Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 1 of 23 PageID #: 115 : : : : : : : :

Transcription

1 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 1 of 23 PageID #: 115 UNITED STATES DISTRICT COURT EASTERN DISTRICT OF NEW YORK X : MELISSA FRANK, individually and on behalf of all : others similarly situated, : : Plaintiff, : : v. : : THE NEIMAN MARCUS GROUP, LLC, a : Delaware limited liability company; and DOES 1-50, : : Defendants. : : : 2:14-cv-233-ADS-GRB ECF CASE X DEFENDANT NEIMAN MARCUS GROUP S MEMORANDUM IN SUPPORT OF MOTION TO DISMISS COMPLAINT

2 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 2 of 23 PageID #: 116 TABLE OF CONTENTS Page I. THE COMPLAINT MUST BE DISMISSED PURSUANT TO RULE 12(b)(1) BECAUSE PLAINTIFF LACKS ARTICLE III STANDING...4 II. THE COMPLAINT ALSO MUST BE DISMISSED PURSUANT TO RULE 12(b)(6) BECAUSE IT FAILS TO STATE A CLAIM...9 A. The First Count fails to state a claim for negligence because it alleges no facts showing either causation or damages...10 B. The Second Count fails to state a claim because New York does not recognize a tort for invasion of privacy...11 C. The Third Count fails to state a cause of action for bailment because it does not allege a transfer of exclusive possession of the information at issue...12 D. The Fourth Count fails to state a claim for conversion because it does not allege that Neiman Marcus exercised an exclusive right of ownership over plaintiff s information...13 E. The Fifth Count fails to state a claim under N.Y. Gen. Bus. Law 349 because it does not allege misleading conduct that caused injury to plaintiff...14 i

3 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 3 of 23 PageID #: 117 TABLE OF AUTHORITIES CASES Page(s) Ancile Inv. Co. v. Archer Daniels Midland Co., 784 F. Supp. 2d 296 (S.D.N.Y. 2011)...12, 13, 14 Ashcroft v. Iqbal, 556 U.S. 662 (2009)...15 Baur v. Veneman, 352 F.3d 625 (2d Cir. 2003)...6 Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007)...9, 10, 11, 15 Cacchillo v. Insmed, Inc., 638 F.3d 401 (2d Cir. 2011)...6 Chylinski v. Wal Mart Stores, Inc., 150 F.3d 214 (2d Cir. 1998)...10 City of Los Angeles v. Lyons, 461 U.S. 95 (1983)...7 Clapper v. Amnesty Int l USA, U.S., 133 S. Ct (2013)...6, 7, 8, 9 Command Cinema Corp. v. VCA Labs, Inc., 464 F. Supp. 2d 191 (S.D.N.Y. 2006)...12, 13 Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167 (2000)...5 Hammond v. Bank of N.Y. Mellon Corp., No. 08-cv-6060, 2010 WL (S.D.N.Y. June 25, 2010)...5, 10 Howell v New York Post Co., 81 N.Y. 115 (1993)...11 In re Barnes & Noble Pin Pad Litig., No. 12-cv-8617, 2013 WL (N.D. Ill. Sept. 3, 2013)...5, 8 In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 903 F. Supp. 2d 942 (S.D. Cal. 2012)...12 In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489 (1st Cir. 2009) ii

4 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 4 of 23 PageID #: 118 Interpharm, Inc. v. Wells Fargo Bank, N.A., 655 F.3d 136 (2d Cir. 2011)...9, 10, 15 Isik Jewelry v. Mars Media, Inc., 418 F. Supp. 2d 112 (E.D.N.Y 2005)...12, 13 Krottner v. Starbucks, 628 F.3d 1139 (9th Cir. 2010)...9 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992)...4, 9 Makarova v. United States, 201 F.3d 110 (2d Cir. 2000)...5, 6 Messenger ex rel. Messenger v. Gruner + Jahr Printing & Pub., 94 N.Y.2d 436 (2000)...11 Pisciotta v. Old Nat. Bancorp, 499 F.3d 629 (7th Cir. 2007)...9 Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011)...9 Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121 (N.D. Cal. 2008)...13 Shafran v. Harley-Davidson, Inc., No. 07-cv-01365, 2008 WL (S.D.N.Y. Mar. 20, 2008)...10 Shipping Fin. Serv. Corp. v. Drakos, 140 F.3d 129 (2d Cir. 1998)...4 Smith v. Chase Manhattan Bank, USA, N.A., 741 N.Y.S.2d 100 (2d Dep t. 2002)...12, 15 Spencer v. Kemna, 523 U.S. 1 (1998)...4, 5 Stutman v. Chem. Bank, 95 N.Y.2d 24 (2000)...14 Yantha v. Omni Childhood Center, Inc., No. 13-cv-1948, 2013 WL (E.D.N.Y. Sept. 20, 2013)...13 CONSTITUTIONS,STATUTES, AND RULES U.S. Const. art. III...4, 5, 6, 8 iii

5 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 5 of 23 PageID #: 119 N.Y. Civ. Rights Law , 12 N.Y. Civ. Rights Law , 12 N.Y. Gen. Bus. Law , 14, 15, 16 Fed. R. Civ. P. 12(b)(1)...1, 2, 4, 5 Fed. R. Civ. P. 12(b)(6)...1, 9 iv

6 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 6 of 23 PageID #: 120 Defendant The Neiman Marcus Group LLC ( Neiman Marcus ) submits this memorandum of law in support of its motion to dismiss the complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of standing and Rule 12(b)(6) for failure to state a claim. STATEMENT OF FACTS Plaintiff Melissa Frank alleges that she made purchases at a Neiman Marcus store on Long Island between December 15, 2013, and January 1, 2014, and that subsequently her debit card received fraudulent charges. Compl. 7. She does not allege that a data incursion at Neiman Marcus caused the fraudulent charges on her debit card. Indeed, she does not even allege that the card issuer is seeking to hold her liable for the charges. As reported in press accounts in early January 2014, cited and quoted in part in the complaint, see Compl , Neiman Marcus received initial indications in mid-december 2013 that some credit and debit cards (collectively, payment cards ) used at its stores were later involved in fraudulent transactions. The work of its forensic investigators led to the preliminary discovery of indications that it appeared to be the victim of a criminal cyber-security incursion. See Bill Chappell, Neiman Marcus Says Hackers Stole Credit Card Data, NPR, Jan. 10, 2014, (website last visited Feb. 11, 2014) (quoted in part and cited as at Compl. 10). Following further work investigating the incursion, containing it, and enhancing system security, id., Neiman Marcus made several public announcements on January 10 regarding the incursion and at the same time gave individual notification to customers who received fraudulent charges after the incursion. See Compl Plaintiff commenced this action on January 13. In the days since, Neiman Marcus has continued its investigation and made public reports of the findings to date, including in reports 1

7 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 7 of 23 PageID #: 121 posted to its website January 16 and January 22, and in a letter responding to questions from United States Senator Richard Blumenthal documents that may be considered with respect to the Rule 12(b)(1) threshold matter of standing. See Declaration of Ginger Reed in Opposition to Motion for Protective Order, dated February 4, 2014 ( Reeder Declaration ), Exhibits A and B; the Reeder Declaration and Exhibits attached hereto as an appendix. As described more fully in those documents, on January 1, 2014, the investigation first discovered malware indicating a possible clandestine effort to compromise Neiman Marcus s point of sale security systems. Over the next few days, Neiman Marcus received further information that this malware apparently had the ability to covertly obtain payment card information. Declaration Exhibit B, at 3-4. It also received information that approximately 2,400 unique payment cards used at certain Neiman Marcus stores in 2013 were subsequently used for fraudulent transactions. Id. at 1. Although these reports did not indicate causation for the fraudulent transaction, Neiman Marcus sent s to such card holders for whom it had addresses on January 10 and the next business day sent letters by regular mail to those for whom it had postal addresses. Id. at 4. In the January 16 website posting, Neiman Marcus provided a detailed update on its investigation. Neiman Marcus confirmed that while payment cards themselves had been compromised, social security numbers and birth dates were not and PINs were never at risk because we do not use PIN pads in our stores. See website reproduced in Plaintiff s Memorandum in Support of Motion for Protective Order, at 4, Info/cat /c.cat?icid=topPromo_hmpg_ticker_SecurityInfo_0114. In the updated report posted to its website on January 22, Neiman Marcus announced the period during which the malware appeared to have been active from July 16 to October 30, 2

8 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 8 of 23 PageID #: Reeder Declaration, Exhibit A. The update also included the approximate number of payment cards potentially exposed (1.1 million), as well as the number of cards on which fraudulent charges had been reported by the card issuers (2,400) after a purchase at Neiman Marcus. Id. The company explained that, out of an abundance of caution, it was notifying ALL customers for whom [it has] addresses or who shopped with [the company] between January 2013 and January 2014, and offering one free year of credit monitoring and identitytheft protection. Id. The company also assured customers who were concerned about fraudulent activity that [t]he policies of the payment card brands such as Visa, MasterCard, American Express, Discover and the Neiman Marcus card provide that you have zero liability for any unauthorized charges if you report them in a timely manner. Id. Also on January 22, Neiman Marcus sent a letter responding to a request from United States Senator Richard Blumenthal, which he released the next day. The letter confirmed Neiman Marcus s efforts to contact consumers, and made clear that Neiman Marcus had not and has not been provided information about whether these cards were also used at other retailers that may have been subjected to a cyber attack. Reeder Declaration, Exhibit B, Letter to the Hon. Richard Blumenthal, dated Jan. 22, 2014, available at PRELIMINARY STATEMENT In this action, plaintiff seeks to assert claims arising from the recent cyber security incursion at Neiman Marcus, but fails to allege any cognizable injury plausibly caused by Neiman Marcus. She alleges only that she made purchases at Neiman Marcus in late December 2013 and thereafter experienced fraudulent charges on her debit card. Compl. 7. The complaint nowhere alleges either that the data incursion at Neiman Marcus caused the fraudulent charges on her debit card or that those charges resulted in any financial or other concrete injury 3

9 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 9 of 23 PageID #: 123 to her. Plaintiff s pleading failure is not an oversight and cannot be remedied: the purchases she alleges at Neiman Marcus occurred after the data incursion and, in any event, plaintiff does not allege that card issuers hold consumers liable for unauthorized charges (they do not). Without alleging that Neiman Marcus caused her a cognizable injury, plaintiff cannot satisfy the standing requirements of Article III. Moreover, even if plaintiff could establish standing, the absence of injury and a causal nexus would compel dismissal of each of the claims she asserts negligence, invasion of privacy, conversion, bailment, and an alleged violation of New York General Business Law 349 all of which require injury and causation. As shown below, three of the alleged tort claims must fail for additional reasons: New York does not recognize a claim of invasion of privacy outside the narrow confines of an unpleaded statute; plaintiff does not (and cannot) allege that Neiman Marcus, rather than unknown third parties, misappropriated and converted her payment card information to its own use; and payment card information is not property that can be the subject of bailment. These defects are irremediable, and the complaint should be dismissed with prejudice. ARGUMENT I. THE COMPLAINT MUST BE DISMISSED PURSUANT TO RULE 12(b)(1) BECAUSE PLAINTIFF LACKS ARTICLE III STANDING Plaintiff lacks Article III standing to bring her claims in federal court, thus compelling dismissal for lack of subject matter jurisdiction under Rule 12(b)(1). When judging a motion to dismiss for lack of standing under Rule 12(b)(1), the Court must accept as true all material factual allegations in the complaint. Shipping Fin. Serv. Corp. v. Drakos, 140 F.3d 129, 131 (2d Cir. 1998); see also Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992) (noting that standing is subject to the same degree-of-proof requirement that applies to other contested facts at a particular phase of the proceedings). The plaintiff s standing may not, however, be inferred 4

10 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 10 of 23 PageID #: 124 argumentatively from averments in the pleadings. Spencer v. Kemna, 523 U.S. 1, (1998) (internal quotation marks omitted); see also Makarova v. United States, 201 F.3d 110, 113 (2d Cir. 2000) (citing Kamen v. Am. Tel. & Tel. Co., 791 F.2d 1006, 1011 (2d Cir. 1986)) (observing that a court may consider facts outside the pleadings when resolving a Rule 12(b)(1) motion to dismiss). Rather, it is the burden of the party who seeks the exercise of jurisdiction in his favor, clearly to allege facts demonstrating that he is a proper party to invoke judicial resolution of the dispute. Spencer, 523 U.S. at 11 (internal quotation marks omitted). Plaintiff has not carried that burden here. Under Article III, a plaintiff must show (1) it has suffered an injury in fact that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, (2000). In the present case, the complaint seeks to assert present and future injuries, but fails to establish a justiciable controversy. First, plaintiff alleges that she incurred fraudulent debit-card charges. Compl. 1. But she fails to allege that she has been or will be required to pay those charges, or that they have resulted in any other form of actual, present harm. Absent such an allegation, the purported charges do not qualify as the sort of concrete, particularized injury required by Article III. See, e.g., Hammond v. Bank of N.Y. Mellon Corp., No. 08-cv-6060, 2010 WL , at *8 (S.D.N.Y. June 25, 2010) (holding that unauthorized credit card charges for which a plaintiff is reimbursed do not constitute injury under Article III); In re Barnes & Noble Pin Pad Litig., No. 12-cv-8617, 2013 WL , at *6 (N.D. Ill. Sept. 3, 2013) ( In order to have suffered an actual injury, [plaintiff] must have had an unreimbursed charge on her credit card... ). And 5

11 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 11 of 23 PageID #: 125 no such allegation could be made, given the zero-fraud-liability policy of card issuers, which this Court may consider in determining subject matter jurisdiction. See Makarova, 201 F.3d at 113. Dismissal of the complaint comports with the purposes of the injury-in-fact requirement, which ensure that the plaintiff has a personal stake in the controversy and avoid[s] having the federal courts serve as merely publicly funded forums for the ventilation of public grievances or the refinement of jurisprudential understanding. Baur v. Veneman, 352 F.3d 625, 632 (2d Cir. 2003) (quoting Valley Forge Christian Coll. v. Ams. United for Separation of Church & State, 454 U.S. 464, 473 (1982)). Here, plaintiff lacks any such stake because she has no harm to be assuaged. For similar reasons, plaintiff cannot meet Article III s redressability requirement because her complaint fails to allege facts showing how her past injuries can be remedied by a judgment in her favor. Due to her card issuer s assurance of zero fraud liability, she does not need money to pay unauthorized charges alleged at Comp. 7, and those are the only concrete consequences of the fraudulent use of her payment card information. Because the complaint describes no specific harm she has suffered, monetary or otherwise, there is no way that a judgment in her favor would make her whole. Rather, she is whole already. Second, the complaint alleges a series of potential future consequences from the data incursion, see Compl ), but fails to allege facts that would show a sufficiently imminent threat of future injury that would give her standing to assert her claims for injunctive relief. Cacchillo v. Insmed, Inc., 638 F.3d 401, 404 (2d Cir. 2011) ( [A] plaintiff must demonstrate standing for each claim and form of relief sought. (internal quotation marks omitted)). Future injury will confer standing only when that harm is certainly impending, Clapper v. Amnesty Int l USA, U.S., 133 S. Ct. 1138, 1147 (2013) (emphasis in original) (internal quotation 6

12 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 12 of 23 PageID #: 126 marks omitted) that is, when a plaintiff pleads (and later proves) that she is immediately in danger of sustaining some direct injury as the result of the challenged... conduct, City of Los Angeles v. Lyons, 461 U.S. 95, 102 (1983) (quoting Golden v. Zwickler, 394 U.S. 103, (1969). The threat of [that] injury must be both real and immediate, not conjectural or hypothetical. Id. at 102. In other words, allegations of possible future injury are not sufficient. Clapper, 133 S. Ct. at 1147 (emphasis in original) (alterations and internal quotation marks omitted). Here, the complaint falls far short of this standard. Although it alludes vaguely to the possibility of future identity theft, see Compl. 21, that possibility is speculative at best and thus cannot confer standing. Indeed, plaintiff does not even allege what information of hers she believes to have been compromised such that future identity theft is even possible. She does not allege that social security numbers, dates of birth, or other information necessary to open new accounts was compromised. Compl. 10. Likewise absent is any allegation that her debit card remains active (i.e., capable of incurring fraudulent charges), and she has pointed to no other payment card and, indeed, to no other information at all that may have been compromised or that may be used to steal her identity in the future. No such putative harm is certainly impending. Clapper, 133 S. Ct. at 1147 (emphasis in original) (quoting Defenders of Wildlife, 504 U.S. at 565 n.2). Nor can the hypothetical costs of guarding against the possibility of such future theft support standing. In Clapper, the plaintiffs (attorneys, journalists, and other professionals) believed it likely that their confidential communications with foreign citizens were being intercepted by U.S. intelligence officials. 133 S. Ct. at To avoid that surveillance, they took costly and burdensome measures to protect the confidentiality of their communications, 7

13 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 13 of 23 PageID #: 127 such as avoid[ing] certain and phone conversations and travel[ing] so that they c[ould] have in-person conversations. Id. at Those costs, the Court held, were not only insufficient to confer standing, but in fact were wholly beside the point. The Court explained: [Plaintiffs ] contention that they have standing because they incurred certain costs as a reasonable reaction to a risk of harm is unavailing because the harm respondents seek to avoid is not certainly impending. In other words, respondents cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending. Id. Because the plaintiffs self-inflicted injuries [we]re not fairly traceable to the Government s purported activities under [the statute at issue], they failed to confer standing. Id. at Just as in Clapper, plaintiff s claim in the present case that she will incur costs from avoiding or mitigating a speculative future harm does not give her standing. Entirely neglecting that Defendant is offering free credit monitoring and identity theft insurance, see Reeder Declaration, Ex. B, at 2, she decries the hypothetical cost of years of constant surveillance of [her]... personal records, including monitoring services, Compl. 22, but as in Clapper, they are completely irrelevant. They are self-inflicted injuries just like those the Court found unavailing there, 133 S. Ct. at 1151, because the central question in the future-harm branch of the standing inquiry is whether the particular injury the plaintiff seeks to avoid or mitigate here, future identity theft is certainly impending. Id. Plaintiff fails even to allege such imminence and thus fails the injury test of Article III. See In re Barnes & Noble Pin Pad Litig., 2013 WL , at *4 (applying Clapper to conclude that expenses incurred to mitigate an increased risk of identity theft or fraud [are] also insufficient to establish standing ). Nor, indeed, has plaintiff alleged that she has actually incurred any of these costs. Instead, plaintiff asserts only that she now face[s] years of those expenses. Compl. 22. But without actually incurring such charges, plaintiff s standing claim fails even on its own terms. 8

14 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 14 of 23 PageID #: 128 Although a few courts have concluded that the possibility of future identity theft may suffice for standing, see, e.g., Krottner v. Starbucks, 628 F.3d 1139, 1142 (9th Cir. 2010); Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 634 (7th Cir. 2007), these decisions predate the Supreme Court s 2013 decision in Clapper, which confirmed that harm must be imminent or certainly impending to create standing. See 133 S. Ct. at 1151; see also Reilly v. Ceridian Corp., 664 F.3d 38, 44 (3d Cir. 2011) ( Neither Pisciotta nor Krottner, moreover, discussed the constitutional standing requirements and how they apply to generalized data theft situations. Indeed, the Pisciotta court did not mention let alone discuss the requirement that a threatened injury must be imminent and certainly impending to confer standing. ). In sum, plaintiff fails to allege what damage, what concrete and compensable harm she is suffering in the here and now. She alleges no unpaid bill to pay, no demand from her bank that it be reimbursed for charges incurred on her account, and no other presently realized (or certainly impending) harm. As such, plaintiff has failed to plead the irreducible... minimum of federal jurisdiction, and her case must be dismissed. Defenders of Wildlife, 504 U.S. at 560. II. THE COMPLAINT ALSO MUST BE DISMISSED PURSUANT TO RULE 12(b)(6) BECAUSE IT FAILS TO STATE A CLAIM Even if plaintiff possessed standing to seek relief, the complaint fails to state a claim on which relief can be granted. Under Fed. R. Civ. P. 12(b)(6), a motion to dismiss should be granted if the complaint does not contain enough facts to state a claim to relief that is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A complaint must contain enough factual content to allow a court to draw the reasonable inference that the defendant is liable for the misconduct alleged. Interpharm, Inc. v. Wells Fargo Bank, N.A., 655 F.3d 136, 141 (2d Cir. 2011) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). In determining a motion to dismiss, a court assum[es] all facts alleged within the four corners of the complaint to 9

15 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 15 of 23 PageID #: 129 be true, and draw[s] all reasonable inferences in plaintiff s favor. Id. However, a complaint that only offers labels and conclusions or a formulaic recitation of the elements of a cause of action will not do. Twombly, 550 U.S. at 555. In other words, a plaintiff s factual allegations must be sufficient to raise a right to relief above the speculative level. Id. Each of plaintiff s purported causes of action fails this standard. A. The First Count fails to state a claim for negligence because it alleges no facts showing either causation or damages Under New York law, a negligence claim requires the plaintiff to plead and prove the existence of a duty, breach of that duty, causation, and damages. See, e.g., Chylinski v. Wal Mart Stores, Inc., 150 F.3d 214, 218 (2d Cir. 1998). Apart from any other infirmity, the complaint here pleads no facts that, if true, would establish damages or causation. As explained above, plaintiff has not alleged that she has any present injury from the purported fraudulent charges on her account, due to the fraud-liability protection provided by her card issuer. Nor does New York law recognize the costs of future-oriented identity-theft prevention services (such as credit monitoring) as a cognizable injury. See, e.g., Hammond, 2010 WL , at *10 (holding that a heightened fear of having [one s] identity stolen does not give rise to damages under New York negligence law); Shafran v. Harley-Davidson, Inc., No. 07-cv-01365, 2008 WL , at *3 (S.D.N.Y. Mar. 20, 2008) (surveying federal district court cases and holding that [c]ourts have uniformly ruled that the time and expense of credit monitoring to combat an increased risk of future identity theft is not, in itself, an injury that the law is prepared to remedy ). This deficiency pervades all of the allegedly negligent acts described by plaintiff. For example, whether the alleged breach of duty is the failure to safeguard information or to give earlier notice, the ultimate injury alleged in either case is the 10

16 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 16 of 23 PageID #: 130 same: charges on her debit account for which she has no liability. Accordingly, plaintiff has failed to allege an essential element of negligence for each theory of liability. The complaint likewise fails to allege a sufficient causal nexus between her supposed injuries and any act or omission by Neiman Marcus. Even if her reimbursed charges could otherwise constitute a compensable injury, the complaint fails to allege any particular data security measure that was below standard or that the data incursion caused the fraudulent charges to be made to her account; rather, it merely alleges that certain charges were received after the incursion. In addition, the complaint fails to allege that any act or omission by Neiman Marcus caused the data incursion, or that the timing of Neiman Marcus s announcement of the incursion somehow caused the fraudulent charges. Because the first count of the complaint merely makes a formulaic recitation of the elements of a cause of action, Twombly, 550 U.S. at 555, which fails to allege facts that would constitute negligence, it should be dismissed. B. The Second Count fails to state a claim because New York does not recognize a tort for invasion of privacy New York law has no common law right of privacy, and its courts have rejected efforts by litigants to introduce a cause of action. [I]n this State the right to privacy is governed exclusively by sections 50 and 51 of the Civil Rights Law. Howell v New York Post Co., 81 N.Y. 115, 123 (1993) (noting NY legislature had rejected bills to provide cause of action for privacy invasion and misappropriation) (citations omitted). Sections 50 and 51 of the Civil Rights Law concern (1) a party s use of another person s name, portrait, and picture, (2) without her consent (3) for advertising or trade. N.Y. Civ. Rights Law 51; Messenger ex rel. Messenger v. Gruner + Jahr Printing & Pub., 94 N.Y.2d 436, 441 (2000). Such a claim is neither pleaded nor available here. See Messenger, 94 N.Y.2d at 441 ( [T]he statute is to be narrowly construed and strictly limited to nonconsensual commercial appropriations of the 11

17 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 17 of 23 PageID #: 131 name, portrait or picture of a living person (quoting Finger v. Omni Publishers Int l, 77 N.Y.2d 138, 141 (1990)); Smith v. Chase Manhattan Bank, USA, N.A., 741 N.Y.S.2d 100, 103 (2d Dep t. 2002) (stating that 50 and 51 must be narrowly construed and were never intended to address the wrongs complained of by the plaintiffs, which included unauthorized disclosure of the plaintiff s identifying information to third-party advertisers). Because the Second Count of the complaint asserts a privacy cause of action that does not exist in the State of New York, it should be dismissed. C. The Third Count fails to state a cause of action for bailment because it does not allege a transfer of exclusive possession of the information at issue Under New York law, a bailment is defined as a delivery of personal property for some particular purpose... upon a contract express or implied, and that after such purpose has been fulfilled it shall be redelivered to the person who delivered it, or otherwise dealt with according to his directions or kept until he reclaims it, as the case may be. Ancile Inv. Co. v. Archer Daniels Midland Co., 784 F. Supp. 2d 296, 306 (S.D.N.Y. 2011) (quoting Herrington v. Verrilli, 151 F. Supp. 2d 449, 457 (S.D.N.Y. 2001) (quoting, in turn, Osborn v. Cline, 263 N.Y. 434, 437 (1934))). The determination as to whether the [parties ] relationship is one of bailor and bailee turns on whether there is a relinquishment of exclusive possession, control and dominion over the property. Command Cinema Corp. v. VCA Labs, Inc., 464 F. Supp. 2d 191, 199 (S.D.N.Y. 2006) (quoting Fada Indus. v. Falchi Bldg. Co., L.P., 730 N.Y.S.2d 827, 839 (Sup. Ct. 2001)); accord Isik Jewelry v. Mars Media, Inc., 418 F. Supp. 2d 112, 120 (E.D.N.Y 2005). Here, the complaint fails to plead sufficient facts to show that the information she shared by swiping her debit card is property that may be subject to bailment. See In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 903 F. Supp. 2d 942, 974 (S.D. Cal. 2012) ( [T]he Court is hard pressed to conceive of how Plaintiffs Personal Information could be construed to be personal property so that Plaintiffs somehow delivered this property to Sony and then expected it be 12

18 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 18 of 23 PageID #: 132 returned. ); Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121, (N.D. Cal. 2008), aff d, 380 F. App x 689 (9th Cir. 2010). To be sure, by swiping her debit card to make a purchase at a Neiman Marcus store, plaintiff shared certain information with the company, but that sort of exchange is far different from the typical bailment case. Merchants clearly do not return such information after a transaction in the same way a parking attendant returns a car, for example. Indeed, the sharing of information hardly surrenders exclusive possession of that information, which is a required element of bailment under New York law. See Command Cinema Corp., 464 F. Supp. 2d at 199; Isik Jewelry, 418 F. Supp. 2d at 120; see also. Yantha v. Omni Childhood Center, Inc., No. 13-cv-1948, 2013 WL , at *10 (E.D.N.Y. Sept. 20, 2013) (dismissing a claim for conversion of plaintiff s identity, identifying information, and electronic accounts with insurers because defendants could not have exercised an unauthorized dominion over the things in question (alteration and internal quotation marks omitted)). As such, plaintiff s bailment claim (Third Count) is deficient as a matter of law and should be dismissed. D. The Fourth Count fails to state a claim for conversion because it does not allege that Neiman Marcus exercised an exclusive right of ownership over plaintiff s information New York law defines conversion as the unauthorized assumption and exercise of the right of ownership over goods belonging to another to the exclusion of the owner s rights. Ancile, 784 F. Supp. 2d at 312 (quoting Vigilant Ins. Co. of Am. v. Housing Auth. of El Paso, Tex., 87 N.Y.2d 36, 44 (1995)). When the original possession is lawful, conversion does not occur until the defendant refuses to return the property after demand or until he sooner disposes of the property. Id. (quoting Stadt v. Fox News Network LLC, 719 F. Supp. 2d 312, 318 (S.D.N.Y. 2010)). In this case, plaintiff has failed to allege any of the elements of a conversion claim. The complaint alleges no acts by Neiman Marcus that evince an assumption and exercise of the right of ownership over plaintiff s information. See id.; Yantha, 2013 WL , at *10; cf. In re TJX 13

19 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 19 of 23 PageID #: 133 Cos. Retail Sec. Breach Litig., 564 F.3d 489, (1st Cir. 2009) ( Conversion implies appropriation, which is hardly the first word that comes to mind to describe the store s behavior when a customer gives a store a credit card and the data is then filched from the store by a third party. ). As with bailment, it is not at all clear that personal information is the sort of property that can be converted in that information by its nature does not belong to one person to the exclusion of another. The complaint lacks indeed any indication of acts by Neiman Marcus that supposedly wrested control of her information from her so fully that they exclu[ded] her from her information. See Ancile, 784 F. Supp. 2d at 312. To the contrary, plaintiff has always retained access to and control over her identifying and financial information and she alleges no facts showing otherwise. Moreover, because the original possession of plaintiff s information by Neiman Marcus arose lawfully out of a transaction voluntarily initiated by the plaintiff herself, no conversion can occur until Neiman Marcus refuses to surrender plaintiff s information upon request or disposes of it. Id. The complaint alleges no failure to surrender or a request for its return. Even if it could be alleged that fraudulent use of debit card information could constitute a dispos[al] of the property, no such use or disposal is alleged with respect to Neiman Marcus. Thus, whether or not plaintiff may claim conversion against a Doe defendant, she cannot claim conversion against Neiman Marcus, and the Fourth Count of the complaint should be dismissed. E. The Fifth Count fails to state a claim under N.Y. Gen. Bus. Law 349 because it does not allege misleading conduct that caused injury to plaintiff A plaintiff under [New York General Business Law ] 349 must prove three elements: first, that the challenged act or practice was consumer-oriented; second, that it was misleading in a material way; and third, that the plaintiff suffered injury as a result of the deceptive act. Stutman v. Chem. Bank, 95 N.Y.2d 24, 29 (2000). As already explained in the standing and negligence discussions above, plaintiff has failed to allege injury, a defect that by itself suffices to defeat her claim under the General Business Law. See id. 14

20 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 20 of 23 PageID #: 134 In addition, plaintiff fails to point to any act or statement by Neiman Marcus that actually caused the fraudulent charges to her account or other, future-oriented expenses she may someday incur. Smith v. Chase Manhattan Bank illustrates the shortcomings of plaintiff s allegations in this regard. There, the plaintiffs alleged that the defendant had issued a Customer Information Principles document that commit[ed] to protect customer privacy and confidentiality and not to share customer information with any unrelated third party. 741 N.Y.S.2d at 101. Plaintiffs further contended that the defendant had violated that agreement by selling their personal, financial, and contact information to non-affiliated third-party vendors, without informing the plaintiffs or affording them an opportunity to opt out. Id. In exchange, they alleged, the bank was given a commission up to 24% of the vendors resulting sales. Id. The Appellate Division held that, if true, these allegations would amount to actionable deception under 349. Id. at 102. Here, by contrast, the complaint fails to identify any particular act, statement, or course of conduct as misleading. Plaintiff seeks to disguise that shortcoming by couching her allegations in the vaguest possible terms, complaining that Neiman Marcus did not inform customers that it failed to properly safeguard their Private Information. Compl. 65. If by this statement plaintiff means to say that Neiman Marcus was aware that its security system lacked proper safeguards and failed to so inform the public, her assertion cannot survive the plausibility test of Iqbal and Twombly, because she pleads no facts that even hint at such knowledge by the Defendant. See Interpharm, 655 F.3d at 141 ( A complaint must contain enough factual content to allow a court to draw the reasonable inference that the defendant is liable for the misconduct alleged. (quoting Iqbal, 556 U.S. at 678)). If, instead, she simply means to say that Neiman Marcus did not disclose that its security systems were not completely immune from 15

21 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 21 of 23 PageID #: 135 cyber-attack, plaintiff s averment is not actionable. No data security system is impenetrable, and plaintiff does not claim otherwise. She cannot plausibly claim either that Neiman Marcus engaged in unlawful conduct for not telling her that truism, or that informing her of that fact would somehow have prevented the fraudulent charges on her account. In short, plaintiff does not assert much less plead any facts that would establish that the timing of Neiman Marcus s announcement of the data incursion was a deceptive practice under 349. See generally Compl Plaintiff simply cannot state a cause of action against Neiman Marcus for misleading or deceptive practices under 349, absent facts establishing what Neiman Marcus said or did that lulled her into a false sense of security and thereby actually caused her harm. Plaintiff misdirects her animus at Neiman Marcus, rather than the cyber-criminals who perpetrated the data incursion of Neiman Marcus. Because plaintiff s 349 claim fails to allege misleading conduct, actual injury, or a causal connection between the alleged conduct and the alleged injury, it is deficient on multiple grounds and should be dismissed. 16

22 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 22 of 23 PageID #: 136 CONCLUSION For the foregoing reasons, the complaint should be dismissed in its entirety. Dated: New York, New York February 12, 2014 Respectfully submitted, SIDLEY AUSTIN LLP By: /s/ Steven M. Bierman Steven M. Bierman James D. Arden 787 Seventh Avenue New York, New York Telephone: (212) Facsimile: (212) Counsel for Defendant The Neiman Marcus Group LLC 17

23 Case 2:14-cv ADS-GRB Document 24 Filed 02/12/14 Page 23 of 23 PageID #: 137 CERTIFICATE OF SERVICE I certify that on February 12, 2014, the foregoing Memorandum in Support of Motion to Dismiss Complaint was served on all counsel of record through the CM/ECF system. /s/ James D. Arden James D. Arden 18

24 Case 2:14-cv ADS-GRB Document 24-1 Filed 02/12/14 Page 1 of 15 PageID #: 138 APPENDIX

25 Case Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 21 of 151 PageID #: #:

26 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 31 of of 15 6 PageID #:

27 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 42 of of 15 6 PageID #: /23/2014 NM - Neiman Marcus ASSISTANCE YOUR ONLINE ACCOUNT Change Country SHOPPING BAG DESIGNERS WOMEN'S APPAREL SHOES HANDBAGS JEWELRY ACCESSORIES BEAUTY THE MAN'S STORE NM KIDS HOME GIFTS SALE To our loyal Neiman Marcus Group customers: We deeply regret and are very sorry that some of our customers' payment cards w ere used fraudulently after making purchases at our stores. We have taken steps to notify those affected customers for w hom w e have contact information. We aim to protect your personal and financial information. We w ant you always to feel confident shopping at Neiman Marcus, and your trust in us is our absolute priority. Here is the information w e have learned so far, based on the ongoing investigations: Social security numbers and birth dates w ere not compromised. Our Neiman Marcus and Bergdorf Goodman cards have not seen any fraudulent activity. Customers that shopped online do not appear to have been impacted. PINs w ere never at risk because w e do not use PIN pads in our stores. We have also provided a Question and Answ er section for additional information. While the forensic and criminal investigations are ongoing, w e know that malicious softw are (malw are) w as clandestinely installed on our system. It appears that the malw are actively attempted to collect or "scrape" payment card data from July 16, 2013 to October 30, During those months, approximately 1,100,000 customer payment cards could have been potentially visible to the malw are. To date, Visa, MasterCard and Discover have notified us that approximately 2,400 unique customer payment cards used at Neiman Marcus and Last Call stores w ere subsequently used fraudulently. We are notifying ALL customers for w hom w e have addresses or w ho shopped w ith us betw een January 2013 and January 2014, and offering one free year of credit monitoring and identity-theft protection. Sign-up instructions for this service can be found below in the Question and Answ er section. If you are concerned about fraudulent activity, you can take these additional steps: Check your payment card statements and if any suspicious or fraudulent activity appears, please call your card issuer to report it. Contact your local store or call our credit division at if you see fraudulent activity on your Neiman Marcus or Bergdorf Goodman Card. The policies of the payment card brands such as Visa, MasterCard, American Express, Discover and the Neiman Marcus card provide that you have zero liability for any unauthorized charges if you report them in a timely manner. For over a century, our company's mission has been dedicated to delivering exceptional service to each of our customers, and responding properly to this attack is our top priority. Our goal is to do everything possible to restore your trust and to earn your loyalty. Sincerely, Karen Katz President and CEO Neiman Marcus Group January 22, 2014 General Q&A 1. How long has Neiman Marcus know n about this? 2. Was Neiman Marcus the victim of a data breach? 3. What w as the date range? 4. How many cards w ere affected? 5. Was PIN data taken or accessed? 6. Has the potential security issue been resolved? 7. Which Neiman Marcus Group stores w ere affected? 8. Did this incident affect customers that shopped online? 9. What types of cards w ere affected? 1/5

28 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 53 of of 15 6 PageID #: /23/2014 NM - Neiman Marcus 10. Were Neiman Marcus or Bergdorf Goodman private label cards used fraudulently? 11. Is this issue linked in any w ay to the breach at Target? Customer Guidance 12. How do I sign up for free credit monitoring? 13. What are some of the steps customers concerned about this loss of payment card information can take? 14. Should consumers contact Neiman Marcus or Bergdorf Goodman if their cards w ere affected? 15. Will consumers be liable for fraudulent charges? 1. How long has Neiman Marcus known about this? On January 1st, a leading forensics firm first discovered evidence that the company w as the victim of a criminal cyber-security intrusion. At this time, the forensic investigation is still underw ay. 2. Was Neiman Marcus the victim of a data breach? Neiman Marcus w as informed by our merchant processor in mid-december of potentially unauthorized payment card activity that occurred follow ing customer purchases at our Neiman Marcus Group stores. We informed federal law enforcement agencies and began w orking actively w ith the U.S. Secret Service, the payment brands, our merchant processor, a leading investigations, intelligence and risk management firm, and a leading payment brand-approved forensics firm to investigate the situation. On January 1st, the forensics firm discovered evidence that the company w as the victim of a criminal cyber-security intrusion and that some customers' cards w ere possibly compromised as a result. At this time, the malicious softw are w e have found has been disabled. 3. What was the date range? Based upon the information w e have to date, it appears that sophisticated, self-concealing malw are, capable of fraudulently obtaining payment card information, w as active betw een July 16 and October 30, How many cards were affected? While the forensic and criminal investigations are ongoing, w e know that malicious softw are (malw are) w as clandestinely installed on our system. It appears that the malw are actively collected or "scraped" credit card data from July 16, 2013 to October 30, During those months, approximately 1,100,000 customer payment cards could have potentially been visible to the malw are. To date, Visa, MasterCard and Discover have notified us that approximately 2,400 unique customer payment cards used at Neiman Marcus and Last Call stores w ere subsequently used fraudulently. 5. Was PIN data taken or accessed? Your PIN w as never at risk because w e do not use PIN pads in our stores. 6. Has the potential security issue been resolved? We are taking a number of steps to contain the situation in all our stores including: Contacting and w orking directly w ith federal law enforcement agencies Conducting a full review of all of our payment card information systems and vulnerability assessment w ith the payment brands, our merchant processor, a leading investigations, intelligence and risk management firm, and a leading payment brand approved forensics firm Review ing our intrusion detection systems and firew alls Reinforcing our security tools Review ing and hardening our systems Modifying our softw are and security credentials Searching for and disabling all malw are w e discover in the course of our investigation 7. Which Neiman Marcus Group stores were affected? We need further information from the forensics investigation to determine accurately how many stores w ere affected. 2/5

29 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 64 of of 15 6 PageID #: /23/2014 NM - Neiman Marcus 8. Did this incident affect customers that shopped online? To our know ledge, the criminal cyber-security intrusion did not impact customers that shopped online. 9. What types of cards were affected? We have been able to determine that both credit and debit cards have been impacted. 10. Were Neiman Marcus or Bergdorf Goodman private label cards used fraudulently? As of January 22, 2014, w e have not been informed of any fraudulent activity on our Neiman Marcus or Bergdorf Goodman cards as a result of this cyber crime. If you are concerned about your Neiman Marcus or Bergdorf Goodman card, please call our credit office at Is this issue linked in any way to the breach at Target? We have no know ledge of any connection to that situation. 12. How do I sign up for free credit monitoring? Your free credit monitoring through Experian's ProtectMyID Alert can be activated by visiting w w w.protectmyid.com/nm. For enrollment issues contact Experian's ProtectMyID at To sign up for our free credit monitoring offer, you must sign up by June 15, What are some of the steps customers concerned about this loss of payment card information can take? There are several other steps you can take if you are concerned about fraudulent activity. Check your statements to see if there is any fraudulent or suspicious activity. If there is any unauthorized activity, call your bank or financial institution in order to report the issue. Consumers may consider placing a fraud alert on their credit reports to help mitigate potential issues. To do this, you w ill need to contact one of the three credit reporting agencies. Equifax: Experian: TransUnion: You can order your credit reports for free from all three credit bureaus once a year. You can do this online at or by phone at Finally, be on the lookout for phishing schemes. Our correspondence regarding this incident w ill not contain any links, so if you receive an appearing to be from us that contains a link, it is not from us, and don't click on the link. Also, never provide sensitive information to unsolicited requests claiming to come from us, your bank or other institutions. We w ould never ask you for sensitive information via Should consumers contact Neiman Marcus or Bergdorf Goodman if their cards were affected? If you are concerned about your Neiman Marcus or Bergdorf Goodman card, please call our credit office at Other cardholders should contact the bank or financial institution that issued their cards about any fraudulent activity. Contact information can be found on the back of their payment cards. They are best suited for helping to resolve any unauthorized charges. 15. Will consumers be liable for fraudulent charges? The policies of the payment brands such as Visa, MasterCard, American Express, Discover and the Neiman Marcus card provide that you have zero liability for any unauthorized charges if you report them in a timely manner. Please contact your card brand or issuing bank for more information about the policy that applies to you. 3/5

30 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 75 of of 15 6 PageID #: /23/2014 NM - Neiman Marcus U.S. State Notification Requirements For additional information, you may contact Neiman Marcus' hotline at , or visit our informational w ebsite accessible from our home page. For residents of California, Hawaii, Illinois, Iowa, Maryland, Michigan, Missouri, North Carolina, Oregon, Vermont, Virginia, West Virginia, and Wyoming: It is recommended by state law that you remain vigilant for incidents of fraud and identity theft by review ing credit card account statements and monitoring your credit report for unauthorized activity. You may obtain a copy of your credit report, free of charge, w hether or not you suspect any unauthorized activity on your account by contacting any one or more of the national consumer reporting agencies listed below. They can also provide you w ith information about fraud alerts and security freezes. Equifax: P.O. Box Atlanta, GA w w w.equifax.com Expe r ian: P.O. Box 2104 Allen, TX w w w.experian.com TransUnion: P.O. Box 6790 Fullerton, CA w w w.transunion.com For residents of Iowa: State law advises you to report any suspected identity theft to law enforcement or to the Attorney General. For residents of Oregon: State law s advise you to report any suspected identity theft to law enforcement, as w ell as the Federal Trade Commission. For residents of Illinois, Maryland and North Carolina: State law s require us to tell you that you can obtain information from the Federal Trade Commission about steps you can take to avoid identity theft (including how to place a fraud alert or security freeze). If you are a Maryland or North Carolina resident, you may also be able to obtain this information from your state's Attorney General. MD Attorney General's Office Consumer Protection Division 200 St. Paul Place Baltimore, MD w w w.oag.state.md.us NC Attorney General's Office Consumer Protection Division 9001 Mail Service Center Raleigh, NC Federal Trade Commission Consumer Response Center 600 Pennsylvania Avenue, NW Washington, DC IDTHEFT ( ) w w w.ftc.gov/bcp/edu/microsites/idtheft/ For residents of Massachusetts and West Virginia: State law s require us to inform you of your right to obtain a police report if you are a victim of identity theft. You also have the right to place a security freeze on your credit 4/5

31 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 86 of of 15 6 PageID #: /23/2014 NM - Neiman Marcus report. A security freeze is intended to prevent credit, loans and services from being approved in your name w ithout your consent; how ever, using a security freeze may delay your ability to obtain credit. To place a security freeze on your credit report, you need to send a request to a consumer reporting agency by certified mail, overnight mail, or regular stamped mail. The follow ing information must be included w hen requesting a security freeze (note that if you are requesting a credit report for your spouse, this information must be provided for him/her as w ell): (1) full name, w ith middle initial and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any applicable incident report or complaint w ith a law enforcement agency or the Registry of Motor Vehicles. The request must also include a copy of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, display your name and current mailing address, and the date of issue. The consumer reporting agency may charge a fee of up to $5.00 to place a freeze or lift or remove a freeze, unless you are a victim of identity theft or the spouse of a victim of identity theft, and you have submitted a valid police report relating to the identity theft incident to the consumer reporting agency. Equifax Security Freeze P.O. Box Atlanta, GA w w w.equifax.com Experian Security Freeze P.O. Box 9554 Allen, TX w w w.experian.com TransUnion (FVAD) P.O. Box 6790 Fullerton, CA w w w.transunion.com UPDATED JANUARY 22, 2014 INVESTOR RELATIONS CAREERS SITE MAP NM CREDIT CARD Enter address 2014, Neiman Marcus, Security & Privacy 5/5

32 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 91 of of 15 7 PageID #:

33 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 102 of 15 7 PageID #:

34 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 113 of 15 7 PageID #:

35 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 124 of 15 7 PageID #:

36 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 135 of 15 7 PageID #:

37 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 146 of 15 7 PageID #:

38 Case 2:14-cv ADS-GRB Document Filed 02/12/14 02/05/14 Page 157 of 15 7 PageID #: