Summary
addressing standards under 18 U.S.C. § 1030(C) in connection with allegations that non-employee improperly was allowed to “hack” into county computer network and obtain information about routers and passwords without the knowledge or consent of the director of the “Harris County Infrastructure Technology office”
Summary of this case from Coll. of the Mainland v. MenekeOpinion
NO. 14-11-00446-CV
06-19-2012
WILFRIDO MATA, Appellant v. HARRIS COUNTY, TEXAS, Appellee
Reversed and Remanded and Memorandum Opinion filed June 19, 2012.
On Appeal from the 270th District Court
Harris County, Texas
Trial Court Cause No. 2010-44692
MEMORANDUM OPINION
Wilfrido Mata sued Harris County under the Texas Whistleblower Act. The Act waives governmental immunity if a governmental entity takes adverse personnel action against a public employee who in good faith reports a violation of law by another public employee to an appropriate law enforcement authority. See Tex. Gov't Code Ann. §§ 554.002, 554.0035 (Vernon 2004). Mata argues that the trial court erred by granting Harris County's plea to the jurisdiction because Mata in good faith reported a violation of law. We reverse and remand.
B ACKGROUND
Mata's original petition alleges that he was employed by the Harris County Sheriff's Office as the director of infrastructure technology. In September 2009, Chief Administrative Officer John Dyess informed Mata that the Sheriff's Office would undergo a security audit of its computer systems. Sheriff Adrian Garcia convened a meeting attended by Dyess, Mata, and Robert Erwin, who was not a Harris County employee at that time. According to Mata, Erwin began to discuss "getting a view" of the computer system; Mata told the meeting attendees that the "Harris County Infrastructure Technology office" and its director, Bruce High, should be involved in the security audit. Dyess objected to informing High, saying that High would not be informed of what the Sheriff's Office was intending to do. Erwin told the meeting attendees that he did not need High's participation because Erwin could use "packet sniffing" to obtain information about the routers and passwords for the network without the knowledge of anyone at "Harris County ITC," including High.
Mata describes "packet sniffing" as a process that occurs "when a person plugs a device into a computer network and captures the mode of transmissions, the binary code, that computers use to 'talk' to each other on a network." He claims that "'[p]acket sniffing' is a favorite technique employed by computer 'hackers' — persons who are unauthorized users of a computer network."
Mata contends he objected to this "unlawful intrusion into the Harris County computer system," but Sheriff Garcia and Dyess ordered him to cooperate. Mata was "[d]isturbed by the plan to 'hack' into Harris County's computer system at the order of the Sheriff," so he contacted the Federal Bureau of Investigation. He alleges that he met with the FBI on several occasions and that the FBI asked him to cooperate with an investigation by wearing a recording device to a meeting with Erwin and others. Mata agreed; but in a meeting with Dyess in October 2009, Mata informed Dyess about his cooperation with the FBI and his belief the project with Erwin was unlawful. Mata received "documented counseling" in November 2009 and an "average" performance review in February 2010. He was fired in May 2010.
In addition to the allegations described above, Mata asserted in his petition: "The retaliatory actions taken against Mata were done because of his good faith report of a violation of the law, including, but not limited to, conspiring and/or attempting to compromise a computer system without the consent of the owner in violation of Section 33.02 of the Texas Penal Code and 18 U.S.C. § 1030."
Harris County filed a plea to the jurisdiction, arguing that "Mata's pleading affirmatively negates the existence of jurisdiction under the Act because (1) he alleges only the existence of a 'plan' or 'intent' to hack but not an actual illegal action or violation of a law by a county employee . . . and (2) he identifies Robert Erwin, a person who was not an employee of Harris County, as the potential hacker/wrongdoer and therefore fails to plead the reporting of a violation of a law by a county employee." Mata responded and moved for a continuance. The trial court signed an order granting the plea to the jurisdiction. Mata now challenges that order on appeal.
ANALYSIS
Mata contends he alleged circumstances that waive governmental immunity because he made a good faith report that a Harris County employee conspired or attempted to violate Tex. Penal Code Ann. § 33.02 (Vernon 2011) or 18 U.S.C. § 1030 (2006 & Supp. II 2008) — statutes that criminalize accessing computers without authorization or consent of the owner.
Harris County contends that Mata's petition affirmatively negates the existence of jurisdiction because (1) Mata alleged only a "plan" or "intent" to hack into Harris County's computer system; (2) there was no conspiracy because there was no agreement to commit the alleged underlying crime; and (3) there was no conspiracy under Texas law because the alleged underlying crime was not a felony. We address each contention in turn.
I. Standard of Review
A court lacks jurisdiction if the government is immune from suit. See City of Elsa v. Gonzalez, 325 S.W.3d 622, 625 (Tex. 2010). We review jurisdiction de novo as a question of law. Id. When reviewing a trial court's ruling on a plea to the jurisdiction, we consider the plaintiff's pleadings and relevant evidence, construing the pleadings liberally in favor of the plaintiff. Id. The pleadings may not be conclusory and must include sufficient jurisdictional facts to determine if the trial court has jurisdiction. Id. If the pleadings do not contain sufficient facts to affirmatively demonstrate the trial court's jurisdiction, the plaintiff should be afforded the opportunity to amend unless the pleadings demonstrate incurable jurisdictional defects. Tex. Dep't of Parks & Wildlife v. Miranda, 133 S.W.3d 217, 226 (Tex. 2004).
If the defendant challenges the existence of jurisdictional facts, the trial court and this court consider relevant evidence when necessary to resolve jurisdictional issues. Id. at 227. If the jurisdictional challenge implicates the merits of the plaintiff's case and the evidence creates fact question, then a court cannot grant the plea to the jurisdiction. See id. at 227-28. On the other hand, if the pleadings or evidence affirmatively negate a jurisdictional fact, then a court may grant the plea to the jurisdiction without allowing the plaintiff to amend the pleadings. City of Waco v. Lopez, 259 S.W.3d 147, 150 (Tex. 2008).
II. Waiver of Immunity Under the Texas Whistleblower Act
To establish a waiver of governmental immunity under the Texas Whistleblower Act, a plaintiff must (1) be a public employee; and (2) allege a violation of the Act. State v. Lueck, 290 S.W.3d 876, 881 (Tex. 2009); see Tex. Gov't Code Ann. § 554.0035. A governmental entity violates the Act if it "suspend[s] or terminate[s] the employment of, or take[s] other adverse personnel action against, a public employee who in good faith reports a violation of law by the employing governmental entity or another public employee to an appropriate law enforcement authority." Tex. Gov't Code Ann. § 554.002(a); City of Elsa, 325 S.W.3d at 625.
The good faith requirement involves subjective and objective elements. Tex. Dep't of Transp. v. Needham, 82 S.W.3d 314, 320 (Tex. 2002). The subjective element requires that the employee believes he or she was reporting an actual violation of law. Id. The objective element requires that "a reasonably prudent employee in similar circumstances would have believed that the facts as reported were a violation of law." Id.
"[A]n actual violation of the law is not required by the Whistleblower Act. The Act requires only a good-faith belief that a violation of law has occurred." City of Elsa, 325 S.W.3d at 627 n.3. An employee's "report of an alleged violation of law may be in good faith even though incorrect . . . as long as a reasonable person with the employee's same level of training and experience would also have believed that a violation had occurred." Town of Flower Mound v. Teague, 111 S.W.3d 742, 753 (Tex. App.—Fort Worth 2003, pet. denied). Accordingly, "when an employee believes and reports in good faith that a violation has occurred, but is wrong about the legal effect of the facts, he is nevertheless protected by the whistleblower statute." Tex. Dep't of Criminal Justice v. McElyea, 239 S.W.3d 842, 850 (Tex. App.—Austin 2007, pet. denied); accord Moreno v. Tex. A & M Univ.-Kingsville, 339 S.W.3d 902, 910 (Tex. App.—Corpus Christi 2011, pet. filed). There is no requirement that an employee have "hard evidence to conclusively prove each and every element of a violation of the [law] prior to qualifying for whistleblower status." McElyea, 239 S.W.3d at 853; see also Castaneda v. Tex. Dep't of Agric., 831 S.W.2d 501, 503-04 (Tex. App.—Corpus Christi 1992, writ denied) (describing the test as "any disclosure of information regarding a public servant's employer tending to directly or circumstantially prove the substance of a violation"), superseded by statute on other grounds, Act of May 25, 1995, 74th Leg., R.S., ch. 721, 1995 Tex. Gen. Laws 3812. "But there must be some law prohibiting the complained-of conduct to give rise to a whistleblower claim." McElyea, 239 S.W.3d at 850. "[A]n employee must have a good-faith belief that a law, which in fact exists, was violated." City of Houston v. Cotton, 171 S.W.3d 541, 547 n.10 (Tex. App.—Houston [14th Dist.] 2005, pet. denied).
Harris County challenges Mata's pleadings based on the objective good faith requirement. Harris County does not contend Mata failed to allege that he was a public employee, that he subjectively believed a law was violated, or that the FBI was an appropriate law enforcement authority. Thus, the sole question before us is whether Mata alleged sufficient facts to establish that it was reasonable for him to believe he was reporting a violation of law.
Harris County also references a portion of Mata's deposition testimony, which is consistent with the allegations in the petition.
Based on the facts discussed above, Mata claimed in his petition that he in good faith reported a violation of law, including "conspiring and/or attempting to compromise a computer system without the consent of the owner in violation of Section 33.02 of the Texas Penal Code and 18 U.S.C. § 1030."
Section 33.02 of the Texas Penal Code states that a person "commits an offense if the person knowingly accesses a computer, computer network, or computer system without the effective consent of the owner." Tex. Penal Code Ann. § 33.02(a). A person commits an offense under Texas's attempt statute if, "with specific intent to commit an offense, he does an act amounting to more than mere preparation that tends but fails to effect the commission of the offense intended." Tex. Penal Code Ann. § 15.01(a) (Vernon 2011). A person commits an offense under Texas's conspiracy statute if, "with intent that a felony be committed: (1) he agrees with one or more persons that they or one or more of them engage in conduct that would constitute the offense; and (2) he or one or more of them performs an overt act in pursuance of the agreement." Tex. Penal Code Ann § 15.02(a) (Vernon 2011). "An agreement constituting a conspiracy may be inferred from the acts of the parties." Id. § 15.02(b).
Under federal law, a person commits an offense if the person "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer." 18 U.S.C. § 1030(a)(2)(C). A "protected computer" includes a computer that is "used in or affecting interstate or foreign commerce or communication." Id. § 1030(e)(2)(B).
III. Reasonable Basis for Belief Mata was Reporting a Violation of Law
Harris County contends Mata's belief that he was reporting a violation of law was unreasonable because (1) "the applicable statutes do not criminalize planning or intending to hack into a computer," and Mata "alleged that he reported only the existence of a 'plan' or 'intent' to hack into the County's computer system, not actual 'accessing' of that system;" (2) there was no conspiracy as a matter of law because Mata pleaded that the hacking scheme was "ordered" by the Sheriff, and "[o]bviously, when a supervisor orders a subordinate to take some action, he is not making an 'agreement' with the subordinate;" and (3) there was no conspiracy as a matter of law because at the time "Mata made his report to the FBI, accessing a government computer without consent was a misdemeanor under Texas law, except in limited circumstances which do not appear to be applicable in this case."
A. Mere "Plan" or "Intent"
Harris County characterizes Mata's report as referencing only a "plan" or "intent" to hack Harris County's computer system, "not an actual 'accessing' of that system." Indeed, Mata's petition does not allege that any public employee actually accessed the system. Mata instead alleged a conspiracy or attempt to access the system. We conclude that a person in Mata's position reasonably could believe he was reporting a violation of law — a conspiracy or attempt to access a computer system without authorization or consent. It was not necessary for Mata to allege "an actual 'accessing'" of a computer system, as Harris County contends.
A person may be found guilty of conspiracy or attempt even though the underlying offense was never committed because conspiracy and attempt are preparatory offenses. See Tex. Penal Code Ann. §§ 15.01, 15.02 (no requirement that underlying offense be committed). Liberally construed, Mata's pleadings allege a meeting among Harris County employees who agreed to access computers by relying on a technique to eliminate the need for obtaining proper authorization. A reasonable person in Mata's position could have believed an offense had been committed based on the agreement among Sheriff Garcia, Dyess, and Erwin, and the overt acts of Sheriff Garcia and Dyess ordering Mata to cooperate with Erwin. Cf. Barber v. State, 764 S.W.2d 232, 235 n.1 (Tex. Crim. App. 1988) ("ring leader" of organized criminal activity may "perform[] the overt act of soliciting and organizing others in furtherance of the combination"). Mata may have been incorrect that an actual conspiracy was formed or an attempt made, but the facts alleged in his petition are consistent with criminal liability for conspiracy and attempt under Texas and federal law. Mata has pointed to actual laws that prohibit the complained-of conduct.
Although Mata's petition does not allege any facts to support a conclusion that the computers involved were "protected" under 18 U.S.C. § 1030, we note that a plaintiff is not required to conclusively establish each element of the violation of a law with certainty; Mata only needed to reasonably believe a violation had occurred. See McElyea, 239 S.W.3d at 853.
B. Order from Supervisor
Harris County suggests Mata's petition negates the existence of a conspiratorial agreement altogether because he was "ordered" by superiors to participate in the alleged conspiracy. "Obviously," Harris County argues, "when a supervisor orders a subordinate to take some action, he is not making an 'agreement' with the subordinate." In making this argument, Harris County relies on Bernegger v. Adams, No. 3:10CV5-M-A, 2010 WL 2243423 (N.D. Miss. June 1, 2010). This reliance is misplaced because Bernegger concluded a party who was "forced" to participate was not in a conspiracy. See id. at *3. Unlike Bernegger, Mata does not allege that he was a member of the conspiracy; he alleges facts that would allow a person to reasonably believe there was an agreement among Sheriff Garcia, Dyess, and Erwin. In any event, Harris County cites no authority for the proposition that the existence of an employer-employee relationship precludes a conspiratorial agreement, and authority exists to the contrary. See Baker v. United States, 393 F.2d 604, 609 (9th Cir. 1968); Nolte v. Gibbs Int'l, Inc., 515 S.E.2d 101, 103 n.1 (S.C. Ct. App. 1998). Accordingly, it was reasonable for Mata to believe that there was a conspiracy to violate Tex. Penal Code Ann. § 33.02 or 18 U.S.C. § 1030.
C. Misdemeanor
Harris County contends that Mata appears to have alleged an agreement to commit a misdemeanor rather than a felony, and thus, there could be no conspiracy under Texas law. See Tex. Penal Code Ann § 15.02(a). Although some violations of Section 33.02 of the Penal Code are misdemeanors for which a conspiracy could not be formed, Mata's petition does not affirmatively negate the alleged conspirators' intent to commit a felony. See Tex. Penal Code Ann. § 33.02(b)(2)(A) (state jail felony if the actor knowingly obtains a benefit, defrauds or harms another, or alters, damages, or deletes property, and the aggregate amount involved is $1,500 to $20,000). Further, 18 U.S.C. § 1030 criminalizes conspiring or attempting to commit an offense, with no apparent requirement that the conspirators intended for a felony to be committed. See 18 U.S.C. § 1030(b); cf. 18 U.S.C. § 371 (2006) (target crime of a conspiracy to commit an offense against the United States may be a misdemeanor). Thus, it was reasonable for Mata to believe he was reporting a violation of law.
After the alleged conspiracy in this case, the Legislature amended Section 33.02 to make an offense a felony if "the computer, computer network, or computer system is owned by the government." See Tex. Penal Code Ann. § 33.02(b)(2) (Vernon Supp. 2011).
The trial court erred by granting Harris County's plea to the jurisdiction. Mata's issues are sustained.
In light of this disposition, we do not address the parties' arguments regarding Mata's motion for continuance. See Tex. R. App. P. 47.1.
CONCLUSION
Having sustained appellant's issues regarding the plea to the jurisdiction, we reverse the trial court's order and remand for further proceedings.
William J. Boyce
Justice
Panel consists of Justices Seymore and Boyce and Senior Justice Mirabal.
Senior Justice Margaret Garner Mirabal sitting by assignment.