Sandvig v. Sessions

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

CHRISTIAN W. SANDVIG, et al.,
Plaintiffs,
v. Civil Action No. 16-1368 (JDB)
1
WILLIAM P. BARR, in his official
capacity as Attorney General of the United
States,
Defendant.

MEMORANDUM OPINION

Plaintiffs are academic researchers who intend to test whether employment websites

discriminate based on race and gender. In order to do so, they plan to provide false information to

target websites, in violation of these websites’ terms of service. Plaintiffs bring a pre-enforcement

challenge, alleging that the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, as applied

to their intended conduct of violating websites’ terms of service, chills their First Amendment right

to free speech. Without reaching this constitutional question, the Court concludes that the CFAA

does not criminalize mere terms-of-service violations on consumer websites and, thus, that plaintiffs’

proposed research plans are not criminal under the CFAA. The Court will therefore deny the parties’

cross-motions for summary judgment and dismiss the case as moot.

1
Pursuant to Fed. R. Civ. P. 25(d), William P. Barr, the current Attorney General of the United States, is
automatically substituted as the defendant in this matter.

1
 BACKGROUND

A. Research Plans

Christopher Wilson and Alan Mislove are professors of computer science at Northeastern

University. Decl. of Pl. Christopher “Christo” Wilson (“First Wilson Decl.”) [ECF No. 48-1] ¶ 1;

Decl. of Pl. Alan Mislove (“First Mislove Decl.”) [ECF No. 48-2] ¶ 1. For their research, Wilson

and Mislove “intend to access or visit certain online hiring websites for the purposes of conducting

academic research regarding potential online discrimination.” Pls.’ Statement of Undisputed

Material Facts (“SMF”) [ECF No. 47-2] ¶ 61. Their plans include “audit testing” to examine whether

various hiring websites’ proprietary algorithms discriminate against online users “based on

characteristics, such as race or gender, that constitute a protected class status under civil rights laws.”

Id. ¶¶ 64, 66. To conduct these audit tests, plaintiffs “will create profiles for fictitious job seekers,

post fictitious job opportunities, and compare their fictitious users’ rankings in a list of candidates

for the fictitious jobs” in order to see “whether [the] ranking is influenced by race, gender, age, or

other attributes.” Id. ¶ 71.

Wilson and Mislove state that they will take steps to minimize the impact of their research

both on the targeted websites’ servers and on other users of those websites. Id. at ¶¶ 75–78. For

instance, they will make it apparent to real job seekers and employers that their postings are fake by

“stat[ing] in any fictitious job posting, or in any fictitious job seeker profile, that the job or the job

seeker is not real.” Id. at ¶¶ 75–78. Both researchers also intend to “comply with the payment

requirement” of certain employment websites. Decl. of Pl. Christopher “Christo” Wilson (“Second

Wilson Decl.”) [ECF No. 65-1] ¶ 5; Decl. of Pl. Alan Mislove (“Second Mislove Decl.”) [ECF No.

65-2] ¶ 5. But Wilson and Mislove acknowledge that their research plan will violate the target

websites’ terms of service prohibiting the provision of false information and/or creating fake

2
accounts. SMF ¶ 86.

B. Procedural History

In June 2016, Wilson and Mislove, as well as two other researchers (Christian W. Sandvig

and Kyratso Karahalios) and the nonprofit journalism group First Look Media Works, Inc., brought

a pre-enforcement constitutional challenge to a provision of the CFAA. Compl. [ECF No. 1] ¶¶ 180–

202. The provision at issue, 18 U.S.C. § 1030(a)(2)(C), or the “Access Provision,” makes it a crime

to “intentionally access[] a computer without authorization or exceed[] authorized access, and

thereby obtain[] . . . information from any protected computer.” Plaintiffs argue that this provision

violates the First and Fifth Amendments. Compl. ¶¶ 180–202. Specifically, they claim that the

Access Provision (1) is overbroad and chills their First Amendment right to freedom of speech; (2)

as applied to their research activities, unconstitutionally restricts their protected speech; (3) interferes

with their ability to enforce their rights and therefore violates the Petition Clause; (4) is void for

vagueness under the Fifth Amendment Due Process Clause; and (5) unconstitutionally delegates

lawmaking authority to private actors in violation of the Fifth Amendment Due Process Clause. See

id. On March 30, 2018, this Court partially granted the government’s motion to dismiss. See Sandvig

v. Sessions, 315 F. Supp. 3d 1, 34 (D.D.C. 2018). The Court dismissed all but the as-applied First

Amendment free speech claim brought by Wilson and Mislove. Id.

Now before the Court are the parties’ cross-motions for summary judgment. Wilson and

Mislove renew their pre-enforcement challenge to the Access Provision of the CFAA, alleging that

it unconstitutionally restricts their First Amendment rights to free speech by criminalizing their

research plans and journalistic activities that involve violating websites’ terms of service. Pls.’ Mem.

P. & A. in Supp. of Mot. for Summ. J. (“Pls.’ Mem.”) [ECF No. 48] at 1. The government, for its

part, argues that plaintiffs have failed to establish standing and that the First Amendment’s

3
protections do not shield plaintiffs from private websites’ choices about whom to exclude from their

servers. Def.’s Mem. in Supp. of Cross-Mot. for Summ. J. & in Opp’n to Pls.’ Mot. for Summ. J.

(“Gov’t’s Opp’n”) [ECF No. 50-1] at 1–4. The Court held a motions hearing on November 15, 2019,

and subsequently ordered another round of briefing to clarify plaintiffs’ specific research plans and

both parties’ understanding of particular terms within the CFAA. See November 26, 2019 Order

[ECF No. 63] at 1–2. The parties each responded, see Def.’s Resp. to Court’s Order for Clarification

(“Def.’s Resp. for Clarification”) [ECF No. 64]; Pls.’ Mem. in Resp. to Court’s Order [ECF No. 65],

and the matter is now ripe for consideration.

LEGAL STANDARD

Summary judgment is appropriate when “the movant shows that there is no genuine dispute

as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ.

P. 56(a). The party seeking summary judgment “bears the initial responsibility of informing the

district court of the basis for its motion, and identifying those portions of [the record] . . .

demonstrat[ing] the absence of a genuine issue of material fact.” Celotex Corp. v. Cartrett, 477 U.S.

317, 323 (1986); see Fed. R. Civ. P. 56(c)(1)(A) (explaining that a moving party may demonstrate

that a fact is undisputed or not by citing “depositions, documents, electronically stored information,

affidavits or declarations, stipulations . . . , admissions, interrogatory answers, or other materials”).

In determining whether a genuine issue of material fact exists, the Court must “view the facts

and draw reasonable inferences in the light most favorable to the party opposing the motion.” Scott

v. Harris, 550 U.S. 372, 378 (2007) (internal quotation marks and alteration omitted). But a non-

moving party must establish more than the “mere existence of a scintilla of evidence” in support of

its position. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 252 (1986). To avoid summary

judgment, “there must be evidence on which the jury could reasonably find for the [non-moving

4
party].” Id.

ANALYSIS

I. Jurisdictional Standing

To have Article III standing, a “plaintiff must have (1) suffered an injury in fact, (2) that is

fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a

favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (citing Lujan v.

Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)). This Court previously concluded that plaintiffs had

plausibly alleged standing on their First Amendment claims at the motion-to-dismiss stage, Sandvig,

315 F. Supp. 3d at 16–22, but plaintiffs must now demonstrate standing “with specific facts set out

by affidavit or other admissible evidence,” In re Navy Chaplaincy, 323 F. Supp. 3d 25, 39 (D.D.C.

2018) (internal quotation marks omitted).

There are two ways in which litigants like plaintiffs here may establish the requisite ongoing

injury when seeking to enjoin a statute alleged to violate the First Amendment. First, plaintiffs may

show that they intend “to engage in a course of conduct arguably affected with a constitutional

interest, but proscribed by a statute, and there exists a credible threat of prosecution thereunder.”

Susan B. Anthony List v. Driehaus, 573 U.S. 149, 159 (2014) (quoting Babbitt v. United Farm

Workers Nat. Union, 442 U.S. 289, 298 (1979)). Second, they may refrain from exposing themselves

to sanctions under the statute, making a sufficient showing of self-censorship—i.e., they may

establish a chilling effect on their free expression. See Laird v. Tatum, 408 U.S. 1, 11–14 (1972). In

either case, a constitutionally affected interest and a credible threat of enforcement are required;

without them, plaintiffs can establish neither a realistic threat of legal sanction for engaging in

protected speech nor an objectively good reason for self-censoring by not conducting their planned

research. Here, plaintiffs take the first path and argue that they intend to engage in conduct

5
“arguably” proscribed by statute.

The government responds that plaintiffs lack standing for three reasons. First, regardless of

whether the Department of Justice would prosecute their conduct, plaintiffs “lack any concrete plans

for conducting future research covered by their as-applied claim, i.e., involving fake or misleading

accounts.” Gov’t’s Opp’n at 10. Second, assuming concrete research plans, “[p]laintiffs have not

demonstrated a credible threat of prosecution for . . . such research.” Id. And third, plaintiffs’

“claims are too abstract to be evaluated and therefore are not ripe.” Id. The government does not

appear to dispute that, if plaintiffs can satisfy the injury-in-fact requirements, they can also meet the

causation and redressability tests to establish standing. See Spokeo, 136 S. Ct. at 1547.

A. Concrete Plans

The government first argues that plaintiffs have failed to establish the existence of “any

concrete plans for conducting further research covered by their as-applied claim.” See Gov’t’s Opp’n

at 10–11. To support this argument, the government quotes testimony from Wilson and Mislove that

they have no “concrete plans” for research involving the provision of false information or the creation

of fake accounts in violation of websites’ terms of service. Id.

This framing—and selective quotation—of plaintiffs’ testimony mischaracterizes the extent

of their plans. “Pre-enforcement review, particularly in the First Amendment context, does not

require plaintiffs to allege that they will in fact violate the regulation in order to demonstrate an

injury.” U.S. Telecom Ass’n v. FCC, 825 F.3d 674, 739 (D.C. Cir. 2016) (internal quotation marks

omitted). “Standing to challenge laws burdening expressive rights requires only a credible statement

by the plaintiff of intent to commit violative acts and a conventional background expectation that the

government will enforce the law.” Id. (emphasis added) (internal quotation marks omitted).

Plaintiffs here satisfy this standard. Wilson later clarified that, when he said he did not have

6
concrete plans, “what [he] meant was [they] don’t have software, [they] don’t have a timeframe.

There [are] no students assigned to it.” Oral Depo. of Christopher Wilson (“Wilson Depo.”) [ECF

No. 54-3] at 215:25–216:4. But Wilson has already “applied and received . . . funding” and approval

from the Institutional Review Board (“IRB”) for such projects. Id. at 217:15–18. Likewise, Mislove

testified that he has “specific research plans [and] specific platforms that [his lab is] studying . . . in

the sense that this is an area of [his] research that [he] intend[s] to conduct work[] in.” Oral Depo.

of Alan E. Mislove (“Mislove Depo.”) [ECF No. 52-3] at 47:4–8. In response to the government’s

interrogatory asking for “any and all platforms and/or websites that Plaintiffs intend to access in the

future for purposes” of research, plaintiffs identified specific websites, including LinkedIn, Monster,

Glassdoor, and Entelo, and noted that they intended to conduct research that might violate these sites’

terms of service by “creating accounts using false information and/or providing false or misleading

information.” Pls.’ Third Suppl. Resps. & Objs. to Def.’s First Set of Interrogs. Nos. 2–3 [ECF No.

52-6] at 3–4.

The government argues in response that “‘some day’ intentions—without any description of

concrete plans, or indeed even any specification of when the some day will be—do not support a

finding of the actual or imminent injury.” Gov’t’s Opp’n at 10–11 (quoting Defs. of Wildlife, 504

U.S. at 564). But unlike the amorphous “‘some day’ intentions” to visit endangered species on

another continent at issue in Defenders of Wildlife, see 504 U.S. at 564, these researchers’ plans are

already in motion, even if the specifics of their study are still being developed. The fact that plaintiffs

have secured funding and IRB clearance to engage in conduct covered by their as-applied challenge

evinces a sufficient demonstration of injury in fact. Cf. Friends of the Earth, Inc. v. Laidlaw Envtl.

Servs. (TOC), Inc., 528 U.S. 167, 183–84 (2000) (concluding that organizational plaintiffs’ members

suffered an injury in fact because they had “reasonable concerns” rising above the level of

7
“speculative some day intentions” that the discharge of pollutants would “directly affect[]” their

“recreational, aesthetic, and economic interests” (internal quotation marks omitted)).

The government also argues that plaintiffs’ two declarations, clarifying the meaning of their

earlier statements about “concrete plans,” must be disregarded under the so-called “sham affidavit

rule.” Gov’t’s Opp’n at 11–12; see also First Wilson Decl.; First Mislove Decl. This argument fails,

however, because these affidavits’ descriptions of plaintiffs’ research plans merely clarify plaintiffs’

prior answers and contextualize their use of the term “concrete.” See Galvin v. Eli Lilly & Co., 488

F.3d 1026, 1030 (D.C. Cir. 2007). Mislove and Wilson said they have no “concrete” plans in order

to explain that they are not currently implementing any of those research plans, notwithstanding their

intent to do so in the future. Moreover, there is no indication that plaintiffs, in their earlier statements,

intended to use the term “concrete plans” in its specific meaning as a legal term of art.

Finally, in its reply brief, the government states that the clearest examples of concrete steps

taken by Wilson actually concern a different research project than the proposed discrimination project

at issue in this case. Def.’s Reply Mem. in Supp. of Cross-Mot. for Summ. J. (“Gov’t’s Reply”)

[ECF No. 56] at 4 n.1. The government does not clearly articulate the distinction between the

different research projects, however, and this Court has already recognized that Wilson and Mislove

intend both to “create fake employer profiles” and to “create fictitious sock-puppet job seeker

profiles” as part of the research at issue in this case. Sandvig, 315 F. Supp. 3d at 9–10.

B. Credible Threat

Under their theory of standing, plaintiffs must show that they intend to engage in conduct

arguably both protected by the First Amendment and proscribed by the statute they challenge, and

that there is a “credible threat” that the statute will be enforced against them when they do so. See

Driehaus, 573 U.S. at 158–63. The government argues that plaintiffs fail to establish a credible threat

8
of prosecution under the CFAA, contending that (1) plaintiffs’ testimony shows that they do not fear

prosecution (and, indeed, already have engaged in such research); (2) past CFAA prosecutions do

not establish a credible threat that plaintiffs’ proposed conduct will be prosecuted; and (3) the

government’s charging policies and public statements undercut plaintiffs’ attempt to establish a

credible threat of prosecution. Gov’t’s Opp’n at 12–18.

“Standing to challenge laws burdening expressive rights requires only a credible statement

by the plaintiff of intent to commit violative acts and a conventional background expectation that the

government will enforce the law” U.S. Telecom Ass’n, 825 F.3d at 739 (internal quotation marks

omitted). As previously noted, plaintiffs satisfy the first half of this test; the question thus becomes

whether the “conventional background expectation” of criminal enforcement holds here. Id. Again,

plaintiffs have the stronger arguments.

First, plaintiffs’ testimony that they do not subjectively fear prosecution under this statute—

and that they have even engaged in the allegedly “chilled” conduct previously—does not undermine

their legal claim. The question is whether there exists “a credible threat,” which is an objective,

rather than subjective, inquiry. See id. Mislove also testifies that he does subjectively fear facing

criminal consequences for his future research. See, e.g., Mislove Depo. at 147:12–19 (“[I]t really

weigh[s] heavily on my mind . . . [that I am] exposing my students to criminal—to potential criminal

prosecution or the risk.”).

Second, even assuming the absence of prior prosecutions, but see Sandvig, 314 F. Supp. 3d

at 19–20 (discussing two previous prosecutions under the Access Provision), plaintiffs still are not

precluded from bringing this pre-enforcement action. When constitutionally protected conduct falls

within the scope of a criminal statute, and the government “has not disavowed any intention of

invoking the criminal penalty provision,” plaintiffs are “not without some reason in fearing

9
prosecution” and have standing to bring the suit. Babbitt, 442 U.S. at 302. Indeed, at the pleadings

stage, the Court already rejected the contention that the lack of similar past CFAA prosecutions

undermines a credible threat of prosecution now. See Sandvig, 315 F. Supp. 3d at 18–21.

Third, the government points to guidance from the Attorney General that “expressly cautions

against prosecutions based on [terms-of-service] violations,” as well as statements to Congress by

Department of Justice officials, as evidence that plaintiffs face no credible threat of prosecution.

Gov’t’s Opp’n at 16–17. But the absence of a specific disavowal of prosecution by the Department

undermines much of the government’s argument. See Babbitt, 442 U.S. at 302. The government

insists that it is not a defendant’s burden to “come forward with proof of a non-existent threat of

prosecution.” Gov’t’s Opp’n at 17. But while the burden of demonstrating standing remains on the

plaintiffs, this Court has previously ruled that in the absence of an “explicit statement” disavowing

prosecution, these various advisory and non-binding statements and Department of Justice policies

do not eliminate the reasonable fear of prosecution. Sandvig, 315 F. Supp. 3d at 20–21. Furthermore,

as noted above the government has brought similar Access Provision prosecutions in the past and

thus created a credible threat of prosecution. Id. at 19–20.

Discovery has not helped the government’s position. John T. Lynch, Jr., the Chief of the

Computer Crime and Intellectual Property Section of the Criminal Division of the Department of

Justice, testified at his deposition that it was not “impossible for the Department to bring a CFAA

prosecution based on [similar] facts and de minimis harm.” Dep. of John T. Lynch, Jr. [ECF No. 48-

4] at 154:3–7. Although Lynch has also stated that he does not “expect” the Department to do so,

Aff. of John T. Lynch, Jr. [ECF No. 21-1] ¶ 9, “[t]he Constitution ‘does not leave us at the mercy of

noblesse oblige,’” Sandvig, 315 F. Supp. 3d at 21 (quoting United States v. Stevens, 559 U.S. 460,

480 (2010)). Absent a specific disavowal or a clear indication that plaintiffs’ conduct falls outside

10
the scope of the criminal provisions, plaintiffs adequately demonstrate a credible threat for standing

purposes.

C. Ripeness

The government also argues that plaintiffs’ claims are not ripe for adjudication. “Plaintiffs

have not yet identified the specific websites that they intend to access for their research,” the

government says, and hence it is “impossible to know what those websites’ [terms of service] will be

at the time of Plaintiffs’ research”—or whether any violation of the terms of service will run afoul of

the Court’s narrow construction of the CFAA. Gov’t’s Opp’n at 18. Because plaintiffs do not know

what their research will entail, the government argues, the Court cannot evaluate the potential harms

caused by their hypothetical research. Id. at 18–19. Hence, according to the government, the Court

cannot meaningfully examine plaintiffs’ First Amendment claim on the merits and fashion a proper

injunction under Rule 65 because it cannot “describe in reasonable detail—and not by referring to

the complaint or other document—the act or acts restrained or required.” Id. at 19 (quoting Fed. R.

Civ. P. 65(d)(1)(B), (C)).

Plaintiffs respond first that, because terms of service are always subject to change, it will

always be impossible to know what a website’s exact terms of service will be in the future, or whether

research violating those terms will implicate the Access Provision. Pls.’ Mem. in Opp’n to Def.’s

Mot. for Summ. J. & Reply in Supp. of Pls.’ Mot. for Summ. J. (“Pls.’ Reply”) [ECF No. 54] at 10–

11. Accordingly, “[p]laintiffs would have to actually undertake the research—taking note of the

[terms of service] actually in effect at the time and exposing themselves to criminal liability—in

order to challenge the Access Provision’s application to them,” a drastic and risky step that plaintiffs

argue is not required by the First Amendment. Id. at 11. Next, plaintiffs say that how exactly they

plan to carry out their research—for instance, the number of fictitious accounts or postings that will

11
be necessary or how long each account or posting will exist—is irrelevant to the First Amendment

question. Id. Finally, plaintiffs argue that their complaint and declarations clarify in detail the

research goals, methodologies, and precautions that will be taken to mitigate potential harm. Id. at

11–12.

The question of ripeness presents a closer call than the previous two standing issues. For

instance, if this Court were to reach the First Amendment analysis urged by plaintiffs and evaluate

the Access Provision under intermediate scrutiny, it would have to determine whether the

government has “show[n] ‘a close fit between ends and means’” such “that the regulation ‘promotes

a substantial government interest that would be achieved less effectively absent the regulation,’” and

does “not ‘burden substantially more speech than is necessary to further the government’s legitimate

interests.’” A.N.S.W.E.R. Coal. v. Basham, 845 F.3d 1199, 1213–14 (D.C. Cir. 2017) (citations

omitted); see also Sandvig, 315 F. Supp. 3d at 30. Absent specific direction from plaintiffs, it will

be difficult to engage in this analysis. The Court is not well placed, for instance, to forecast what

technological or security risks might be generated by permitting such research.

Still, based on the record before it, the Court concludes that the present dispute is ripe.

Plaintiffs listed several websites—LinkedIn, Monster, Glassdoor, and Entelo—that they plan to visit,

and they described intending to violate these sites’ terms of service by “creating accounts using false

information and/or providing false or misleading information.” Pls.’ Third Suppl. Resps. & Objs. to

Def.’s First Set of Interrogs. No. 3, at 3–4. Wilson and Mislove also both testified that their research

plans were designed to have, at most, a de minimis effect on the targeted websites, further

demonstrating that specific concrete steps have been taken in their research. First Wilson Decl. ¶ 46;

First Mislove Decl. ¶ 43. The governments’ own exhibits make clear the extent to which websites,

like LinkedIn, both prohibit and attempt to eliminate false accounts. See, e.g., Decl. of Paul Rockwell

12
(“LinkedIn Decl.”) [ECF No. 52-11] at 3–12; Decl. of Thomas O’Brien (“GlassDoor Decl.”) [ECF

No. 52-13] at 5–6; Affirmation of Leonard Kardon (“Monster Aff.”) [ECF No. 52-14] at 1–2. These

various pieces of evidence reveal a ripe dispute over whether criminally prosecuting plaintiffs under

the CFAA for violations of public websites’ terms of service runs afoul of the First Amendment.

* * *

Finally, the Court turns to the question of whether plaintiffs’ “intended future conduct is

‘arguably . . . proscribed by’” the CFAA. Driehaus, 573 U.S. at 162 (quoting Babbitt, 442 U.S. at

298). The government does not appear to question that plaintiffs plan to engage in proscribed

conduct, but the Court has “an independent obligation to assure that standing exists.” Summers v.

Earth Island Inst., 555 U.S. 488, 499 (2009). The Court is also mindful that its ultimate interpretation

of the CFAA, see infra, at 15–28, excludes plaintiffs’ conduct from criminal liability and, at

minimum, moots their First Amendment claim. Still, the question remains whether the Court’s

ultimate determination that the CFAA does not criminalize plaintiffs’ intended conduct eliminates

plaintiffs’ injury-in-fact, see Driehaus, 573 U.S. 158–59, or merely moots the First Amendment

dispute, see Powell v. McCormack, 395 U.S. 486, 496 (1969) (“[A] case is moot when the issues

presented are no longer ‘live’ . . . .”).

The resolution to this question turns on the meaning of Driehaus’s holding that plaintiffs’

intended conduct must be “arguably . . . proscribed by statute,” Driehaus, 573 U.S. at 159; see also

Woodhull Freedom Found. v. United States, 948 F.3d 363, 371 (D.C. Cir. 2020) (holding that courts

should look to Driehaus’s test for determining whether a plaintiff faces an “imminent threat” of

prosecution in a pre-enforcement action). The Second Circuit has taken this standard to mean that,

as long as plaintiffs propose a reasonable interpretation of the statute under which they credibly fear

prosecution, then they satisfy the standing requirement. See Knife Rights, Inc. v. Vance, 802 F.3d

13
377, 384–86 (2d Cir. 2015) (holding that plaintiff had standing where, despite believing its knife

design was not proscribed, plaintiff could not “confidently determine which such knives defendants

will deem proscribed gravity knives”). This “reasonable interpretation” approach stems from a line

of pre-Driehaus cases in which the Second Circuit was interpreting Babbitt, from which Driehaus

borrowed the “arguably proscribed” standard. See Vt. Right to Life Comm., Inc. v. Sorrell, 221 F.3d

376, 382 (2d Cir. 2000). The Second Circuit understood Babbitt to require only that an interpretation

proscribing plaintiffs’ intended conduct be “reasonable enough that [they] may legitimately fear that

[they] will face enforcement of the statute.” Id. at 383.

The D.C. Circuit’s recent decision in Woodhull Freedom Foundation suggests a slightly

different approach. Although not as explicit as the Second Circuit in stating how plausible an

interpretation needs to be to satisfy plaintiffs’ standing requirements, the court engaged in

considerable statutory construction before deciding that plaintiffs did, in fact, have standing. See

Woodhull Freedom Found., 948 F.3d at 371–73. As Judge Katsas suggested in concurrence, a district

court is first to decide the statute’s meaning and then to decide if, arguably, the plaintiffs’ conduct

falls within its “[p]roperly construed” bounds. Id. at 375 (Katsas, J., concurring).

Unlike in Woodhull Freedom Foundation, which concerned a plain-meaning interpretation

relying on dictionaries and precedent, see id. at 372–73, Wilson and Mislove challenge an ambiguous

statute that this Court has already deemed may apply to their conduct, see Sandvig, 315 F. Supp. 3d

at 18. As will be discussed below, substantive canons of interpretation, like the rule of lenity and

constitutional avoidance, guide this Court’s ultimate decision. Under such circumstances, the Court

concludes that plaintiffs’ intended conduct is “arguably . . . proscribed by statute,” Driehaus, 573

U.S. at 159. To rule otherwise, and decide this complicated statutory matter under the rubric of

standing, would risk converting the “arguably . . . proscribed by statute” standard of Babbitt and

14
Driehaus into one of certainty. Cf. Hedges v. Obama, 724 F.3d 170, 199 (2d Cir. 2013) (noting an

unease with “allowing a preenforcement standing inquiry to become the vehicle by which a court

addresses” important and complex matters of statutory interpretation).

II. Interpreting the CFAA

Assuming, then, that plaintiffs have satisfied the injury-in-fact requirement, the Court

nevertheless concludes that their First Amendment claim is moot. As will be discussed below, courts

have disagreed as to the breadth of the CFAA’s Access Provision. If this Court determines that the

Access Provision does not actually criminalize plaintiffs’ proposed conduct—namely, violating

consumer websites’ terms of service—then the Court need not dive, and judicial economy would

advise against diving, into the First Amendment issue. See Bond v. United States, 572 U.S. 844, 855

(2014) (“[I]t is a well-established principle governing the prudent exercise of this Court’s jurisdiction

that normally the Court will not decide a constitutional question if there is some other ground upon

which to dispose of the case.” (internal quotation marks omitted)). Rather, the Court concludes that

the First Amendment claims plaintiffs “presented are no longer ‘live’” and will dismiss the case as

moot. Powell, 395 U.S. at 496.

a. Accessing Without Authorization

The CFAA prohibits “intentionally access[ing] a computer without authorization or

exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected

computer.” 18 U.S.C. § 1030(a)(2). The term “protected computer” refers to any computer “used in

or affecting interstate or foreign commerce or communication,” Id. § 1030(e)(2)(B), and no party

disputes that the servers and other computers associated with the websites in question here, like

LinkedIn, constitute “protected computer[s].”

Although the CFAA does not define “authorization,” courts have found the term “clear” and

15
given it a “straightforward meaning.” United States v. Nosal (“Nosal II”), 844 F.3d 1024, 1035 (9th

Cir. 2016). The Ninth Circuit, for instance, has consistently interpreted “authorization” to mean

“permission or power granted by an authority.” LVRC Holdings LLC v. Brekka, 581 F.3d 1127,

1133 (9th Cir. 2009); see also hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985, 1000 (9th Cir. 2019)

(“Authorization is an affirmative notion, indicating that access is restricted to those specially

recognized or admitted.” (internal quotation marks omitted)); Facebook, Inc. v. Power Ventures, Inc.,

844 F.3d 1058, 1067 (9th Cir. 2016) (“[A] defendant can run afoul of the CFAA when he or she has

no permission to access a computer or when such permission has been revoked explicitly.”); Nosal II,

844 F.3d at 1033 (“Not surprisingly, there has been no division among the circuits on the

straightforward ‘without authorization’ prong of [§ 1030(a)].”). At least the Second, Fourth, and

Sixth Circuits have come to the same conclusion. See, e.g., United States v. Valle, 807 F.3d 508,

524 (2d Cir. 2015) (“[C]ommon usage of ‘authorization’ suggests that one ‘accesses a computer

without authorization’ if he accesses a computer without permission to do so at all.”); WEC Carolina

Energy Sols. v. Miller, 687 F.3d 199, 204 (4th Cir. 2012) (“[B]ased on the ordinary, contemporary,

common meaning of ‘authorization,’ . . . an employee is authorized to access a computer when his

employer approves or sanctions his admission to that computer.”); Pulte Homes, Inc. v. Laborers’

Int’l Union of N. Am., 648 F.3d 295, 303–04 (6th Cir. 2011) (“Commonly understood, . . . a

defendant who accesses a computer ‘without authorization’ does so without sanction or

permission.”).

The statutory text is less clear, however, when it comes to the entire phrase “accesses a

computer without authorization.” The CFAA does not define this phrase, but “the wording of the

statute, forbidding ‘access[] . . . without authorization,’ . . . suggests a baseline in which access is not

generally available and so permission is ordinarily required.” hiQ Labs, 938 F.3d at 1000. This

16
wording thus contemplates a view of the internet as divided into at least two realms—public websites

(or portions of websites) where no authorization is required and private websites (or portions of

websites) where permission must be granted for access. Because many websites on the internet are

open to public inspection, a website or portion of a website becomes “private” only if it is “delineated

as private through use of a permission requirement of some sort.” Id. at 1001.2

Most courts agree with the hiQ Labs court’s interpretation of “accesses . . . without

authorization” as contemplating a “two-realm internet.” See, e.g., WEC Carolina Energy Sols., 687

F.3d at 204 (“[A user] accesses a computer ‘without authorization’ when he gains admission to a

computer without approval.” (emphasis added)); United States v. Nosal (“Nosal I”), 676 F.3d 854,

858 (9th Cir. 2012) (en banc) (“‘[W]ithout authorization’ would apply to outside hackers (individuals

who have no authorized access to the computer at all) and ‘exceeds authorized access’ would apply

to inside hackers (individuals whose initial access to a computer is authorized but who access

unauthorized information or files).”). Courts have interpreted this provision to involve transitioning

from a public area of the internet to a private, permission-restricted area, often requiring some form

2
The hiQ Labs court faced the additional wrinkle of whether sending a cease-and-desist letter to specific users,
who were allegedly violating LinkedIn’s terms of service, was enough to revoke authorization even for otherwise
“public” parts of the website. See 938 F.3d at 999 (“The pivotal CFAA question here is whether once hiQ received
LinkedIn’s cease-and-desist letter, any further scraping and use of LinkedIn’s data was ‘without authorization’ within
the meaning of the CFAA and thus a violation of the statute.”); see also Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d
1178, 1182 (N.D. Cal. 2013) (describing “the question here” as “whether Craigslist had the power to revoke, on a case-
by-case basis, the general permission it granted to the public to access the information on its website”). Because no such
letters have been sent in this case, the Court need not decide whether they would constitute a revocation of authorization
and thereby make any further visits by the recipients to the otherwise public portions of LinkedIn a CFAA violation. See
also Pet. for Writ of Cert. at 25, LinkedIn Corp. v. hiQ Labs, Inc., No. 19-1116 (U.S. Mar. 9, 2020) (“Where a website
owner sets up technical measures to deny a third-party scraper access to its website or sends a cease-and-desist letter,
thereby putting the scraper indisputably on notice that access is not authorized, any further efforts to access that website
are ‘without authorization.’”).
At the same time, the fact that receipt of a cease-and-desist letter might render the recipient’s future visits to an
otherwise public website “unauthorized” does provide one possible distinction between § 1605(a)(2) and § 1605(a)(3)
that helps to give meaning to the term “nonpublic” in the latter provision. Cf. 3Taps, 964 F. Supp. 2d at 1182–83
(“Congress apparently knew how to restrict the reach of the CFAA to only certain kinds of information, and it appreciated
the public vs. nonpublic distinction—but § 1030(a)(2)(C) contains no such restrictions or modifiers.”).

17
of authentication before a viewer is granted access. See, e.g., hiQ Labs, 938 F.3d at 1001

(“[A]uthorization is only required for password-protected sites or sites that otherwise prevent the

general public from viewing the information.”); Valle, 807 F.3d at 524 (“‘[W]ithout authorization’

most naturally refers to a scenario where a user lacks permission to access the computer at all.”).

The statutory and legislative history of the CFAA support this public-private reading of the

provision. Originally part of the Counterfeit Access Device and Computer Fraud and Abuse Act of

1984, Pub. L. No. 98-473, § 2102(a), 98 Stat. 2190, 2190–92, the CFAA “has been substantially

modified” over the intervening decades. See Orin S. Kerr, Vagueness Challenges to the Computer

Fraud and Abuse Act, 94 Minn. L. Rev. 1561, 1561 (2010). Throughout this history, however,

Congress has consistently analogized violations of § 1030 to physical-world crimes. For example,

“[t]he 1984 House Report on the CFAA explicitly analogized the conduct prohibited by section 1030

to forced entry.” hiQ Labs, 938 F.3d at 1000. That Report notes that “[d]ifficulties in coping with

computer abuse arise because much of the property involved does not fit well into categories of

property subject to abuse or theft.” H.R. Rep. No. 98-894, at *9 (1984) (emphasis added). Instead

of focusing on what was stolen, the CFAA relied on “an ‘unauthorized access’ concept,” wherein

“the conduct prohibited is analogous to that of ‘breaking and entering’ rather than using a computer

(similar to the use of a gun) in committing the offense.” Id. at *20.

Likewise, when the CFAA was amended in 1996 to cover federal government computers and

those in interstate commerce (i.e., “protected computers”), the Senate Report described the bill as

“protect[ing] against the interstate or foreign theft of information by computer” (emphasis added),

suggesting a comparison to the physical-world crime of theft. S. Rep. No. 104-357, at *7 (1996).

This Report reveals that a central motivation behind these amendments was “to increase protection

for the privacy and confidentiality of computer information,” id., further suggesting that “access[ing]

18
a computer without authorization” involves “obtain[ing]” information from non-public websites, see

18 U.S.C. § 1030(a)(2).

This interpretation rooted in property norms also aligns with judicial readings of similar

language in the Stored Communications Act. See 18 U.S.C. § 2701(a) (criminalizing “intentionally

access[ing] without authorization a facility through which an electronic communication service is

provided” or “intentionally exceed[ing] an authorization to access [such a] facility”); see also

Wachovia Bank v. Schmidt, 546 U.S. 303, 305 (2006) (“[U]nder the in pari materia canon, statutes

addressing the same subject matter generally should be read as if they were one law . . . .” (internal

quotation marks omitted)). For example, interpreting the Act in light of the common law, the Ninth

Circuit focused on “the essential nature” of the relationship between the computer owner and the

accesser, and concluded that “[p]ermission to access a stored communication does not constitute

valid authorization if it would not defeat a trespass claim in analogous circumstances.” Theofel v.

Farey-Jones, 359 F.3d 1066, 1073 (9th Cir. 2004) (emphasis added).

Likewise, in amending 18 U.S.C. § 2510, the Patriot Act defined “computer trespasser” as “a

person who accesses a protected computer without authorization and thus has no reasonable

expectation of privacy in any communication transmitted to, through, or from the protected

computer.” Pub. L. 107–56, 115 Stat. 272 (2001). That the Patriot Act cites § 1030 for the definition

of “protected computer” makes the connection between these two statutes all the clearer:

“access[ing] a computer without authorization” is the computer equivalent of trespassing in the

physical world.

Adopting the formulation of the Ninth Circuit in hiQ Labs, this Court will call the barriers

between the public internet and private authorization-based computers “permission requirements.”

938 F.3d at 1001. Under this interpretation, the question becomes what sort of “permission

19
requirement” constitutes enough of a barrier to trigger criminal liability under § 1030(a)(2) if

bypassed. The government suggests that such “permission requirements” can be minimal. See Tr.

Mots. H’rg [ECF No. 62] at 54:15–56:17. An announcement on the homepage of a website that

access to any further content is conditioned on agreeing to lengthy terms of service—or even one

term of service—would, the government argues, constitute such a requirement. Id. at 54:22–24.

The Court concludes that agreeing to such contractual restrictions, although that may have

consequences for civil liability under other federal and state laws, is not sufficient to trigger criminal

liability under the CFAA. In other words, terms of service do not constitute “permission

requirements” that, if violated, trigger criminal liability.

A number of considerations lead the Court to this conclusion. First, websites’ terms of service

provide inadequate notice for purposes of criminal liability. These protean contractual agreements

are often long, dense, and subject to change. While some websites force a user to agree to the terms

before access—so-called “clickwrap”—others simply provide a link at the bottom of the webpage,

or place the terms, often in fine print, elsewhere on the page. “Significant notice problems arise if

we allow criminal liability to turn on the vagaries of private polices that are lengthy, opaque, subject

to change and seldom read.” Nosal I, 676 F.3d at 860.

Second, although not a paradigmatic example of a “nondelegation” problem, enabling private

website owners to define the scope of criminal liability does raise concerns for the Court. See The

Vagaries of Vagueness: Rethinking the CFAA as a Problem of Private Nondelegation, 127 Harv. L.

Rev. 751, 768–71 (2013). Previously, this Court determined that a narrow interpretation of the CFAA

limited to “access restrictions” saved § 1030(a)(2) from becoming “a limitless, standardless

delegation of power to individual websites to define crimes.” Sandvig, 315 F. Supp. 3d at 33. The

Court also concluded that merely “incorporat[ing] private parties’ chosen restrictions, which are only

20
binding on those who interact with those parties’ individual [websites],” did not necessarily constitute

an improper delegation of legislative or regulatory authority. Id. at 33–34.

Upon further reflection, and now presented with additional evidence of the nature of the target

websites’ terms of service, the Court finds that it is necessary to answer another question: whether

terms-of-service conditions, rather than authentication gates, constitute adequate “permission

requirements” for criminal liability under the CFAA. Again, the Court concludes that the narrower

interpretation is the wiser path. The government analogizes website owners to real property owners,

who have historically been allowed to exclude whomever they choose from their private, non-

commercial land, Gov’t’s Opp’n at 23–24, but the analogy between real property and the internet is

not perfect. The internet is inherently open and public, see Reno v. Am. Civil Liberties Union, 521

U.S. 844, 880 (1997) (observing that “most Internet forums—including chat rooms, newsgroups,

mail exploders, and the Web—are open to all comers”), and users constantly move from one website

to another and navigate between various sections of a given website. Under such circumstances, the

CFAA’s prohibition on “access[ing] a computer without authorization,” even though phrased “in the

form of a general prohibition” that can often escape nondelegation worries, see Silverman v. Barry,

845 F.2d 1072, 1086 (D.C. Cir. 1988), becomes unworkable and standardless. Criminalizing terms-

of-service violations risks turning each website into its own criminal jurisdiction and each webmaster

into his own legislature. Such an arrangement, wherein each website’s terms of service “is a law

unto itself,” Emp’t Div., Dep’t of Human Res. of Or. v. Smith, 494 U.S. 872, 890 (1990), would raise

serious problems. This concern, then, supports a narrow interpretation of the CFAA.

Third, both the rule of lenity and the avoidance canon weigh in favor of this narrow

interpretation as well. “When interpreting a criminal statute, we do not play the part of a mindreader.”

United States v. Santos, 553 U.S. 507, 515 (2008). If “a reasonable doubt persists about a statute’s

21
intended scope even after resort to the language and structure, legislative history, and motivating

policies of the statute,” Moskal v. United States, 498 U.S. 103, 108 (1990) (internal quotation marks

omitted), courts must adopt the narrower interpretation. See Yates v. United States, 135 S. Ct. 1074,

1088 (2015) (“[I]f . . . recourse to traditional tools of statutory construction leaves any doubt about

the meaning of [a statutory term] . . . , we would invoke the rule that ambiguity concerning the ambit

of criminal statutes should be resolved in favor of lenity.” (internal quotation marks omitted)). Here,

none of the traditional tools of statutory interpretation definitively resolves the question of what

constitutes “access[ing] . . . without authorization,” so the Court opts to interpret the provision

narrowly and as not encompassing terms-of-service violations.

Likewise, constitutional avoidance weighs in favor of interpreting “accesses . . . without

authorization” narrowly. If the Court were to conclude that plaintiffs’ terms-of-service violations do

violate the CFAA, then it would have to decide whether prosecuting them for such actions violates

the First Amendment. As the Court previously observed, it “need not determine whether plaintiffs’

constitutional arguments would actually win the day,” but rather “whether one reading ‘presents a

significant risk that [constitutional provisions] will be infringed.’” Sandvig, 315 F. Supp. 3d at 25

(quoting NLRB v. Catholic Bishop of Chi., 440 U.S. 490, 502 (1979)). Plaintiffs’ First Amendment

challenge raises such risks, see Sandvig, 315 F. Supp. 3d at 28–30, and thus weighs in favor of a

narrow interpretation under the avoidance canon.

Given all these concerns, a user should be deemed to have “accesse[d] a computer without

authorization,” 18 U.S.C. § 1030(a)(2), only when the user bypasses an authenticating permission

requirement, or an “authentication gate,” such as a password restriction that requires a user to

demonstrate “that the user is the person who has access rights to the information accessed,” Orin S.

Kerr, Norms of Computer Trespass, 116 Colum. L. Rev. 1143, 1147, 1164 (2016) (hereinafter

22
“Norms”). Although bypassing code-based restrictions, like a social-security-number or credit-card

requirement, are paradigmatic examples of an “authentication gate,” see Orin S. Kerr, Cybercrime’s

Scope: Interpreting “Access” and “Authorization” in Computer Misuse Statutes, 78 N.Y.U. L. Rev.

1596, 1664 (2003), “[t]he key point is not that some code was circumvented but rather that the

computer owner conditioned access on authentication of the user and the access was outside the

authentication,” Norms at 1164.

Here, neither Wilson nor Mislove attempt to bypass an authentication gate. For websites

requiring “login credentials—i.e., usernames and passwords”—Wilson and Mislove intend to

provide the information that they “generated when [they] created tester accounts.” Second Wilson

Decl. ¶ 6; Second Mislove Decl. ¶ 6. And for websites that require payments, they intend to “comply

with the payment requirement.” Second Wilson Decl. ¶ 5; Second Mislove Decl. ¶ 5. None of their

research plans, then, involve bypassing authenticating “permission requirements,” and thus none of

them when executed will constitute violations of the CFAA as interpreted herein.

The record does reflect that at least Wilson previously used borrowed business information

for authentication purposes on CareerBuilder.com. See Wilson E-mails Regarding CareerBuilder

Receipt, PID7243-46 (July 2016) [ECF No. 52-16] at 3. At the motions hearing, however, counsel

for plaintiffs stated that “they only intend to access parts of a website that are otherwise open to the

public or available to anyone who creates a [username] and password.” Mots. Hr’g Tr. at 8:15–17.

The Court asked for clarification, see Nov. 26, 2019 Order at 1–2, and declarations from both

researchers now clarify that, although they may pay for access to some public employment websites,

their future research plans entail no provision of “authenticating, real-world business information

. . . , such as real-world business license information.” Second Wilson Decl. ¶ 2; Second Mislove

Decl. ¶ 2. The Court thus has no occasion to determine whether provision of either false or borrowed

23
real-world business information to access otherwise private portions of employment websites would

violate the CFAA.

b. Exceeding Authorized Access

Turning to the second part of the Access Provision, the CFAA prohibits “exceed[ing]

authorized access, and thereby obtain[ing] . . . information from any protected computer.” The

CFAA defines “the term ‘exceeds authorized access’ [to] mean[] to access a computer with

authorization and to use such access to obtain or alter information in the computer that the accesser

is not entitled so to obtain or alter.” 18 U.S.C § 1030(e)(6).

This language suggests that an individual cannot “exceed[] authorized access” without first

legitimately passing through a “permission requirement.” After all, the violator must “use such

[authorized] access” in order to “obtain or alter information” to which the violator “is not entitled,”

implying that barriers are passed through permissibly. Id. (emphasis added). This interpretation

aligns with the Ninth Circuit’s distinction between “accesses . . . without authorization” applying to

“outside hackers” and “exceeds authorized access” applying to “inside hackers.” Nosal I, 676 F.3d

at 858.

If bypassing a “permission requirement” is not the action that triggers criminal liability,

however, then the question remains what type of conduct does constitute a criminal act. In other

words, what distinguishes information that an authorized accesser is “entitled to obtain or alter” from

information to which he is not entitled? Does plaintiffs’ anticipated provision of false information

to their target websites, in violation of these websites’ terms of services, cross that line and “exceed[]

authorized access”?

The resolution of this question turns, in part, on the meaning of “entitled” in the statutory

definition of “exceeds authorized access” at § 1030(e)(6). The government argues that “entitled”

24
means “to furnish with a right,” and “supports [a] broader interpretation of the phrase ‘exceeds

authorized access’ . . . , in which all relevant facts (including policies set by the computer owners)

may be considered in determining the scope of a person’s authorized access.” Def.’s Resp. for

Clarification at 5–6. By this approach, the meaning of “exceeds authorized access” is context-

dependent: “Because the computer owner furnishes an individual with the right to access its systems

and obtain information from them, explicit policies restricting that right determines when an

individual ‘exceeds authorized access.’” Id. at 6. According to the government, such “explicit

policies” include employers’ computer-use policies and the terms of service of public websites. See

id. at 6; Gov’t’s Opp’n at 53–54.

Plaintiffs seem to have agreed with this interpretation for much of the litigation and assumed

that such terms-of-service violations do fall afoul of the CFAA. See Pls.’ Mem. at 2–3, 9–11. Rather

than interpreting the statute narrowly, they argued that their actions are protected by the First

Amendment. But plaintiffs now suggest that they would be satisfied with “declaratory and injunctive

relief” barring prosecution under the CFAA for violations of websites’ terms of service—in other

words, with a narrow interpretation of the CFAA that it does not encompass terms-of-service

violations. See Pls.’ Mem. in Resp. to Court’s Order at 1.

Courts have come to a range of views on the best interpretation of “exceeds authorized

access,” and the circuits are currently divided on whether, in the employment context, an employee’s

violation of company policy constitutes a CFAA violation. The First, Fifth, Seventh, and Eleventh

Circuits have concluded that a person with access to a computer for business purposes exceeds

authorized access when the accesser “obtain[s] . . . information for a nonbusiness reason.” United

States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010); see also United States v. John, 597 F.3d

263, 272 (5th Cir. 2010) (concluding that an employee’s “access[ing] account information for

25
individuals whose accounts she did not manage, remov[ing] this highly sensitive and confidential

information from [the employer’s] premises, and ultimately us[ing] this information to perpetrate

fraud on [the employer] and its customers” constituted a CFAA violation); Int’l Airport Ctrs., L.L.C.

v. Citrin, 440 F.3d 418, 420–21 (7th Cir. 2006) (similar); EF Cultural Travel BV v. Explorica, Inc.,

274 F.3d 577, 582–83 (1st Cir. 2001) (similar).3 The Second and Fourth Circuits have come to the

opposite conclusion. See Valle, 807 F.3d at 512–13, 528 (applying the rule of lenity and not imposing

liability for accessing a government database of personal information for no law enforcement

purpose); WEC Carolina Energy Sols., 687 F.3d at 205–07 (refusing to impose liability when

employees violated company policy).

Far fewer courts have weighed in on the facts before this Court: namely, whether violating

the terms of service of consumer websites constitutes a criminal CFAA violation. But the majority

of courts that have examined this question has determined that there is no liability. See, e.g.,

Facebook, 844 F.3d at 1067 (“[A] violation of the terms of use of a website—without more—cannot

establish liability under the CFAA.”); Bittman v. Fox, 107 F. Supp. 3d 896, 900–01 (N.D. Ill. 2015)

(concluding that defendants did not “exceed[] authorized access” by creating “a fake social media

account in violation of a social media company’s terms of service”); United States v. Drew, 259

F.R.D. 449, 464–65 (C.D. Cal. 2009) (interpreting “exceeds authorized access” to exclude mere

terms-of-service violations to avoid rendering the statute void for vagueness). But see United States

v. Lowson, Crim. No. 10-114 (KSH), 2010 WL 9552416, at *5 (D.N.J. Oct. 12, 2010) (not dismissing

3
The First Circuit later extended its holding in Explorica, which was based upon confidentiality agreements
signed by former employees, to Zefer, a third-party website. See EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58 (1st
Cir. 2003). Although the decision did suggest that terms of service may create CFAA liability by “say[ing] just what
non-password protected access they purport to forbid,” id. at 64, the First Circuit’s holding relied upon the “relatively
narrow grounds” that the injunction against Explorica applied to “anyone else with notice” and thus “precluded [Zefer]
from acting to assist the enjoined party from violating the decree [and] from doing so on behalf of that party,” id. at 61,
63.

26
a case wherein the defendants “implement[ed] ‘hacks’ and us[ed] ‘backdoors’ to enable automated

programs to purchase tickets” from online vendors).

The Court agrees with the clear weight of relevant authority and adopts a narrow

interpretation of “exceeds authorized access.” Without weighing in on the circuit split over

employers’ computer-use policies, the Court concludes that violating public websites’ terms of

service, as Wilson and Mislove propose to do for their research, does not constitute a CFAA violation

under the “exceeds authorized access” provision.

In coming to this determination, the Court is guided by many of the same reasons that led to

a narrow interpretation of “accesses . . . without authorization” that excludes terms-of-service

violations. See supra, at 20–22. First, consumer websites’ terms of service do not provide adequate

notice for purposes of criminal liability. See Drew, 259 F.R.D. at 464–66; see also United States v.

Thomas, 877 F.3d 591, 596 (5th Cir. 2017) (recognizing that “a narrow reading of [§ 1030(a)(2)]

avoids criminalizing common conduct—like violating contractual terms of service for computer use

or using a work computer for personal reasons—that lies beyond the antihacking purpose of the

access statutes”). Second, criminalizing violations of private websites’ terms of service raises

considerable nondelegation issues. See supra, at 20–21.

Third, the rule of lenity and the constitutional avoidance canon weigh against a broad

interpretation of “exceeds authorized access” as encompassing terms-of-service violations. As noted

above, courts have come to varying opinions on what type of conduct violates this provision.

Compare Rodriguez, 628 F.3d at 1263; John, 597 F.3d at 272; Citrin, 440 F.3d at 420–21; Explorica,

274 F.3d at 582–83, with Valle, 807 F.3d at 512–13, 528; WEC Carolina Energy Sols., 687 F.3d at

205–07. Legislative history and statutory structure provide little guidance one way or the other. See,

e.g., Valle, 807 F.3d at 526 (finding the legislative history inconclusive on whether a public employee

27
“exceed[ed] authorized access” in using government computers for personal ends). Because the

traditional tools of statutory interpretation do not point definitively one way or the other for whether

“exceeds authorized access” encompasses terms-of-service violations on public websites, the rule of

lenity requires that the Court adopt the narrower construction. See id. at 526–28. And because this

narrow interpretation obviates the need to engage with plaintiffs’ thorny First Amendment concerns,

constitutional avoidance, too, counsels in favor of this narrow reading. See Bond, 572 U.S. at 855.

Taken together, these considerations make clear that, even if reading “exceeds authorized

access” to exclude terms-of-service violations on public websites is not the only reasonable

interpretation, adopting the narrow approach is the wisest path forward. In agreement with the clear

weight of relevant cases, then, the Court adopts this narrow interpretation of the CFAA and concludes

that plaintiffs’ proposed research plans do not violate either provision of § 1030(a)(2).

CONCLUSION

For the foregoing reasons, the Court concludes that plaintiffs’ research plans do not violate

the Access Provision of the CFAA. Because their actions are not criminal, the Court need not wade

into the question whether plaintiffs’ proposed conduct should receive First Amendment protection.

Instead, the Court concludes that the parties’ cross-motions for summary judgment are moot, and the

case will be dismissed. A separate order will be issued on this date.

/s/
JOHN D. BATES
United States District Judge
Dated: March 27, 2020

28