unauthorized swap, an AT&T employee assured him that Mr. Williams was on a special list of customers at high risk for SIM swap attacks. This happened three more times. AT&T would perform a SIM swap, Mr. Williams would reverse it, and AT&T would assure Mr. Williams that it had implemented security measures. The hackers compromised his accounts, forcing Mr. Williams to shut down AKM’s bitcoin mining operation. Between November 5, 2018, and February 8, 2019, AT&T performed six unauthorized SIM swaps. Finally, Mr. Williams switched to Verizon. In October 2019, Mr. Jason Williams brought this lawsuit against AT&T. He did not include AKM as a party. The suit contains six claims: (I) violation of the Federal Communications Act, 47 U.S.C. § 201 et seq.; (11) violation of the North Carolina Unfair and Deceptive Trade Practices Act (“UDTPA”), N.C. Gen. Stat. § 75-1.1; (III) negligence; (IV) negligent supervision; (V) violation of North Carolina’s computer trespass law, N.C. Gen. Stat. § 1-539.2A; and (VI) violation of the Computer Fraud and Abuse Act (““CFAA”), 18 U.S.C. § 1030. The Court denied defendant’s motion to dismiss [DE 20], and defendant has filed this motion for summary judgment. [DE 118]. DISCUSSION A motion for summary judgment may not be granted unless there are no genuine issues of material fact and the movant is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(a). The moving party bears the initial burden of demonstrating the absence of a genuine issue of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). If that burden has been met, the nonmoving party must then come forward and establish the specific material facts in dispute to survive summary judgment. Matsushita Elec. Indus. Co., Ltd. v. Zenith Radio Corp., 475 U.S. 574, 587-88 (1986). In determining whether a genuine issue of material fact exists, a court must view the evidence and the inferences in the light most favorable to the nonmoving party. Scott v. Harris, 550 U.S. 372, 378 (2007). However, “[t]he mere existence of a scintilla of evidence” in support of the nonmoving party’s position is not sufficient to defeat a motion for summary judgment; “there must be evidence on which the [fact finder] could reasonably find for the [nonmoving party].” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 252 (1986). And “the mere existence of some alleged factual dispute between the parties will not defeat an otherwise properly supported motion for summary judgment; the requirement is that there be no genuine issue of material fact.” Id. at 247-48 (emphasis in original). Speculative or conclusory allegations will not suffice. Thompson v. Potomac Elec. Power Co., 312 F.3d 645, 649 (4th Cir. 2002). Subject-matter jurisdiction is based on diversity of citizenship, and this Court applies state substantive law and federal procedural rules. See Erie R.R. v. Tompkins, 304 U.S. 64, 76-80 (1938); Dixon v. Edwards, 290 F.3d 699, 710 (4th Cir. 2002). North Carolina law applies to Mr. Williams’s tort claims and AT&T’s contract defenses. In tort claims, North Carolina follows the lex loci delicti rule. Because the alleged negligence occurred in Raleigh, the law of North Carolina applies. Hensley v. Nat'l Freight Transp., Inc., 193 N.C. App. 561 (2008). For contract defenses, “the substantive law of the state where the last act to make a contract occurs governs all aspects of the contract.” Tolaram Fibers, Inc. v. Tandy Corp.,92 N.C. App. 713,717 (1989). Since Mr. Williams signed the contract in Raleigh, NC, the laws of North Carolina apply to AT&T’s contract defenses. Accordingly, this Court must predict how the Supreme Court of North Carolina would rule on any disputed state-law issue. See Twin City Fire Ins. Co. v. Ben Arnold-Sunbelt Beverage Co. of S.C., 433 F.3d 365, 369 (4th Cir. 2005). A. Economic Loss Rule AT&T argues that Mr. Williams’s negligence claims are barred by the economic loss rule. The rule is that ‘‘a breach of contract does not give rise to a tort action by the promisee against the promisor.” N. Carolina State Ports Auth. v. Lloyd A. Fry Roofing Co., 294 N.C. 73, 81, 240 S.E.2d 345 (1978) (overturned on other grounds). The economic loss rule is designed to prevent plaintiffs from repackaging their breach of contract claims as tort claims. AT&T’s argument begins with the faulty premise that Mr. Williams’s claims are “properly set forth in the law of contract.” [DE 148 at 11]. The service agreement does rot swallow up AT&T’s common law duty to treat Mr. Williams with reasonable care. See Kelly v. Georgia-Pac. LLC, 671 F. Supp. 2d 785, 791 (E.D.N.C. 2009). The economic loss rule does not bar a claim where the breaching act ultimately harms something other than the subject of the contract or causes personal injury to the promisee. Ellis v. Louisiana-Pac. Corp., 699 F.3d 778, 783 (4th Cir. 2012). The subject matter of the service agreement was Mr. Williams’s cell phone. However, the alleged harm — compromised legal and financial information, money stolen from his bank account, personal threats, and a tarnished reputation — reaches well beyond the subject matter of the cell phone service agreement. Because plaintiff is not seeking to repackage a breach of contract claim as a tort claim, the economic loss rule does not bar Mr. Williams’s negligence claim. B. AKM damages Mr. Williams alleges that AT&T’s negligence forced him to shut down AKM, his bitcoin mining operation. Mr. Williams was AKM’s sole shareholder and had invested $1,400,000 in AKM. He also claims that, but for the hack, he would have reaped $600,000 in AKM’s profits. In total, Mr. Williams alleges $2,000,000 in ““AKM damages.” AT&T argues that Mr. Williams lacks standing to claim the AKM damages because AKM is not a party in this suit. The general rule is that a shareholder lacks standing to sue for an injury suffered by the corporation. There are two exceptions to this rule. A shareholder has standing “(1) where there is a special duty, such as a contractual duty, between the wrongdoer and the shareholder, and (2) where the shareholder suffered an injury separate and distinct from that suffered by other shareholders.” Barger v. McCoy Hillard & Parks, 346 N.C. 650, 658 (1997). AT&T argues that there is no “special duty” between AT&T and Mr. Williams because there is no contractual relationship between AT&T and AKM. Therefore, AT&T argues Mr. Williams has no standing to clam AKM damages. However, a contractual relationship between AT&T and AKM is not necessary to establish a special duty between AT&T and Mr. Williams. A special duty is established when a “defendant[] owed a duty to plaintiff[] that was personal to plaintiff[] as shareholders and was separate and distinct from the duty defendants owed the corporation.” /d. at 659. For example, a special duty is established “when the party performed individualized services directly for the shareholder.” /d.; see Lemon v. Myers Bigel, P.A., No. 5:18- CV-200-FL, 2019 WL 1117911, at *21 (E.D.N.C. Mar. 11, 2019). The service agreement between AT&T and Mr. Williams obliged AT&T to perform individualized services directly for Mr. Williams. This obligation created a “special duty” between the parties, providing Mr. Williams with standing to claim the AKM damages. C. Negligent infliction of emotional distress Mr. Williams allegedly suffered severe emotional distress caused by the hacker’s threatening texts. He did not specify whether he was accusing AT&T of intentional infliction of emotional distress or negligent infliction of emotional distress. Nothing in the filings suggests that AT&T intentionally caused him emotional distress. Therefore, this Court infers that Mr. Williams is alleging negligent infliction of emotional distress. “A claim for negligent infliction of emotional distress requires a plaintiff to establish that (1) the defendant engaged in negligent conduct; (2) it was reasonably foreseeable that such conduct would cause the plaintiff to suffer severe emotional distress; and (3) the conduct did in fact cause plaintiff to suffer severe emotional distress.” Mullis vy. Mechanics & Farmers Bank, 994 F. Supp. 688 (M.D.N.C. 1997) (citing Johnson v. Ruark Obstetrics & Gynecology Assocs., 327 N.C. 283, 304 (1990). Mr. Williams has carried his burden to create a genuine issue of material fact as to each element. First, Mr. Williams created a genuine issue of material fact as to whether AT&T negligently performed or supervised the unauthorized SIM swaps. An unforeseeable act usually severs proximate cause. And because a third party’s intentional criminal act is usually unforeseeable, the general rule is that a third party’s intentional criminal act usually severs proximate cause. Foster v. Winston-Salem Joint Venture, 303 N.C. 636, 638 (1981). Here, consistent with that general rule, AT&T argues that proximate cause is severed by the hacker’s independent intervening criminal acts. [DE 119 at 26-27]. However, the general rule is inapplicable here because the hacks were “not merely foreseeable by AT&T but were in fact foreseen.” [DE 20 at 8]. The evidence showed that AT&T told Mr. Williams it had placed specific security protocols on his account. But in reality, AT&T did not follow those protocols. The evidence also showed that AT&T knew or should have known that their security procedures left their customers vulnerable to unauthorized SIM swaps. AT&T procedure allowed an employee to change any AT&T customer’s SIM card simply by entering the last four digits of the customer’s social security number and noting, without verification, that the employee had reviewed the customer’s photo identification. Thus, proximate cause is not severed because, even though Mr. Williams’s injury was caused by a third party’s criminal acts, those acts should have been foreseeable to AT&T. Second, Williams created a genuine issue of material fact as to whether it was reasonably foreseeable that AT&T’s negligence would cause Mr. Williams severe emotional distress. AT&T knew that two-factor authentication was an extremely popular method of protecting personal accounts. Therefore, AT&T should have foreseen that an unauthorized SIM swap would likely result in the publication of a customer’s sensitive information, causing that customer severe emotional distress. Finally, Mr. Williams created a genuine issue of material fact as to whether plaintiff's emotional distress was severe. “[P]laintiff’s testimony, standing alone, can support an award of compensatory damages for emotional distress.” Bryant v. Aiken Reg'l Med. Centers Inc., 333 F.3d 536, 546 (4th Cir. 2003). Plaintiff's testimony must indicate with specificity “how [plaintiffs] alleged distress manifested itself.” /d. In addition, plaintiff must show he suffered more than mere fright or temporary anxiety. Johnson, 327 N.C. at 303. Here, Mr. Williams provided a text from the hacker, threatening to kidnap his daughter: “Answer the phone or your daughter will go missing tonight.” [DE 2 at 48]. This threat was “terrifying” and “unnerving.” [DE 141 at 25]. When Mr. Williams called the police, the officers advised him to buy a gun. [DE 2 at 49]. Mr. Williams bought a gun, silencer, and other accessories but still could not sleep for fear that intruders would harm him and his family. [DE 144 at § 6]. Considering all the evidence provided, Mr. Williams has done enough to create a genuine issue of material fact regarding his claim for emotional distress. D. Punitive damages Mr. Williams claims he is entitled to punitive damages. [DE 2 § 191]. Under North Carolina law, punitive damages may not be awarded for a breach of contract alone. N.C. Gen. Stat. § 1D- 15(d). There must be clear and convincing evidence of one of the following aggravating factors: (i) fraud, (ii) malice, or (ii) willful or wanton conduct. N.C. Gen. Stat. § 1D-15(a) A corporate entity can be liable for punitive damages: (a) where its own acts or policies constitute the aggravating factor, or (b) where officers, directors, or managers participated in or condoned the conduct. McKiver v. Murphy-Brown, LLC, 980 F.3d 937, 970-711 (4th Cir. 2020) (citing N.C. Gen. Stat. § 1D-15(c)). On defendant’s motion for summary judgment, this Court views the evidence through the “prism” of that heightened evidentiary burden. Walls vy. Ford Motor Co., No. 1:20- CW-98, 2022 WL 588901, at *14(M.D.N.C. Feb. 25, 2022). Here, the Wireless Customer Agreement is binding anid forecloses plaintiff's) punitive damages. See AT&T Mobility v. Concepcion, 563 U.S. 333 (2011). Section 4.1 of that agreement states, “AT&T isn’t liable for any indirect, special, punitive, incidental or consequential losses or damages you or any third party may suffer by use of, or inability to use, Services, Software, or Devices provided by or through AT&T, including loss of business or goodwill, revenue or profits, or claims of personal injuries.” [DE 143 at 530 (emphasis added)]. Mr. Williams argues AT&T’s policies “demonstrate a conscious and intentional disregard of’ Mr. Williams’s rights and safety. [DE 141 at 19]. Specifically, AT&T’s policy allegedly allowed an AT&T agent to perform a SIM swap if that agent examined a customer’s identification and entered the last four digits of their social security number. [DE 141 at 10]. Mr. Williams argues this policy intentionally disregarded his safety “because there was no mechanism in place to prevent an AT&T agent from simply lying about seeing a customer’s photo identification.” [DE 141 at 19]. But these procedures are evidence of negligence, not “fraud,” “malice,” or “wanton conduct.” N.C. Gen. Stat. § 1D-15(a). In fact, the evidence suggests that AT&T was investing millions of dollars in fixing this SIM swap problem. [DE 119]. Even when drawing all inferences in his favor, Mr. Williams has not met the required heightened burden necessary to survive defendant’s motion for summary judgment. Therefore, Mr. Williams’s alleged punitive damages must be dismissed. E. CFAA claim AT&T argues that defendant’s Computer Fraud and Abuse Act (CFAA) claim should be dismissed. [DE 119 at 23]. Mr. Williams concedes that Van Buren v. United States, 141 S.Ct. 1648 (2021) limited the scope of AT&T’s CFAA liability. [DE 141 at 25 n. 6]. Therefore, “Mr. Williams does not contest the dismissal of his CFAA claim.” [DE 141 at 25 n.6]. Accordingly, the CFAA claim [DE 2 at 228-35 (Count VI.)] is dismissed. CONCLUSION For the above reasons, defendant’s motion for summary judgment [DE 118] is GRANTED IN PART AND DENIED IN PART. Accordingly, the following two claims are DISMISSED: plaintiff's punitive damage claim and plaintiff's Computer Fraud and Abuse Act claim. SO ORDERED, this_ day of December, 2022. Tantne » TERRENCE W. BOYLE UNITED STATES DISTRICT JUDGE 10