Elvey V. TD Ameritrade - August 14,2007 - Motion for Preliminary Injunction

Alan Himmelfarb LAW OFFICES OF ALAN HIMMELFARB 2757 Leonis Blvd Los Angeles, CA 90058 Telephone: (323) 585-8696 Fax: (323) 585-8198 consumerlaw1@earthlink.net
Scott A. Kamber Ethan Preston KAMBER & ASSOCIATES, LLC 11 Broadway, 22d Floor New York, NY 10004 Telephone: (212) 920-3072 Fax: (212) 202-6364 skamber@kolaw.com epreston@kolaw.com
Counseljar Plaintifs
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF CALIFORNIA
SAN FRANCISCO DIVISION

d
GADGETWIZ, INC., an Arizona corporation, on their own behalf and on behalf of all others similarly situated,
Plaintiffs
v.
TD AMERITRADE, INC., a New York corporation, and DOES 1 to 100,
Defendants.
No. C 07 2852 MJJ
Judge Martin J. Jenkins
NOTICE OF MOTION; MOTION FOR PRELIMINARY INJUNCTION AND CLASS CERTIFICATION
Date: August 14,2007 Time: 9:30 a.m. Location: Courtroom 11, 19th Floor 450 Golden Gate Ave. San Francisco, CA 94102
PLAINTIFFS' MOTION FOR
PRELIMINARY INJUNCTION AND CLASS CERTIFICATION

NOTICE OF MOTION
NOTICE IS HEREBY GIVEN that Matthew Elvey and Gadgetwiz, Inc. will move the Court for a preliminary injunction in the above referenced proceedings, pursuant to Federal Rule of Civil Procedure 65(a) on August 14,2007, at 9:30 a.m., or as soon thereafter as counsel may be heard by the above-entitled Court, located at 450 Golden Gate Avenue, 19th Floor, San Francisco, CA 94102, in Courtroom 11, before the Honorable Martin Jenkins.
This Motion is based on this Notice of Motion and Motion, the Brief in Support of the Motion to Intervene and the authorities cited therein, oral argument of counsel, and any other matter that may be submitted at the hearing. Through this Motion, Plaintiffs seek the following equitable remedies:

To the extent Ameritrade is deliberately leaking email addresses to spammers, it must be enjoined from doing so. The evidence before Plaintiffs suggests, however, the disclosure of email addresses is the result of an ongoing security breach at Ameritrade. The Motion seeks an order that Ameritrade disclose all material information about the leaks to prospective and current accountholders and for an accounting of the record systems which contain accountholders' personal information, so that Plaintiffs' counsel can identify reasonable steps which Ameritrade can take to protect this information (or require Ameritrade to sequester these systems and their data).

Second, Ameritrade is California Resident Class's stock broker. The spam resulting from the Ameritrade leaks are exclusively stock spam -the spam touts thinly-traded stocks which can be easily manipulated as part of the spammers' pump-and-dump scheme against the spam recipients. Ameritrade knows or could easily determine which stocks are thus being touted, and could prevent its accountholders from purchasing those stocks in the wake of the spam. At a minimum, Ameritrade should fully disclose to prospective purchasers of touted stocks that the stock's value is being manipulated by spammers.

Lastly, the Motion seeks to prevent Ameritrade from telling accountholders to destroy evidence. There is evidence that Ameritrade encouraged accountholders to delete spam when communicating about the leak. These communications promote the destruction of evidence to
Motion for Preliminary Injunction ii No. C 07 2852 MJJ and Class Certification

the prejudice of the FAC's CAN SPAM Class (which has claims for statutory damages based
on each spam sent). These communications are tantamount to spoliation, and this Motion
seeks to prohibit Ameritrade from continuing this spoliation.
In sum, this Motion seeks an Order from this Court against TD AMERITRADE, Inc.
that:

1.
Certifies the action as a class action and designating Plaintiffs as representatives of the CAN SPAM Class and Kamber & Associates, LLC as Class counsel under Rule 23(b)(2) and Rule 23(c)(4) to the extent necessary for the preliminary injunction sought herein.

2.
Prohibits TD AMERITRADE, Inc. from instructing, directing, or suggesting that its accountholders destroy copies of spam which promotes stocks.

3.
Certifies the action as a class action and designating Elvey as representative of the California Resident Class and Kamber & Associates, LLC as Class counsel under Rule 23(b)(2) and Rule 23(c)(4) to the extent necessary for the preliminary injunction sought herein.

4.
Prohibits TD AMERITRADE, Inc. from disclosing its accountholders' personal information (including its email addresses) to third parties in a manner inconsistent with its February 2007 Privacy Statement.

5.
Requires TD AMERITRADE, Inc. to detect spam sent to its accountholders and to identify stocks touted by such spam.

6.Requires TD AMERITRADE, Inc. to display the following disclosure to California Resident Class members (Ameritrade's accountholders in California) who attempts to purchase a stock which has been touted by spam detected by Ameritrade:

ALERT: THIS STOCK SHOULD BE PURCHASED ONLY
WITH EXTREME CAUTION. THIS STOCK HAS
RECENTLY BEEN TOUTED IN UNSOLICITED
COMMERCIAL EMAIL. IT IS LIKELY THAT THE PERSONS
SENDING THESE EMAILS ARE MANIPULATING THE
VALUE OF THIS STOCK AS PART OF A FRAUDULENT
INVESTMENT SCHEME. THIS SCHEME MAY CAUSE ANY
INVESTMENT IN THIS STOCK TO LOSE ITS VALUE,
NOTWITHSTANDING THE COMPANY'S FINANCIAL
PERFORMANCE.

and require the purchaser to affirmatively indicate that the purchaser has read
this warning, before executing any such purchase in such a time period for any
California Resident Class members.

7.Requires TD AMERITRADE, Inc. to provide Plaintiffs and their counsel with an accounting of any of its records systems which store Plaintiffs' personal information or personal information of any members of the California Resident Class.

8.Requires TD AMERITRADE, Inc. to prominently disclose in its Privacy Statement and in emails or other individual disclosures to its accountholders:

ALERT: AMERITRADE'S INFORMATION SYSTEMS ARE NOT NECESSARILY SECURE AND WE CANNOT ASSURE THE SECURITY OF YOUR PERSONAL INFORMATION. THERE IS EVIDENCE THAT SOME ACCOUNTHOLDERS' EMAIL ADDRESSES HAVE LEAKED FROM AMERITRADE' S COMPUTER SYSTEMS TO SPAMMERS. AMERITRADE HAS AN ONGOING INVESTIGATION INTO THIS SITUATION. YOUR NAME, SOCIAL SECURITY NUMBER, AND YOUR EMAIL ADDRESS MAY HAVE BEEN LEAKED AS WELL.

We recommend that you place a fraud alert on your credit file. A
fraud alert tells creditors to contact you before they open any
new accounts or change your existing accounts. Call anyone of
the three major credit bureaus. As soon as one credit bureau
confirms your fraud alert, the others are notified to place fraud
alerts. All three credit reports will be sent to you, free of charge,
for your review. You can contact Equifax (800-685-1111),
Experian (888-397-3742), or TransUnionCorp (800-680-7289).
Even if you do not find any suspicious activity on your initial
credit reports, the Federal Trade Commission (FTC)
recommends that you check your credit reports periodically.
Victim information sometimes is held for use or shared among a
group of thieves at different times. Checking your credit reports
periodically can help you spot problems and address them
quickly.

If you find suspicious activity on your credit reports or have reason to believe your information is being misused, call [insert contact information for law enforcement] and file a police report. Get a copy of the report; many creditors want the information it contains to absolve you of the fraudulent debts. You also should file a complaint with the FTC at www.consumer.gov/idtheft or at 1-877-ID-THEFT (877-438-4338). Your complaint will be added to the FTC's Identity Theft Data Clearinghouse, where it will be accessible to law enforcers for their investigations.

You can obtain a copy of Take Charge: Fighting Back Against
Identity Theft, a comprehensive guide from the FTC to help you
guard against and deal with identity theft at:
http://www.ftc.gov/bcp/edu/pubs/consumer/idtheftlidt04.htm
and to further publish to current and former accountholders a report to be
drafted by Plaintiffs' counsel and approved by the Court upon completion of
the accounting in Paragraph 7.

Requires TD AMERITRADE, Inc. to take such reasonable measures to protect the security of California Resident Class members' personal information drafted by Plaintiffs' counsel and approved by the Court upon completion of the accounting in Paragraph 7.

Table of Contents Page
I. Plaintiffs' Evidence Mandates Urgent Action 1
A. Ameritrade Disclosed Its Accountholders' Email Addresses to Spammers .2
B. Ameritrade Has Been Unable or Unwilling to Explain How It Disclosed Email Addresses to Spammers 3
C. Unauthorized Disclosure of Plaintiff Elvey's Email Address Creates a Likelihood that He Will Prevail on His Claims, Irrespective ofWhether the Disclosure Was Deliberate or Unintentional 4
D. Disclosure ofAccountholders' Personal Information Threatens Irreparable Harm 7
E. Balance of Hardships and Public Interest Favor Relief Sought in Motion ll
F. The Court Should Impose No Bond or a Minimal Bond 13
II. The Preliminary Injunction Sought Is Carefully Tailored to Address the Ongoing Harm to the California Resident Class 14
A. PlaintiffElvey Seeks To Enjoin Disclosure ofAccountholder Email Addresses 14
B. The Injunction Sought Requires Ameritrade to Mitigate the Security Breach...15
C. Ameritrade Should Be Prohibited From Instructing Its Accountholders to Spoliate Evidence 16
III. Plaintiffs Seek Class Certification Under Rule 23(b)(2) and Rule 23(c)(4) to the Extent the Court Deems Class Certification Necessary to Obtain the Preliminary Injunction 18
A. Members of Both Classes Are So Numerous That Joinder Is Impractical .20
B. The General Application of the Ameritrade Policies to Plaintiffs and the Other Members of the Classes Establish Commonality, Typicality, and Class Cohesion .21

Table of Contents Page
C. Class Representatives And Their Counsel Are Adequate to Represent the Classes .23
IV. Conclusion .24

Table of Authorities Federal Cases Page
Armstrong v. Davis, 275 F3d 849 (9th Cir. 2001) .23 Barahona-Gomez v. Reno, 167 F.3d 1228 (9th Cir. 1999) 14 Barnes v. Am. Tobacco Co., 161 F3d 127 (3d Cir. 1998) .22 Blackie v. Barrack, 524 F2d 891 (9th Cir. 1975) .21,22-23,24 Bowman v. Nat 'I Football League, 402 F Supp. 754 (D. Minn. 1975) 18 n.5 Burnham v. Rohnert Park,
No. 92-1439, 1992 US. Dist. LEXIS 8540 (N.D. Cal. May 18, 1992) 3 n.2 Caroline C. v. Johnson, 174 FR.D. 452 (D. Neb. 1996) .22 Cason v. Nissan Motor Acceptance Corp., 212 FR.D. 518 (M.D. Tenn. 2002) .20 n.6 Cent. Wesleyan College v. WR. Grace & Co., 6 F3d 177 (4th Cir. 1993) 19 Cobell v. Norton, 391 F3d 251 (D.C. Cir. 2004) 16 Chamberlan v. Ford Motor Co., 369 F Supp. 2d 1138 (N.D. Cal. 2005) 6 Entm t Scftware Assn 'n v. Fait,
No. 06-431,2006 US. Dist. LEXIS 67290 (M.D. La. Aug. 24, 2006) 18 n.5 Fraser v. Major League Soccer, LLC, 180 FR.D. 178 (D. Mass. 1998) 19 n.6 Flynt Distrib. Co. v. Harvey, 734 F2d 1389 (9th Cir. 1984) 1 n.1 FTCv.AJfordableMedia,LLC, 179F3d 1228 (9thCir. 1999) 15 Gay v. Waiters' & Dairy Lunchmen s Union, 549 F2d 1330 (9th Cir. 1977) .21 Gilder v. PGA lour, Inc., 936 F2d 417 (9th Cir. 1991) 8 Gratz v. Bollinger, 539 US. 244 (2003) .23 n.7 Guckenberger v. Boston Univ., 957 F Supp. 306 (D. Mass. 1997) 19 n.6 Hanlonv. Chrysler Corp., 150F3d 1011 (9thCir.1998) 17,22,23-24 Hicks v. Morgan Stanley & Co.,
No. 01-10071,2003 US. Dist. LEXIS 11972 (S.D.N.Y. July 16,2003) .23 n. 7 Howe v. Varity Corp.,
No. 88-1598, 1989 US. Dist. LEXIS 17521 (S.D. Iowa July 14, 1989) 18 n.5 In re Activision Sec. Litig., 621 F Supp. 415,438 (N.D. Cal. 1985) 19 In re Data Access Systems Sec. Litig., 103 FR.D. 130 (D. N.J. 1984) .24

Table of Authorities Federal Cases Page In re Harford Nuclear Reservation Litig., 292 F3d 1124 (9th Cir. 2002) 19 In re Niles, 106F3d 1456 (9thCir. 1997) 16 In re Rubber Chems. Antitrust Litig., 232 FR.D. 346 (N.D. Cal. 2005) .21 in re WorldCom, inc. Sec. Litig., 219 FR.D. 267 (S.D.N.Y. 2003) .23 n.7 Jordan v. County cfLos Angeles, 669 F2d 1311, 1319 (9th Cir. 1982) .21 Justin v. City cfLos Angeles,
No. 00-12352,2000 US. Dist. LEXIS 17881 (C.D. Cal. Dec. 5,2000) 14 Kleiner v. First Nat 'I Bank, 751 F2d 1193 (11thCir. 1985) 17-18
L.H. v. Schwarzenegger, No. 06-2042,2007 US. Dist. LEXIS 18728 (E.D. Cal. Feb. 28, 2007) .20 Lynch v. Rank, 604 F Supp. 30 (N.D. Cal. 1984) .22 Leon v.ilJX ~Ys. Corp., 464 F3d 951 (9th Cir. 2006) 18 Moeller v. lam Bell Corp., 220 FR.D. 604 (N.D. Cal. 2004) .21 Molski v. Gleich, 318 F3d 937 (9th Cir. 2003) .24 Morgan v. UPS c] Am., 169 FR.D. 349 (E.D. Mo. 1996) 19-20 n.6 Metro Publ 'g, Inc. v. Sutfmet, Inc., No. 02-01833,2002 US. Dist. LEXIS 26232 (N.D. Cal. July 3, 2002) 3 n.2 Nat 'I Ass 'n cfRadiation Survivors v. Walters, III FR.D. 595 (N.D. Cal. 1986) .20 O'Connor v. Boeing North Am., Inc., 180 FR.D. 359 (C.D. Cal. 1997) .23 Pollar v. Judson Steel Corp., No. 82-6833, 1984 US. Dist. LEXIS 19765 (N.D. Cal. Feb. 3, 1984) 17 Premier Nutrition, Inc. v. Organic Food Bar, Inc., 475 F Supp. 2d 995 (C.D. Cal. 2007) 1 n.1 Rent-A-Center, Inc. v. Canyon Television & Appliance Rental, Inc., 944 F2d 597 (9th Cir. 1991) 8-9 Santiago v. Philadelphia, 72 FR.D. 619 (E.D. Pa. 1976) 19 Save Our Sonoran, inc. v. Flowers, 408 F3d 1113 (9th Cir. 2005) 1-2, 14 Schreiber v. NCAA, 167 F.R.D. 169 (D. Kan. 1996) 19 n.6 Smith v. Univ. cfWa. Law Sch., 2 F Supp. 2d 1324 (W.D. Wash. 1998) .23
Soc yfor Individual Rights, Inc. v. Hampton, 528 F2d 905 (9th Cir. 1975) 19 Stollenwerk v. Tri-WestHealthcare Alliance, No. 03-0185,2005 US. Dist. LEXIS 41054 (D. Ariz. Sept. 28, 2005) 10 Sweet v. Ffizer, 232 FR.D. 360 (C.D. Cal. 2005) 21 Univ. cj Iex. v. Camenisch, 451 US. 390 (1981) 1 n.1 Vision Sports, Inc. v. Melville Corp., 888 F2d 609 (9th Cir. 1989) 8 Wakefield v. Monsanto Co., 120 FR.D. 112 (B.D. Mo. 1988) 20 n.6 Walkerv. Pierce, 665 F Supp. 831 (N.D. Cal. 1987) 14 Walters v. Reno, 145 F3d 1032 (9th Cir. 1998) 8, 22 Wang v. Chinese Daily News, Inc., 236 F.R.D. 485 (C.D. Cal. 2006) 17 Washington v. Reno, 35 F3d 1093 (6th Cir. 1994) 18 Weathers v. Peters Realty Corp., 499 F2d 1197 (6th Cir. 1974) 20 n.6

Federal Statutes Page
15 US.C. § 7706 (2007) 17

Federal Rules Page
Fed. R. Civ. P. 23 18-19,21-23 Fed. R. Civ. P. 26 13 Fed. R. Civ. P. 65 1, 13-14

California Cases Page
Balboa Ins. Co. v. Trans Global Equities, 218 Cal. App. 3d 1327,267 Cal. Rptr. 787 (Cal. Ct. App. 1990) 5
Bank c] Am. Nat 'I Trust & Sav. Assoc. v. Ryan, 207 Cal. App. 2d 698, 24 Cal. Rptr. 739 (Cal. Ct. App. 1962) 5-6
Cal. Ass 'n cfDispensing Opticians v. Pearle Vision Ctr., 143 Cal. App. 3d 419, 191 Cal. Rptr. 762 (Cal. Ct. App. 1983) 7-8
Colgan v. Leatherman 1001Group, Inc., 135 Cal. App. 4th 663,38 Cal. Rptr. 3d 36 (Cal. Ct. App. 2006) 5, 15
Comm. on Children s TVv. General Foods Corp., 35 Cal. 3d 197,673 P.2d 660 (1983) 5
Consumer Advocates v. Echostar Satellite Corp., 113 Cal. App. 4th 1351, 8 Cal. Rptr. 3d 22 (Cal. Ct. App. 2003) 5

Table of Authorities California Cases Page Cortez v. Purolator Air Filtration Prods. Co., 23 Cal. 4th 163,999 P.2d 706 (2000) 5, 15 Du.fy v. Cavalier,
215 Cal. App. 3d 1517,264 Cal. Rptr. 740 (Cal. Ct. App. 1989) 5 Estate cfSanders, 40 Cal. 3d 607,710 P.2d 232 (1985) 7 Ferguson v. Friendfinders,
94 Cal. App. 4th 1255, 115 Cal. Rptr. 2d 258 (Cal. Ct. App. 2002) 9 Heckmann v. Ahmanson, 168 Cal. App. 3d 119,214 Cal. Rptr. 177 (Cal. Ct. App. 1985) 16 Herr v. Nestle US.A., Inc.,
109 Cal. App. 4th 779,135 Cal. Rptr. 2d 477 (Cal. Ct. App. 2003) 15 Huong Que, Inc. v. Luu,
150 Cal. App. 4th 400, 58 Cal. Rptr. 3d 527 (Cal. Ct. App. 2007) 6, 15-16 Kosky v. Nike, Inc., 27 Cal. 4th 939, 45 P.3d 243 (2002) 5, 6 Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134,63 P.3d 937 (2003) 15
L. Byron Culver & Assocs. v. Jaoudi indus. & Trading Corp., 1 Cal. App. 4th 300, 1 Cal. Rptr. 2d 680 (Cal. Ct. App. 1991) 7 Maria P v. Riles, 43 Cal. 3d 1281, 743 P.2d 932 (1987) 8
Moore v. Regents cfUniv. (fCal., 51 Cal. 3d 120,271 Cal. Rptr. 146 (1990) 7 Outboard Marine Corp. v. Superior Court,
52 Cal. App. 3d 30, 124 Cal. Rptr. 852 (Cal. Ct. App. 1975) 6
S. Christian Leadership Conference v. Al Malaikah Auditorium Co., 230 Cal. App. 3d 207,281 Cal. Rptr. 216 (Cal. Ct. App. 1991) 8
Stevens v. Marco, 147 Cal. App. 2d 357,305 P.2d 669 (Cal. Ct. App. 1956) 6 Twomey v. Mitchum, Jones & Templeton, Inc.,
262 Cal. App. 2d 690, 69 Cal. Rptr. 222 (Cal. Ct. App. 1968) 5 Other State Cases Page Remsburg v. Docusearch, Inc., 149N.H. 148, 816A.2d 1001 (2003) 10

California Statutes Page
Cal. Civ. Code § 1780 (2007) 15 Cal. Civ. Code § 1782 (2007) .4 Cal. Civ. Code § 1785.11.2 (2007) 11

Table of Authorities

California Statutes Page
3 Cal. Bus. & Prof. Code § 17203 (2007) .4, 15, 16 4 Cal. Bus. & Prof. Code § 17529 (2007) 9

Miscellaneous Page
6 Richard W. Downing, I hinking Ihrough Sentencing in Computer Hacking Cases: Did the US. Sentencing Commission Get it Right", 76 Miss. L.J. 923 (2007) 9-10 7
H.R. Rep. No. 109-522 (2006) 9
ISP Planet, TGp 21 US. ISPs by Subscriber: Q4 2006, at http://www.isp•9 planet.com/research/rankings/usa.html (Apr. 12, 2007) .21
Manual for Complex Litigation § 21.24 (4th ed. 2004) 19
11 S. Rep. No. 108-102 (2003) 8, 12
12 TD AMERITRADE Holding Corp., Form 10-K 31 (Dec. 12,2006), available at http://edgar.sec.gov/Archives/edgar/dataIl173431/0000950137060133451 13 cl054gel0vk.htm .20
14 US. Census Bureau, California Quickbactsfrom the US. Census Bureau, at http://quickfacts.census.gov/qfd/states/06000.html (May 7, 2007) .20
US. Dep't of Justice, Former Cfficer cfInternet Company Sentenced in Case cfMassive 16 Data Theft from Acxiom Corporation, at
http://www.usdoj.gov/criminallcybercrime/levineSent.htm (Feb. 22, 2006) 8 17 US. General Accounting Office, Identity Theft: Prevalence and Cost Appear to be Growing 18 55 (GAO-02-363 2002) 11, 12-13
19 William Shakespeare, The Tragedy of Hamlet, Prince of Denmark, act 1, sc. 4 1
John K. Webb, Prosecuting Social Security Number Misuse: Attacking identity Iheft at its Source, 53 US. Att'ys Bull. 1, 1-2 (Jan. 2005), available at 21 http://www.usdoj.gov/usao/eousa/foiaJeadingJoom/usab5301.pdf l0

PLAINTIFFS' MOTION FOR PRELIMINARY INJUNCTION AND CLASS CERTIFICATION Plaintiffs Matthew Elvey ("Elvey") and Gadgetwiz, Inc. ("Gadgetwiz"), respectfully files this Brief in Support of its Motion for Preliminary Injunction and Class Certification under Federal Rule of Civil Procedure 65. The gist of the allegations in Plaintiffs' First Amended Complaint ("FAC") is that TD AMERTRADE,Inc.("Ameritrade") isdisclosing, eitherdeliberatelyorasaresult ofa security breach, its accountholders' email addresses to spamrners. The FAC states claims for accountholders residing in California ("California Resident Class") and domain name/email service providers for Ameritrade accountholders which received spam because of Ameritrade's disclosure ("CAN SPAM Class"). Plaintiffs' evidence indicates that Ameritrade has disclosed the email addresses of its accountholders, Although Plaintiffs do not have access to evidence which directly shows how the disclosures occurred, the fact that the disclosures occurred at all isevidencethat"[s]omethingisrottenin thestateofDenmark" sufficientto justify Plaintiffs' injunction. William Shakespeare, The Tragedy ofHamlet, Prince of Denmark, act I, sc. 4. 1
I, Plaintiffs' Evidence Mandates Urgent Action The Ninth Circuit has provided two tests for preliminary injunctive relief under Federal Rule 65 . The traditional criteria are I) likelihood of success on the merits, 2) risk of irreparable injury without a preliminary injunction, 3) a balance of hardships favoring the movant, and 4) advancement of the public interest. Save Our Sonoran, Inc. v. Flowers, 408 F3d 1113, 1120 (9th Cir. 2005). Alternatively, the movant may demonstrate "either a combination of probable success on the merits and the possibility of irreparable injury or that

I " A preliminary injunction is customarily granted on the basis of procedures that are less formal and evidence that is less complete than in a trial on the merits. A party thus is not required to prove his case in full at a preliminary-injunction hearing ..." Univ. cf Tex. v Camenisch, 451 U .S. 390, 394-95 (1981) . "The urgency of obtaining a preliminary injunction necessitates a prompt determination and makes it difficult to obtain affidavits from persons who would be competent to testify at trial. The trial court may give even inadmissible evidence some weight. .. " Flynt Distrib. Co. v Harvey, 734F2d 1389, 1394 (9th Cir. 1984) (quoted by Republic cfPhilippines v. Marcos, 862 F2d 1355, 1363 (9th Cir, 1988». See also Premier Nutrition, Inc v Organic Food Bar, Inc , 475 F Supp, 2d 995, 1000 n.l (CD. Cal. 2007) (inadmissible hearsay was evidentiary ground for preliminary injunction).

serious questions are raised and the balance of hardships tips sharply in his favor." Id. (emphasis in original, citations omitted). "These two formulations represent two points on a sliding scale in which the required degree of irreparable harm increases as the probability of success decreases. They are not separate tests but rather outer reaches of a single continuum." Id. This brief establishes that Elvey is likely to succeed on his claims, that there is a risk of irreparable harm without the sought preliminary injunction, that the absence of the requested relief prejudices Elvey and the California Resident Class worse than the relief will prejudice Ameritrade, and that the public interest favors the injunctive relief sought.

A. Ameritrade Disclosed Its Accountholders' Email Addresses to Spammers It is apparent that Ameritrade has disclosed its accountholders' email addresses to spamrners. Elvey and one of Gadgetwiz user's, Joel Griffiths ("Griffiths"), are accountholders at Arneritrade. (El vey Decl ~ I; Griffiths Decl. ~ 1.) Elvey and Griffiths provided a series of email addresses to Ameritrade, and subsequently received spam at these email addresses. (Elvey Decl. ~~ 2, 3; Griffiths Dec!. ~~ 2, 3.) These spam are exclusively stock spam (authenticated, redacted copies are attached as Exhibits A and B): the spam encourages its recipients to purchased the stock oftouted companies. Elvey and Griffiths should not have received this spam. The persons who sent the spam could have only obtained their email addresses from Elvey and Griffiths, or Ameritrade, and neither Elvey nor Griffiths disclosed these email addresses any person other than Ameritrade (except their counsel). (Elvey Decl, ~ 2; Griffiths Decl. ~ 2.) However, as discussed below, the disclosure ofElvey and Griffiths' email addresses by Ameritrade violates the February 2007 Privacy Statement published at Ameritrade's website (attached as Exhibit C) which purports to be the authoritative statement on Ameritrade's practices with respect to accountholders' personal information. Elvey and Griffiths' situation is not unique. On May 30, Plaintiffs' counsel found an article (a copy of which is attached as Exhibit D) on Slashdot (a prominent online forum for technology and technology policy news) indicating that many other Ameritrade accountholders had received spam at unique emails provided only to Arneritrade (Ex. D 1-3, 6, II, 19-20.) See Slashdot, Who:S Trading Your E-mail Addresses", at http ://yro.slashdot.org/yro/07/05/30/1444236.shtml (May 30, 2007). Subsequently, Plaintiffs' counsel's performed several Internet searches which located other reported accounts (copies of which are attached as Exhibits E, F and G) which are consistent with Elvey and Griffiths' declarations. See Bill Katz, ID Ameritrade data definitely compromised, at http://wwwbillkatz.comlnodeI77 (last modified May 31, 2007), news .admin.nct-abuse.ernail, Ameritrade Spam Again , at http ://groups.google.com.fj/group/news.admin.net•abuse.email/browse_thread/thread/de64222d0929c6b4/a402bc49558f7330 (July 28, 2006), and NetworkWorld, Ameritradeleaks andmore Wi-Fi theft, at http ://wwwnetworkworld.com/columnistsI2007/053107-backspin.html(May31 .2007).As more accountholders report disclosing unique email addresses to Ameritrade and receiving spam at those email addresses, the probability that Ameritrade is not responsible for the disclosure of these email addresses approaches zero. At this point, it is extremely implausible that spammers independently obtained each of the email addresses involved in the public reports described above.'

B. Ameritrade Has Been Unable or Unwilling to Explain How It Disclosed Email Addresses to Spammers
The only remaining alternative is that Ameritrade has disclosed the email addresses of
Elvey, Griffiths, and the other Ameritrade accountholders Ameritrade's communications
buttress this conclusion. The Slashdot article links to a forwarded email (a copy of which is
attached as Exhibit II) from Ameritrade responding to an accountholder's inquiry about spam
and indicates that response was identical to Ameritrade's response the Slashdot author's own
inquiry (Ex. D 2.) Ameritrade's response to accountholder inquiries regarding spam states:
We understand your concern and frustration over the spam e-mail you 've received, and we want you to know that we take your privacy and security seriously. We will continue to do all we can to protect both . Our investigation into this issue is ongoing We've recently expanded the directions in which 01833,2002 U.S. Dist. LEXIS 26232, at *10-11 & n.4 (N.D. Cal. July 3, 2002) (preliminary injunction based on declarations, overruled admissibility objections); Burnham v Rohnert Park, No. 92-1439, 1992 U.S. Dist. LEXIS 8540, at *2 n.z (N.D. Cal. May 18, 1992) (preliminary injunction based on declaration, overruled objections to hearsay, incompetence, or opinion) we'reinvestigating, andhave duubledourtjjurtsinbothinternalandexternal investigations. We're looking at our own systems, and working closely with our vendors to examine theirs. ...

(Ex. H 1) (emphasis added). Ameritrade has acknowledged that it is conducting an ongoing investigation into the possibility of a information security breach. Such an investigation would necessarily consider both rogue insiders (such as employees or partner firms), as well as outside intruders.

Collectively, the evidence available to Plaintiffs strongly suggests that Ameritrade is unable to control or prevent the disclosure of accountholder email addresses. The alternative is that Ameritrade has deliberately and willfully disclosed email addresses. While Plaintiffs cannot discount this explanation without discovery, Plaintiffs and their counsel are operating
lIon the assumption that there is an ongoing, systematic security breach at Ameritrade.

c. Unauthorized Disclosure of Plaintiff Elvey's Email Address Creates a Likelihood that He Will Prevail on His Claims, Irrespective of Whether the Disclosure Was Deliberate or Unintentional
Elvey is likely to prevail on his claims under California's Consumer Legal Remedies
Act ("CLRA") (Cal. Civ. Code § 1782(a» and Unfair Competition Law ("UCL") (Cal. Bus. &
Prof. Code § 17203), and for breach of fiduciary duty.
The disclosure of accountholder email addresses violates the Privacy Statement
published at Ameritrade's website. The Privacy Statement states "TD AMERITRADE does
not sell, license, lease or otherwise disclose your personal information to any third party for
any reason" subject to certain exceptions not applicable here.' (Ex. C. 3.) This statement is not
consistent with an ongoing security breach at Ameritrade in which third parties regularly
obtain accountholders' email addresses, and such a security breach renders the Privacy
3 The Privacy Statement indicates that Ameritrade may share personal information "with affiliates if the information is required to provide the product or service [accountholders] have requested or to provide [accountholders] the opportunity to participate in the products or services our affiliates offer." (Ex. C. 2) Also, the Privacy Statement also indicates that Ameritrade may share information in "partnerships and alliances, which may include joint marketing agreements, with other companies who offer high-quality products and services that might be of value to our clients" in order "to ensure that these products and services meet [accountholders'] needs and are delivered in a manner that is useful and relevant." (ld. 2.) WithrespectAmeritrade'saffiliates,alliancesandpartners,thePrivacy Statementindicates that Ameritrade "require[s] that it be identified that an offer is being extended because ofthe relationship with us." (ld. 2-3.) The spam does not indicate that the spammers have a relationship with Ameritrade. ((1 Exs. A, B.)

Statement false and misleading.
As the representations in the Privacy Statement are false and misleading, they are a sufficient basis for Elvey's CLRA and DCL claims, irrespective of whether it was unintentional, inadvertent, or deliberate. Elveys claim under the DCL only requires "that members of the public are likely to be deceived " Kasky v. Nike, Inc., 27 Cal. 4th 939, 951, 45 P.3d 243,250 (2002) (citations omitted). "The DCL imposes strict liability [on] conduct that constitutes an unfair business practice." Cortez v. Purolator Air Filtration Prods. Co., 23 Cal. 4th 163,181,999 P2d706,717(2000)."Allegations ofactualdeception,reasonablereliance, and damage are unnecessary" for DCL claims. Comm. on Children 's TV v. General Foods Corp., 35 Cal. 3d 197,211,673 P2d 660, 668 (1983). The liability standard applicable to DCL claims also applies to claims under the CLRA. Consumer Advocates v. Echostar Satellite Corp. , 113 Cal. App. 4th 1351, 1360,8 Cal. Rptr. 3d 22, 29 (Cal. Ct. App . 2003) (cited by Colgan v. Leatherman 'lool Group, Inc., 135 Cal. App . 4th 663, 680, 38 Cal. Rptr. 3d 36,46 (Cal. Ct. App. 2006» . "Conduct that is 'likely to mislead a reasonable consumer' thus violates the CLRA" Colgan , 135 Cal. App. 4th at 680,38 Cal. Rptr, 3d at 46.
Ameritrade is liable for disclosing the California Class members' email addresses even without regard to the Privacy Statement. As a stock broker, Ameritrade is a fiduciary of its accountholders. Dl~fy v. Cavalier, 215 Cal. App. 3d 1517, 1534-35,751-52 (Cal. Ct. App. 1989) (cited by Rosenthal v Great W Fin Sec Corp., 14 Cal. 4th 394, 425-26, 926 P2d 1061 , 1080 (1996) ); Twomey v. Mitchum, Jones & Templeton. Inc., 262 Cal. App . 2d 690, 708-09, 69 Cal. Rptr. 222,235-36 (Cal. Ct. App. 1968). One ofAmeritrade's fiduciary duties is to "not to use or communicate confidential information of the principal for the agent's own purposes or those ofa third party" Huong Que, Inc. v. Luu, ISO Cal. App. 4th 400, 416 , 58 Cal. Rptr. 3d 527,540 (Cal. Ct. App. 2007) (quoting Restatement ofAgency (Third) § 8.05 (2006» . See also Balboa Ins. Co. v. Trans Global Equities, 218 Cal. App . 3d 1327 , 1344 & n.20 , 267 Cal. Rptr. 787, 797 & n.20 (Cal. Ct. App. 1990) (elements of breach of confidence); Bank cf Am. Nat'l Trust & Sav. Assoc. v. Ryan, 207 Cal. App. 2d 698, 706, 24 Cal. Rptr. 739, 744 (Cal. Ct. App. 1962) (fiduciary "who acquires confidential information in the course of his employment ... has a duty not to use it to the disadvantage of the principal"); Stevens v. Marco, 147 Cal. App. 2d 357, 372-74, 305 P.2d 669, 678-79 (Cal. Ct. App. 1956) (breach offiduciary duty by disclosure of confidential information).
Likewise, the Privacy Statement represents that:

All third parties with which we share personal information are required to protect personal information in a manner similar to the way we protect personal information... We have made a significant investment in leading-edge security software, systems, and procedures to offer you a safe and secure tradi ng environment and protect your personal, financial and trading information. While no security system is absolutely impenetrable, we are constantly reviewing, refining and upgrading our security technology, as new tools become available.
(Ex. A 3-4.) These statements are misleading inasmuch as the Privacy Statement omits mentionofAmeritrade's investigationinto thepossibility ofanongoingsecuritybreach.The VCL and CLRA prohibit misleading omissions of material facts , not just affirmative misrepresentations. Kasky , 27 Cal. 4th at 951 , 45 P3d at 250 (VCL prohibits representations which "although true, is either actually misleading or which has a capacity, likelihood or tendency to deceive or confuse the public"); Outboard Marine Corp v Superior Court, 52 Cal. App. 3d 30,38,124 Cal. Rptr. 852,857 (Cal. Ct. App. 1975) (CLRAprohibits omission of material facts, cited by Bardin v. DaimlerChrysler Corp., 136 Cal. App. 4th 1255,1276,39 Cal. Rptr. 3d 634 , 648 (Cal. Ct: App. 2006». See a/so Chamber/an v. Ford Motor Co., 369 F. Supp. 2d 1138, 1144-46 (N.D. Cal. 2005) (omitted disclosure of defects in non-metal manifolds could violate VCL, CLRA).

Finally, Ameritrade's receipt of personal information from accountho1ders violates its fiduciary duties to its accountholders, inasmuch as1) it is even now investigating the possibility of an ongoing security breach and 2) the Privacy Statement fails to disclose either the investigation or the possible security breach. Ameritradc's fiduciary duties include
full disclosure of all material facts within [its] knowledge relating to the transaction in question and any concealment of material facts [by a fiduciary] is a fraud .. .. Where there is [such] a duty to disclose, the disclosure must be full and complete, and any material concealment or misrepresentation will amount to fraud sufficient to entitle the party injured thereby to an action.
Estate cfSanders, 40 Cal. 3d 607,616,710 P2d 232, 237 (1985) (citations, punctuation omitted). "An agent has a fiduciary duty to the principal to disclose all information in the agent's possession relevant to the subject matter ofthe agency." L. Byron Culver & Assocs. v. Jaoudi Indus. & Irading Corp ., 1 Cal. App. 4th 300, 304, 1 Cal. Rptr. 2d 680, 682 (Cal. Ct. App. 1991) (citing Sierra Pac. Indus. v. Carter, 104 Cal. App. 3d 579, 581-83,163 Cal. Rptr. 764,766 (Cal. Ct. App. 1980». See also Moore v. Regents ofUniv. cfCal., 51 Cal. 3d 120,
129,271 Cal. Rptr. 146,150 (1990) (fiduciary has "duty to disclose all information material to the patient's decision," citing, e.g., Nelson v (Jaunt, 125 Cal. App. 3d 623 , 634, 178 Cal. Rptr.
167,172 (Cal. Ct. App. 1981».

Elvey and the California Resident Class are also entitled to disclosure of all material facts on the purchase of stocks that Ameritrade knows have been touted by spam. The fact that spammers are seeking to inflate the value of stock is material to the accountholders' decision to purchase the stock, and Ameritrade plainly has a duty to disclose such material facts. It is important to remember that Ameritrade earns commissions on trades induced by this stock
The misleading statements and omissions in the Privacy Statement (and the material omission that spammers have manipulated particular spammed stocks) are sufficient basis to conclude that Elvey will prevail in his claims.

D. Disclosure of Accountholders' Personal Information Threatens Irreparable Harm
As a matter of California law, Ameritrade's continued violation of the CLRA and VCL -by disclosing email addresses to spammers, failing to disclosing its investigation or the possible security breach. or manipulation of stock value by spammers -constitutes irreparable harm. "[Pjlaintiffs are not required to wait until they have suffered actual harm before they apply for an injunction, but may seek injunctive relief against the threatened infringement of their rights." Maria J>. v Hiles, 43 Cal. 3d 1281, 1292-93,743 P2d 932, 938 (1987); S Christian Leadership Conf erence v. Al Malaikah Auditorium Co., 230 Cal. App. 3d 207, 224, 281 Cal. Rptr. 216 , 227 (Cal. Ct. App. 1991) Further, a presumption of irreparable injury applies when there is a "substantial showing of prospective violation of California statutes"
such as the VCL and CLRA. Cal. Ass'n cfDispensing Opticians v. Pearle Vision Ctr., 143 Cal. App. 3d 419, 434,191 Cal. Rptr. 762,772 (Cal. Ct. App . 1983) . See also Vision Sports, Inc. v. Melville Corp., 888 F.2d 609 ,612 n.3 (9th Cir. 1989) (in unfair competition actions, "once the plaintiff establishes a likelihood of confusion, it is ordinarily presumed that the plaintiff will suffer irreparable harm if injunctive reliefis not granted").

Plaintiffs do not rely solely on formulaic points oflaw. When email addresses are leaked to spammers, the damage is irreparable: once accountholders ' email addresses are known to spammers, those email addresses will never again be spam-free. Moreover, in most situations, accountholders will not be able successfully identify the spammers -let alone successfully claim damages from them in a lawsuit. S. Rep. No. 108-102, at 5 (2003) (Congressionaltestimonythat90percent ofallofthe spam sentworldwideis"untraceable" to its actual source). See also US. Dep't ofJustice, Former Officer cflnternet Company Sentenced in Case cfMassive Data Iheft frum Acxium Corporation, al http://www.usdcjgov/criminallcybercrimellevineSent.htm (Feb. 22, 2006) (defendant stole more than one billion records containing names, physical and e-mail addresses, as well as phone numbers from data broker, and resold some data to another broker for use in an ad campaign)." Thus, most accountholders will be unable trace particular spam back to Ameritrade's disclosure oftheir email address, and hence unable to calculate their damages from Ameritrade's disclosure. Where"[tjhereis noway tocalculatethe value of'ofthe movant's damages, a movant for preliminary injunction has no adequate legal remedies and irreparable harm exists. Walters v Reno, 145 F.3d 1032, 1048 (9th Cir. 1998). "[Wjhere the threat of injury is imminent and the measure of that injury defies calculation, damages will not provide a remedy at law" Gilder v. PGA Tow; Inc., 936 F.2d 417, 423 (9th Cir. 1991) See also Rent-AiCentcr, Inc. v. Canyon Television & Appliance Rental, Inc., 944 F.2d 597, 603 (9th Cir. 1991) (where "damages would be difficult to valuate," they "constituted possible irreparable harm". 4 Wesipac Audiotext, Inc. v. Wilks, 756 F. Supp. 1267, 1268-69 (ND Cal. 1991), vacated on other grounds, 804 F. Supp. 1225 (N.D. Cal. 1992) (under loosened evidentiary standards applicable in preliminary injunction, legislative history was evidentiary grounds for preliminary injunction).

. This is especially true where much of the damages from spam are non•economic. Cal. Bus. & Prof Code § I7529(e) (2007) ("spam ... discourages people from using e-mail..);Fergusonv.Frienofinders. 94 Cal. App 4th 1255 , 1267, lIS Cal. Rptr, 2d 258, 267 (Cal. Ct. App 2002) (spam consumes the time of recipients "required to sort, read, discard and attempt to prevent future" spam).
More critically, however, Ameritrade collects not only email addresses from accountholders, but other, more sensitive personal information. It unlikely that Ameritrade failed to protect accountholders' email addresses from disclosure but managed to protect their names and Social Security numbers. Certainly, Ameritrade has not offered any evidence to Plaintiffs to support this inference. Consequently, an ongoing security breach at Ameritrade threatens accountholders with a much more grave irreparable harm than spam -the risk of identity theft. Like email addresses, Social Security numbers can be traded and retraded among identity thieves once they are disclosed:
[O]rganized criminals have increasingly turned to computer crime to engage in identity theft and financial fraud ... . The criminal organizations traffic this information through underground websites on the Internet, creating a black market in cyberspace for stolen personal and finan cial information. Some of these identity thieves advertise that they have access to literally millions of stolen credit card and bank records for sale.. .. A year-long Secret Service investigation of the "Shadowcrew" organization led to the indictment of27
U.S. and foreign persons involved in an organized identity theft and financial fraud ring According to government estimates, the members of the Shadowcrew organization trafficked in at least 1.5 million stolen credit and bank card numbers, and caused an estimated $40 million in losses. A recent investigation by US. and UK authorities ofthe website "carderplanet.net" revealed that the site boasted nearly 7,000 members and served as a marketplace for millions of stolen bank and credit card accounts.

HK Rep.No. 109-522,at 5-6 (2006).Wherean"intrudercopiesdigital information"the
privacy invasion may be the "most salient harm"; "where a hacker sells identity information
on the black market. . ..the severity ofthe harm increases dramatically" See Richard W
Downing, Thinking Through Sentencing in Computer Hacking Cases: Did the US Sentencing
Commission Getlt Right", 76Miss.L.J. 923 ,937-38(2007)(citingUS.Dep'tofJustice, Six
Defendants Plead Guilty in Internet Identity 1heft and Credit Card Fraud Conspiracy, at
http://wwwcybercrime.gov/mantovaniPlea.htm (Nov. 17,2005), which describes an black
market for misappropriated identity documents, credit and bank card numbers, and email addresses). The threat of identity theft is so prevalent and foreseeable that at least one court has imposed a duty of care on data brokers which disclose personal information to clients. Remsburg v. Docusearch, Inc., 149 N.H. 148, 153-55,816 A2d 1001, 1006-08 (2003). Social Security numbers are vastly more difficult to change than email addresses, and the potential costs of misappropriation of Social Security number are correspondingly greater:
The extent of the threat to individual privacy is readily apparent when considering that the SSN is used as an identification code that brings individuals into contact for everyday communication with databases containing a wide range offinancial, medical, educational, and credit information. Once obtained by an identity thief, the SSN opens practically every door related to a person's identity and personal history and completely compromises an individual's personal privacy.... Identity theft occurs when an individual steals another individual's personal identifying information and uses it fraudulently.

It i c ~ cr-im e that r-an ~ffp.(".t:::lll Ameri canc ~<;;:N~ :::Inn other rter-crvn al i nformati on ,
for PY:::Imnl p ~UP lIl;;.pn to Fr-aurlul errtl v nht:::lln credit r-a rrlc nnpn rrtili tv ::!r.(,:()lIntl>:., access existing financial accounts, commit bank fraud, file false tax returns, and falsely obtain employment and government benefits. The SSN plays an important role in identity theft because it is used as breeder information to create additional false identification documents ... John K Webb , Prosecuting Social Security Number Misuse: Attacking Identity Theft at its Source , 53US.Att'ysBull. 1,1-2(Jan.2005), available at http://wwwusdcj.gov/usao/eousa/foiaJeadingJoomiusab5301.pdf Again,itwill typically be impossible for accountholders to trace any particular instance of identity theft back to Ameritrade's disclosure oftheir personal information, and therefore their legal remedy is inadequate because they will generally not be able to calculate their damages. Stollenwerk v. 7ri-West Healthcare Alliance, No. 03-0185 ,2005 US. Dist. LEXIS 41054, at *15-21 (D. Ariz. Sept. 28, 2005) (evidence of six instances of identity theft against plaintiff beginning six weeks after defendant suffered security breach was not sufficient to survive motion for summary judgment). Indeed, someone used Elvey's name and Social Security number to open a cellular phone account and incurred $2,500 in charges in 2006. (Elvey Decl ~ 4.) Elvey has no adequate legal remedy for this claim, because he has no way to prove that his information was obtained from Ameritrade, (Id.) Like spam , identity theft imposes significant non•monetary damages on its victims, including denial of credit or other financial services, time lost to resolve the problems, harassment by creditors, and even criminal investigation, arrest, or conviction. U.S. General Accounting Office, Identity Theft: Prevalence and Cost Appear to be Growing 55 (GAO-02-363 2002). Further, other members of the California Resident Class may be victims of identity theft due to personal information obtained from Ameritrade -but not even know it. Plainly, these accountholders cannot have an adequate legal remedy if they do not even know their claim exists.

Where accountholders' legal claims with respect to Ameritrade's disclosure of email addresses or other personal information face insurmountable barriers, those legal claims are inadequate -and the accountholders face irreparable harm. Consequently, it is critical that Ameritrade act to protect accountholders -by disclosing its internal investigation and the possibility of a security breach, providing an accounting of California Resident Class members' personal information and implementing reasonable security measures (or sequestering that information). The disclosure of the possible security breach is imperative because it will give California Resident Class members the opportunity to place a security freeze on their credit report -which will hamper any efforts at identity theft. See Cal. Civ. Code § 1785.11.2 (2007) (identity freeze legislation). Further, accountholders who purchase spammed stocks also face irreparable harm, because they will generally be unable to calculate the damage caused by Ameritrade's failure to disclose that particular stocks were manipulated by spammers.

E. Balance of Hardships and Public Interest Favor Relief Sought in Motion The balance ofhardships between Ameritrade, and Plaintiffs, the California Class Members and the public interest, tips sharply in favor of the injunction. Ameritrade should not be heard to complain of the costs of either complying with its Privacy Statement or amending the Privacy Statement so that it is not misleading, and the relief sought in the Motion imposes few out-of-pocket costs on Ameritrade. Ceasing any voluntary disclosure of accountholder email addresses will not burden Ameritrade at all. Ameritrades out-of-pocket costs for disclosing its investigation into a possible ongoing security breach, or alerting accountholders who try to purchase stock that is being manipulated by spam, are negligible. Ameritrade's own internal investigation should subsume the costs involved in setting up token email addresses to detect stock spam sent to its accountholders, and many or most ofthe costs associated with providing an accounting of the California Resident Class members ' personal information and Ameritrades information systems.
Conversely, many parties, not just accountholders, face potentially grave burdens ifthe injunction does not issue. Without the injunction, it is plain that Ameritrade will continue to contribute (whether intentionally or not) to the societal problems spam imposes.

Spam imposes significant economic burdens on ISPs , consumers, and businesses.Left uncheckedatitspresentrate ofincrease,spam maysoon undermine the usefulness and efficiency of e-mail as a communications tool. Massive volumes of spam can clog a computer network, slowing Internet service for those who share that network. ISPs must respond to rising volumes of spam by investing in new equipment to increase capacity and customer service personnel to deal with increased subscriber complaints. ISPs also face high costs maintaining e-mail filtering systems and other antispam technology on their networks to reduce the deluge of spam. Increasingly, ISPs are also undertaking extensive investigative and legal efforts to track down and prosecute those who send the most spam , in some cases spending over a million dollars to find and sue a single, heavy-volume spamrner, S. Rep . No . 108.102, at 6. The Senate report cites two studies: one estimated that spam costs Internet subscribers worldwide $94 billion annually, and the other estimated that anti-spam efforts increase the cost of an individual 's Internet access service by an average of $2 per month .1d. Still another study cited by the Senate report estimated that spam cost Ll.S, businesses over $10 billion in 2003 from lost productivity, network system upgrades, unrecoverable data, and increased personnel costs, and that the employee productivity losses from sifting through and deleting spam accounted for nearly $4 billion alone. ld. at 7.

IfAmeritrade has disclosed personal information besides email addresses, the potential burdens imposed by the lack of an injunction become still more grave. One detailed study indicates that the average identity theft victim estimated he or she spent 175 hours and $100 in costs on resolving their identity theft-related problems , and suffered a loss of$808 U.S. General Accounting Office, Identity Theft: Prevalence and Cost Appear to be Growing 60-61. Identity theft imposes a high cost on the rest of society, as well. The majority of bank respondents to a American Bankers Association survey regarded identity theft as one of the top three threats against deposit accounts and spend significant sums of money to prevent identity theft-related fraud. ld. at 41-42,46-47. The Secret Service estimated its average cost for investigating an incident of identity theft was $15,000.ld at 65. The Executive Office for Ll.S. Attorneys estimated the average cost of prosecuting white-collar criminals was $11,443. Id. at 66. Plainly, identity theft imposes high costs on our financial institutions and our justice system, and the public interest favors the mitigation of identity theft to the greatest extent possible.

Nonetheless, this Motion presents an unusual set of equities to the Court. Ameritrades counsel has stated to Plaintiffs' counsel that Ameritrade is investigating these matters, and has asserted that this investigation might be prejudiced ifit were disclosed publicly Although counsel held several phone conferences that have been largely productive, Ameritrade has not yet provide adequate evidence to support this assertion. Elvey cannot simply take Ameritrade at its word and delay until Ameritrade deems its investigation complete (especially where Ameritrade has already publicly disclosed the fact of the internal investigation) (See Exs. D, E, F, G, and I.) As it stands, the parties have not been able to complete a Rule 26(f) conference, and so Plaintiffs have not propounded any discovery to test Arneritrade's claims. See Fed. R. Civ. P. 26(d). However, Elvey and the other California Resident Class members have as much interest in Ameritradc 's investigation concluding successfully as Ameritrade itself, and Elvey does not dispute that Ameritrade may yet present persuasive evidence that its investigation (or certain aspects of the investigation) require or will benefit from a degree of confidentiality. Elvey and his counsel have repeatedly indicated they would enter into an appropriate confidentiality agreement ifAmeritrade presented such evidence (as related in an email to Ameritrade's counsel, attached as Exhibit 1) (Ex I I.) Ultimately. Plaintiffs may alter or narrow the remedies sought in the Motion as Ameritrade produces more information in its response.

F. The Court Should Impose No Bond or a Minimal Bond Federal Rule of Civil Procedure 65(c) requires that a movant for a preliminary
injunction give "security . .. in such sum as the court deems proper" before any preliminary injunction issues. Fed. R. Civil P. 65(c). Rule 65(c) "invest]s] the district court with discretion as to the amount of security required, if any." Barahona-Gomez v. Reno, 167 F.3d 1228, 1237 (9th Cir. 1999) (citing three other circuit court cases); Justin v. City cfLos Angeles, No. 00•
12352,2000U.S.Dist. LEXIS17881,at*6-7 (CD.Cal. Dec.5,2000)(bondsunderRule 65(c) have "been dispensed with entirely where there was no proof oflikelihood of harm to the party enjoined"). Consequently, the Ninth Circuit boasts "long-standing precedent that requiring nominal bonds is perfectly proper in public interest litigation." Save Our Sonoran, 408 F.3d at 1126. See also Walker v. Pierce, 665 F. Supp. 831,843-44 (N.D. Cal. 1987) (waiving bond requirement for class representative). Elvey's status as class representative, his inability to absorb the expenses of a massive commercial empire like Ameritrade, and the publicinterestfeatures ofthe reliefsoughtall weighinfavor ofa minimal bond,ornobondat all. (C/ Elvey Decl ~ 5) (Elvey cannot afford a bond over $1,000) with Barahona-Gomez, 167 F.3d at 1237 (affirming district court's discretion to require only nominal bond of$I,OOO); Justin, 2000 U.S. Dist. LEXIS 17881 , at *38 (where injunction on constitutional claim "posejd] no risk ofpecuniary injury ... from being restrained and enjoined," class representative exempted from bond).

II. The Preliminary Injunction Sought Is Carefully Tailored to Address the Ongoing Harm to the California Resident Class Elvey seeks for himself and the California Resident Class a preliminary injunction that addresses the harms arising from the disclosure of email addresses and potential security breach. The injunction accounts for two alternative possibilities: that the disclosure of email
addresses is deliberate, or that the disclosure of email addresses is unintentional and is the result of a security breach at Ameritrade.

A. Plaintiff Elvey Seeks To Enjoin Disclosure of Accountholder Email Addresses The Motion seeks an injunction prohibiting Ameritrade from disclosing its accountholders' personal information in a manner inconsistent with its Privacy Statement. Although the deliberate disclosure of accountholder email addresses would be reprehensible,
remedying it is a simple matter. Injunctive relief under Elvey's CLRA and UCL claims is a statutory matter. CaL Civ, Code § I780(a)(2) (2007) (relief available under CLRA includes "order enjoining the methods, acts, or practices" violative ofthe CLRA); Cal. Bus. & Prof Code 17203 (2007) (authority to enjoin persons engaged in unfair competition). Prohibiting Ameritrade from violating its Privacy Statement certainly falls within the DCL's broad authorization "to prevent, deter, and compensate for unfair business practices." Cortez , 23 Cal. 4th at 176, 23 Cal. 4th at 176. See also Korea Supply Co. v. Lockheed Martin Corp., 29 CaL 4th 1134, 1146-1148, 63 P3d 937, 945-947 (2003) (statutory analysis suggests that "deterrence of unfair practices" was " au important goal" of DCL); Herr v. Nestle U.SA., Inc., 109 Cal. App 4th 779, 135 Cal. Rptr. 2d 477 (CaL Ct. App. 2003) (injunction under DCL prohibiting age discrimination as unfair competition)

Any inability to stop the disclosure of email addresses purported by Ameritrade does not militate against Elvey's injunctive relief "A party's inability to comply with ajudicial order constitutes a defense to a charge of civil contempt." FTC v A.Jordable Media , LLC , 179 F3d 1228, 1239 (9th Cir. 1999) (citing United States v Rylander, 460 US. 752, 757 (1983» IfAmeritrade claims it is unable to stop the disclosure, it bears the burden of proving "categorically and in detail" that is the case. ld. at 1241. Arneritrade's proofthat it is unable to stop the disclosure would have the important judicial economy of definitively establishing whether or not there is a security breach or not -although remedying a security breach is far more problematic than remedying the voluntary disclosure of email addresses.

B. The Injunction Sought Requires Ameritrade to Mitigate the Security Breach
California law also authorizes the injunction remedies which are aimed at addressing a security breach (requiring the disclosure ofAmeritrade's internal investigation, and the possibility of a security breach, and notification when accountholders try to purchase stocks known to Ameritrade to have been touted by spammers). California courts recognize that the CLRA authorizes mandatory corrective disclosures. Colgan, 135 Cal. App 4th at 672-73, 677-78,38 Cal. Rptr, 3d at 41,44-45 (affirming injunction requiring corrective advertising).

Also, Elvey seeks an accounting of the California Resident Class members' personal information and Ameritrade's information systems as an equitable remedy for his breach of fiduciary duty claim. Equitable remedies for breach of fiduciary duty are available as a preliminary injunction. Huang Que, Inc., 150 Cal. App, 4th at 400-19,58 Cal. Rptr. 3d at 527•42 (preliminary injunction to prohibit competition on breach ofloyalty claim); Heckmann v. Ahmanson, 168 Cal. App 3d 119, 135-38,214 Cal. Rptr, 177, 188-90 (CaL Ct. App, 1985) (granting constructive trust as preliminary injunction). Where a breach of fiduciary duty is established, "the burden then shifts to the fiduciary to render an accounting." In re Niles, 106 F3d 1456, 1461 (9th Cir. 1997) (citing Paramount Mfg Co. v. Mohan, 196 Cal. App 2d 372,
16 CaL Rptr. 417,421 (CaL Ct. App 1961». An accounting requires Ameritrade to prove that it has performed its duties (including its duty of confidentiality) properly
the action for account render compels the fiduciary to explain the books under oath.. .. the fiduciary was under a duty to render an account that should show in detail the items expended and show when, to whom, and for what purposes the payments were made so the beneficiaries can make a reasonable test ofthe accuracy of the accounts. The accounts should be clear and accurate and ifthey are not, all presumptions are against the trustee and all obscurities and doubts are to be taken adversely to him.

ld. at 1461 n.4 (citations, punctuation omitted). The common law evolves in step with the advance of technology and society; the scope of an accounting now encompasses information held by the fiduciary and the fiduciary 's information technology systems. See Cabell v Norton, 391 F3d 251 ,254-56 (D.C. Cir 2004) (recounting breach of fiduciary duty claim against Department ofInterior and accounting remedy against information technology insecurities). See also CaL Bus. & Prof Code § 17203 (2007) (providing for appointment of receiver). Here, Elvey seeks an accounting ofAmeritrade's accounting of the personal information of California Resident Class members held by Ameritrade and the information technology systems on which Ameritrade stores such information.

c. Ameritrade Should Be Prohibited From Instructing Its Accountholders to Spoliate Evidence
Plaintiffs seek a court order prohibiting Ameritrade from directing its accountholders to delete stock spam received at the email addresses provided to Arneritrade. Ameritrade's response to customer inquiries regarding such spam directs accountholders to " [pjlease be sure to delete any spam you might receive, then empty your e-mail's trash so that it's no longer kept there, either." (Ex. HI) Such spam may be critical to proving CAN SPAM Class members damages. CAN SPAM Class members' claim for damages under the CAN SPAM Act provides for statutory damages calculated by ul message that is transmitted ... over the facilities of the provider ofInternet access service, or that is transmitted or attempted to be transmitted to an electronic mail address obtained from the provider of Internet access service in violationofsection 7704(b)(I)(A)(i) ofthis title, treated as a separateviolation) 15 U.S.C. § 7706(g)(3)(A) (2007). Plainly, the elimination of evidence that such spam were transmitted to the CAN SPAM Class members' users will diminish their recovery. Ameritrade has indicated through counsel that it has stopped advising customers to discard the spam and instead simply asked the customer to send a copy of the spam to Ameritrade. While this assurance partly addresses Plaintiffs' concerns, Plaintiffs and their counsel would be remiss in their duties to the CAN SPAM Class ifthey settled for an unsworn representation by counsel who does not have personal knowledge of the matter.

The Court has the power to prevent Ameritrade from spoliating evidence proving the CAN SPAM Class's damages. Rule 23(d) vests the Court "with the authority and discretion to protect the interests and rights of class members ... A district court has both the duty and the broad authority to exercise control over a class action and to enter appropriate orders governing the conduct of counsel and parties." Hanlon v. Chrysler COlp., 150 F.3d 1011, 1025 (9th Cir. 1998) (quoting Gu,jOil Co. v. Bernard, 452 U.S. 89, 100 (1981), punctuation omitted). The Court's authority and discretion extends to prohibiting misleading or prejudicial communications by defendants. Wang v. Chinese Daily News, Inc., 236 F.R.D. 485, 487-89
(C.D. Cal. 2006) (invalidating class member opt-outs under Rule 23(d) where the court found "that the opt outs were procured through fraud, duress, or other improper conduct" by defendant). See also Foliar v. Judson Steel Corp., No. 82-6833, 1984 U.S. Dist. LEXIS 19765
(N.D. Cal. Feb. 3, 1984). Courts have recognized that "it is obviously in defendants' interest
to diminish the size of the class and thus the range of potential liability by soliciting exclusion
requests." Id. at 488 (citingKleinerv. First Nat 'I Bank, 751 F.2d 1193,1202 (lIth Cir. 1985)).

Likewise, it is plainly in defendants' interest to eliminate evidence that supports class members' claims for damages. "Such conduct reduces the effectiveness of the 23(b)(3) class action for no reason except to undermine the purposes of the rule." Kleiner, 751 F.2d at 1202. "Unsupervised, unilateral communications with the plaintiff class sabotage the goal of informed consent by urging exclusion on the basis of a one-sided presentation of the fact, without opportunity for rebuttal. The damage from misstatements could well be irreparable." ld. at 1203. Further, the Court can prevent further spoliation of evidence under its "inherent power ... to levy sanctions in response to abusive litigation practices ..." Leon v. IlJX '\');s. Corp., 464 F.3d 951,958 (9th Cir. 2006).

III. Plaintiffs Seek Class Certification Under Rule 23(b)(2) and Rule 23(c)(4) to the Extent the Court Deems Class Certification Necessary to Obtain the Preliminary Injunction
Plaintiffs may not need class certification to obtain the preliminary injunction sought. Ample authority supports the entry of preliminary injunctions to protect the class prior to class certification. See Washington v. Reno, 35 F.3d 1093, 1104 (6th Cir. 1994) (class certification sometimes unnecessary preliminary injunctions that provide class relief)." To the extent that the requested injunction exceeds the Court's equitable powers as to Plaintiffs' individual claims, they seeks class certification for the narrow purpose of effectuating the preliminary injunction. Cf Fed. R. Civ. P. 23(c)(4) (an action may be maintained as a class action "with respect to particular issues"). The instant Motion seeks certification exclusively for the purpose of obtaining the injunctive relief sought therein. Because the parties have not been able to complete a Rule 26(f) conference, Plaintiffs have not taken the discovery that typically precedes class certification. When due discovery is taken, Plaintiffs will file another motion to certify the class's claims for permanent relief under Rule 23(b)(3). Cf Fed. R. Civ.
P. 23(c)(1)(4) (order on class certification can be "altered or amended before final judgment"). Rule 23(c)(4) provides more than enough flexibility to certify classes "with respect to particular issues" (and not other issues). " It is within the discretion of the trial judge, under Rule 23(c)(4), to limit the issues in a class action to those parts of a lawsuit which lend themselves to convenient use of the class action motif." Soc y jor Individual Rights, Inc. v. Hampton, 528 F2d 905, 906 (9th Cir. 1975) (quotation marks, citation omitted, certification ofclassonly forprospectiveinjunctive reliefwasproper). Forinstance,"[a]courtmaycertify a Rule 23(b)(3) class for certain claims, allowing class members to opt out, while creating a non-opt-out Rule 23(b)(I) or (b)(2) class for other claims " Manual for Complex Litigation §
21.24 (4th ed. 2004).

[Rule 23(c)(4)] is particularly helpful in enabling courts to restructure complex cases to meet the ... requirements for maintaining a class action . .. . [Rule 23(c)(4)] is designed to give the court maximum flexibility in handling class actions, its proper utilization will allow a Rule 23 action to be adjudicated that otherwise might have had to be dismissed or reduced to a nonrepresentative proceeding because it appears to be unmanageable.

In re Activision Sec. Litig., 621 F Supp. 415 ,438 (N.D . Cal. 1985) (certification on single issue related to liability). See also In re Harford Nuclear Reservation Litig., 292 F.3d 1124, 1139 (9th Cir. 2002) (remanding with recommendation that the trial court consider "[class] certification only for questions of generic causation common to plaintiffs who suffer from the same or a materially similar disease"); Cent. Wesleyan College v. W.R. Grace & Co., 6 F3d 177,184-87 (4th Cir. 1993) (certification on certain issues related to asbestos liability); Santiago v. Philadelphia, 72 FR.D. 619,629 (E.D. Pa. 1976) (deferring certification, but stating" itispossiblethata23(b)(3) classaction mightbepursuedfor certainissues" ifclass could not be certified under Rule 23(b)(2). Indeed, many courts have already granted the limited certification sought here : certification of a class for injunctive relief now under Rule 23(b)(2), whiledeferringthecertification ofadamagesclassunderRule23(b)(3)6
6 Fraser v. Mcjor League Soccer, LLC, 180 FR.D. 178, 182 (D. Mass . 1998) (certification of only claims for injunctive and declaratory relief is "an appropriate limitation"); Guckcnbcrger II Roston Univ 9~7 F Sunn ,On ,?n n 17 In M"" 1(97)' Schreiber v NI 'AA 1«: FR n 169, 176-77 (D. Kan. 1996) (where plaintiffs did not have sufficient evidence to support certification under Rule 23(b )(3) because of defendants failure to comply with discovery deadlines, class certification nonetheless appropriate for injunctive relief only under Rule
?'Ih)(?)) amended hu raw v Nt" AA Nn 94_?O~ 199R TT S Tiist T.FXTS liliOR In K"n Anr.
17,1998) (class certification under 23(b)(3) ultimately granted, motion to decertify denied); Morgan v UPS cfAm., 169 F R.D. 349, 358 (ED. Mo. 1996) (certification under Rule 23(b)(2) only on liability and injunctive relief, certification for damages remedy under Rule Motion for

A. Members of Both Classes Are So Numerous That Joinder Is Impractical Members of both the California Resident Class and the CAN SPAM Class are numerous enough to support certification under Rule 23(a)(I). Ameritrade's latest Form 10-K filed with the SEC indicates it has 6,191,000 accountholders. TD AMERITRADE Holding Corp., Form 10-K 31 (Dec. 12,2006), available at http://edgar.sec.gov/Archives/edgar/dataIl173431/000095013706013345/cl 054ge 1Ovk.htm. It is reasonable to infer that this massive number of accountholders supports numerosity for both Classes. The US. Census Bureau estimates California contained more than 12% of the US. population in 2006. See US. Census Bureau, California QuickFactsjrom the US. Census Bureau, at http://quickfacts.census.gov/qfd/states/06000.html (May 7, 2007). Assuming that Ameritrade's accountholders are distributed evenly across the US population, there are approximately 740,000 Ameritrade accountholders residing in California. This is a sufficient basis to infer numerosity. L.H. v. Schwarzenegger, No. 06-2042,2007 US. Dist. LEXIS 18728, at *28-29 (E.D. Cal. Feb. 28, 2007) (class of learning disabled parolees sufficiently numerous, where population of parolees was 4,000, a DOJ study indicated that 50% of parolees were learning disabled, and 25% percent of parolees "registered with Special Education"); Nat'l Ass'n cfRadiation Survivors v. Walters, 111 F.R.D. 595,599 (N.D. Cal. 1986), rev'd on other grounds sub nom., Walters v. Nat'l Ass'n (JRadiation Survivors, 473 US. 305 (1985) (class of disability claimants drawn from population of233,000 veterans exposed to radiation was numerous, despite "no way to determine the number of future
claimants" and "long latency period of many radiation-related diseases"). Elvey does not have to prove numerosity with absolute certainty but only present "sufficient material to allow [the ("recommended procedure" in employment cases is to certify a class on liability issues and injunctive relief, and if liability is found, "to certify the damage phase as a ("even if a plaintiff may be unable to state a sub-class for monetary citing Korn v. Franchard Corp., 456 F.2d 1206 (2d Cir. 1972)); Cason v. Nissan Motor Acceptance Corp., 212 F.R.D. 518,520-23 (M.D. Tenn. 2002) (denying class certification under Rule 23(b)(2) for disgorgement remedy, but granting certification on purely injunctive and declaratory relief).

Court to make an] informed judgment" that the California Resident Class is sufficiently "numerousthatjoinderofall members is impracticable" underRule 23(a)(1). Blackie v. Barrack, 524 F.2d 891, 901 n. 17 (9th Cir. 1975). See also Gay v. Waiters' & Dairy Lunchmen s Union, 549 F.2d 1330, 1332 n.5 (9th Cir. 1977) (with respect to numerosity determinations "a judge may consider reasonable inferences drawn from facts before him at that stage of the proceedings"); lynch v. Rank, 604 F Supp. 30, 36 (N.D. Cal. 1984), cjj'd, 747 F2d 528 (9th Cir. 1984) ("a court may draw a reasonable inference of class size from the facts before it").

Likewise, it is reasonable to infer that there are a sufficient number of CAN SPAM Class members to satisfy Rule 23(a)(I), where the CAN SPAM Class members provide service to approximately 6.2 million Ameritrade accountholders. Cf Jordan v. County cfLos Angeles, 669 F.2d 1311, 1319 (9th Cir. 1982), vacated on other grounds, 459 U.S. 810 (1982). (classes with 39,64, and 71 members sufficiently numerous) with ISP Planet, Top 21 U.S. ISPs by Subscriber: Q4 2006, at http://www.isp-planet.com/research/rankings/usa.html (Apr. 12,2007) (top 21 ISPs by subscriber base have 28.6 million users and control 30.1 % of the market). Plaintiffs do not need "to state the exact number of potential class members, nor is a specific number of class members required for numerosity.... A court may make common sense assumptions to support a finding that joinder would be impracticable." In re Rubber Chems. Antitrust Litig., 232 F.R.D. 346, 351 (N.D. Cal. 2005) (citation, quotation omitted). See also Sweet v. Ffizer, 232 FR.D. 360, 366 (C.D. Cal. 2005) ("where the exact size of the class is unknown but general knowledge and common sense indicate that it is large, the numerosity requirement is satisfied") (citation, quotation omitted); Moeller v. Iaco Bell Corp., 220 FR.D. 604, 608 (N.D. Cal. 2004) (same).

B. The General Application of the Ameritrade Policies to Plaintiffs and the Class Cohesion
The Motion challenges Ameritrade's policies which are generally applicable to the
members of either Class proposed in the Motion and FAC -the potential impact of these
policies on the members of each Class and the Class representatives satisfies both the commonality and the typicality elements of Rule 23(a), as well as the common policy requirement ofRule 23(b)(2). Certification ofthe California Resident Class is appropriate because each member of the Class (including Elvey) is potentially affected by the policies which are challenged in the Motion -including the disclosure of their email addresses to spamrners, and the failure to disclose Ameritrade's internal investigation into the possibility of an security breach, and to notify Class members that sparnmers have manipulated particular stocks. Likewise, certification ofthe CAN SPAM Class is appropriate because each member ofthatclassispotentiallyaffectedbyAmeritrade's policy ofdirectingaccountholdersto eliminate evidence critical to their proof of damages.
"Although common issues must predominate for class certification under Rule 23(b)(3), no such requirement exists under 23(b)(2)." Walters, 145 F3d at 1047. Under Rule 23(b)(2), it is sufficient that there is "a pattern or practice that is generally applicable to the class as a whole. Even if some class members have not been injured by the challenged practice, a class may nevertheless be appropriate." Id. A class can be certified under Rule 23(b)(2) where it is "composed ofthose who have not yet been injured by the allegedly defective policies, but that are or will in the future be exposed to a risk of harm as a result of the policies," provided the class definition provides "definite boundar[ies],' between class members and non-class members. Caroline C. v. Johnson , 174 FR.D. 452, 459-61 (D Neb . 1996). See also Barnes v Am. Iobacco Co., 161 F3d 127,143 (3d Cir. 1998) (class claims under Rule 23(b)(2) "must be cohesive," cited by Sweet, 232 FRD. at 374 ("a class under Rule 23(b)(2) must not be overrun with individual issues"» . Distinguishing members ofthe California Resident Class from non-members is trivial and requires reviewing Ameritrade's accountholder information to determine which accountholders live in California. Likewise, members of the CAN SPAM Class can be identified from the domain names incorporated in Ameritrade accountholders' email addresses. Certification is appropriate under Rule 23(b)(2)

Commonality exists where there are "shared legal issues with divergent factual predicates" or "a common core of salient facts coupled with disparate legal remedies within the class." Hanlon , 150 F3d at 1019. See also Blackie, 524 F2d at 904 (commonality only requires "a common issue of law or fact"); 0 'Connor v. Boeing North Am., Inc., 180 FR.D. 359, 370 (C.D. Cal. 1997) (sufficient commonality for class certification where relief "turn[s] on questions of law applicable in the same manner to each member of the class"). Commonality does not require class members to be identical and interchangeable: it tolerates "divergent factual predicates" where there are "shared legal issues," as well as "a common core of salient facts coupled with disparate legal remedies within the class." Hanlon, 150 F.3d at 1019.
Typicality and commonality share many "underlying issue[s]." Armstrong v. Davis, 275 F3d 849, 868 (9th Cir. 2001); Smith v. Univ. cfWa. Law Sch., 2 F Supp. 2d 1324, 1342
(W.D.
Wash. 1998) ("Typicality turns on the defendant's actions toward the plaintiff class, not particularized defenses against individual class members."). Under Rule 23(a)(3)'s "permissive standards," Plaintiffs are typical of their respective Classes because their claims are "reasonably co-extensive with those of absent class members; [the claims] need not be substantially identical." Hanlon, 150 F3d at 1020. Rule 23(a)(3) only requires "that the unnamed class members have injuries similar to those of the named plaintiffs and that the injuries result from the same, injurious course of conduct." Armstrong, 275 F.3d at 869.7

C.
Class Representatives And Their Counsel Are Adequate to Represent the Classes Lastly, Rule 23(a)(4) requires that Plaintiffs and their counsel fairly and adequately protect the class's interests. The adequacy test has two elements: (1) are there conflicts between the Class representatives or their counsel and the other Class members, and (2) will the Class representatives and their counsel vigorously prosecute the class action? See Hanlon,
7 Indeed, typicality under Rule 23(a)(3) lends class representatives enough flexibility to even borrow absent class members' standing. See Gratz v. Bollinger, 539 U.S. 244,262-68 (2003) (class representative denied undergraduate admission as freshman could represent class of applicants denied undergraduate admission as transfers; use of race in transfer admissions (S.D.N.Y July 16,2003) (analyzing Gratz and concluding that typicality requirement in Rule 23(a)(3) sufficiently flexible that class representation with section 12 Securities Act claim could represent class of section 11 claimants, citing 1 Alba Conte & Herbert B.
ISOF3d at 1020. See also Molski v. Gleich, 318 F3d 937, 955 (9th Cir. 2003) (adequacy "dependson thequalificationsofcounsel for therepresentatives,an absence ofantagonism,a sharing of interests between representatives and absentees, and the unlikelihood that the suit is collusive"). Plaintiffs' counsel are well qualified and highly experienced in litigating consumer fraud actions. (Plaintiffs' counsel's resume is attached as Exhibit 1.) Counsel will advance the costs oflitigation and will represent the Classes on a contingent fee basis, and will provide representation to the class adequate pursuant to Rule 23(a)(4). Likewise, no potential conflicts exist here : Plaintiffs share the precise same claims with their respective Classes, and have an acute interest in the issuance ofthe preliminary injunction. "[C]ourts have generally declined to consider conflicts ... sufficient to defeat class action status at the outset unless the conflict is apparent, imminent, and on an issue at the very heart of the suit." Blackie, 524 F2d at 909 . The burden is on the party opposing certification to show that the named plaintiff will be an inadequate representative. in re Data Access Systems Sec. Litig.,
103FR.D. 130,140(D. NT 1984).

IV. Conclusion Plaintiffs need the preliminary injunction sought in the attached Motion to protect their respective Classes from a variety of harms: the risk of disclosure of email addresses to spammers and, worse, identity theft, lost investments on stocks manipulated by spammers, and spoliation ofevidence.All oftheseharmspresentirreparableinjuryto therespective Classes and they are based on either incontestable breaches ofAmeritrade's fiduciary duties and its Privacy Statement (for the California Resident Class) or spoliation of evidence (for the CANSPAM Class).The benefits ofthereliefsoughtwill greatlyoutweighany potential
harms to Ameritrade, so the Court should grant the relief requested Dated: July 10, 2007

By:/s/Alan Himmelfarb

Alan Himmelfarb LAW OFFICES OF ALAN HIMMELFARB 2757 Leonis Blvd Los Angeles, CA 90058
Telephone (323) 585-8696 Fax: (323) 585-8198 consumerlawI @earthlink.net
Scott A. Kamber Ethan Preston KAMBER & ASSOCIATES, LLC II Broadway, 22d Floor New York, NY 10004 Telephone: (212) 920-3072 Fax (212) 202-6364 skamber@kolaw.com epreston@kolaw.com
MotionforPreliminaryInjnnction 25 No.C072852MJJ and Class Certification