BACKGROUND

Andrea Clare and Kevin Clare were married for ten years. During the marriage, Kevin “regularly and routinely” sought access to Andrea’s cell phone, text messages, e-mail, computer, and other electronic equipment. As their relationship deteriorated and she became unhappy with his behavior, Andrea told Kevin to stop looking at her messages and attempted to block his access by changing her iPhone passcode. The phone could be accessed only with Andrea’s thumbprint or with the new passcode, which Andrea did not share with Kevin. One night while Andrea slept, Kevin used her thumbprint to unlock her phone, accessed her work e- mail through Microsoft Exchange, and forwarded approximately ten e-mails to himself.

When Andrea moved out of the family home, she continued her efforts to stop Kevin’s invasions of privacy by changing cell phone carriers and purchasing a new iPhone. Kevin’s conduct continued. He accessed and read her work e-mail on a formerly shared iPad and used the information he learned to his advantage during the couple’s divorce proceedings.

This conduct, some of which Kevin has admitted, formed the basis of the case that Andrea and her law firm employer later initiated against Kevin and his divorce lawyer. After the other parties resolved their claims, Andrea filed a second amended complaint alleging one cause of action against Kevin under the Stored Communications Act, 18 U.S.C. § 2701 et seq.

Soon after discovery began, Kevin moved for summary judgment, contending that Andrea lacked evidence that the e-mails he accessed were in backup storage within the meaning of the SCA. In opposition, Andrea submitted the declaration of Dan Morgan, an employee of the Information Technology (IT) company that provided data protection services to her law firm. Asked to investigate whether there had been unauthorized access into Andrea’s Microsoft

CLARE V. CLARE 5

Exchange law firm account, Morgan concluded that an Apple device other than Andrea’s cell phone or home computer logged in using her credentials in both 2017 and 2018. Morgan also described the private server that he and his company maintained for backup storage of the firm’s e- mails.

The district court disregarded the Morgan declaration because it did not describe his expert qualifications or how he reached his conclusions on unauthorized access. The court then granted summary judgment in favor of Kevin because Andrea “failed to show that the e-mails [Kevin] allegedly accessed were in ‘back up storage’ as defined by the SCA.”

LEGAL STANDARD

We review de novo a district court’s grant of summary judgment. Flores v. City of San Gabriel, 824 F.3d 890, 897 (9th Cir. 2016). We review evidentiary rulings for an abuse of discretion “even when the rulings determine the outcome of a motion for summary judgment.” Domingo v. T.K., 289 F.3d 600, 605 (9th Cir. 2002).

DISCUSSION

We are presented with two questions: (1) Whether the district court abused its discretion by excluding the Morgan declaration; and (2) Whether there is evidence that Andrea’s e-mails were in “electronic storage” within the meaning of the SCA. We answer both in the affirmative.

I. Evidentiary Ruling

We reverse in part the district court’s exclusion of the Morgan declaration because it was an abuse of discretion to disregard Morgan’s personal knowledge about Andrea’s e- mail storage. The declaration describes the law firm’s storage practices as follows:

With regards to the manner in which the firm’s e-mail accounts, calendars, and contacts are stored in Exchange, like all the firm’s computer/data systems, we maintain a private local server which is protected by firewall for the firm’s security. . . . [T]he firm’s Microsoft Exchange email service is owned by the law firm, hosted by Microsoft, but all the email accounts and security controls are managed exclusively by Teknologize [Morgan’s IT company].

According to Morgan, the firm’s e-mails are “regularly downloaded and stored for both security and backup protection” on the private server paid for by the firm and maintained by the IT company.

This evidence, which is based on Morgan’s personal knowledge, does not require expert qualification. As a result of his employment with the IT company that services Andrea’s law firm, Morgan is aware of the private server his company maintains for storage of the law firm’s e-mails and other materials. The information he provides in paragraphs five and six is far from technical. Instead, Morgan offers lay witness evidence. A plumber may not be qualified to describe the inner workings of a garbage disposal but can certainly observe the presence of such a unit in a particular customer’s sink. Here, Morgan’s description of the existence of a backup drive on the law firm’s computer system creates a genuine dispute of material fact on the

CLARE V. CLARE 7

narrow issue that formed the basis of the district court’s summary judgment ruling. 1

II. Summary Judgment Ruling

A. The SCA and Backup Storage

In the SCA, Congress created a private cause of action against one who “intentionally accesses without authorization [or intentionally exceeds an authorization to access] a facility through which an electronic communication service is provided . . . and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.” 18 U.S.C. §§ 2701(a)(1), 2707(a). “[E]lectronic storage” is: “(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication[.]” 18 U.S.C. § 2510(17), incorporated by 18 U.S.C. § 2711(1).

We have provided guidance on what it means to store messages “for purposes of backup protection” under subsection (B) of the SCA. See Theofel v. Farey-Jones, 359 F.3d 1066, 1075 (9th Cir. 2004). The defendants there accessed the plaintiffs’ e-mails using a “patently unlawful” subpoena to their internet service provider (ISP). Id. at 1071–72 (quoting the district court). The district court dismissed the SCA claim, and we reversed. Id. at 1072–77.

1 We need not address the district court’s ruling with respect to Morgan’s expert opinions on the outside access into Andrea’s Microsoft Exchange account in 2017 and 2018 because the lay aspects of the declaration make summary judgment inappropriate. As relevant here, we rejected the argument that the accessed messages were not in “electronic storage” within the meaning of the Act. Id. at 1075–77. The plaintiffs’ e- mails, which remained on the ISP’s server post-delivery, “fit comfortably” within subsection (B). Id. at 1075. They were stored “for purposes of backup protection” because an “obvious purpose” for storing a delivered message on an ISP’s server is to maintain a backup copy “in the event that the user needs to download it again.” Id. We distinguished a user whose only storage was on a remote computing service, in which case the messages would not be stored for “backup purposes.” Id. at 1077.

B. Application

Notwithstanding the complexities of the SCA and the greater complexities of modern technology, our discussion of subsection (B) in Theofel was based on a straightforward premise: for an e-mail to be stored “for purposes of backup protection,” there must be a second, backup copy of the message. See id. at 1075, 1077. The Morgan declaration provides evidence of exactly that. Viewing the record in the light most favorable to Andrea, she stores her e-mails for backup purposes on both her Microsoft Exchange account and on the private server paid for by her firm and maintained by the IT company. Thus, the Morgan declaration creates a genuine dispute of material fact with respect to whether the e-mails Kevin accessed are entitled to protection under subsection (B) of the SCA.

Neither party raises the minor distinction between this case and the facts of Theofel, namely that Kevin hacked into Andrea’s e-mail through Microsoft Exchange, the same point of access she uses. By contrast, in Theofel the defendants accessed the ISP’s copies of the plaintiffs’ e- mails rather than the copies downloaded onto the plaintiffs’

CLARE V. CLARE 9

own devices. See id. at 1075. We agree with the Fourth Circuit’s recent rejection of any distinction between the protection afforded to “service copies,” i.e., those immediately accessible to a user, and “storage copies,” i.e., those less conveniently accessible. See Hately v. Watts, 917 F.3d 770, 796 n.8 (4th Cir. 2019). Further, Andrea asserts that both copies of her e-mails are stored for purposes of backup protection; accordingly, both could be entitled protection under subsection (B). See id. (“Neither the [SCA] nor its legislative history limits the scope of messages in ‘electronic storage’ under Subsection (B) to a single backup copy or type of backup copy.”). It is immaterial that Kevin accessed Andrea’s e-mails via the same platform she uses.

Kevin asserts that Andrea cannot rely on the Morgan declaration to manufacture a dispute in light of her earlier declaration that her firm “does not store e-mail on a server in the office.” But the summary judgment standard requires us to resolve all disputes in favor of the non-moving party and therefore to credit fully the admissible portions of the Morgan declaration. Further, Andrea’s statement would not contradict the evidence in the declaration if discovery reveals that the firm’s private server is located somewhere other than its own office. 2

We briefly address Andrea’s contention that her SCA claim should have survived summary judgment even without the Morgan declaration because she stores e-mails for backup purposes on her Microsoft Exchange account. Her argument begs a question that other courts have faced: whether e-mail messages maintained only on a web-based platform can fall within the purview of subsection (B). See,

2 The Morgan declaration does not indicate the location of the private server. e.g., Hately, 917 F.3d at 790–97; Cline v. Reetz-Laiolo, 329 F. Supp. 3d 1000, 1044 (N.D. Cal. 2018); Cheng v. Romo, No. 11-cv-10007, 2013 WL 6814691, at *3 (D. Mass. Dec. 20, 2013). We cannot answer this question today. Not only does the admissibility of Dan Morgan’s observations make it unnecessary, but the record before us entirely lacks information on Microsoft Exchange’s role or functioning, most critically its e-mail storage practices. See Hately, 917 F.3d at 791–92 (detailing Google’s “redundant systems” manner of storing a single e-mail on multiple servers). Further, the parties have not adequately briefed whether the reasoning of cases like Hately is consistent with our observation in Theofel that “[a] remote computing service might be the only place a user stores his messages; in that case, the messages are not stored for backup purposes.” See Theofel, 359 F.3d at 1077.

CONCLUSION

We REVERSE in part the district court’s evidentiary ruling, REVERSE summary judgment on the SCA claim, and REMAND the case for further proceedings consistent with this opinion.

REVERSED and REMANDED. Costs awarded to Appellant.