Zigler v. TD AmeriTrade - September 21, 2007 - Complaint

David C. Parisi, Esq. (162248)
Suzanne Havens Beckman, Esq.(188814)

__ ~2 1 r;· 12: 19
PARISI & HA YENS LL P 15233 Valleyheart Drive
il .1 .r. ',: \'d£l'WIG
Sherman Oaks, California 91403 C!.UH•. u.s. L; t"rlUCT COURT "' ....:l HUIPl O I ~fIlI C I OJ C,",lII0IlNI'"
(818)990-1299 (phone)
(818) 501-7852 (facsimile)
dnansi arisihavens.com s ave ansihavens.cnm
Attorneys for plaintiff Brad Zigler,
on behalf of hunself, the general public and all

others similarly situated
IN THE UNITED STATES DISTRICT COURT

M1\1c
FOR THE NORTHERN DISTRICT OF CALIFORNIA
SA~ FRAlle~~~vM 4903
BRADZIGLER,anindividual, on behalf Case No.:
ofhimself, thegeneralpublicandallothers
similarly situated,

CLASS ACTION COMPLAINT
Plaintiff
v.
TD AMERITRADE, INC., a New York
corporation, and DOES J to 100,
Defendants .
BradZigler ("Plaintiff'),forhiscomplaint,allegesasfollows upon informationand
belief, based upon. inter alia, investigationconducted byand throughhisattorneys,except
asto thoseallegationspertainingto PlaintifTandhis counse l personally, whicharealleged
upon knowledge:
Intradistrict Assignment
L A substantialpart oftheeventswhichgive rise to the claim occurred in the
place ofPlaintiff'sresidence,Santa Rosa,inSonoma County, California. Under Local Rule
3-2(d), this civil action should be assigned to the San Francisco Division of the Northern District of California.

Nature of the Claim

2.
This case is about TD AMERITRADE, Inc.’s (“Ameritrade”) disclosure and failure to keep secure its accountholder’s private email addresses to spammers and potential disclosure of accountholder’s social security numbers to undesirable third parties. Stock spammers continue to send Ameritrade accountholders unsolicited commercial email promoting certain stocks (“stock spam”). Ameritrade’s disclosure of these email addresses is tortious and may indicate still more systematic torts by the company. On or about September 14, 2007, Ameritrade admitted these disclosures and failures to keep secure personal and private information, but, based on information and belief, Ameritrade was aware of the problem for many months and possibly over a year.

3.
This is a class action brought on behalf of two classes: 1) all Ameritrade accountholders residing in the United States (“U.S. Resident Class”), and 2) only those Ameritrade accountholders residing in California (“California Resident Class”). All California Resident Class members are also members of the U.S. Resident Class.

4.
Ameritrade’s disclosure of its accountholders’ email addresses and potential disclosure of social security numbers not only facilitated the transmission of spam to its accountholders, it violated its fiduciary duties and the provisions of its privacy policy.

5.
On behalf of the U.S. Resident Class, Plaintiff seeks equitable relief, damages and injunctive relief under the Nebraska Consumer Protection Act (NRS § 59-1602, et seq.), equitable relief, damages and injunctive relief under the Nebraska Uniform Trade Practices Act (NRS § 87-301, et seq.), damages and equitable relief for breach of fiduciary duty, and equitable relief and damages under the Computer Fraud and Abuse Act (18 U.S.C. § 1030).

6.
On behalf of the California Resident Class, Plaintiff seeks damages and injunctive relief under California’s Consumer Legal Remedies Act (“CLRA”) (Cal. Civ. Code § 1750, et seq., and equitable relief under California’s Unfair Competition Law (“UCL”) (Cal. Bus. & Prof. Code § 172000, et seq.).

Parties
7.
Plaintiff Brad Zigler is a resident of Santa Rosa, California. Mr. Zigler is an accountholder at TD Ameritrade, Inc. Mr. Zigler maintains an email account which has been provided to TD Ameritrade, Inc. in the course of Plaintiff’s business with TD Ameritrade, Inc. Mr. Zigler has also provided his social security number to TD America, Inc. in the course of his business with TD America, Inc.

8.
Defendant TD AMERITRADE, Inc.: TD AMERITRADE, Inc. is a New York corporation which maintains its headquarters at 4211 South 102d Street, Omaha, Nebraska 68127. Ameritrade provides securities brokerage services, with retail brokerage representing the vast majority of its business. Ameritrade was established in 1971 as a local investment banking firm and began operations as a retail discount securities brokerage firm in 1975. As of September 2006, Ameritrade had an estimated 6,191,000 accountholders.

9.
Defendants Does: Plaintiff is currently ignorant of the true names and capacities, whether individual, corporate, associate, or otherwise, of the defendants sued herein under the fictitious names Does 1 through 100, inclusive, and therefore, sue such defendants by such fictitious names.

10.
Plaintiff alleges on information and belief that Doe defendants were at all relevant times acting as Ameritrade’s agents, ostensible agents, partners and/or joint venturers and employees, and that all acts alleged herein occurred within the course and scope of said agency, employment, partnership, and joint venture, or enterprise; however, each of these allegations are deemed “alternative” theories whenever not doing so would result in a contraction with the other allegations.

Jurisdiction and Venue

Plaintiff asserts claims under CFAA for damages and injunctive remedies on behalf of himself and all others similarly situated. This Court has federal subject matter jurisdiction over this case under 28 U.S.C. § 1331.

Ameritrade is a New York corporation headquartered in Nebraska.Ameritrade can only be a citizen in New York and Nebraska. The members of the U.S. Resident Class and the California Resident Class are diverse from Ameritrade. The U.S. Resident Class is a national class whose members are scattered throughout the fifty states (including the 48 states besides New York and Nebraska) and the U.S. territories: there is minimal diversity of citizenship between the proposed U.S. Resident Class and Ameritrade. The aggregate of claims asserted in the class exceeds the sum or value of $5,000,000. This Court has subject matter jurisdiction over this case under 28 U.S.C. § 1332(d)(2).

13.
This Court has personal jurisdiction over the Defendant under because some of the acts alleged herein were committed, and Plaintiff incurred him injury, in California (and, specifically, the Northern District of California).

14.
Venue is also proper before this Court under 28 U.S.C. § 1391(b)(1), (2), and (c).

Factual Background
15.
Email Anatomy: The domain name portion of an email address follows the @ symbol. (Thus, the domain name portion for “webmaster@cand.uscourts.gov” is “cand.uscourts.gov”.) Email systems use domain names to direct email to the correct email server, which in turn provide users with email accounts with the relevant domain name access to the messages sent to their address.

16.
Stock Spam: Stock spam is a technique for manipulating stock prices – essentially a contemporary version of a classic pump-and-dump scheme. The scheme typically involves purchasing stock in a small, thinly-traded company (whose prices can be driven up easily), transmitting a massive volume of email touting the company’s stock and urging recipients to buy, and then selling the stock after its price rises on the purchases of spam recipients. See Laura Frieder & Jonathan Zittrain, Spam Works: Evidence from Stock Touts and Corresponding Market Activity, http://papers.ssrn.com/sol3/papers.cfm?abstract_id=920553 (Mar. 14, 2007); Rainer Böhme & Thorsten Holz, The Effect of Stock Spam on Financial Markets, http://papers.ssrn.com/sol3/papers.cfm?abstract_id=897431 (Apr. 2006).

Stock spam correlates with significant short-term increases in the touted stockprices (and a corresponding collapse soon thereafter). Frieder & Zittrain, Spam Works, at 40
(fig. 2); Spam Stock Tracker, http://www.spamstocktracker.com/ (updated Apr. 20, 2007).

Stock spam’s primary purpose is the advertisement and promotion of thetouted stock.

Ameritrade’s Privacy Statement: At all times relevant to this complaint,Ameritrade published a Privacy Statement which indicated that Ameritrade would not
disclose personal information to third parties. The relevant portion of the Privacy Statement
has been reproduced below:
Do we share the information collected with any other third parties?
The cornerstone of our Privacy Statement is the commitment to keep our
clients’ personal information confidential. Ameritrade does not sell, license,
lease or otherwise disclose your personal information to any third party for
any reason, except as noted earlier and as described below:

•
To help us improve our services to you, we may engage another business to help us to carry out certain internal functions such as account processing, fulfillment, client service, client satisfaction surveys or other data collection activities relevant to our business. We may also provide a party with client information from our database to help us to analyze and identify client needs and notify clients of product and service offerings. Use of the information shared is strictly limited to the performance of the task we request and for no other purpose.

•
Periodically, we may invite you to participate in advertisements,promotions and special offers offered by Ameritrade or by other sponsoring organizations. These could include retailers, airlines and Internet service providers. Your participation may require us to gather and share your personal information or may require you to supply personal information to the promotion sponsor. For example, a referral program may require that we provide your name as a reference to a prospective client. It is always your choice whether or not to participate.

All third parties with which we share personal information are required to protect personal information in a manner similar to the way we protect personal information. Examples of information shared are identifying information such as name, mailing address, e-mail address, telephone number, and information on account activity.
If at any time you choose to purchase a product or service offered by another company, any personal information you share with that company will no longer be controlled under our Privacy Statement.

Ameritrade also reserves the right to disclose your personal information to third parties where permitted by law or where required by law to regulatory, law enforcement or other government authorities. We may also disclose your information as necessary to credit reporting or collection agencies, or whennecessary to protect our rights or property.
Ameritrade, Ameritrade Privacy Statement, http://www.tdAmeritrade.com/privacy.html (Feb. 2007) (emphasis added). The Privacy Statement does allow disclosures of accountholder email addresses to partners and alliances (except for California and Vermont residents), but the Privacy Statement requires marketing under such relationships to identify that an offer is being extended because of the relationship with Ameritrade. Further, Ameritrade’s Privacy Statement allows for disclosure to third parties for “certain internal functions such as account processing, fulfillment, client service, client satisfaction surveys or other data collection activities relevant to our business.” Id. The spam received by Plaintiff was not consistent with these exceptions.

Plaintiff Receives Spam: Plaintiff provided Ameritrade with a unique email address.

21.
Plaintiff has received stock spam at his email address.

22.
Ameritrade admits that its clients have received stock spam: With an email dated September 14, 2007, Ameritrade advised its clients as follows:
Let me tell you why I am sending you this email. While investigating client reports about the industry-wide issue of investment-related SPAM, we recently discovered and eliminated unauthorized code from our systems. This code allowed certain client information stored in one of our databases, including email addresses, to be retrieved by an external source.

Ameritrade admits that accountholder’s social security numbers were in a database which was accessed by unauthorized persons: Ameritrade’s September 14, 2007, email advised its accountholders that social security numbers were stored in the particular database which was accessed by an external source. While Ameritrade asserts that it has no evidence that the social security numbers were copied, it has provided no evidence to establish this fact.

24.
Based on information and belief, the spam is exclusively stock spam: it touts low-priced, speculative stocks of smaller companies traded on exchanges like Pink Sheets and OTCBB, and urges recipients to purchase the touted stock. Thus, Ameritrade’s accountholders are not only targeted for spam, but are specifically targeted for stock spam – and accountholders naturally have the ability to purchase touted stocks through Ameritrade. Ameritrade benefits from the spam because its accountholders trade stocks based on tips in the spam and Ameritrade earns commissions on those trades.

25.
Ameritrade’s Past Communications to Class Members: On May 30, 2007, it became clear that this is a widespread problem. See Slashdot, Who’s Trading Your E-mail Addresses?, at http://yro.slashdot.org/yro/07/05/30/1444236.shtml (May 30, 2007) (“Slashdot Story”). The story further disclosed that Ameritrade’s response to customer inquiries has been to either 1) deny any breach of the Privacy Statement and attribute the spam to dictionary attacks or 2) indicate it is investigating the situation, but decline to provide further details. Despite the story, it took Ameritrade over four months to advise its accountholders of the issue.

26.
Ameritrade’s Spoliation of Evidence: The Slashdot Story indicated that Ameritrade’s current response to accountholders who inquire about spam traced to Ameritrade is that the accountholders should “delete any spam you might receive, then empty your e-mail’s trash so that it’s no longer kept there, either.” It appears that, although Ameritrade was aware of potential class claims no later than May 21, 2007, it still urged potential class members to destroy this evidence.

27.
Undisclosed Security Breach at Ameritrade: At all times during the security breach at TD Ameritrade, the following portion of Ameritrade’s Privacy Statement was misleading: “TD Ameritrade does not . . . disclose [accountholders’] personal information to any third party for any reason . . .” Likewise, the portion of the Privacy Statement below is also misleading:

We have made a significant investment in leading-edge security software, systems, and procedures to offer you a safe and secure trading environment and protect your personal, financial and trading information. While no security system is absolutely impenetrable, we are constantly reviewing, refining and upgrading our security technology, as new tools become available. Ameritrade Privacy Statement.

28.
At all times when Ameritrade knew there was an ongoing security breach, the Privacy Statement’s representations were knowingly and intentionally misleading. In this light, Ameritrade continued to entice new accountholders to provide personal information under the representation that such information is secure from third parties, when it knew that those representations were false.

29.
Ameritrade profited from the email security breach, because accountholders would trade stocks based on tips in the spam and Ameritrade would earn commissions on those trades.

Class Certification Allegations

30.
Plaintiff seek certification of two classes, the California Resident Class and the U.S. Resident Class, both pursuant to Rule 23(b)(2) and Rule 23(b)(3).

31.
The California Resident Class asserts claims for violations of California’s CLRA (Cal. Civ. Code §§ 1750-84) and UCL (Cal. Bus. & Prof. Code §§ 17200-10) on behalf of all Ameritrade accountholders residing in California.

32.
The U.S. Resident Class includes all members of the California Resident Class and asserts claims under the Nebraska Consumer Protection Act (NRS § 59-1602, et seq.), the Nebraska Uniform Trade Practices Act (NRS § 87-301, et seq.), the common law theory of breach of fiduciary duty, and under the Computer Fraud and Abuse Act (18 U.S.C. § 1030).

33.
Adequate Representation: Plaintiff will fairly and adequately represent and protect the interests of the members of both classes, and has retained counsel competent and experienced in complex class actions. Plaintiff has no interest antagonistic to those of either class, and Defendants have no defenses unique to Plaintiff.

34.
Predominance and Superiority: This class action is appropriate for certification because class proceedings are superior to all other available methods for the fair and efficient adjudication of this controversy, since joinder of all members is impracticable. The damages suffered by each individual member of either class will likely be relatively small, especially given the burden and expense of individual prosecution of the complex litigation necessitated by the actions of Defendants. It would be virtually impossible for the members of either class individually to obtain effective relief from the misconduct of Defendants. Even if members of either class themselves could sustain such individual litigation, it would still not be preferable to a class action, because individual litigation would increase the delay and expense to all parties due to the complex legal and factual controversies presented in this complaint. By contrast, a class action presents far fewer management difficulties and provides the benefits of single adjudication, economy of scale, and comprehensive supervision by a single Court. Economies of time, effort, and expense will be fostered and uniformity of decisions will be ensured.

Policies Generally Applicable to the Class: This class action is also appropriate for certification because Defendants have acted or refused to act on grounds generally applicable to the class, thereby making appropriate final injunctive relief or corresponding declaratory relief with respect to either class as a whole. The policies of the Defendants challenged herein apply and affect members of both class uniformly, and Plaintiff’s challenge of these policies hinges on Defendants’ conduct, not on facts or law applicable only to Plaintiff.

Allegations to Certification of California Resident Class

Definition of the California Resident Class: Pursuant to Federal Rule of Civil Procedure 23, Plaintiff brings this complaint against Ameritrade on behalf of himself, the general public and all similarly situated persons who are accountholders of Ameritrade who reside in California. Excluded from the California Resident Class are 1) any Judge or Magistrate presiding over this action and members of their families; 2) Defendants, Defendants’ subsidiaries, parents, successors, predecessors, and any entity in which the Defendants or their parents have a controlling interest and their current or former employees, officers and directors; and 3) persons who properly execute and file a timely request for exclusion from the class and 4) the legal representatives, successors or assigns of any such excluded persons.

37.
California Resident Class Numerosity: The exact number of California Resident Class members is unknown and is not available to Plaintiff, but it is clear that individual joinder of all class members is impracticable. In SEC filings, Ameritrade estimated it had 6,191,000 accountholders as of September 2006. According to recent U.S. Census estimates, approximately 12% of the US population resides in California. Assuming that Ameritrade’s accountholders are distributed evenly across the US population, there are approximately 740,000 Ameritrade accountholders residing in California. California Resident Class members can be easily identified through Ameritrade’s records.

38.
California Resident Class Commonality: Common questions of fact and
law exist as to all California Resident Class members and predominate over the questions
affecting only individual California Resident Class members. These common questions
include:

(a)
Whether Ameritrade exposed or provided email addresses of the California Resident Class members to spammers;

(b)
Whether Ameritrade exposed or provided social security numbers ofthe California Resident Class members to others not affiliated with Ameritrade;

(c)
Whether such exposure violated Ameritrade’s Privacy Statement;

(d)
Whether such exposure was intentional or unintentional on Ameritrade’s part;

(e)
Whether Ameritrade’s Privacy Statement represented that Ameritrade’s services have characteristics, uses, and benefits, or quantities which they do not have, in violation of Cal. Civ. Code § 1770(a)(5);

(f)
Whether Ameritrade’s Privacy Statement represented that Ameritrade’s services confer or involves rights, remedies, or obligations which they do confer not or involve, in violation of Cal. Civ. Code § 1770(a)(14);

(g)
Whether, in light of the exposure and provision of California Resident Class members’ email addresses to spammers, Ameritrade’s Privacy Statement was deceptive under Cal. Bus. & Prof. Code § 17200;

(h)
Whether Ameritrade violated the CLRA;

(i)
Whether Ameritrade violated the UCL;

(j)
Whether Plaintiff and the class are entitled to relief, and the nature of such relief.

California Resident Class Typicality: Plaintiff’s claims are typical of theclaims of other California Resident Class members, as Plaintiff and other California
Resident Class members sustained damages arising out of the wrongful conduct of
Defendant, based upon the same transactions which were made uniformly to Plaintiff and
the public.

Allegations to Certification of U.S. Resident Class

40.
Definition of the U.S. Resident Class: Pursuant to Federal Rule of Civil Procedure 23, Plaintiff brings this complaint against Ameritrade on behalf of himself, the general public and all similarly situated persons who are accountholders of Ameritrade who reside in the United States. Excluded from the California Resident Class are 1) any Judge or Magistrate presiding over this action and members of their families; 2) Defendants, Defendants’ subsidiaries, parents, successors, predecessors, and any entity in which the Defendants or their parents have a controlling interest and their current or former employees, officers and directors; and 3) persons who properly execute and file a timely request for exclusion from the class and 4) the legal representatives, successors or assigns of any such excluded persons.

41.
U.S. Resident Class Numerosity: The exact number of U.S. Resident Class members is unknown and is not available to Plaintiff, but it is clear that individual joinder of all Class members is impracticable. As Ameritrade is an online brokerage service, it stands to reason that some or all of its estimated 6,191,000 accountholders provided it with email addresses and social security numbers. Potential U.S. Resident Class members can be identified by the email addresses contained in Ameritrade’s records; membership in the class can be confirmed either by actual production of spam or can be inferred from the proof of the spam.

U.S. Resident Class Commonality: Common questions of fact and law existas to all U.S. Resident Class members and predominate over the questions affecting only
individual U.S. Resident Class members. In addition to the questions which predominate the
U.S. Resident Class, these common questions include:

(a)
Whether Ameritrade owed the class members a fiduciary duty as their broker;

(b)
Whether Ameritrade owed the class members a fiduciary duty by dint of its collection of personal information under the Privacy Statement;

(c)
Whether Ameritrade breached such fiduciary duties through the violation of its Privacy Statement;

(d)
Whether Ameritrade failed to fully and accurately disclose the exposure and provision of class members’ email addresses and/or social security numbers to spammers or others. and any underlying security breach;

(e)
Whether, in light of its fiduciary duties, Ameritrade’s failure to disclose any security breach violated its fiduciary duties to the class members;

(f)
Whether the Does obtained the email addresses to send the class members the spam or to have confederates send such spam by accessing Ameritrade’s computer systems;

(g)
Whether the Does’ access of Ameritrade’s computer systems waswithout authorization or in excess of authorization. because it was in violation of the Privacy Statement;

(h)
Whether the Does violated the CFAA;

(i)
Whether Ameritrade is liable for the Does’ violation of the CFAA under the doctrine of respondeat superior;

(j)
Whether Ameritrade’s Privacy Statement represented that Ameritrade’s services have characteristics, uses, and benefits, which they do not have, in violation of NRS § 87-302(5);

(k)
Whether Ameritrade’s Privacy Statement represented that Ameritrade’s services were of a particular standard or quality which they were not, in violation of NRS § 87-302(7);

(l)
Whether Ameritrade advertised its services with an intent not to sell them as advertised, in violation of NRS § 87-302(9);

(m)
Whether Ameritrade’s knowingly made false or misleading statements in a published privacy policy regarding the use of personal information submitted by members of the public in violation of NRS § 87-302(14);

(n)
Whether, in light of the exposure and provision of U.S. Resident Class members’ email addresses and social security numbers, Ameritrade’s conduct was deceptive under the Nebraska Consumer Protection Act;

(o)
Whether Ameritrade violated the Nebraska Consumer Protection Act;

(p)
Whether Ameritrade violated the Nebraska Deceptive Trade Practices Act.

U.S. Resident Class Typicality: Plaintiff’s claims are typical of the claims of other California Resident Class members, as Plaintiff and other California Resident Class members sustained damages arising out of the wrongful conduct of Defendant, based upon the same transactions which were made uniformly to Plaintiff and the public.Count I: Violation of California’s UCL, Cal. Bus. & Prof. Code § 17200 (By the California Resident Class against all Defendants)

Plaintiff incorporates the above allegations by reference.

45.
Ameritrade’s Privacy Statement was deceptive. Ameritrade’s failure to disclose to California Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very likely being manipulated, is also deceptive. Moreover, Ameritrade’s failure to disclose to the U.S. Resident Class members that their social security numbers were made available to undisclosed third parties was deceptive.

46.
The acts alleged above are unlawful, unfair or fraudulent business acts or
practices and constitute unfair competition under Cal. Bus. & Prof. Code § 17200, et seq.

47.
Ameritrade’s unfair competition has damaged Plaintiff and the other California Resident Class members, and threatens additional injury in the future. This damage includes the loss of the benefit of bargain on Ameritrade’s brokerage fees, which were premised, in part, on Ameritrade’s compliance with the privacy statement and full disclosure of facts relevant to the security of accountholders’ information. The damage from the spam includes California Resident Class members’ lost time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received the spam. Further, California Resident Class members are subject to identity theft to the extent that their social security numbers were obtained in the security breach.

Plaintiff, on his own behalf, the general public and behalf of the other California Resident Class members, seeks an order enjoining Ameritrade’s unfair competition alleged herein, and restitution of property gained by such unfair competition under the UCL (Cal. Bus. & Prof. Code § 17203), as well as interest and attorney’s fees and costs pursuant to, in part, Cal. Code Civ. Proc. § 1021.5.Count II: Violation of the CLRA, Cal. Civ. Code § 1770 (By the California Resident Class against all Defendants)

Plaintiff incorporates the above allegations by reference.

50.
Ameritrade’s Privacy Statement represented that Ameritrade’s services have characteristics, uses, and benefits, or quantities which they do not have, in violation of Cal. Civ. Code § 1770(a)(5), and that Ameritrade’s services have confer or involves rights, remedies, or obligations which they do confer not or involve, in violation of Cal. Civ. Code § 1770(a)(14). The Privacy Statement stated that Ameritrade would not disclose accountholders’ personal information to third parties, and that it provided a secure trading environment and protected accountholders’ personal, financial and trading information. The Privacy Statement is also misleading inasmuch as it not disclose any ongoing security breach, to the extent such a breach exists.

51.
Ameritrade’s failure to disclose to California Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very likely being manipulated, also violates the CLRA.

52.
Ameritrade’s CLRA violations have damaged Plaintiff and the other California Resident Class members, and threaten additional injury if the violations continue. This damage includes the loss of the benefit of bargain on Ameritrade’s brokerage fees, which were premised, in part, on Ameritrade’s compliance with the privacy statement and full disclosure of facts relevant to the security of accountholders’ information. The damage from the Traced Spam includes California Resident Class members’ lost time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received the spam. Further, California Resident Class members are subject to identity theft to the
extent that their social security numbers were obtained in the security breach.

Plaintiff, on his own behalf, and behalf of the other California Resident Class members, seeks damages, an order enjoining Ameritrade’s CLRA violations alleged herein, restitution of property gained by the CLRA violations (including commissions on trades while actionable failure to disclose information was ongoing), and court costs and attorney’s fees under the CLRA (Cal. Civ. Code § 1780(d)).Count III: Violation of Nebraska’s Consumer Protection Act (By the U.S. Resident Class against all Defendants)

Plaintiff incorporates the above allegations by reference.

55.
Ameritrade’s Privacy Statement was deceptive. Ameritrade’s failure to disclose to U.S. Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very likely being manipulated, is deceptive. Moreover, Ameritrade’s failure to disclose to the U.S. Resident Class members that their social security numbers were made available to undisclosed third parties was deceptive.

56.
The acts alleged above are unfair or deceptive business acts or practices and constitute unfair competition under Nebraska Revised Statutes § 59-1602. This conduct had an impact on the public interest.

57.
Ameritrade’s unfair competition has damaged Plaintiff and the other U.S. Resident Class members, and threatens additional injury in the future. This damage includes the loss of the benefit of bargain on Ameritrade’s brokerage fees, which were premised, in part, on Ameritrade’s compliance with the privacy statement and full disclosure of facts relevant to the security of accountholders’ information. The damage from the spam includes the U.S. Resident Class members’ lost time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received the spam. Further, U.S. Resident Class members are subject to identity theft to the extent that their social security numbers were
obtained in the security breach.

58.
Plaintiff, on his own behalf and behalf of the other U.S. Resident Class members, seeks an order enjoining Ameritrade’s unfair competition alleged herein, and restitution of property gained by such unfair competition under the Nebraska Consumer Protection Act (NRS § 59-1609), as well as interest and reasonable attorney’s fees and costs pursuant to, in part, this code section.

59.
Plaintiff, on his own behalf and behalf of the other U.S. Resident Class
members, also seeks a civil penalty from Ameritrade of two thousand dollars for each
violation of the Nebraska Consumer Protection Act.

Count IV: Violation of the Nebraska Uniform Deceptive Trade Practices Act (By the United States Resident Class against all Defendants)

Plaintiff incorporates the above allegations by reference.

61.
Ameritrade’s Privacy Statement stated that Ameritrade would not disclose accountholders’ personal information to third parties, and that it provided a secure trading environment and protected accountholders’ personal, financial and trading information. The Privacy Statement is also misleading inasmuch as it not disclose any ongoing security breach, to the extent such a breach exists.

62.
Ameritrade’s Privacy Statement represented that Ameritrade’s services have characteristics, uses, and benefits, or quantities which they do not have, in violation of NRS § 87-302(5) and that Ameritrade’s services were of a particular standard or quality which they were not, in violation of NRS § 87-302(7). Moreover, Ameritrade advertised its services with an intent not to sell them as advertised, in violation of NRS § 87-302(9), and Ameritrade knowingly made false or misleading statements in a published privacy policy regarding the use of personal information submitted by members of the public in violation of § 87-302(14).

63.
Ameritrade’s failure to disclose to U.S. Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very likely being manipulated, also violates the Nebraska Uniform Deceptive Trade Practices Act.

64.
Ameritrade’s violations of the Nebraska Uniform Deceptive Trade Practices Act have damaged Plaintiff and the other U.S. Resident Class members, and threaten additional injury if the violations continue. This damage includes the loss of the benefit of bargain on Ameritrade’s brokerage fees, which were premised, in part, on Ameritrade’s compliance with the privacy statement and full disclosure of facts relevant to the security of accountholders’ information. The damage from the spam includes U.S. Resident Class members’ lost time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received the spam. Further, U.S. Resident Class members are subject to identity theft to the extent that their social security numbers were obtained in the security breach.

65.
Plaintiff, on his own behalf, and behalf of the other U.S. Resident Class members, seeks damages, an order enjoining Ameritrade’s violations of the Nebraska Uniform Trade Practices Act alleged herein, restitution of property gained by the violations (including commissions on trades while actionable failure to disclose information was ongoing), and court costs and attorney’s fees under the Nebraska Consumer Protection Act.

Count V: Breach of Fiduciary Duty
(Breach of Fiduciary Duty)
(By the U.S. Resident Class against all Defendants)

Plaintiff incorporates the above allegations by reference.

67.
As their stock broker, Ameritrade and the Does owed all U.S. Resident Class members a fiduciary duty.

68.
Ameritrade breached its fiduciary duty of confidentiality by allowing the
disclosure of its accountholder’s email addresses to spammers and potentially allowing
disclosure of social security numbers to unauthorized third parties.

69.
Ameritrade owed a fiduciary duty to disclose all material facts within its knowledge relating to its transaction with the U.S. Resident Class members. The security of personal information given to Ameritrade was a material fact, because exposure of accountholders’ personal information subjects the accountholders to spam and increased risk of identity theft.

70.
Ameritrade breached its fiduciary duty by 1) its continued failure to correct the deception created by the Privacy Statement, and 2) its failure to the extent Ameritrade failed to disclose the events that led to the disclosure of its accountholders’ email addresses and social security numbers to thieves, and 3) instructed accountholders to destroy spam.

71.
Ameritrade also breached its fiduciary duty by failing to disclose to U.S. Resident Class members who trade in stock touted in the spam that the stock is being touted by the spam and its value is very likely being manipulated.

72.
Ameritrade’s breach of its fiduciary duties has caused damage to Plaintiff and the other U.S. Resident Class members and threatens additional damage in the future. This damage includes the loss of the benefit of bargain on Ameritrade’s brokerage fees, which were premised, in part, on Ameritrade’s compliance with the privacy statement and full disclosure of facts relevant to the security of accountholders’ information. The damage from the spam includes U.S. Resident Class members’ lost time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received the spam. Further, U.S. Resident Class members are subject to identity theft to the extent that their social security numbers were obtained in the security breach.

73.
Plaintiff, on his own behalf and behalf of the other U.S. Resident Class members, seeks damages in an amount to be determined at trial and equitable relief (including an accounting, and disgorgement of profits obtained while the breach of fiduciary duty was ongoing, such as commissions on trades), for Ameritrade’s breach of its fiduciary duties, as well as interest and attorney’s fees and costs pursuant to, in part, Cal. Code Civ. Proc. § 1021.5.

Count VI: Violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030
(Violation of CFAA)
(By the U.S. Resident Class against all Defendants)

Plaintiff incorporates the above allegations by reference.

75.
Plaintiff alleges on information and belief that the Does are Ameritrade’s agents, ostensible agents, partners and/or joint venturers and employees, that Ameritrade has given the Does access to its computer systems, and that the Does are either sending stock spam to these email addresses as alleged above, or are deliberately providing the email addresses to confederates who are sending the stock spam.

76.
The Does obtained the U.S. Resident Class members’ email addresses by
intentionally accessing Ameritrade’s computer systems.

77.
The Does obtained the email addresses to send the U.S. Resident Class
members the spam or to have confederates send such spam.

78.
The Does’ access of Ameritrade’s computer systems was without
authorization or in excess of authorization because it was in violation of the Privacy
Statement.

79.
The Does’ access of Ameritrade’s computer systems impaired the integrity of those systems.

80.
The Does’ access of Ameritrade’s computer systems caused the U.S. Resident Class members to lose time required to sort, read, discard and attempt to prevent future spam, and lost storage space, Internet connectivity, and computing resources on the personal computers on which they received the spam. This loss exceeded $5,000 in damages in the last year.

The Does have violated the CFAA (18 U.S.C. § 1030(a)(5)).

The Does’ use of their access to the Ameritrade’s computer systems was in the scope of their employment. The Does were in a position to access Ameritrade’s computer systems because of their agency relationship with Ameritrade, and their access to those systems was an outgrowth of that relationship. As it was here, the risk of the Does abusing their employer’s proprietary information was inherent in the workplace, or typical of or broadly incidental to the Ameritrade’s business. The Does’ violation of the CFAA was reasonably foreseeable by Ameritrade. Ameritrade benefited from (in the form of commissions on trades prompted by the spam) the Does’ violation of the CFAA.

83.
In the alternative, Ameritrade directed and encouraged the Does’ violation of the CFAA.

84.
Ameritrade is liable for the Does’ violation of the CFAA under the doctrine
of respondeat superior.

85.
As alleged above, the Does’ CFAA violation has damaged Plaintiff and the
other U.S. Resident Class members, and threatens additional damage in the future.

86.
Plaintiff, on his own behalf and behalf of the other U.S. Resident Class members, seeks compensatory damages in an amount to be determined at trial and injunctive relief or other equitable relief (including an accounting, and disgorgement of profits obtained while the CFAA violations were ongoing, such as commissions on trades), for Ameritrade’s vicarious liability under the CFAA.

WHEREFORE, Plaintiff prays that the Court enter judgment and orders in their favor and against Defendants as follows:

(a)
Certifying the action as a class action and designating Plaintiff and his counsel as representatives of the California Resident Class and the U.S. Resident Class;

(b)
With respect to all Counts, equitable relief for both classes, including an order for accounting, an order enjoining the misconduct alleged herein, restitution of property gained by this misconduct and disgorgement of profits obtained while the breach of fiduciary duty was ongoing, such as commissions on trades;

(c)
With respect to Counts I, III, IV, V and VI, damages in an amount to be determined at trial;

(d)
Awarding pre- and post-judgment interest; and

(e) Granting such other and further relief as the Court may deem just and
proper.

DEMAND FOR JURY TRIAL

Plaintiff hereby demands a trial by jury of all claims and causes of action in this lawsuit.