Facebook, Inc. v. Steven Vachani

FOR PUBLICATION

UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT

FACEBOOK, INC., a Delaware No. 13-17102
corporation,
Plaintiff-Appellee, D.C. No.
5:08-cv-05780-LHK
v.

POWER VENTURES, INC., DBA
Power.com, a California
corporation; POWER VENTURES,
INC., a Cayman Island
corporation,
Defendants,

and

STEVEN SURAJ VACHANI, an
individual,
Defendant-Appellant.
2 FACEBOOK V. VACHANI

FACEBOOK, INC., a Delaware No. 13-17154
corporation,
Plaintiff-Appellee, D.C. No.
5:08-cv-05780-LHK
v.

POWER VENTURES, INC., DBA ORDER AND
Power.com, a California AMENDED
corporation, OPINION
Defendant,

and

POWER VENTURES, INC., a
Cayman Island corporation; and
Steven Suraj Vachani, an
individual,
Defendants Appellants.

Appeals from the United States District Court
for the Northern District of California
Lucy H. Koh, District Judge, Presiding

Argued and Submitted December 9, 2015
San Francisco, California

Filed July 12, 2016
Amended December 9, 2016

Before: Susan P. Graber, Kim McLane Wardlaw,
and Mary H. Murguia, Circuit Judges.

Opinion by Judge Graber
 FACEBOOK V. VACHANI 3

SUMMARY*

CAN-SPAM Act / Computer Fraud

The panel filed an order denying a petition for panel
rehearing and rehearing en banc and amending its opinion
affirming in part and reversing and vacating in part the
district court’s summary judgment in favor of Facebook, Inc.,
on Facebook’s claims against Power Ventures, Inc., a social
networking company that accessed Facebook users’ data
and initiated form e-mails and other electronic messages
promoting its website.

Reversing in part, the panel held that Power’s actions did
not violate the Controlling the Assault of Non-Solicited
Pornography and Marketing Act of 2003, or CAN-SPAM
Act, which grants a private right of action for a provider of
Internet access service adversely affected by the transmission,
to a protected computer, of a message that contains, or is
accompanied by, header information that is materially false
or materially misleading. The panel held that here, the
transmitted messages were not materially misleading.

Reversing in part and affirming in part, the panel held that
Power violated the Computer Fraud and Abuse Act of 1986,
or CFAA, which prohibits acts of computer trespass by those
who are not authorized users or who exceed authorized use,
and California Penal Code § 502, but only after it received a
cease and desist letter from Facebook and nonetheless
continued to access Facebook’s computers without

*
This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
4 FACEBOOK V. VACHANI

permission. With regard to authorization, the panel stated
that a defendant can run afoul of the CFAA when he or she
has no permission to access a computer or when such
permission has been revoked explicitly. Once permission has
been revoked, technological gamesmanship or the enlisting of
a third party to aid in access will not excuse liability. The
panel also stated that a violation of the terms of use of a
website, without more, cannot be the basis for liability under
the CFAA.

The panel vacated the district court’s awards of injunctive
relief and damages and remanded for consideration of
appropriate remedies under the CFAA and § 502.

COUNSEL

Amy Sommer Anderson (argued), Aroplex Law, San
Francisco, California; Steven Vachani (argued pro se),
Berkeley, California, for Defendants-Appellants.

Eric A. Shumsky (argued), Orrick, Herrington & Sutcliffe
LLP, Washington, D.C.; I. Neel Chatterjee, Monte Cooper,
Brian P. Goldman, and Robert L. Uriarte, Orrick, Herrington
& Sutcliffe LLP, Menlo Park, California, for Plaintiff-
Appellee.

Jamie L. Williams (argued), Hanni M. Fakhoury, and Cindy
A. Cohn, Electronic Frontier Foundation, San Francisco,
California, as and for Amicus Curiae.
 FACEBOOK V. VACHANI 5

ORDER

The opinion filed July 12, 2016, and published at 828
F.3d 1068, is amended by the opinion filed concurrently with
this order.

With these amendments, the panel has voted to deny the
petition for panel rehearing and rehearing en banc.

The full court has been advised of the petition for
rehearing en banc, and no judge of the court has requested a
vote on it.

The petition for panel rehearing and rehearing en banc is
DENIED. No further petitions for panel rehearing or
rehearing en banc shall be entertained.

OPINION

GRABER, Circuit Judge:

One social networking company, Facebook, Inc., has sued
another, Power Ventures, Inc., over a promotional campaign.
Power accessed Facebook users’ data and initiated form e-
mails and other electronic messages promoting its website.
Initially, Power had implied permission from Facebook. But
Facebook sent Power a cease and desist letter and blocked
Power’s IP address; nevertheless Power continued its
campaign. Facebook alleges that Power’s actions violated the
Controlling the Assault of Non-Solicited Pornography and
Marketing Act of 2003 (“CAN-SPAM”), the Computer Fraud
and Abuse Act of 1986 (“CFAA”), and California Penal Code
6 FACEBOOK V. VACHANI

section 502. We hold that Power did not violate the CAN-
SPAM Act because the transmitted messages were not
materially misleading. We also hold that Power violated the
CFAA and California Penal Code section 502 only after it
received Facebook’s cease and desist letter and nonetheless
continued to access Facebook’s computers without
permission. Accordingly, we affirm in part, reverse in part,
and remand to the district court.

BACKGROUND

Defendant Power Ventures, a corporation founded and
directed by CEO Steven Vachani, who also is a defendant
here, operated a social networking website, Power.com. The
concept was simple. Individuals who already used other
social networking websites could log on to Power.com and
create an account. Power.com would then aggregate the
user’s social networking information. The individual, a
“Power user,” could see all contacts from many social
networking sites on a single page. The Power user thus could
keep track of a variety of social networking friends through
a single program and could click through the central Power
website to individual social networking sites. By 2008, the
website had attracted a growing following.

Plaintiff Facebook also operates a social networking
website, Facebook.com. Facebook users, who numbered
more than 130 million during Power’s promotional campaign,
can create a personal profile—a web page within the
site—and can connect with other users. Facebook requires
each user to register before accessing the website and requires
that each user assent to its terms of use. Once registered, a
Facebook user can create and customize her profile by adding
personal information, photographs, or other content. A user
 FACEBOOK V. VACHANI 7

can establish connections with other Facebook users by
“friending” them; the connected users are thus called
“friends.”

Facebook has tried to limit and control access to its
website. A non-Facebook user generally may not use the
website to send messages, post photographs, or otherwise
contact Facebook users through their profiles. Instead,
Facebook requires third-party developers or websites that
wish to contact its users through its site to enroll in a program
called Facebook Connect. It requires these third parties to
register with Facebook and to agree to an additional
Developer Terms of Use Agreement.

In December 2008, Power began a promotional campaign
to attract more traffic to its website; it hoped that Facebook
users would join its site. Power placed an icon on its website
with a promotional message that read: “First 100 people who
bring 100 new friends to Power.com win $100.” The icon
included various options for how a user could share Power
with others. The user could “Share with friends through my
photos,” “Share with friends through events,” or “Share with
friends through status.” A button on the icon included the
words “Yes, I do!” If a user clicked the “Yes, I do!” button,
Power would create an event, photo, or status on the user’s
Facebook profile.

In many instances, Power caused a message to be
transmitted to the user’s friends within the Facebook system.
In other instances, depending on a Facebook user’s settings,
Facebook generated an e-mail message. If, for example, a
Power user shared the promotion through an event, Facebook
generated an e-mail message to an external e-mail account
from the user to friends. The e-mail message gave the name
8 FACEBOOK V. VACHANI

and time of the event, listed Power as the host, and stated that
the Power user was inviting the recipient to this event. The
external e-mails were form e-mails, generated each time that
a Facebook user invited others to an event. The “from” line
in the e-mail stated that the message came from Facebook;
the body was signed, “The Facebook Team.”

On December 1, 2008, Facebook first became aware of
Power’s promotional campaign and, on that same date,
Facebook sent a “cease and desist” letter to Power instructing
Power to terminate its activities. Facebook tried to get Power
to sign its Developer Terms of Use Agreement and enroll in
Facebook Connect; Power resisted. Facebook instituted an
Internet Protocol (“IP”) block in an effort to prevent Power
from accessing the Facebook website from Power’s IP
address. Power responded by switching IP addresses to
circumvent the Facebook block. Through this period, Power
continued its promotion even though it acknowledged that it
took, copied, or made use of data from Facebook.com without
Facebook’s permission.

Power’s campaign lasted less than two months. On
December 20, 2008, Facebook filed this action. Toward the
end of January 2009, Power ended its campaign. In April
2011, Power ceased doing business altogether. In total, more
than 60,000 external e-mails promoting Power were sent
through the Facebook system. An unknown number of
internal Facebook messages were also transmitted.

In this action, Facebook alleged violations of the CFAA,
the CAN-SPAM Act, and California Penal Code section 502
and moved for summary judgment. The district court granted
summary judgment to Facebook on all three claims. The
district court awarded statutory damages of $3,031,350,
 FACEBOOK V. VACHANI 9

compensatory damages, and permanent injunctive relief, and
it held that Vachani was personally liable for Power’s actions.
Discovery disputes persisted after the judgment; a magistrate
judge ordered Power to pay $39,796.73 in costs and fees for
a renewed Federal Civil Procedure Rule 30(b)(6) deposition.
Power filed a motion for reconsideration, which the district
court denied. Defendants timely appeal both the judgment
and the discovery sanctions.

STANDARD OF REVIEW

We review de novo a grant of summary judgment.
Johnson v. Poway Unified Sch. Dist., 658 F.3d 954, 960 (9th
Cir. 2011). We may affirm the judgment on any ground
supported by the record and presented to the district court.
Venetian Casino Resort L.L.C. v. Local Joint Exec. Bd.,
257 F.3d 937, 941 (9th Cir. 2001).

DISCUSSION

A. CAN-SPAM Act

The CAN-SPAM Act grants a private right of action for
a “provider of Internet access service adversely affected by a
violation of section 7704(a)(1) of this title.” 15 U.S.C.
§ 7706(g)(1). In relevant part, § 7704(a)(1) makes it unlawful
for “any person to initiate the transmission, to a protected
computer, of a commercial electronic mail message, or a
transactional or relationship message, that contains, or is
accompanied by, header information that is materially false
or materially misleading.”

The CAN-SPAM Act “does not ban spam outright, but
rather provides a code of conduct to regulate commercial e-
10 FACEBOOK V. VACHANI

mail messaging practices.” Gordon v. Virtumundo, Inc.,
575 F.3d 1040, 1047–48 (9th Cir. 2009). To prove a violation
of the statute, Facebook cannot simply identify excessive
electronic messages. Rather, assuming all facts in favor of
the non-moving party, the offending messages must be
“materially false” or “materially misleading.” 15 U.S.C.
§ 7704(a)(1).

The statute provides that

the term “materially,” when used with respect
to false or misleading header information,
includes the alteration or concealment of
header information in a manner that would
impair the ability of an Internet access service
processing the message on behalf of a
recipient, a person alleging a violation of this
section, or a law enforcement agency to
identify, locate, or respond to a person who
initiated the electronic mail message or to
investigate the alleged violation, or the ability
of a recipient of the message to respond to a
person who initiated the electronic message.

Id. § 7704(a)(6). A “from” line “that accurately identifies any
person who initiated the message shall not be considered
materially false or materially misleading.” Id.
§ 7704(a)(1)(B). And, further, “header information that is
technically accurate but includes an originating electronic
mail address, domain name, or Internet Protocol address the
access to which for purposes of initiating the message was
obtained by means of false or fraudulent pretenses or
representations shall be considered materially misleading.”
Id. § 7704(a)(1)(A).
 FACEBOOK V. VACHANI 11

Here, two types of messages might rise to the level of
“materially misleading” under the CAN-SPAM Act: external
e-mails sent when Power caused a Facebook event to be
created and internal Facebook messages authored by Power
that Power users transmitted to their Facebook friends.

We first consider the external e-mails. Facebook
generated these e-mails whenever a Power user created a
Facebook event, promoting Power. The “from” line of the e-
mails identified “Facebook” as the sender. The body was
signed “Thanks, The Facebook Team.” The header stated
that a friend of the recipient invited her to an event entitled
“Bring 100 friends and win 100 bucks!”

Because the statute provides that a “from” line that
accurately identifies a person who initiated the message is not
misleading, it is relevant whether Facebook, identified in the
from line, initiated the messages. The statute defines
“initiate” as “to originate or transmit such message or to
procure the origination or transmission of such message, but
shall not include actions that constitute routine conveyance of
such message.” Id. § 7702(9). It provides that “more than
one person may be considered to have initiated a message.”
Id. A Power user gave Power permission to share a
promotion, Power then accessed that user’s Facebook data,
and Facebook crafted and caused form e-mails to be sent to
recipients. These actions all go beyond the routine
conveyance of a message. All the actions require some
affirmative consent (clicking the “Yes, I do!” button) or some
creative license (designing the form e-mails). Because more
than one person may be considered to have initiated the
message, we hold that, within the meaning of the statute,
Power’s users, Power, and Facebook all initiated the
messages at issue.
12 FACEBOOK V. VACHANI

Because Facebook (among others) initiated the messages,
the “from” line accurately identified a person who initiated
the messages. Accordingly, the “from” line is not misleading
within the meaning of the statute. Similar reasoning also
leads us to conclude that the header is technically accurate.
Because a Power user consented to share Power’s promotion
through an event invitation, a header line that stated that a
recipient’s friend “invited” the recipient to the event does not
conceal or misstate a creator of the e-mail.

It is true that the CAN-SPAM Act includes as materially
misleading a technically accurate header that includes
information accessed through false or fraudulent pretenses or
representations. Id. § 7704(a)(1)(A). But Power users
consented to Power’s access to their Facebook data. In
clicking “Yes, I do!,” users gave Power permission to share
its promotion through event invitations. On this record,
Power did not use false pretenses or fraudulent
representations to obtain users’ consent. Therefore, the
external messages were not materially misleading within the
meaning of the CAN-SPAM Act.

We next consider internal messages sent within the
Facebook system. We can find these messages misleading
only if they impaired the ability of the recipient to “respond
to a person who initiated the electronic mail message” or the
ability of Facebook to locate the initiator of the messages. Id.
§ 7704(a)(6). Two factors convince us that the messages are
not misleading under this standard. First, the body of the
messages included both Power’s name and a link to the
Power website. A reasonable recipient could understand that
Power had drafted the message or had some part in its
construction. Second, Facebook users who were identified as
the senders did authorize the sending of these messages. It
 FACEBOOK V. VACHANI 13

was not misleading for such users to be identified in internal
messages sent through the Facebook system.

Because neither e-mails nor internal messages sent
through Power’s promotional campaign were materially
misleading, Power did not violate the CAN-SPAM Act. We
reverse the district court on this claim and remand for entry
of judgment in favor of Defendants.

B. CFAA

The CFAA prohibits acts of computer trespass by those
who are not authorized users or who exceed authorized use.
It creates criminal and civil liability for whoever
“intentionally accesses a computer without authorization or
exceeds authorized access, and thereby obtains . . .
information from any protected computer.” 18 U.S.C.
§ 1030(a)(2)(C). “The statute thus provides two ways of
committing the crime of improperly accessing a protected
computer: (1) obtaining access without authorization; and
(2) obtaining access with authorization but then using that
access improperly.” Musacchio v. United States, 136 S. Ct.
709, 713 (2016). The CFAA provides a private right of
action for “[a]ny person who suffers damage or loss by reason
of a violation of this section.” 18 U.S.C. § 1030(g).

First, we hold that Facebook suffered a loss within the
meaning of the CFAA. The statute permits a private right of
action when a party has suffered a loss of at least $5,000
during a one-year period. Id. § 1030(c)(4)(A)(i)(I). The
statute defines “loss” to mean “any reasonable cost to any
victim, including the cost of responding to an offense,
conducting a damage assessment, and restoring the data,
program, system, or information to its condition prior to the
14 FACEBOOK V. VACHANI

offense, and any revenue lost, cost incurred, or other
consequential damages incurred because of interruption of
service.” Id. § 1030(e)(11). It is undisputed that Facebook
employees spent many hours, totaling more than $5,000 in
costs, analyzing, investigating, and responding to Power’s
actions. Accordingly, Facebook suffered a loss under the
CFAA.

We next consider whether Power accessed Facebook’s
computers knowing that it was not authorized to do so. We
have previously considered whether a defendant has accessed
a computer “without authorization” or in a manner that
“exceeds authorized access” under the CFAA.

In LVRC Holdings LCC v. Brekka, 581 F.3d 1127 (9th
Cir. 2009), an employee logged onto his employer’s
computer, accessed confidential information, and sent e-mails
from the computer to himself and his wife with the intention
of starting a competing business. We held that a person is
“without authorization” under the CFAA “when the person
has not received permission to use the computer for any
purpose (such as when a hacker accesses someone’s computer
without any permission), or when the employer has rescinded
permission to access the computer and the defendant uses the
computer anyway.” Id. at 1135. Because the employee had
sent e-mails while he still had authorized access to the
company’s computers, his actions did not constitute
unauthorized use and did not run afoul of the CFAA. Id.
That fact was key; had the employee accessed company
computers without express permission, he would have
violated the CFAA. “[I]f [the employee had] accessed
LVRC’s information on the LOAD website after he left the
company in September 2003, [the employee] would have
 FACEBOOK V. VACHANI 15

accessed a protected computer ‘without authorization’ for
purposes of the CFAA.” Id. at 1136.

In United States v. Nosal, 676 F.3d 854 (9th Cir. 2012)
(en banc) (“Nosal I”), a criminal case, we considered whether
a group of employees who logged on to a work computer,
downloaded information from a confidential database, and
transferred it to a competing business “exceed[ed] authorized
access.” Id. at 856. Wary of creating a sweeping Internet-
policy mandate, we applied the rule of lenity to the CFAA
and reversed liability for the defendant. Id. at 863. The
decision broadly described the application of the CFAA to
websites’ terms of service. “Not only are the terms of service
vague and generally unknown . . . but website owners retain
the right to change the terms at any time and without notice.”
Id. at 862. As a result, imposing criminal liability for
violations of the terms of use of a website could criminalize
many daily activities. Accordingly, “the phrase ‘exceeds
authorized access’ in the CFAA does not extend to violations
of use restrictions. If Congress wants to incorporate
misappropriation liability into the CFAA, it must speak more
clearly.” Id. at 863.

From those cases, we distill two general rules in analyzing
authorization under the CFAA. First, a defendant can run
afoul of the CFAA when he or she has no permission to
access a computer or when such permission has been revoked
explicitly. Once permission has been revoked, technological
gamesmanship or the enlisting of a third party to aid in access
will not excuse liability. Second, a violation of the terms of
use of a website—without more—cannot establish liability
16 FACEBOOK V. VACHANI

under the CFAA.1 Our analysis also is consistent with United
States v. Nosal, 828 F.3d 865 (9th Cir. 2016) (“Nosal II”).

Here, initially, Power users arguably gave Power
permission to use Facebook’s computers to disseminate
messages. Power reasonably could have thought that consent
from Facebook users to share the promotion was permission
for Power to access Facebook’s computers.2 In clicking the
“Yes, I do!” button, Power users took action akin to allowing
a friend to use a computer or to log on to an e-mail account.
Because Power had at least arguable permission to access
Facebook’s computers, it did not initially access Facebook’s
computers “without authorization” within the meaning of the
CFAA.

But Facebook expressly rescinded that permission when
Facebook issued its written cease and desist letter to Power
on December 1, 2008. Facebook’s cease and desist letter
informed Power that it had violated Facebook’s terms of use
and demanded that Power stop soliciting Facebook users’
information, using Facebook content, or otherwise interacting

1
One can imagine situations in which those two principles might be in
tension—situations in which, for example, an automatic boilerplate
revocation follows a violation of a website’s terms of use—but we need
not address or resolve such questions on the stark facts before us.
2
Because, initially, Power users gave Power permission to use
Facebook’s computers to disseminate messages, we need not decide
whether websites such as Facebook are presumptively open to all comers,
unless and until permission is revoked expressly. See Orin S. Kerr, Norms
of Computer Trespass, 116 Colum. L. Rev. 1143, 1163 (2016) (asserting
that “websites are the cyber-equivalent of an open public square in the
physical world”).
 FACEBOOK V. VACHANI 17

with Facebook through automated scripts.3 Facebook then
imposed IP blocks in an effort to prevent Power’s continued
access.

The record shows unequivocally that Power knew that it
no longer had authorization to access Facebook’s computers,
but continued to do so anyway. In requests for admission
propounded during the course of this litigation, Power
admitted that, after receiving notice that its use of or access
to Facebook was forbidden by Facebook, it “took, copied, or
made use of data from the Facebook website without
Facebook’s permission to do so.” (Emphasis added;
capitalization omitted.) Contemporaneously, too, soon after
receiving the cease and desist letter, Power’s CEO sent an e-
mail stating: “[W]e need to be prepared for Facebook to try
to block us and the [sic] turn this into a national battle that
gets us huge attention.” On December 4, 2008, a Power
executive sent an e-mail agreeing that Power engaged in four
“prohibited activities”4; acknowledging that Power may have
“intentionally and without authorization interfered with
[Facebook’s] possessory interest in the computer system,”
while arguing that the “unauthorized use” did not cause

3
The mention of the terms of use in the cease and desist letter is not
dispositive. Violation of Facebook’s terms of use, without more, would
not be sufficient to impose liability. Nosal I, 676 F.3d at 862–63. But, in
addition to asserting a violation of Facebook’s terms of use, the cease and
desist letter warned Power that it may have violated federal and state law
and plainly put Power on notice that it was no longer authorized to access
Facebook’s computers.
4
The activities were: “- Using a person’s Facebook account without
Facebook’s authorization; - Using automated scripts to collect information
from their site; - Incorporating Facebook’s site in another database[; and] -
Using Facebook’s site for commercial purposes[.]”
18 FACEBOOK V. VACHANI

damage to Facebook; and noting additional federal and state
statutes that Power “may also be accused of violating,”
beyond those listed in Facebook’s cease and desist letter. E-
mails sent later in December 2008 discussed the IP blocks
that Facebook had imposed and the measures that Power took
to evade them. Nevertheless, Power continued to access
Facebook’s data and computers without Facebook’s
permission.

The consent that Power had received from Facebook users
was not sufficient to grant continuing authorization to access
Facebook’s computers after Facebook’s express revocation of
permission. An analogy from the physical world may help to
illustrate why this is so. Suppose that a person wants to
borrow a friend’s jewelry that is held in a safe deposit box at
a bank. The friend gives permission for the person to access
the safe deposit box and lends him a key. Upon receiving the
key, though, the person decides to visit the bank while
carrying a shotgun. The bank ejects the person from its
premises and bans his reentry. The gun-toting jewelry
borrower could not then reenter the bank, claiming that access
to the safe deposit box gave him authority to stride about the
bank’s property while armed. In other words, to access the
safe deposit box, the person needs permission both from his
friend (who controls access to the safe) and from the bank
(which controls access to its premises). Similarly, for Power
to continue its campaign using Facebook’s computers, it
needed authorization both from individual Facebook users
(who controlled their data and personal pages) and from
Facebook (which stored this data on its physical servers).
Permission from the users alone was not sufficient to
constitute authorization after Facebook issued the cease and
desist letter.
 FACEBOOK V. VACHANI 19

In sum, as it admitted, Power deliberately disregarded the
cease and desist letter and accessed Facebook’s computers
without authorization to do so. It circumvented IP barriers
that further demonstrated that Facebook had rescinded
permission for Power to access Facebook’s computers.5 We
therefore hold that, after receiving written notification from
Facebook on December 1, 2008, Power accessed Facebook’s
computers “without authorization” within the meaning of the
CFAA and is liable under that statute.

Nosal I is materially distinguishable. First, Nosal I
involved employees of a company who arguably exceeded the
limits of their authorization. 676 F.3d at 856. Here, by
contrast, Facebook explicitly revoked authorization for any
access, and this case does not present the more nuanced
question of exceeding authorization. Nosal I involved a
defendant who “exceeded authorization,” while this case
involves a defendant who accessed a computer “without
authorization.” Second, although Nosal I makes clear that
violation of the terms of use of a website cannot itself
constitute access without authorization, this case does not
involve non-compliance with terms and conditions of service.
Facebook and Power had no direct relationship, and it does
not appear that Power was subject to any contractual terms
that it could have breached. Finally, Nosal I was most
concerned with transforming “otherwise innocuous behavior
into federal crimes simply because a computer is involved.”

5
Simply bypassing an IP address, without more, would not constitute
unauthorized use. Because a blocked user does not receive notice that he
has been blocked, he may never realize that the block was imposed and
that authorization was revoked. Or, even if he does discover the block, he
could conclude that it was triggered by misconduct by someone else who
shares the same IP address, such as the user’s roommate or co-worker.
20 FACEBOOK V. VACHANI

Id. at 860. It aimed to prevent criminal liability for computer
users who might be unaware that they were committing a
crime. But, in this case, Facebook clearly notified Power
of the revocation of access, and Power intentionally and
admittedly refused to comply. Nosal I’s concerns about
overreaching or an absence of culpable intent simply do not
apply here, where an individualized cease-and-desist letter is
a far cry from the permission skirmishes that ordinary
Internet users may face.

Accordingly, we hold that, after receiving the cease and
desist letter from Facebook, Power intentionally accessed
Facebook’s computers knowing that it was not authorized to
do so, making Power liable under the CFAA. We therefore
affirm in part the holding of the district court with respect to
the CFAA.

C. Section 502

California Penal Code section 502 imposes liability on a
person who “[k]nowingly accesses and without permission
takes, copies, or makes use of any data from a computer,
computer system, or computer network, or takes or copies
any supporting documentation, whether existing or residing
internal or external to a computer, computer system, or
computer network.” Id. § 502(c)(2). This statute, we have
held, is “different” than the CFAA. United States v.
Christensen, 801 F.3d 970, 994 (2015). “[T]he California
statute does not require unauthorized access. It merely
requires knowing access.” Id.

But despite differences in wording, the analysis under
both statutes is similar in the present case. Because Power
had implied authorization to access Facebook’s computers, it
 FACEBOOK V. VACHANI 21

did not, at first, violate the statute. But when Facebook sent
the cease and desist letter, Power, as it conceded, knew that
it no longer had permission to access Facebook’s computers
at all. Power, therefore, knowingly accessed and without
permission took, copied, and made use of Facebook’s data.
Accordingly, we affirm in part the district court’s holding that
Power violated section 502.

D. Personal Liability

We affirm the district court’s holding that Vachani is
personally liable for Power’s actions. A “corporate officer or
director is, in general, personally liable for all torts which he
authorizes or directs or in which he participates,
notwithstanding that he acted as an agent of the corporation
and not on his own behalf.” Comm. for Idaho’s High Desert,
Inc. v. Yost, 92 F.3d 814, 823 (9th Cir. 1996) (internal
quotation marks omitted). Cases finding “personal liability
on the part of corporate officers have typically involved
instances where the defendant was the ‘guiding spirit’ behind
the wrongful conduct, or the ‘central figure’ in the challenged
corporate activity.” Davis v. Metro Prods., Inc., 885 F.2d
515, 523 n.10 (9th Cir. 1989) (internal quotation marks and
ellipsis omitted).

Vachani was the central figure in Power’s promotional
scheme. First, Vachani admitted that, during the promotion,
he controlled and directed Power’s actions. Second, Vachani
admitted that the promotion was his idea. It is undisputed,
therefore, that Vachani was the guiding spirit and central
figure in Power’s challenged actions. Accordingly, we affirm
the district court’s holding on Vachani’s personal liability for
Power’s actions.
22 FACEBOOK V. VACHANI

E. Discovery Sanctions

We affirm the discovery sanctions imposed against Power
for non-compliance during a Rule 30(b)(6) deposition.
Defendants failed to object to discovery sanctions in the
district court. Failure to object forfeits Defendants’ right to
raise the issue on appeal. Simpson v. Lear Astronics Corp.,
77 F.3d 1170, 1174 (9th Cir. 1996).

Even assuming the issue was not waived, we “review the
district court’s rulings concerning discovery, including the
imposition of discovery sanctions, for abuse of discretion.”
Goodman v. Staples Office Superstore, LLC, 644 F.3d 817,
822 (9th Cir. 2011). The magistrate judge’s findings that
Vachani was unprepared, unresponsive, and argumentative
and that Power Ventures had failed to produce many e-mails
responsive to Facebook’s requests prior to discovery are
supported by the record. Accordingly, we hold that the
discovery sanctions imposed were not an abuse of discretion.

F. Remedies

Because we reverse in significant part, we also vacate the
injunction and the award of damages. We remand the case to
the district court to reconsider appropriate remedies under the
CFAA and section 502, including any injunctive relief. With
respect to damages, the district court shall calculate damages
only for the period after Power received the cease and desist
letter, when Power continued to access data contained in
Facebook’s servers and memory banks.

REVERSED in part, VACATED in part, AFFIRMED
in part, and REMANDED. The parties shall bear their own
costs on appeal.