Free Complaint - District Court of California - California

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 1 of 22

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 2 of 22

1 3-2(d), this civil action should be assigned to the San Francisco Division of the Northern 2 District of California. 3 4 2. Nature of the Claim This case is about TD AMERITRADE, Inc.'s ("Ameritrade") disclosure and

5 failure to keep secure its accountholder's private email addresses to spammers and potential 6 disclosure of accountholder's social security numbers to undesirable third parties. Stock 7 spammers continue to send Ameritrade accountholders unsolicited commercial email 8 promoting certain stocks ("stock spam"). Ameritrade's disclosure of these email addresses is 9 tortious and may indicate still more systematic torts by the company. On or about 10 September 14, 2007, Ameritrade admitted these disclosures and failures to keep secure 11 personal and private information, but, based on information and belief, Ameritrade was 12 aware of the problem for many months and possibly over a year. 13 3. This is a class action brought on behalf of two classes: 1) all Ameritrade

14 accountholders residing in the United States ("U.S. Resident Class"), and 2) only those 15 Ameritrade accountholders residing in California ("California Resident Class"). All 16 California Resident Class members are also members of the U.S. Resident Class. 17 4. Ameritrade's disclosure of its accountholders' email addresses and potential

18 disclosure of social security numbers not only facilitated the transmission of spam to its 19 accountholders, it violated its fiduciary duties and the provisions of its privacy policy. 20 5. On behalf of the U.S. Resident Class, Plaintiff seeks equitable relief, damages

21 and injunctive relief under the Nebraska Consumer Protection Act (NRS § 59-1602, et seq.), 22 equitable relief, damages and injunctive relief under the Nebraska Uniform Trade Practices 23 Act (NRS § 87-301, et seq.), damages and equitable relief for breach of fiduciary duty, and 24 equitable relief and damages under the Computer Fraud and Abuse Act (18 U.S.C. § 1030). 25 6. On behalf of the California Resident Class, Plaintiff seeks damages and

26 injunctive relief under California's Consumer Legal Remedies Act ("CLRA") (Cal. Civ. 27 Code § 1750, et seq., and equitable relief under California's Unfair Competition Law 28 ("UCL") (Cal. Bus. & Prof. Code § 172000, et seq.). -2PARISI & HAVENS
LLP

15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 3 of 22

1 2 7.

Parties Plaintiff Brad Zigler is a resident of Santa Rosa, California. Mr. Zigler is an

3 accountholder at TD Ameritrade, Inc. Mr. Zigler maintains an email account which has been 4 provided to TD Ameritrade, Inc. in the course of Plaintiff's business with TD Ameritrade, 5 Inc. Mr. Zigler has also provided his social security number to TD America, Inc. in the 6 course of his business with TD America, Inc. 7 8. Defendant TD AMERITRADE, Inc.: TD AMERITRADE, Inc. is a New

8 York corporation which maintains its headquarters at 4211 South 102d Street, Omaha, 9 Nebraska 68127. Ameritrade provides securities brokerage services, with retail brokerage 10 representing the vast majority of its business. Ameritrade was established in 1971 as a local 11 investment banking firm and began operations as a retail discount securities brokerage firm 12 in 1975. As of September 2006, Ameritrade had an estimated 6,191,000 accountholders. 13 9. Defendants Does: Plaintiff is currently ignorant of the true names and

14 capacities, whether individual, corporate, associate, or otherwise, of the defendants sued 15 herein under the fictitious names Does 1 through 100, inclusive, and therefore, sue such 16 defendants by such fictitious names. 17 10. Plaintiff alleges on information and belief that Doe defendants were at all

18 relevant times acting as Ameritrade's agents, ostensible agents, partners and/or joint 19 venturers and employees, and that all acts alleged herein occurred within the course and 20 scope of said agency, employment, partnership, and joint venture, or enterprise; however, 21 each of these allegations are deemed "alternative" theories whenever not doing so would 22 result in a contraction with the other allegations. 23 24 Jurisdiction and Venue 11. Plaintiff asserts claims under CFAA for damages and injunctive remedies on

25 behalf of himself and all others similarly situated. This Court has federal subject matter 26 jurisdiction over this case under 28 U.S.C. § 1331. 27 12. Ameritrade is a New York corporation headquartered in Nebraska.

28 Ameritrade can only be a citizen in New York and Nebraska. The members of the U.S. -3PARISI & HAVENS
LLP

15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 4 of 22

1 Resident Class and the California Resident Class are diverse from Ameritrade. The U.S. 2 Resident Class is a national class whose members are scattered throughout the fifty states 3 (including the 48 states besides New York and Nebraska) and the U.S. territories: there is 4 minimal diversity of citizenship between the proposed U.S. Resident Class and Ameritrade. 5 The aggregate of claims asserted in the class exceeds the sum or value of $5,000,000. This 6 Court has subject matter jurisdiction over this case under 28 U.S.C. § 1332(d)(2). 7 13. This Court has personal jurisdiction over the Defendant under because some

8 of the acts alleged herein were committed, and Plaintiff incurred him injury, in California 9 (and, specifically, the Northern District of California). 10 11 (c). 12 13 Factual Background 15. Email Anatomy: The domain name portion of an email address follows the 14. Venue is also proper before this Court under 28 U.S.C. § 1391(b)(1), (2), and

14 @ symbol. (Thus, the domain name portion for "[email protected]" is 15 "cand.uscourts.gov".) Email systems use domain names to direct email to the correct email 16 server, which in turn provide users with email accounts with the relevant domain name 17 access to the messages sent to their address. 18 16. Stock Spam: Stock spam is a technique for manipulating stock prices ­

19 essentially a contemporary version of a classic pump-and-dump scheme. The scheme 20 typically involves purchasing stock in a small, thinly-traded company (whose prices can be 21 driven up easily), transmitting a massive volume of email touting the company's stock and 22 urging recipients to buy, and then selling the stock after its price rises on the purchases of 23 spam recipients. See Laura Frieder & Jonathan Zittrain, Spam Works: Evidence from Stock 24 Touts and Corresponding Market Activity, 25 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=920553 (Mar. 14, 2007); Rainer Böhme 26 & Thorsten Holz, The Effect of Stock Spam on Financial Markets, 27 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=897431 (Apr. 2006). 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

-4Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 5 of 22

1

17. Stock spam correlates with significant short-term increases in the touted stock

2 prices (and a corresponding collapse soon thereafter). Frieder & Zittrain, Spam Works, at 40 3 (fig. 2); Spam Stock Tracker, http://www.spamstocktracker.com/ (updated Apr. 20, 2007). 4 18. Stock spam's primary purpose is the advertisement and promotion of the

5 touted stock. 6 19. Ameritrade's Privacy Statement: At all times relevant to this complaint,

7 Ameritrade published a Privacy Statement which indicated that Ameritrade would not 8 disclose personal information to third parties. The relevant portion of the Privacy Statement 9 has been reproduced below: 10 11 12 13 · 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Do we share the information collected with any other third parties? The cornerstone of our Privacy Statement is the commitment to keep our clients' personal information confidential. Ameritrade does not sell, license, lease or otherwise disclose your personal information to any third party for any reason, except as noted earlier and as described below: To help us improve our services to you, we may engage another business to help us to carry out certain internal functions such as account processing, fulfillment, client service, client satisfaction surveys or other data collection activities relevant to our business. We may also provide a party with client information from our database to help us to analyze and identify client needs and notify clients of product and service offerings. Use of the information shared is strictly limited to the performance of the task we request and for no other purpose. Periodically, we may invite you to participate in advertisements, promotions and special offers offered by Ameritrade or by other sponsoring organizations. These could include retailers, airlines and Internet service providers. Your participation may require us to gather and share your personal information or may require you to supply personal information to the promotion sponsor. For example, a referral program may require that we provide your name as a reference to a prospective client. It is always your choice whether or not to participate.

·

All third parties with which we share personal information are required to protect personal information in a manner similar to the way we protect personal information. Examples of information shared are identifying information such as name, mailing address, e-mail address, telephone number, and information on account activity. If at any time you choose to purchase a product or service offered by another company, any personal information you share with that company will no longer be controlled under our Privacy Statement. -5Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 6 of 22

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 address.

Ameritrade also reserves the right to disclose your personal information to third parties where permitted by law or where required by law to regulatory, law enforcement or other government authorities. We may also disclose your information as necessary to credit reporting or collection agencies, or when necessary to protect our rights or property. Ameritrade, Ameritrade Privacy Statement, http://www.tdAmeritrade.com/privacy.html (Feb. 2007) (emphasis added). The Privacy Statement does allow disclosures of accountholder email addresses to partners and alliances (except for California and Vermont residents), but the Privacy Statement requires marketing under such relationships to identify that an offer is being extended because of the relationship with Ameritrade. Further, Ameritrade's Privacy Statement allows for disclosure to third parties for "certain internal functions such as account processing, fulfillment, client service, client satisfaction surveys or other data collection activities relevant to our business." Id. The spam received by Plaintiff was not consistent with these exceptions. 20. Plaintiff Receives Spam: Plaintiff provided Ameritrade with a unique email

21. Plaintiff has received stock spam at his email address. 22. Ameritrade admits that its clients have received stock spam: With an email dated September 14, 2007, Ameritrade advised its clients as follows: Let me tell you why I am sending you this email. While investigating client reports about the industry-wide issue of investment-related SPAM, we recently discovered and eliminated unauthorized code from our systems. This code allowed certain client information stored in one of our databases, including email addresses, to be retrieved by an external source. 23. Ameritrade admits that accountholder's social security numbers were in

23 a database which was accessed by unauthorized persons: Ameritrade's September 14, 24 2007, email advised its accountholders that social security numbers were stored in the 25 particular database which was accessed by an external source. While Ameritrade asserts 26 that it has no evidence that the social security numbers were copied, it has provided no 27 evidence to establish this fact. 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

-6Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 7 of 22

1

24. Based on information and belief, the spam is exclusively stock spam: it touts

2 low-priced, speculative stocks of smaller companies traded on exchanges like Pink Sheets 3 and OTCBB, and urges recipients to purchase the touted stock. Thus, Ameritrade's 4 accountholders are not only targeted for spam, but are specifically targeted for stock spam ­ 5 and accountholders naturally have the ability to purchase touted stocks through Ameritrade. 6 Ameritrade benefits from the spam because its accountholders trade stocks based on tips in 7 the spam and Ameritrade earns commissions on those trades. 8 25. Ameritrade's Past Communications to Class Members: On May 30, 2007,

9 it became clear that this is a widespread problem. See Slashdot, Who's Trading Your E-mail 10 Addresses?, at http://yro.slashdot.org/yro/07/05/30/1444236.shtml (May 30, 2007) 11 ("Slashdot Story"). The story further disclosed that Ameritrade's response to customer 12 inquiries has been to either 1) deny any breach of the Privacy Statement and attribute the 13 spam to dictionary attacks or 2) indicate it is investigating the situation, but decline to 14 provide further details. Despite the story, it took Ameritrade over four months to advise its 15 accountholders of the issue. 16 26. Ameritrade's Spoliation of Evidence: The Slashdot Story indicated that

17 Ameritrade's current response to accountholders who inquire about spam traced to 18 Ameritrade is that the accountholders should "delete any spam you might receive, then 19 empty your e-mail's trash so that it's no longer kept there, either." It appears that, although 20 Ameritrade was aware of potential class claims no later than May 21, 2007, it still urged 21 potential class members to destroy this evidence. 22 27. Undisclosed Security Breach at Ameritrade: At all times during the

23 security breach at TD Ameritrade, the following portion of Ameritrade's Privacy Statement 24 was misleading: "TD Ameritrade does not . . . disclose [accountholders'] personal 25 information to any third party for any reason . . ." Likewise, the portion of the Privacy 26 Statement below is also misleading: 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

We have made a significant investment in leading-edge security software, systems, and procedures to offer you a safe and secure trading environment and protect your personal, financial and trading information. While no security -7Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 8 of 22

1 2 3

system is absolutely impenetrable, we are constantly reviewing, refining and upgrading our security technology, as new tools become available. Ameritrade Privacy Statement. 28. At all times when Ameritrade knew there was an ongoing security breach, the

4 Privacy Statement's representations were knowingly and intentionally misleading. In this 5 light, Ameritrade continued to entice new accountholders to provide personal information 6 under the representation that such information is secure from third parties, when it knew that 7 those representations were false. 8 29. Ameritrade profited from the email security breach, because accountholders

9 would trade stocks based on tips in the spam and Ameritrade would earn commissions on 10 those trades. 11 Class Certification Allegations 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

30. Plaintiff seek certification of two classes, the California Resident Class and the U.S. Resident Class, both pursuant to Rule 23(b)(2) and Rule 23(b)(3). 31. The California Resident Class asserts claims for violations of California's CLRA (Cal. Civ. Code §§ 1750-84) and UCL (Cal. Bus. & Prof. Code §§ 17200-10) on behalf of all Ameritrade accountholders residing in California. 32. The U.S. Resident Class includes all members of the California Resident Class and asserts claims under the Nebraska Consumer Protection Act (NRS § 59-1602, et seq.), the Nebraska Uniform Trade Practices Act (NRS § 87-301, et seq.), the common law theory of breach of fiduciary duty, and under the Computer Fraud and Abuse Act (18 U.S.C. § 1030). 33. Adequate Representation: Plaintiff will fairly and adequately represent and protect the interests of the members of both classes, and has retained counsel competent and experienced in complex class actions. Plaintiff has no interest antagonistic to those of either class, and Defendants have no defenses unique to Plaintiff. 34. Predominance and Superiority: This class action is appropriate for certification because class proceedings are superior to all other available methods for the -8Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 9 of 22

1 fair and efficient adjudication of this controversy, since joinder of all members is 2 impracticable. The damages suffered by each individual member of either class will likely 3 be relatively small, especially given the burden and expense of individual prosecution of the 4 complex litigation necessitated by the actions of Defendants. It would be virtually 5 impossible for the members of either class individually to obtain effective relief from the 6 misconduct of Defendants. Even if members of either class themselves could sustain such 7 individual litigation, it would still not be preferable to a class action, because individual 8 litigation would increase the delay and expense to all parties due to the complex legal and 9 factual controversies presented in this complaint. By contrast, a class action presents far 10 fewer management difficulties and provides the benefits of single adjudication, economy of 11 scale, and comprehensive supervision by a single Court. Economies of time, effort, and 12 expense will be fostered and uniformity of decisions will be ensured. 13 35. Policies Generally Applicable to the Class: This class action is also

14 appropriate for certification because Defendants have acted or refused to act on grounds 15 generally applicable to the class, thereby making appropriate final injunctive relief or 16 corresponding declaratory relief with respect to either class as a whole. The policies of the 17 Defendants challenged herein apply and affect members of both class uniformly, and 18 Plaintiff's challenge of these policies hinges on Defendants' conduct, not on facts or law 19 applicable only to Plaintiff. 20 21 Allegations to Certification of California Resident Class 36. Definition of the California Resident Class: Pursuant to Federal Rule of

22 Civil Procedure 23, Plaintiff brings this complaint against Ameritrade on behalf of himself, 23 the general public and all similarly situated persons who are accountholders of Ameritrade 24 who reside in California. Excluded from the California Resident Class are 1) any Judge or 25 Magistrate presiding over this action and members of their families; 2) Defendants, 26 Defendants' subsidiaries, parents, successors, predecessors, and any entity in which the 27 Defendants or their parents have a controlling interest and their current or former 28 employees, officers and directors; and 3) persons who properly execute and file a timely -9PARISI & HAVENS
LLP

15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 10 of 22

1 request for exclusion from the class and 4) the legal representatives, successors or assigns of 2 any such excluded persons. 3 37. California Resident Class Numerosity: The exact number of California

4 Resident Class members is unknown and is not available to Plaintiff, but it is clear that 5 individual joinder of all class members is impracticable. In SEC filings, Ameritrade 6 estimated it had 6,191,000 accountholders as of September 2006. According to recent U.S. 7 Census estimates, approximately 12% of the US population resides in California. Assuming 8 that Ameritrade's accountholders are distributed evenly across the US population, there are 9 approximately 740,000 Ameritrade accountholders residing in California. California 10 Resident Class members can be easily identified through Ameritrade's records. 11 38. California Resident Class Commonality: Common questions of fact and

12 law exist as to all California Resident Class members and predominate over the questions 13 affecting only individual California Resident Class members. These common questions 14 include: 15 (a) 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Whether Ameritrade exposed or provided email addresses of the California Resident Class members to spammers; Whether Ameritrade exposed or provided social security numbers of the California Resident Class members to others not affiliated with Ameritrade; Whether such exposure violated Ameritrade's Privacy Statement; Whether such exposure was intentional or unintentional on Ameritrade's part; Whether Ameritrade's Privacy Statement represented that Ameritrade's services have characteristics, uses, and benefits, or quantities which they do not have, in violation of Cal. Civ. Code § 1770(a)(5); Whether Ameritrade's Privacy Statement represented that Ameritrade's services confer or involves rights, remedies, or obligations which they do confer not or involve, in violation of Cal. Civ. Code § 1770(a)(14); Whether, in light of the exposure and provision of California Resident Class members' email addresses to spammers, Ameritrade's Privacy Statement was deceptive under Cal. Bus. & Prof. Code § 17200; Whether Ameritrade violated the CLRA; -10Class Action Complaint

(b)

(c) (d) (e)

(f)

(g)

(h)

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 11 of 22

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

(i) (j)

Whether Ameritrade violated the UCL; Whether Plaintiff and the class are entitled to relief, and the nature of such relief.

39. California Resident Class Typicality: Plaintiff's claims are typical of the claims of other California Resident Class members, as Plaintiff and other California Resident Class members sustained damages arising out of the wrongful conduct of Defendant, based upon the same transactions which were made uniformly to Plaintiff and the public. Allegations to Certification of U.S. Resident Class 40. Definition of the U.S. Resident Class: Pursuant to Federal Rule of Civil Procedure 23, Plaintiff brings this complaint against Ameritrade on behalf of himself, the general public and all similarly situated persons who are accountholders of Ameritrade who reside in the United States. Excluded from the California Resident Class are 1) any Judge or Magistrate presiding over this action and members of their families; 2) Defendants, Defendants' subsidiaries, parents, successors, predecessors, and any entity in which the Defendants or their parents have a controlling interest and their current or former employees, officers and directors; and 3) persons who properly execute and file a timely request for exclusion from the class and 4) the legal representatives, successors or assigns of any such excluded persons. 41. U.S. Resident Class Numerosity: The exact number of U.S. Resident Class members is unknown and is not available to Plaintiff, but it is clear that individual joinder of all Class members is impracticable. As Ameritrade is an online brokerage service, it stands to reason that some or all of its estimated 6,191,000 accountholders provided it with email addresses and social security numbers. Potential U.S. Resident Class members can be identified by the email addresses contained in Ameritrade's records; membership in the class can be confirmed either by actual production of spam or can be inferred from the proof of the spam.

-11Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 12 of 22

1

42. U.S. Resident Class Commonality: Common questions of fact and law exist

2 as to all U.S. Resident Class members and predominate over the questions affecting only 3 individual U.S. Resident Class members. In addition to the questions which predominate the 4 U.S. Resident Class, these common questions include: 5 6 (b) 7 8 9 (d) 10 11 (e) 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

(a)

Whether Ameritrade owed the class members a fiduciary duty as their broker; Whether Ameritrade owed the class members a fiduciary duty by dint of its collection of personal information under the Privacy Statement; Whether Ameritrade breached such fiduciary duties through the violation of its Privacy Statement; Whether Ameritrade failed to fully and accurately disclose the exposure and provision of class members' email addresses and/or social security numbers to spammers or others. and any underlying security breach; Whether, in light of its fiduciary duties, Ameritrade's failure to disclose any security breach violated its fiduciary duties to the class members; Whether the Does obtained the email addresses to send the class members the spam or to have confederates send such spam by accessing Ameritrade's computer systems; Whether the Does' access of Ameritrade's computer systems was without authorization or in excess of authorization. because it was in violation of the Privacy Statement; Whether the Does violated the CFAA; Whether Ameritrade is liable for the Does' violation of the CFAA under the doctrine of respondeat superior; Whether Ameritrade's Privacy Statement represented that Ameritrade's services have characteristics, uses, and benefits, which they do not have, in violation of NRS § 87-302(5); Whether Ameritrade's Privacy Statement represented that Ameritrade's services were of a particular standard or quality which they were not, in violation of NRS § 87-302(7); Whether Ameritrade advertised its services with an intent not to sell them as advertised, in violation of NRS § 87-302(9); Whether Ameritrade's knowingly made false or misleading statements in a published privacy policy regarding the use of personal information submitted by members of the public in violation of NRS § 87-302(14); Whether, in light of the exposure and provision of U.S. Resident Class members' email addresses and social security numbers, Ameritrade's conduct was deceptive under the Nebraska Consumer Protection Act; -12Class Action Complaint

(c)

(f)

(g)

(h) (i) (j)

(k)

(l) (m)

(n)

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 13 of 22

1 (o) 2 (p) 3 4 5 6 7 8 9 10 11 43. U.S. Resident Class Typicality: Plaintiff's claims are typical of the claims of other California Resident Class members, as Plaintiff and other California Resident Class members sustained damages arising out of the wrongful conduct of Defendant, based upon the same transactions which were made uniformly to Plaintiff and the public. Count I: Violation of California's UCL, Cal. Bus. & Prof. Code § 17200 (By the California Resident Class against all Defendants) 44. Plaintiff incorporates the above allegations by reference. 45. Ameritrade's Privacy Statement was deceptive. Ameritrade's failure to Whether Ameritrade violated the Nebraska Deceptive Trade Practices Act. Whether Ameritrade violated the Nebraska Consumer Protection Act;

12 disclose to California Resident Class members who trade in stock touted in the spam that the 13 stock is being touted by the spam and its value is very likely being manipulated, is also 14 deceptive. Moreover, Ameritrade's failure to disclose to the U.S. Resident Class members 15 that their social security numbers were made available to undisclosed third parties was 16 deceptive. 17 46. The acts alleged above are unlawful, unfair or fraudulent business acts or

18 practices and constitute unfair competition under Cal. Bus. & Prof. Code § 17200, et seq. 19 47. Ameritrade's unfair competition has damaged Plaintiff and the other

20 California Resident Class members, and threatens additional injury in the future. This 21 damage includes the loss of the benefit of bargain on Ameritrade's brokerage fees, which 22 were premised, in part, on Ameritrade's compliance with the privacy statement and full 23 disclosure of facts relevant to the security of accountholders' information. The damage from 24 the spam includes California Resident Class members' lost time required to sort, read, 25 discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and 26 computing resources on the personal computers on which they received the spam. Further, 27 California Resident Class members are subject to identity theft to the extent that their social 28 security numbers were obtained in the security breach. -13PARISI & HAVENS
LLP

15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 14 of 22

1

48. Plaintiff, on his own behalf, the general public and behalf of the other

2 California Resident Class members, seeks an order enjoining Ameritrade's unfair 3 competition alleged herein, and restitution of property gained by such unfair competition 4 under the UCL (Cal. Bus. & Prof. Code § 17203), as well as interest and attorney's fees and 5 costs pursuant to, in part, Cal. Code Civ. Proc. § 1021.5. 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Count II: Violation of the CLRA, Cal. Civ. Code § 1770 (By the California Resident Class against all Defendants) 49. Plaintiff incorporates the above allegations by reference. 50. Ameritrade's Privacy Statement represented that Ameritrade's services have characteristics, uses, and benefits, or quantities which they do not have, in violation of Cal. Civ. Code § 1770(a)(5), and that Ameritrade's services have confer or involves rights, remedies, or obligations which they do confer not or involve, in violation of Cal. Civ. Code § 1770(a)(14). The Privacy Statement stated that Ameritrade would not disclose accountholders' personal information to third parties, and that it provided a secure trading environment and protected accountholders' personal, financial and trading information. The Privacy Statement is also misleading inasmuch as it not disclose any ongoing security breach, to the extent such a breach exists. 51. Ameritrade's failure to disclose to California Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very likely being manipulated, also violates the CLRA. 52. Ameritrade's CLRA violations have damaged Plaintiff and the other California Resident Class members, and threaten additional injury if the violations continue. This damage includes the loss of the benefit of bargain on Ameritrade's brokerage fees, which were premised, in part, on Ameritrade's compliance with the privacy statement and full disclosure of facts relevant to the security of accountholders' information. The damage from the Traced Spam includes California Resident Class members' lost time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received -14Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 15 of 22

1 the spam. Further, California Resident Class members are subject to identity theft to the 2 extent that their social security numbers were obtained in the security breach. 3 53. Plaintiff, on his own behalf, and behalf of the other California Resident Class

4 members, seeks damages, an order enjoining Ameritrade's CLRA violations alleged herein, 5 restitution of property gained by the CLRA violations (including commissions on trades 6 while actionable failure to disclose information was ongoing), and court costs and attorney's 7 fees under the CLRA (Cal. Civ. Code § 1780(d)). 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Count III: Violation of Nebraska's Consumer Protection Act (By the U.S. Resident Class against all Defendants) 54. Plaintiff incorporates the above allegations by reference. 55. Ameritrade's Privacy Statement was deceptive. Ameritrade's failure to disclose to U.S. Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very likely being manipulated, is deceptive. Moreover, Ameritrade's failure to disclose to the U.S. Resident Class members that their social security numbers were made available to undisclosed third parties was deceptive. 56. The acts alleged above are unfair or deceptive business acts or practices and constitute unfair competition under Nebraska Revised Statutes § 59-1602. This conduct had an impact on the public interest. 57. Ameritrade's unfair competition has damaged Plaintiff and the other U.S. Resident Class members, and threatens additional injury in the future. This damage includes the loss of the benefit of bargain on Ameritrade's brokerage fees, which were premised, in part, on Ameritrade's compliance with the privacy statement and full disclosure of facts relevant to the security of accountholders' information. The damage from the spam includes the U.S. Resident Class members' lost time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received the spam. Further, U.S. Resident Class

-15Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 16 of 22

1 members are subject to identity theft to the extent that their social security numbers were 2 obtained in the security breach. 3 58. Plaintiff, on his own behalf and behalf of the other U.S. Resident Class

4 members, seeks an order enjoining Ameritrade's unfair competition alleged herein, and 5 restitution of property gained by such unfair competition under the Nebraska Consumer 6 Protection Act (NRS § 59-1609), as well as interest and reasonable attorney's fees and costs 7 pursuant to, in part, this code section. 8 59. Plaintiff, on his own behalf and behalf of the other U.S. Resident Class

9 members, also seeks a civil penalty from Ameritrade of two thousand dollars for each 10 violation of the Nebraska Consumer Protection Act. 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Count IV: Violation of the Nebraska Uniform Deceptive Trade Practices Act (By the United States Resident Class against all Defendants) 60. Plaintiff incorporates the above allegations by reference. 61. Ameritrade's Privacy Statement stated that Ameritrade would not disclose accountholders' personal information to third parties, and that it provided a secure trading environment and protected accountholders' personal, financial and trading information. The Privacy Statement is also misleading inasmuch as it not disclose any ongoing security breach, to the extent such a breach exists. 62. Ameritrade's Privacy Statement represented that Ameritrade's services have characteristics, uses, and benefits, or quantities which they do not have, in violation of NRS § 87-302(5) and that Ameritrade's services were of a particular standard or quality which they were not, in violation of NRS § 87-302(7). Moreover, Ameritrade advertised its services with an intent not to sell them as advertised, in violation of NRS § 87-302(9), and Ameritrade knowingly made false or misleading statements in a published privacy policy regarding the use of personal information submitted by members of the public in violation of § 87-302(14). 63. Ameritrade's failure to disclose to U.S. Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very -16Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 17 of 22

1 likely being manipulated, also violates the Nebraska Uniform Deceptive Trade Practices 2 Act. 3 64. Ameritrade's violations of the Nebraska Uniform Deceptive Trade Practices

4 Act have damaged Plaintiff and the other U.S. Resident Class members, and threaten 5 additional injury if the violations continue. This damage includes the loss of the benefit of 6 bargain on Ameritrade's brokerage fees, which were premised, in part, on Ameritrade's 7 compliance with the privacy statement and full disclosure of facts relevant to the security of 8 accountholders' information. The damage from the spam includes U.S. Resident Class 9 members' lost time required to sort, read, discard and attempt to prevent future spam, and 10 lost storage space, Internet connectivity, and computing resources on the personal 11 computers on which they received the spam. Further, U.S. Resident Class members are 12 subject to identity theft to the extent that their social security numbers were obtained in the 13 security breach. 14 65. Plaintiff, on his own behalf, and behalf of the other U.S. Resident Class

15 members, seeks damages, an order enjoining Ameritrade's violations of the Nebraska 16 Uniform Trade Practices Act alleged herein, restitution of property gained by the violations 17 (including commissions on trades while actionable failure to disclose information was 18 ongoing), and court costs and attorney's fees under the Nebraska Consumer Protection Act. 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Count V: Breach of Fiduciary Duty (Breach of Fiduciary Duty) (By the U.S. Resident Class against all Defendants) 66. Plaintiff incorporates the above allegations by reference. 67. As their stock broker, Ameritrade and the Does owed all U.S. Resident Class members a fiduciary duty. 68. Ameritrade breached its fiduciary duty of confidentiality by allowing the disclosure of its accountholder's email addresses to spammers and potentially allowing disclosure of social security numbers to unauthorized third parties.

-17Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 18 of 22

1

69. Ameritrade owed a fiduciary duty to disclose all material facts within its

2 knowledge relating to its transaction with the U.S. Resident Class members. The security of 3 personal information given to Ameritrade was a material fact, because exposure of 4 accountholders' personal information subjects the accountholders to spam and increased risk 5 of identity theft. 6 70. Ameritrade breached its fiduciary duty by 1) its continued failure to correct

7 the deception created by the Privacy Statement, and 2) its failure to the extent Ameritrade 8 failed to disclose the events that led to the disclosure of its accountholders' email addresses 9 and social security numbers to thieves, and 3) instructed accountholders to destroy spam. 10 71. Ameritrade also breached its fiduciary duty by failing to disclose to U.S.

11 Resident Class members who trade in stock touted in the spam that the stock is being touted 12 by the spam and its value is very likely being manipulated. 13 72. Ameritrade's breach of its fiduciary duties has caused damage to Plaintiff and

14 the other U.S. Resident Class members and threatens additional damage in the future. This 15 damage includes the loss of the benefit of bargain on Ameritrade's brokerage fees, which 16 were premised, in part, on Ameritrade's compliance with the privacy statement and full 17 disclosure of facts relevant to the security of accountholders' information. The damage from 18 the spam includes U.S. Resident Class members' lost time required to sort, read, discard and 19 attempt to prevent future spam, and lost storage space, Internet connectivity, and computing 20 resources on the personal computers on which they received the spam. Further, U.S. 21 Resident Class members are subject to identity theft to the extent that their social security 22 numbers were obtained in the security breach. 23 73. Plaintiff, on his own behalf and behalf of the other U.S. Resident Class

24 members, seeks damages in an amount to be determined at trial and equitable relief 25 (including an accounting, and disgorgement of profits obtained while the breach of fiduciary 26 duty was ongoing, such as commissions on trades), for Ameritrade's breach of its fiduciary 27 duties, as well as interest and attorney's fees and costs pursuant to, in part, Cal. Code Civ. 28 Proc. § 1021.5.
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

-18Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 19 of 22

1 2 3 4

Count VI: Violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (Violation of CFAA) (By the U.S. Resident Class against all Defendants) 74. Plaintiff incorporates the above allegations by reference. 75. Plaintiff alleges on information and belief that the Does are Ameritrade's

5 agents, ostensible agents, partners and/or joint venturers and employees, that Ameritrade has 6 given the Does access to its computer systems, and that the Does are either sending stock 7 spam to these email addresses as alleged above, or are deliberately providing the email 8 addresses to confederates who are sending the stock spam. 9 76. The Does obtained the U.S. Resident Class members' email addresses by

10 intentionally accessing Ameritrade's computer systems. 11 77. The Does obtained the email addresses to send the U.S. Resident Class

12 members the spam or to have confederates send such spam. 13 78. The Does' access of Ameritrade's computer systems was without

14 authorization or in excess of authorization because it was in violation of the Privacy 15 Statement. 16 79. The Does' access of Ameritrade's computer systems impaired the integrity of

17 those systems. 18 80. The Does' access of Ameritrade's computer systems caused the U.S. Resident

19 Class members to lose time required to sort, read, discard and attempt to prevent future 20 spam, and lost storage space, Internet connectivity, and computing resources on the personal 21 computers on which they received the spam. This loss exceeded $5,000 in damages in the 22 last year. 23 24 81. The Does have violated the CFAA (18 U.S.C. § 1030(a)(5)). 82. The Does' use of their access to the Ameritrade's computer systems was in

25 the scope of their employment. The Does were in a position to access Ameritrade's 26 computer systems because of their agency relationship with Ameritrade, and their access to 27 those systems was an outgrowth of that relationship. As it was here, the risk of the Does 28 abusing their employer's proprietary information was inherent in the workplace, or typical -19PARISI & HAVENS
LLP

15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 20 of 22

1 of or broadly incidental to the Ameritrade's business. The Does' violation of the CFAA was 2 reasonably foreseeable by Ameritrade. Ameritrade benefited from (in the form of 3 commissions on trades prompted by the spam) the Does' violation of the CFAA. 4 83. In the alternative, Ameritrade directed and encouraged the Does' violation of

5 the CFAA. 6 84. Ameritrade is liable for the Does' violation of the CFAA under the doctrine

7 of respondeat superior. 8 85. As alleged above, the Does' CFAA violation has damaged Plaintiff and the

9 other U.S. Resident Class members, and threatens additional damage in the future. 10 86. Plaintiff, on his own behalf and behalf of the other U.S. Resident Class

11 members, seeks compensatory damages in an amount to be determined at trial and 12 injunctive relief or other equitable relief (including an accounting, and disgorgement of 13 profits obtained while the CFAA violations were ongoing, such as commissions on trades), 14 for Ameritrade's vicarious liability under the CFAA. 15 16 17 18 19 20 21 22 23 24 25 26 27 28
PARISI & HAVENS LLP
15233 Valleyheart Drive Sherman Oaks, CA 91403 (818) 990-1299

WHEREFORE, Plaintiff prays that the Court enter judgment and orders in their favor and against Defendants as follows: (a) Certifying the action as a class action and designating Plaintiff and his counsel as representatives of the California Resident Class and the U.S. Resident Class; With respect to all Counts, equitable relief for both classes, including an order for accounting, an order enjoining the misconduct alleged herein, restitution of property gained by this misconduct and disgorgement of profits obtained while the breach of fiduciary duty was ongoing, such as commissions on trades; With respect to Counts I, III, IV, V and VI, damages in an amount to be determined at trial; Awarding pre- and post-judgment interest; and

(b)

(c) (d)

-20Class Action Complaint

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 21 of 22

Case 3:07-cv-04903-VRW

Document 1

Filed 09/21/2007

Page 22 of 22