Sandvig v. Sessions

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
CHRISTIAN W. SANDVIG, et al.,
Plaintiffs,
v. Civil Action No. 16-1368 (JDB)
JEFFERSON B. SESSIONS III, in his
official capacity as Attorney General of the
United States,
Defendant.
MEMORANDUM OPINION
It’s a dangerous business, reading the fine print. Nearly every website we visit features
Terms of Service (“ToS”), those endless lists of dos and don’ts conjured up by lawyers to govern
our conduct in cyberspace. They normally remain a perpetual click away at the bottom of every
web page, or quickly scrolled past as we check the box stating that we agree to them. But to
knowingly violate some of those terms, the Department of Justice tells us, could get one thrown in
jail. This reading of federal law is a boon to prosecutors hoping to deter cybercrime. Yet it also
creates a dilemma for those with more benign intentions. Plaintiffs in this case, for instance, are
researchers who wish to find out whether websites engage in discrimination, but who have to
violate certain ToS to do so. They have challenged the statute that they allege criminalizes their
conduct, saying that it violates their free speech, petition, and due process rights. First, however,
they must show that they have a sufficient injury to make it through the courthouse door, and that
their suit is plausible enough to continue. For the following reasons, the Court finds that plaintiffs
have standing, and that they can bring one (but not the rest) of their claims.
1
I. BACKGROUND
This case centers on a few sections of the Computer Fraud and Abuse Act (CFAA), a law
dedicated to “deterring the criminal element from abusing computer technology.” H.R. Rep. No.
98–894, at 4 (1984). Plaintiffs directly challenge one section, referred to here as the Access
Provision, which sweeps in the greatest amount of conduct. The Access Provision states that
“[w]hoever . . . intentionally accesses a computer without authorization or exceeds authorized
access, and thereby obtains . . . information from any protected computer . . . shall be punished as
provided in subsection (c) of this section.” 18 U.S.C. § 1030(a)(2)(C). The CFAA defines
“protected computer” to mean, among other things, “a computer . . . which is used in or affecting
interstate or foreign commerce or communication.” Id. § 1030(e)(2)(B). This definition
encompasses just about all computers hooked up to the Internet—including computers that house
website servers. See, e.g., United States v. Nosal, 676 F.3d 854, 859 (9th Cir. 2012). The statute
also defines “exceeds authorized access” as “to access a computer with authorization and to use
such access to obtain or alter information in the computer that the accesser is not entitled so to
obtain or alter.” 18 U.S.C. § 1030(e)(6). Thus, the Access Provision applies to anyone who
purposely accesses an Internet-connected computer without authorization, or uses a legitimate
authorization to receive or change information that they are not supposed to, and thereby obtains
information from the computer.
The CFAA provides for a fine and/or imprisonment for up to one year upon a first violation
of the Access Provision, or up to ten years for any further offenses. Id. § 1030(c)(2)(A), (C).
However, the punishment for an initial violation rises to a sentence of up to five years’
imprisonment if the offense (1) “was committed for purposes of commercial advantage or private
financial gain,” (2) was “in furtherance of any criminal or tortious act in violation of the
2
Constitution” or state or federal law, or (3) involved obtaining information valued at more than
$5,000. Id. § 1030(c)(2)(B). Thus, meeting one of these three conditions makes a first violation
a felony; if none are met, the first violation is a misdemeanor.
Plaintiffs in this case are four professors and a media organization: Christian W. Sandvig
of the University of Michigan; Kyratso “Karrie” Karahalios of the University of Illinois; Alan
Mislove of Northeastern University; Christopher “Christo” Wilson of Northeastern University;
and First Look Media Works, Inc. (“Media Works”), which publishes the online news platform
The Intercept. Compl. [ECF No. 1] ¶¶ 13–14, 16–17, 19. Plaintiffs are conducting studies to
respond to new trends in real estate, finance, and employment transactions, which increasingly
have been initiated on the Internet. Id. ¶¶ 15, 18, 55. Data brokers assemble consumers’
information from myriad sources and place consumers into models that include racial, ethnic,
socioeconomic, gender, and religious inferences about them. Id. ¶¶ 56–57. After brokers create
consumer profiles, those profiles follow consumers around online through tracking technologies
such as cookies. Id. ¶¶ 58–59. Tracking allows websites and advertisers to display content targeted
at particular groups, based on consumers’ inferred characteristics or the sorts of websites they visit.
Id. ¶¶ 59–60. But plaintiffs are concerned, “[g]iven the . . . history of racial discrimination in
housing and employment,” that this technology may be “harnessed for discriminatory purposes.”
Id. ¶ 61. They are also concerned that, “when algorithms automate decisions, there is a very real
risk that those decisions will unintentionally have a prohibited discriminatory effect.” Id. ¶ 62.
One way to determine whether members of protected classes are being discriminated
against is to engage in “outcomes-based audit testing.” Id. ¶ 67. Such testing commonly involves
accessing a website or other network service repeatedly, generally by creating false or artificial
user profiles, to see how websites respond to users who display characteristics attributed to certain
3
races, genders, or other classes. Id. ¶ 70. This method is similar to classical paired testing
procedures, in which multiple people—identical but for one legally protected trait—apply for the
same house or job. Such procedures are often used to uncover violations of housing and
employment discrimination laws in the physical world. Id. ¶¶ 41, 50, 52.
Plaintiffs plan to engage, and are engaging, in such audit testing. Sandvig and Karahalios
are investigating whether computer programs that decide what to display on real estate websites
discriminate against users based on race or other factors. Id. ¶ 82. They are writing a computer
program that will create bots—automated agents that will each browse the Internet and interact
with websites as a human user might. Id. ¶ 88. Each bot will create a number of distinct user
profiles, each of which is called a “sock puppet.” Id. ¶ 89. Sandvig and Karahalios will program
the bots to visit real estate websites and search for properties, while also engaging in behaviors
correlated with members of a particular race. Id. ¶¶ 90–91. Sandvig and Karahalios will use an
automatic data recording technique known as scraping to record the properties that each bot sees
on the real estate sites. Id. ¶¶ 90, 92. They can then examine their data to determine whether race-
associated behaviors caused the sock puppets to see different sets of properties. Id. ¶ 93.
Similarly, Mislove and Wilson plan to conduct a study to see whether hiring websites’
algorithms end up discriminating against job seekers based on protected statuses like race or
gender. Id. ¶ 107. They will first use bots to crawl the profiles of a random selection of job-
seekers to obtain baseline demographic data, then create fake employer profiles so that they can
search for candidates and record how the algorithms rank those candidates. 1 Id. ¶¶ 114–17. They
will also create fictitious sock-puppet job seeker profiles, and have the fictitious seekers—who
1
This second step involves both crawling the profiles of ranked candidates to determine their demographic
data and scraping to record the overall rankings. Compl. ¶¶ 114–16.
4
will vary along different demographic axes—apply for fictitious jobs, to examine how the
algorithms rank the candidates. Id. ¶¶ 118–19, 121–22. Mislove and Wilson will prevent real
people from applying for the false jobs by giving them titles that say “[t]his is not a real job, do
not apply,” and will delete the fictitious accounts and jobs when they finish. Id. ¶ 120.
Media Works and its journalists seek to investigate online companies, websites, and
platforms, including by examining any discriminatory effects of their use of algorithms. Id. ¶ 130.
Mislove and Wilson plan to publish their findings in academic papers, and to bring the
results of their research to the public. Id. ¶ 123. Media Works intends to use the results of its
journalistic investigations to inform the public about online business practices. Id. ¶ 132. Sandvig
and Karahalios do not explicitly claim that they will publish their work, but state that their findings
“would produce important new scientific knowledge about the operation of computer systems,
discrimination, and cumulative disadvantage.” Id. ¶ 94.
Plaintiffs are all aware that their activities will violate certain website ToS. Id. ¶¶ 95, 124,
131. All intend to use scraping to record data, which is banned by many of the websites plaintiffs
seek to study. Id.; see id. ¶¶ 70–71. Many of the housing websites that Sandvig and Karahalios
will study prohibit the use of bots. Id. ¶¶ 71, 95. All of the hiring websites that Mislove and
Wilson will study prohibit the use of sock puppets, and most prohibit crawling. Id. ¶¶ 71, 124.
Additionally, some websites control when and how visitors may speak about any information
gained through the site—even in other forums—by including non-disparagement clauses in their
ToS. Id. ¶ 72. Some sites also have ToS that require advance permission before using the sites
for research purposes, which, plaintiffs allege, creates the possibility of viewpoint-discriminatory
permission schemes. Id. ¶ 73. Aside from their ToS violations, plaintiffs’ experiments will have
at most a minimal impact on the operations of the target websites. Id. ¶¶ 96, 125. All plaintiffs
5
but Media Works have already begun some of the activities involved in their research plans,
including activities that require violating websites’ TOS. Id. ¶¶ 98, 126.
Plaintiffs claim that they must either refrain from conducting research, testing, and
investigations that (they argue) constitute protected speech or expressive activity, or else expose
themselves to the risk of prosecution under the Access Provision of the CFAA. Id. ¶ 137. Plaintiffs
therefore filed this suit against the Attorney General, raising four causes of action: (1) a facial
overbreadth and as-applied challenge under the Free Speech and Free Press Clauses of the First
Amendment, id. ¶¶ 180–86; (2) a First Amendment Petition Clause challenge, ¶¶ 187–93; (3) a
vagueness claim under the Fifth Amendment’s Due Process Clause, id. ¶¶ 194–98; and (4) a claim
of unconstitutional delegation to private parties under the Fifth Amendment, id. ¶¶ 199–202. The
government has moved to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6)
for lack of standing and failure to state a claim. See Mot. to Dismiss [ECF No. 10].
II. DISCUSSION
We begin with the familiar standards that govern Rule 12(b) analysis. When facing a Rule
12(b)(1) motion to dismiss for lack of subject-matter jurisdiction, a plaintiff “bears the burden of
showing that he has standing.” Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009). Just
because a plaintiff makes it through the courthouse doors on one claim does not mean that other
claims can tag along; rather, a plaintiff “must demonstrate standing for each claim he seeks to press
and for each form of relief that is sought.” Town of Chester v. Laroe Estates, Inc., 137 S. Ct. 1645,
1650 (2017) (citation omitted). On a motion to dismiss, plaintiffs must plead facts that, taken as
true, raise a plausible standing claim. See Humane Soc’y of the U.S. v. Vilsack, 797 F.3d 4, 8
(D.C. Cir. 2015). The Court must take all facts alleged in the complaint as true and make all
reasonable inferences in plaintiffs’ favor. See Gulf Coast Mar. Supply, Inc. v. United States, 867
6
F.3d 123, 128 (D.C. Cir. 2017). However, the Court “may consider materials outside the pleadings
in deciding whether to grant a motion to dismiss for lack of jurisdiction.” Id.
To survive a motion to dismiss for failure to state a claim under Rule 12(b)(6), a complaint
must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible
on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly,
550 U.S. 544, 570 (2007)). Plausibility does not mean certainty, or that a claim is more likely to
succeed than not, but rather that the claim at issue rises “above the speculative level.” Twombly,
550 U.S. at 555. In other words: if what plaintiffs lay out in the complaint actually happened, is it
more than merely possible that the law has been violated? Plaintiffs cannot meet this standard
through “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory
statements.” Iqbal, 556 U.S. at 678. Likewise, a court need not accept a plaintiff’s legal
conclusions, even if they are dressed up as factual allegations. See Sickle v. Torres Advanced
Enter. Sols., LLC, 884 F.3d 338, 345 (D.C. Cir. 2018). However, courts must accept as true all
facts stated in the complaint, making all reasonable inferences in plaintiffs’ favor. Id.
A. THE INTERNET AS PUBLIC FORUM
At the outset, it is necessary to answer a question that affects both the standing and the
merits inquiries in this case: what is the First Amendment status of the Internet? And, more
particularly, what powers does the government possess to regulate activity on individual websites?
The government bases much of its argument that plaintiffs do not have standing, and that
they have not alleged a First Amendment violation, on the premise that this case is about “a private
actor’s abridgment of free expression in a private forum.” Reply in Supp. of Def.’s Mot. to Dismiss
(“Def.’s Reply”) [ECF No. 15] at 2; see Mem. of P. & A. in Supp. of Def.’s Mot. to Dismiss
(“Def.’s Mem.”) [ECF No. 10-1] at 10–13, 22–24. This argument finds some support in Supreme
7
Court case law, which has rejected the First Amendment claims of individuals who wished to
distribute handbills or advertise a strike in shopping centers against the wishes of the property
owners. See Hudgens v. NLRB, 424 U.S. 507, 520 (1976); Lloyd Corp. v. Tanner, 407 U.S. 551,
567–68 (1972). Private property, the Court determined, does not “lose its private character merely
because the public is generally invited to use it for designated purposes.” Lloyd, 407 U.S. at 569.
Why, then, would it violate the First Amendment to arrest those who engage in expressive activity
on a privately owned website against the owner’s wishes?
The answer is that, quite simply, the Internet is different. The Internet is a “dynamic,
multifaceted category of communication” that “includes not only traditional print and news
services, but also audio, video, and still images, as well as interactive, real-time dialogue.” Reno
v. Am. Civil Liberties Union, 521 U.S. 844, 870 (1997). Indeed, “the content on the Internet is as
diverse as human thought.” Id. (citation omitted). Only last Term, the Supreme Court
emphatically declared the Internet a primary location for First Amendment activity: “While in the
past there may have been difficulty in identifying the most important places (in a spatial sense) for
the exchange of views, today the answer is clear. It is cyberspace . . . .” Packingham v. North
Carolina, 137 S. Ct. 1730, 1735 (2017) (citation omitted).
With this special status comes special First Amendment protection. The Packingham Court
applied public forum analysis to a North Carolina law that banned former sex offenders from using
social media websites, employing intermediate scrutiny because the law was content-neutral. See
id. at 1736. The fact that the statute restricted access to particular websites, run by private
companies, did not change the calculus. Consider: on one of the sites the Court treated as an
exemplar of social media, LinkedIn, “users can look for work, advertise for employees, or review
tips on entrepreneurship,” id. at 1735—the same activities in which Mislove and Wilson wish to
8
engage for their research. As the Court warned, the judiciary “must exercise extreme caution
before suggesting that the First Amendment provides scant protection for access to vast networks
in [the modern Internet].” Id. at 1736. The government’s proposed public/private ownership
distinction cannot account for the Court’s determination in Packingham that privately-owned sites
like Facebook, LinkedIn, and Twitter are part of a public forum, government regulation of which
is subject to heightened First Amendment scrutiny. The Internet “is a forum more in a
metaphysical than in a spatial or geographic sense, but the same principles are applicable.”
Rosenberger v. Rector & Visitors of Univ. of Virginia, 515 U.S. 819, 830 (1995).
An analogy to the real world, while necessarily imperfect, may help illustrate the point.
Stroll out onto the National Mall on any day with decent weather and you will discover a phalanx
of food trucks lining the streets. Those food trucks are privately owned businesses. Customers
interact with them for the private purpose of buying a meal. If they were a brick-and-mortar store
on private property, they would encounter no First Amendment barrier to removing a patron who
created a ruckus. Yet if a customer standing on a public sidewalk tastes her food and then yells at
those in line behind her that they should avail themselves of the myriad other culinary options
nearby, the truck could not call the police to arrest her for her comments. She is in a public forum,
and her speech remains protected even when she interacts with a private business located within
that forum.
It makes good sense to treat the Internet in this manner. “Each medium of expression . . .
must be assessed for First Amendment purposes by standards suited to it, for each may present its
own problems.” Se. Promotions, Ltd. v. Conrad, 420 U.S. 546, 557 (1975). Regulation of the
Internet presents serious line-drawing problems that the public/private distinction in physical space
does not. The decisions in Lloyd and Hudgens concerned “property privately owned and used
9
nondiscriminatorily for private purposes only.” Lloyd, 407 U.S. at 568. It is difficult to argue that
most websites readily meet this description. As the Supreme Court has recognized, the Internet
“provides relatively unlimited, low-cost capacity for communication of all kinds.” Reno, 521 U.S.
at 870. Much of this communication takes place on websites that, in the physical world, would be
seen solely as private, commercial spaces. Take Amazon.com. As a “popular retail website,”
Amazon undoubtedly has a private use “as a seller of products.” Packingham, 137 S. Ct. at 1741
(Alito, J., concurring in the judgment). Yet the site also “facilitates the social introduction of
people for the purpose of information exchanges,” since it “allows a user to create a personal
profile” and, “[w]hen someone purchases a product on Amazon, the purchaser can review the
product and upload photographs, and other buyers can then respond to the review.” Id.
Conversely, Facebook—to which the Court pointed in Packingham as a quintessential site for
protected First Amendment activity—allows users to buy and sell products in its Marketplace, and,
like many social media sites, sells ads to make revenue. 2 Simply put: the public Internet is too
heavily suffused with First Amendment activity, and what might otherwise be deemed private
spaces are too blurred with expressive spaces, to sustain a direct parallel to the physical world.
At the same time, however, it would be ill-advised to “equate the entirety of the [I]nternet
with public streets and parks.” Id. at 1738 (emphasis added). To do so would “gloss[] over the
dual public and private nature of digital arenas,” and subject to heightened scrutiny regulations on
even the Internet’s most secluded nooks and crannies. Note, First Amendment-Freedom of
Speech-Public Forum Doctrine-Packingham v. North Carolina, 131 Harv. L. Rev. 233, 238 (2017).
Rifling through a business’s confidential files is no less a trespass merely because those files are
located in the cloud. A hacker cannot legally break into a Gmail account and copy the account-
2
See Facebook, Facebook Ads, https://www.facebook.com/business/products/ads; Facebook, Marketplace,
https://www.facebook.com/marketplace/learn-more.
10
holder’s emails, just as a busybody cannot legally reach into someone else’s mailbox and open her
mail. The First Amendment does not give someone the right to breach a paywall on a news website
any more than it gives someone the right to steal a newspaper.
What separates these examples from the social media sites in Packingham is that the
owners of the information at issue have taken real steps to limit who can access it. But simply
placing contractual conditions on accounts that anyone can create, as social media and many other
sites do, does not remove a website from the First Amendment protections of the public Internet.
If it did, then Packingham—which examined a law that limited access to websites that require user
accounts for full functionality—would have come out the other way. 137 S. Ct. at 1737; see also
Orin S. Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse
Statutes, 78 N.Y.U. L. Rev. 1596, 1658 (2003) (“Applying a contract-based theory of authorization
in a criminal context . . . may be constitutionally overbroad, criminalizing a great deal beyond core
criminal conduct, including acts protected by the First Amendment.”). Rather, only code-based
restrictions, which “carve[] out a virtual private space within the website or service that requires
proper authentication to gain access,” remove those protected portions of a site from the public
forum. Orin S. Kerr, Essay, Norms of Computer Trespass, 116 Colum. L. Rev. 1143, 1171 (2016).
Stealing another’s credentials, or breaching a site’s security to evade a code-based restriction,
therefore remains unprotected by the First Amendment.
To return to the National Mall example, suppose that a food truck remains stationed on the
Mall but boards up for the night, and the owner returns home. By shutting the food in a truck,
perhaps along with her cooking instructions, the owner has placed a barrier between that property
and the public forum outside. Thus, while the police could not arrest a customer for telling others
in line that the food tastes terrible, or for reading the menu on the truck’s exterior, they could arrest
11
that customer for breaking into the boarded-up truck seeking confidential culinary information.
This is true even if the customer claimed she was doing so in order to broadcast to the world the
truck’s substandard ingredients and ill-conceived recipes. While the First Amendment has free
rein on the Mall generally, it does not protect those who circumvent barriers that demarcate private
areas, even if those private areas are surrounded by an otherwise public forum. This distinction
guides the Court’s analysis here.
B. STANDING
Before reaching the merits of plaintiffs’ claims, the Court must assure itself that they have
standing—a sufficient stake to transform this dispute into one of the “Cases” or “Controversies”
on which federal courts may pass judgment. U.S. Const. art. III, § 2. “The ‘irreducible
constitutional minimum of standing contains three elements’: (1) injury-in-fact, (2) causation, and
(3) redressability.” Rainbow/PUSH Coal. v. FCC, 330 F.3d 539, 542 (D.C. Cir. 2003) (quoting
Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). Plaintiffs must plead or prove each element
of standing “with the manner and degree of evidence required at the successive stages of the
litigation.” Lujan, 504 U.S. at 561. Here, therefore, “general factual allegations of injury resulting
from the defendant’s conduct may suffice” to allege standing, “for on a motion to dismiss we
‘presum[e] that general allegations embrace those specific facts that are necessary to support the
claim.’” Id. (alteration in original) (citation omitted). For any given claim or form of relief, “the
presence of one party with standing is sufficient” to reach the issue. Rumsfeld v. Forum for Acad.
& Institutional Rights, Inc., 547 U.S. 47, 53 n.2 (2006).
Because this is a pre-enforcement challenge, plaintiffs must meet more specific conditions
to satisfy the injury-in-fact requirement. They must plausibly allege “an intention to engage in a
course of conduct [1] arguably affected with a constitutional interest, but [2] proscribed by a
12
statute, and [3] [that] there exists a credible threat of prosecution thereunder.” Susan B. Anthony
List v. Driehaus, 134 S. Ct. 2334, 2342 (2014) (quoting Babbitt v. United Farm Workers Nat’l
Union, 442 U.S. 289, 298 (1979)). The government argues that plaintiffs cannot meet this test.
See Def.’s Mem. at 8–19. Plaintiffs contend that they do intend to engage in constitutionally
protected speech, and that they have pled a credible threat of prosecution. See Pls.’ Mem. of P. &
A. in Opp’n to Def.’s Mot. to Dismiss (“Pls.’ Mem.”) [ECF No. 13] at 18–30. It is clear that any
injury to plaintiffs is caused by the government’s criminalization of websites’ ToS, and that the
declaratory and injunctive relief plaintiffs seek, see Compl. at 46–47, would redress the injury.
Therefore, the question is whether plaintiffs allege a sufficient injury in the first place.
Generally speaking, a court’s standing analysis must be “especially rigorous when reaching
the merits of the dispute would force us to decide whether an action taken by one of the other two
branches of the Federal Government was unconstitutional.” Raines v. Byrd, 521 U.S. 811, 819–
20 (1997). However, the D.C. Circuit has interpreted the Supreme Court’s pre-enforcement
standing doctrine broadly in the First Amendment sphere. Indeed, “the courts have shown special
solicitude to pre-enforcement challenges brought under the First Amendment.” N.Y. Republican
State Comm. v. SEC, 799 F.3d 1126, 1135 (D.C. Cir. 2015). Therefore, the Circuit has found,
“the courts’ willingness to permit pre-enforcement review is ‘at its peak’ when claims are rooted
in the First Amendment.” Id. at 1135 (citation omitted). “Pre-enforcement review, particularly in
the First Amendment context, does not require plaintiffs to allege that they ‘will in fact’ violate
the regulation in order to demonstrate an injury.” U.S. Telecom Ass’n v. FCC, 825 F.3d 674, 739
(D.C. Cir. 2016) (quoting Driehaus, 134 S. Ct. at 2345), reh’g en banc denied, 855 F.3d 381 (D.C.
Cir.), cert. docketed, No. 17-504 (U.S. Oct. 3, 2017). Nor need they show that they are likely to
be prosecuted. Rather, “[s]tanding ‘to challenge laws burdening expressive rights requires only a
13
credible statement by the plaintiff of intent to commit violative acts and a conventional background
expectation that the government will enforce the law.’” Id. (quoting Act Now to Stop War & End
Racism Coal. v. District of Columbia (ANSWER I), 589 F.3d 433, 435 (D.C. Cir. 2009)).
1. “Arguably Affected With a Constitutional Interest”
Plaintiffs assert that their conduct falls within three categories of First Amendment-
protected activity. Scraping data from their target websites, they allege, is subject to the First
Amendment right to record or preserve information. Pls.’ Mem. at 10–14. Moreover, employing
bots and sock puppets and creating false user accounts constitute harmless false speech. Id. at 14–
17. And their planned post-research activities are protected by the right to publish. Id. at 17–18.
All of these claims are sufficiently plausible to conclude that plaintiffs’ proposed conduct is
“arguably affected with a constitutional interest.” Driehaus, 134 S. Ct. at 2342.
First, scraping plausibly falls within the ambit of the First Amendment. “[T]he First
Amendment goes beyond protection of the press and the self-expression of individuals to prohibit
government from limiting the stock of information from which members of the public may draw.”
First Nat. Bank of Boston v. Bellotti, 435 U.S. 765, 783 (1978). The Supreme Court has made a
number of recent statements that give full First Amendment application to the gathering and
creation of information. 3 Additionally, six courts of appeals have found that individuals have a
First Amendment right to record at least some matters of public interest, in order to preserve and
3
See Packingham, 137 S. Ct. at 1737 (holding that banning people from “gain[ing] access to information,”
“knowing current events,” and “checking ads for employment” through social media inhibits “the legitimate exercise
of First Amendment rights”); Sorrell v. IMS Health Inc., 564 U.S. 552, 570 (2011) (“This Court has held that the
creation and dissemination of information are speech within the meaning of the First Amendment. Facts, after all, are
the beginning point for much of the speech that is most essential to advance human knowledge and to conduct human
affairs.” (citations omitted)); Brown v. Entm’t Merchants Ass’n, 564 U.S. 786, 792 n.1 (2011) (“Whether government
regulation applies to creating, distributing, or consuming speech makes no difference.”); Citizens United v. FEC, 558
U.S. 310, 340 (2010) (“Laws enacted to control or suppress speech may operate at different points in the speech
process . . . .”).
14
disseminate ideas. 4 That plaintiffs wish to scrape data from websites rather than manually record
information does not change the analysis. Scraping is merely a technological advance that makes
information collection easier; it is not meaningfully different from using a tape recorder instead of
taking written notes, or using the panorama function on a smartphone instead of taking a series of
photos from different positions. And, as already discussed, the information plaintiffs seek is
located in a public forum. Hence, plaintiffs’ attempts to record the contents of public websites for
research purposes are arguably affected with a First Amendment interest.
Second, plaintiffs have a First Amendment interest in harmlessly misrepresenting their
identities to target websites. The complaint alleges that plaintiffs’ research requires them to create
false employer and job-seeker profiles on employment websites, and to use sock puppets to make
it appear to a number of housing and employment sites that multiple people are accessing the
information they have made available. Compl. ¶¶ 88–93, 114–21. Because “some false statements
are inevitable if there is to be an open and vigorous expression of views in public and private
conversation,” and because “[t]he Government has not demonstrated that false statements
generally should constitute a new category of unprotected speech,” false claims that are not “made
to effect a fraud or secure moneys or other valuable considerations” fall within First Amendment
protection. United States v. Alvarez, 567 U.S. 709, 718, 722–23 (2012). Plaintiffs allege that their
conduct will cause minimal, if any, harm to the targeted websites, and that they will take steps to
avoid affecting third-party users of the website (such as informing job seekers that their fake
4
See Gericke v. Begin, 753 F.3d 1, 7 (1st Cir. 2014); Fields v. City of Philadelphia, 862 F.3d 353, 359 (3d
Cir. 2017); Turner v. Lieutenant Driver, 848 F.3d 678, 688–89 (5th Cir. 2017); ACLU of Ill. v. Alvarez, 679 F.3d 583,
595 (7th Cir. 2012); Animal Legal Def. Fund v. Wasden, 878 F.3d 1184, 1203 (9th Cir. 2018); W. Watersheds Project
v. Michael, 869 F.3d 1189, 1195–97 (10th Cir. 2017); Smith v. City of Cumming, 212 F.3d 1332, 1333 (11th Cir.
2000); see also Rideout v. Gardner, 838 F.3d 65, 75 (1st Cir. 2016), cert. denied, 137 S. Ct. 1435 (2017) (stating that
“[t]here are strong First Amendment interests” in photographically recording one’s own completed ballot, because the
“‘use of illustrations or pictures . . . serves important communicative functions’” (citation omitted)).
15
positions are fake). Compl. ¶¶ 96, 120, 125. Thus, plaintiffs’ harmless false or misleading speech
to website owners is arguably affected with a constitutional interest. 5
Third, plaintiffs contend that they have the right, and the desire, to publish the results of
their research, and that some sites’ ToS prohibit them from doing so without prior permission or
else employ anti-disparagement clauses. Pls.’ Mem. at 17. The Supreme Court has made very
clear that the right to publish falls within the core of the First Amendment’s protections. See, e.g.,
Bartnicki v. Vopper, 532 U.S. 514, 527 (2001) (“As a general matter, ‘state action to punish the
publication of truthful information seldom can satisfy constitutional standards.’” (quoting Smith
v. Daily Mail Publishing Co., 443 U.S. 97, 102 (1979)). Applying criminal sanctions for
publishing original material that uses publicly available information, or for making negative
statements about a website, triggers First Amendment scrutiny.
The government raises two overarching objections to all of these alleged rights. It initially
claims that the First Amendment does not regulate the decisions that private entities make about
how to control access to their private websites—in other words, that there is no state action here.
See Def.’s Mem. at 21–24; Def.’s Reply at 6–12; see also Columbia Broad. Sys., Inc. v.
Democratic Nat. Comm., 412 U.S. 94, 114 (1973) (“[The First Amendment] is a restraint on
government action, not that of private persons.”). However, private speech prohibitions can still
implicate the First Amendment when given the imprimatur of state protection through civil or
criminal law. See, e.g., New York Times Co. v. Sullivan, 376 U.S. 254, 265 (1964). Moreover,
plaintiffs claim injury from a potential criminal action against them—and “a criminal prosecution
under the CFAA would undoubtedly constitute state action” because the government itself is
5
The government counters that Alvarez and the cases that follow it do not “address facially neutral statutes
of general applicability, such as the CFAA.” Def.’s Reply at 10. However, that goes to the standard of review on the
merits rather than to whether plaintiffs’ activities are imbued with any First Amendment interest at all.
16
policing website ToS violations. hiQ Labs, Inc. v. LinkedIn Corp., 273 F. Supp. 3d 1099, 1114
n.12 (N.D. Cal. Aug. 14, 2017), appeal docketed, No. 17-16783 (9th Cir. Sept. 6, 2017).
The government also claims that the First Amendment does not protect plaintiffs’ conduct
because, under Zemel v. Rusk, 381 U.S. 1, 16–17 (1965), and Houchins v. KQED, Inc., 438 U.S.
1, 10–11 (1978) (plurality opinion), the First Amendment does not create a right to acquire
information in whatever manner one desires. Def.’s Mem. at 10–12. In Zemel, the Court held that
the government did not implicate any First Amendment rights by refusing to issue the plaintiff a
passport to visit Cuba, which the plaintiff claimed interfered with his ability to acquaint himself
with the effects of the government’s policies in relation to Cuba. 381 U.S. at 16. The Court
rejected the claim, stating that “[t]he right to speak and publish does not carry with it the
unrestrained right to gather information.” Id. at 17. Then, in Houchins, the Court held that
journalists had no special First Amendment right to access inmates in a jail just because they sought
to write stories about the jail; the Court rejected the “notion that the First Amendment confers a
right of access to news sources.” 438 U.S. at 11. However, the Court did note that “[t]he right to
receive ideas and information is not the issue in this case,” and that “[t]he issue is a claimed special
privilege of access.” Id. at 12. Thus, “[t]here is an undoubted right to gather news ‘from any
source by means within the law,’” but the First Amendment does not “compel[] others—private
persons or governments—to supply information.” Id. at 11.
Here, plaintiffs are not asking the Court to force private websites to provide them with
information that others cannot get. Instead, they seek only to prevent the government from
prosecuting them for obtaining or using information that the general public can access—though
they wish to do so in a manner that could have private consequences, such as a website banning
them or deleting their accounts. See Compl. ¶ 4 (“[Plaintiffs] have no intent . . . to access any data
17
or information that is not made available to the public.”). Because plaintiffs neither want a special
privilege of access nor seek to force websites to give them otherwise unobtainable information,
the Zemel and Houchins line of cases is inapposite here. Plaintiffs therefore plausibly allege that
their conduct is arguably affected with a constitutional interest.
2. “Proscribed by a Statute”
Under D.C. Circuit precedent, “at the motion to dismiss stage, a plaintiff’s non-frivolous
contention regarding the meaning of a statute must be taken as correct for purposes of standing.”
Info. Handling Servs., Inc. v. Def. Automated Printing Servs., 338 F.3d 1024, 1030 (D.C. Cir.
2003). Because plaintiffs’ reading of the statute to encompass all ToS violations is not frivolous,
and because plaintiffs allege that their conduct would violate websites’ ToS, it is clear for standing
purposes that their intended actions would violate the statute.
The government contests this conclusion in only one instance. In two sentences in its reply
brief, the government claims that plaintiffs lack standing for any injuries relating to their ability to
publish. As the government sees it, “[t]he Complaint contains no allegation that any website on
which plaintiffs intend to conduct their activity contains” a restriction on future publication, “and
plaintiffs lack standing to assert claims based on hypothetical circumstances.” Def.’s Reply at 12.
This argument is unavailing. True, plaintiffs do not explicitly allege that their target
websites restrict subsequent publication. But the complaint does allege that “[p]laintiffs wish to
. . . report on their findings to the public,” and that “[t]he research, testing, and investigative
methods they have designed would, if carried out, violate the [Access] Provision, because they all
require violating the [ToS] of the targeted website.” Compl. ¶¶ 134–35 (emphasis added); see also
id. ¶ 160 (“Plaintiffs wish to have the option of publishing the results of their research, including
any findings of discrimination, even if a target website’s ToS prohibit doing so.”). “[O]n a motion
18
to dismiss we presum[e] that general allegations embrace those specific facts that are necessary to
support the claim.” Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C. Cir. 2015)
(second alteration in original) (citation omitted). Plaintiffs’ allegations allow for the presumption
that reporting on their research findings would violate some targeted websites’ ToS. While far
from the degree of proof necessary for summary judgment, see Lujan, 504 U.S. at 561, at this early
stage plaintiffs have plausibly alleged that the CFAA prevents all of their conduct.
3. “Credible Threat of Prosecution”
Even if plaintiffs’ intended conduct is arguably affected with a constitutional interest, and
is prohibited by the CFAA, plaintiffs still must show that there is a credible threat of prosecution
for that conduct under the statute. See Driehaus, 134 S. Ct. at 2342. The government asserts that
plaintiffs cannot meet this test, because “plaintiffs make no allegation that the government has
threatened them with CFAA enforcement,” plaintiffs “cite no instances in which the government
has enforced the challenged provision for harmless [ToS] violations,” and DOJ “has expressly
stated that it has no intention of prosecuting harmless [ToS] violations that are not in furtherance
of other criminal activity or tortious conduct.” Def.’s Reply at 13. The government is, for the
most part, correct on the facts. The complaint does not allege that plaintiffs have actually been
threatened with prosecution. The two cases plaintiffs cite to show that prosecutors have used the
Access Provision to punish ToS violations did, in fact, involve harmful conduct. And DOJ’s
guidance to federal prosecutors does discourage them—though somewhat tepidly—from bringing
CFAA cases based solely on harmless ToS violations. See U.S. Att’y Gen., Intake and Charging
Policy for Computer Crimes Matters (“Charging Policy”) (Sept. 11, 2014) [ECF No. 15–1] at 5.
However, both Supreme Court and D.C. Circuit precedent create a low standing bar in
cases like this one. Because plaintiffs “challenge [a] law[] burdening expressive rights,” and
19
because their complaint provides “a credible statement . . . of intent to commit violative acts,”
plaintiffs may rely on the “conventional background expectation that the government will enforce
the law.” U.S. Telecom Ass’n, 825 F.3d at 739 (citation omitted); accord Act Now to Stop War
& End Racism Coal. v. District of Columbia (ANSWER II), 846 F.3d 391, 401–02 (D.C. Cir.
2017), cert. denied, 138 S. Ct. 334 (2017) (mem.). Indeed, the D.C. Circuit has occasionally found
standing without inquiring into whether the government has actually enforced the challenged
restriction. See U.S. Telecom Ass’n, 825 F.3d at 739–40.
Here, there are sufficient indications of a credible threat to enforce the Access Provision,
both in general and as applied to plaintiffs’ activities. To begin with, the parties have sparred over
whether DOJ has enforced the Access Provision specifically against harmless ToS violations. See
Compl. ¶ 31; Def.’s Mem. at 14–17; Pls.’ Mem. at 3–4, 25. Yet a number of cases have looked to
whether the statutory provision as a whole—or at least the particular term being challenged—has
been enforced through prosecutions, without asking whether the facts were similar to those the
plaintiffs alleged. See, e.g., Holder v. Humanitarian Law Project, 561 U.S. 1, 16 (2010); Babbitt,
442 U.S. at 302; N. Carolina Right to Life, Inc. v. Bartlett, 168 F.3d 705, 710 (4th Cir. 1999). If
one need only find a history of enforcement of the Access Provision generally, or enforcement of
the “exceeds authorized access” language in particular, plaintiffs would have no trouble showing
that there is a significant history. Indeed, the Supreme Court decided a case just two years ago
that involved a prosecution under the Access Provision, in part for exceeding authorized access.
Musacchio v. United States, 136 S. Ct. 709, 713 & n.1 (2016). 6
6
For some other recent examples, see United States v. Batti, 631 F.3d 371, 372 (6th Cir. 2011); United States
v. Willis, 476 F.3d 1121, 1124 (10th Cir. 2007); United States v. Cave, No. 8:12CR417, 2013 WL 3766550, at *1 (D.
Neb. July 16, 2013); United States v. Roque, No. CRIM. 12-540 KM, 2013 WL 2474686, at *1 (D.N.J. June 6, 2013);
United States v. Auernheimer, No. 11-CR-470 SDW, 2012 WL 5389142, at *1 (D.N.J. Oct. 26, 2012), rev’d, 748 F.3d
525 (3d Cir. 2014); United States v. Aleynikov, 737 F. Supp. 2d 173, 190 (S.D.N.Y. 2010).
20
Even looking more closely at similar factual scenarios, plaintiffs have shown that
prosecutions have stemmed from close enough facts that it would be credible to fear a future
prosecution for their own activities. Plaintiffs cite two cases in which individuals were prosecuted
under the Access Provision for violating ToS agreements: United States v. Lowson, No. 10-cr-114
(KSH), 2010 WL 9552416 (D.N.J. Oct. 12, 2010), and United States v. Drew, 259 F.R.D. 449
(C.D. Cal. 2009). Compl. ¶ 31. Lowson, as the government points out, did not solely involve
violations of website ToS; it also involved ticket scalpers’ attempts “to defeat code-based security
restrictions” on Ticketmaster’s website. 2010 WL 9552416, at *5. However, the indictment
alleged “both contract- and code-based violations,” id. at *6, and laid out the websites’ prohibitions
that the defendants allegedly violated, see Superseding Indictment at 5–9, Lowson, 2010 WL
9552416 (No. 10-cr-114), ECF No. 10-2. More directly on point is Drew, in which the government
prosecuted a woman for lying about her age and creating a false account on Myspace in order to
cyberbully her daughter’s teenage classmate—thus violating Myspace’s ToS in order to commit
the tort of intentional infliction of emotional distress. 259 F.R.D. at 452. Prosecutors included
both a felony count under the Access Provision—because the violation was in furtherance of a
tortious act—and a misdemeanor count for the standalone ToS violations. Id. at 451. The jury
acquitted Drew on the felony count, id.; the court then dismissed the misdemeanor conviction, as
coverage of ToS violations rendered the Access Provision unconstitutionally vague, id. at 467.
That the government brought the Drew case without enough evidence to ultimately prove
the added harm required for a felony conviction, and chose to include a misdemeanor count for
harmless ToS violations, lends some credibility to plaintiffs’ fears of prosecution. The government
also does not know whether prosecutors may have employed the Access Provision to obtain plea
agreements in which defendants admitted to harmless ToS violations. See Tr. of Mot. Hr’g [ECF
21
No. 20] at 17:15–18:13. 7 These prior prosecutions, whether under the Access Provision generally
or under related factual circumstances, provide “somewhat more than the ‘conventional
background expectation that the government will enforce the law.’” ANSWER I, 589 F.3d at 435
(citation omitted). Thus, even if more were necessary, plaintiffs have provided it.
Finally, the government has not expressly disavowed any intent to prosecute plaintiffs,
which would defeat the normal expectation of enforcement. The government points to a 2014
memorandum that the Attorney General sent to United States Attorneys regarding charging policy
under the CFAA, which the government claims is the current “binding guidance” on this issue.
Def.’s Reply at 14. According to the government, plaintiffs’ fear of prosecution is “implausible”
because (1) the charging policy focuses on several factors that would not apply to harmless ToS
violations, (2) prosecutions based solely on such violations are discouraged, and (3) attorneys must
consult with the Criminal Division of DOJ before making CFAA charging decisions. Id.
However, to disprove an otherwise credible threat of prosecution, courts have normally required
an explicit statement “that plaintiffs will not be prosecuted if they do what they say they wish to
do.” Humanitarian Law Project, 561 U.S. at 16. The government has not made such a declaration.
DOJ’s charging policy states that, “if the defendant exceeded authorized access solely by violating
an access restriction contained in a contractual agreement or [ToS] with an Internet service
provider or website, federal prosecution may not be warranted.” Charging Policy at 5 (emphasis
added). This is a far cry from the sort of disavowal required by case law. 8
7
It also matters that the CFAA is a civil as well as a criminal statute. The possibility of administrative or
private civil actions, even without a threat of criminal prosecution, may buttress—or perhaps independently provide—
standing for pre-enforcement challenges. See, e.g., Babbitt, 442 U.S. at 302 n.13; Chamber of Commerce v. FEC, 69
F.3d 600, 603 (D.C. Cir. 1995).
8
The government also offers the statement of the Deputy Assistant Attorney General for the Criminal
Division before a congressional subcommittee in 2015, in which the DAAG stated that DOJ “has no interest in
prosecuting harmless violations of use restrictions” and suggested amending the CFAA so that it would essentially
only apply to the acts that currently give rise to a felony under the Access Provision. Statement of David M. Bitkower,
Deputy Ass’t Att’y Gen., Crim. Div., Dep’t of Justice, Before the Subcomm. On Crime and Terrorism, S. Comm. on
22
In an attempt to provide such a disavowal, and at the Court’s suggestion, the government
filed an affidavit from John T. Lynch, Jr., Chief of the Computer Crime and Intellectual Property
Section of the Criminal Division of DOJ. Aff. of John T. Lynch, Jr. [ECF No. 21-1]. He points
to the charging factors mentioned above, id. at 2–3, and states that he “do[es] not expect that the
Department would bring a CFAA prosecution based on such facts and de minimis harm,” id. at 3.
But many things that we do not expect in fact come to pass. An official’s prognostication does not
substitute for a declaration of non-prosecution. Moreover, even explicit disavowals are most
valuable when they are made “on the basis of the Government’s own interpretation of the statute
and its rejection of plaintiffs’ interpretation as unreasonable.” Blum v. Holder, 744 F.3d 790, 798
(1st Cir. 2014). Here, the government has implicitly—and in past prosecutions, explicitly—read
the Access Provision to include ToS violations. See Charging Policy at 4–5. “[T]o rely upon
prosecutorial discretion to narrow the otherwise wide-ranging scope of a criminal statute’s highly
abstract general statutory language places great power in the hands of the prosecutor.” Marinello
v. United States, No. 16-1144, 2018 WL 1402426, at *6 (U.S. Mar. 21, 2018). The Constitution
“does not leave us at the mercy of noblesse oblige,” United States v. Stevens, 559 U.S. 460, 480
(2010), which is all the government ultimately offers.
One final point. Until now, this standing analysis has focused on plaintiffs’ First
Amendment challenge. But plaintiffs also bring due process claims. In Seegars v. Gonzales, 396
F.3d 1248 (D.C. Cir. 2005), the D.C. Circuit applied a more rigorous “imminence” standard for
non-First-Amendment constitutional claims. But the court took pains to point out that it was forced
to follow circuit precedent that conflicted with the Supreme Court’s and the D.C. Circuit’s own
the Judiciary (July 8, 2015) [ECF No. 10-3] at 6. However, this is no stronger a disavowal than is DOJ’s statement in
its charging policy. Moreover, Congress never adopted DOJ’s proposed amendments.
23
laxer standing test for First Amendment pre-enforcement challenges. See id. at 1252–54.
Subsequent cases have confirmed that the “more demanding standard” required by Seegars does
not apply when challenging “laws burdening expressive rights.” ANSWER I, 589 F.3d at 435.
Here, plaintiffs’ Fifth Amendment claims allege an injury-in-fact essentially identical to that
alleged for their First Amendment claims. Pls.’ Mem. at 23 n.2. Both the Supreme Court and the
D.C. Circuit have upheld standing for dual First- and Fifth-Amendment pre-enforcement
challenges, under a less rigorous imminence standard, without distinguishing between the two
amendments for standing purposes. See Humanitarian Law Project, 561 U.S. at 11–12, 15–16;
ANSWER II, 846 F.3d at 396, 401–02; ANSWER I, 589 F.3d at 434–35. Plaintiffs therefore have
standing to bring their Fifth Amendment claims along with their First Amendment ones.
For the foregoing reasons, plaintiffs have plausibly pled standing at the motion to dismiss
stage, and the government’s Rule 12(b)(1) motion will be denied.
C. INTERPRETING THE STATUTE
Plaintiffs allege only constitutional claims in this case. Likely because they are bringing a
pre-enforcement challenge, they are not claiming that the statute, properly read, does not apply to
them. However, nearly all of their claims require the Court to determine the reach of the Access
Provision before deciding the constitutional question. Since the Court does not accept plaintiffs’
legal conclusions as true for purposes of a motion to dismiss under Rule 12(b)(6), see Doe v.
Rumsfeld, 683 F.3d 390, 391 (D.C. Cir. 2012), plaintiffs’ reading of the statute to cover their
conduct does not control. Instead, the Court must interpret the law.
Courts are split as to how to read the relevant provisions. The CFAA defines the phrase
“exceeds authorized access” as “to access a computer with authorization and to use such access to
obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”
24
18 U.S.C. § 1030(e)(6). The Second, Fourth, and Ninth Circuits have held that this language
prohibits only unauthorized access to information. See United States v. Valle, 807 F.3d 508, 523–
28 (2d Cir. 2015); WEC Carolina Ener. Solutions LLC v. Miller, 687 F.3d 199, 206 (4th Cir.
2012); Nosal, 676 F.3d at 863; see also Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648
F.3d 295, 304 (6th Cir. 2011) (stating, based on Ninth Circuit precedent, that “an individual who
is authorized to use a computer for certain purposes but goes beyond those limitations . . . has
‘exceed[ed] authorized access’” (citation omitted) (alteration in original)). Meanwhile, the First,
Fifth, and Eleventh Circuits have held that it also covers (at least in some instances) unauthorized
use of information that a defendant was authorized to access only for specific purposes. See EF
Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 583 (1st Cir. 2001); United States v. John,
597 F.3d 263, 271 (5th Cir. 2010); United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir.
2010); see also Int’l Airport Centers, LLC v. Citrin, 440 F.3d 418, 420–21 (7th Cir. 2006) (holding
that an employee who deleted his employer’s files in violation of his employment contract had
terminated the agency relationship that authorized him to access the information). Courts have
also split over whether violating a website’s ToS exceeds authorized access for purposes of the
CFAA. 9 The D.C. Circuit has never opined on either question. Several district judges in this
9
Compare Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016) (“[A] violation of
the terms of use of a website—without more—cannot establish liability under the CFAA.”), cert. denied 138 S. Ct.
313 (2017) (mem.); Valle, 807 F.3d at 528 (rejecting unauthorized use reading of “exceeds authorized access” because
“the government’s interpretation of ‘exceeds authorized access’ makes every violation of a private computer use policy
a federal crime”); WEC Carolina, 687 F.3d at 206 (noting that the unauthorized use reading “would impute liability
to an employee who with commendable intentions disregards his employer’s policy against downloading information
to a personal computer so that he can work at home”), with EarthCam, Inc. v. OxBlue Corp., 703 Fed. App’x 803,
808 & n.2 (11th Cir. 2017) (stating that “one of the lessons from [circuit precedent] may be that a person exceeds
authorized access if he or she uses the access in a way that contravenes any policy or term of use governing the
computer in question,” and noting the dissenting views of other circuits); CollegeSource, Inc. v. AcademyOne, Inc.,
597 Fed. App’x 116, 130 (3d Cir. 2015) (suggesting that defendants can be prosecuted under the CFAA if they
“breach[ed] any technological barrier or contractual term of use”); EF Cultural Travel BV v. Zefer Corp., 318 F.3d
58, 62 (1st Cir. 2003) (“A lack of authorization could be established by an explicit statement on the website restricting
access. . . . Many webpages contain lengthy limiting conditions, including limitations on the use of scrapers.”).
25
Circuit, however, have held that the provision only applies to unauthorized access to information,
not to unauthorized use of properly accessed material. See Hedgeye Risk Mgmt., LLC v. Heldman,
271 F. Supp. 3d 181, 194–95 (D.D.C. 2017) (collecting cases).
At one point in their briefing, plaintiffs suggest a different dividing line: a limiting
construction that carves out harmless ToS violations from the statute. Pls.’ Mem. at 31–33, 35.
However, “[t]he text will not bear such a reading.” INS v. Yueh-Shaio Yang, 519 U.S. 26, 30
(1996). It is one thing to carve out such violations by determining that the statute is
unconstitutional as applied, but the text of the statute itself—“exceeds authorized access”—and its
statutory definition do not appear to allow for such a surgical slicing off of conduct. How does
the text differentiate between ToS violations and violations of employers’ computer use policies,
for instance? And how does the text distinguish between “[ToS] violations alone,” Pls.’ Mem. at
35, and ToS violations that cause damage or involve fraud, which plaintiffs admit are covered by
§§ 1030(a)(4) and (a)(5), id. at 31–32? One can just as easily “use [authorized] access to obtain
or alter information in the computer that the accesser is not entitled so to obtain or alter,”
§ 1030(e)(6), whether it is a website or some other entity that is doing the authorizing, and whether
the violation is harmful or harmless.
The question thus remains whether “exceeds authorized access” refers to access alone or
to access, use, and other violations. The Court finds the narrow interpretation adopted by the
Second, Fourth, and Ninth Circuits—and by numerous other district judges in this Circuit—to be
the best reading of the statute. First, the text itself more naturally reads as limited to violations of
the spatial scope of one’s permitted access. To “exceed[] authorized access,” one must have
permission to access the computer at issue, and must “use such access”—i.e., one’s authorized
presence on the computer—“to obtain or alter information in the computer.” Id. Thus, unlike the
26
phrase “unauthorized access” used alongside it in several CFAA provisions, the phrase “exceeds
authorized access” refers not to an outside attack but rather to an inside job. See, e.g., Nosal, 676
F.3d at 858. The rest of the definition requires that the information at issue be information “that
the accesser is not entitled so to obtain or alter.” Id. The key word here is “entitled.” “And, in
context, the most ‘sensible reading of “entitled” is as a synonym for “authorized.”’” Hedgeye, 271
F. Supp. 3d at 194 (quoting Nosal, 676 F.3d at 857). The focus is thus on whether someone is
allowed to access a computer at all, in the case of “unauthorized access,” or on whether someone
is authorized to obtain or alter particular information, in the case of “exceeds authorized access.”
In neither instance does the statute focus on how the accesser plans to use the information. 10
The statutory context buttresses this narrower reading of the text. Reading “exceeds
authorized access” to turn on the accesser’s purpose in seeking out the information would eliminate
a major difference between the Access Provision—which has no purpose requirement—and other
provisions that require intent to defraud. E.g., 18 U.S.C. § 1030(a)(4). It would also water down
the difference between the misdemeanor penalty provisions and the felony provisions that enhance
sentences for violations committed for fraud or financial gain. Id. § 1030(c)(2); see also S. Rep.
No. 104-357, at 8 (1996) (“[T]he statutory penalties are structured to provide that obtaining
information of minimal value is only a misdemeanor, but obtaining valuable information, or
misusing information in other more serious ways, is a felony.” (emphasis added)). After all, just
about any attempt to use proprietary information to defraud or for personal or commercial gain
would likely violate a computer use policy or website ToS. See Nosal, 676 F.3d at 858 n.4.
10
Nor does the word “so,” which has inspired a good deal of exegesis in prior opinions, see WEC Carolina,
687 F.3d at 205–06; Nosal, 676 F.3d at 857–58, meaningfully change this focus. Read in the context of the phrase
“so to obtain or alter,” “so” most naturally refers back to the earlier phrase “such access,” emphasizing that the accesser
must not have been entitled to obtain or alter that particular information through the particular authorization used—
even if, theoretically, there were another way in which the accesser might legally obtain or alter the information.
27
Congress knew how to draft a specific intent requirement, and did so in these other sections of the
CFAA. It would be rather odd, then, for Congress to also smuggle a specific intent factor into its
definition of the actus reus of the offense. While this context is certainly not dispositive—
Congress often drafts overlapping or even redundant provisions—it is best to avoid readings that
“would render superfluous another part of the same statutory scheme.” Marx v. Gen. Revenue
Corp., 568 U.S. 371, 386 (2013).
Legislative history also points to an access-based, rather than an intended-use-based,
reading of “exceeds authorized access.” The Second Circuit has already canvassed in great detail
the congressional intent and history behind the definition of “exceeds authorized access,” see
Valle, 807 F.3d at 525–26, and this Court will not repeat it here. This Court agrees with the Second
Circuit, however, that “the legislative history consistently characterizes the evil to be remedied—
computer crime—as ‘trespass’ into computer systems or data, and correspondingly describes
‘authorization’ in terms of the portion of the computer’s data to which one’s access rights extend.”
Id. at 525. Congress thus viewed exceeding authorized access as the digital equivalent of being
allowed into a house but entering a room within it that the owner has declared to be off-limits. A
sensible conception, particularly considering that the language at issue was written in 1986—
before the World Wide Web or websites existed. See Kerr, Norms of Computer Trespass, supra,
at 1161.
The amendment history of the definition supports this reading. The initial language of the
CFAA applied to anyone who, knowingly “having accessed a computer with authorization, uses
the opportunity such access provides for purposes to which such authorization does not extend,
and thereby obtains information.” Counterfeit Access Device and Computer Fraud and Abuse Act
of 1984, Pub. L. No. 98-473, tit. II, ch. 21, § 2102(a), 98 Stat. 1837, 2190–91 (emphasis added).
28
In 1986, however, in a section entitled “Modification of Authorized Access Aspect of Offenses,”
Congress replaced this language with the phrase “exceeds authorized access,” and, in a section
entitled “Conforming Amendments to Definitions Provision,” added the current definition of that
phrase. See Computer Fraud and Abuse Act of 1986, Pub. L. No. 99-474, § 2(c), (g)(4), 100 Stat.
1213, 1215. It is not clear that Congress intended this language change to be substantive. See S.
Rep. No. 99-432, at 9 (1986) (“The Committee intends this change to simplify the language in 18
U.S.C. 1030(a)(1) and (2), and the phrase ‘exceeds authorized access’ is defined separately in
Section (2)(g) of the bill.”); 132 Cong. Rec. 28,821 (1986) (statement of Rep. Hughes) (stating, as
the chairman of the drafting subcommittee just before final passage, that “the basic thrust of this
bill remains its three new offenses with some minor changes in the existing law”). Yet it is notable
that Congress did not simply transpose the existing, purpose-oriented language into the definition
section—which still would have simplified the language of § 1030(a), as desired—but instead
replaced it with new language that focuses on authorization to access particular information.
Indeed, if Congress did not think it was making a substantive change, the legislative history
suggests that this was because Congress thought the initial language also was limited to access,
since “when Congress referenced the user’s ‘purposes,’ it spoke in terms of the particular computer
files or data to which the user’s access rights extended.” Valle, 807 F.3d at 526.
Finally, plaintiffs raise numerous First and Fifth Amendment concerns with the Access
Provision that would arise out of reading “exceeds authorized access” to include the purpose or
use restrictions that appear in many ToS. When a court is “deciding which of two plausible
statutory constructions to adopt,” and when “one of them would raise a multitude of constitutional
problems, the other should prevail.” Clark v. Martinez, 543 U.S. 371, 380–81 (2005). This maxim
holds doubly true for criminal statutes. See Marinello, 2018 WL 1402426, at *4 (“[Courts] have
29
traditionally exercised restraint in assessing the reach of a federal criminal statute, both out of
deference to the prerogatives of Congress and out of concern that ‘a fair warning should be given
to the world in language that the common world will understand, of what the law intends to do if
a certain line is passed.’” (citation omitted)). While the CFAA’s text and legislative history point
strongly toward an access-only interpretation of “exceeds authorized access,” a broader reading is
not entirely implausible; therefore, constitutional avoidance applies. Cf. Jennings v. Rodriguez,
138 S. Ct. 830, 842 (2018). In interpreting the statutory text, the Court need not determine whether
plaintiffs’ constitutional arguments would actually win the day. Rather, the Court undertakes “a
narrow inquiry” into whether one reading “presents a significant risk that [constitutional
provisions] will be infringed.” NLRB v. Catholic Bishop of Chicago, 440 U.S. 490, 533 (1979).
Here, significant risks abound. By providing for both civil and criminal enforcement of
websites’ limitless ToS—including enforcement by the same entities that write the ToS—a broader
reading of the CFAA “would appear to criminalize a broad range of day-to-day activity” and
“subject individuals to the risk of arbitrary or discriminatory prosecution and conviction,” raising
Fifth Amendment concerns. United States v. Kozminski, 487 U.S. 931, 949 (1988); see Valle, 807
F.3d at 527–28; Nosal, 676 F.3d at 862. By incorporating ToS that purport to prohibit the purposes
for which one accesses a website or the uses to which one can put information obtained there, the
CFAA threatens to burden a great deal of expressive activity, even on publicly accessible
websites—which brings the First Amendment into play. See Packingham, 137 S. Ct. at 1736. If
“exceeds authorized access” is read broadly, plaintiffs claim, the Access Provision could even run
afoul of the Fifth Amendment by delegating power to private parties to define restrictions
“limitless in time and space,” which can then operate as petty civil and criminal codes. Pls.’ Mem.
at 10; see Ass’n of Am. R.Rs. v. U.S. Dep’t of Transp. (Ass’n of Am. R.Rs. II), 821 F.3d 19, 31
30
(D.C. Cir. 2016) (“[T]he Supreme Court has consistently concluded the delegation of coercive
power to private parties can raise . . . due process concerns.”); Note, The Vagaries of Vagueness:
Rethinking the CFAA as a Problem of Private Nondelegation, 127 Harv. L. Rev. 751, 768–71
(2013) (arguing that a broadly-read CFAA violates the nondelegation doctrine). One need neither
slay nor succumb to this Hydra-headed set of objections to acknowledge it as formidable.
All of these factors, therefore, lead the Court to adopt a narrow reading of the term “exceeds
authorized access.” 11 Just as an individual “accesses a computer ‘without authorization’ when he
gains admission to a computer without approval,” an individual “‘exceeds authorized access’ when
he has approval to access a computer, but uses his access to obtain or alter information that falls
outside the bounds of his approved access.” WEC Carolina, 687 F.3d at 204.
This interpretation gets us far, but not all the way. At oral argument, both parties agreed
that the Access Provision applies only to access restrictions. See Tr. of Mot. Hr’g at 19:17–20:3,
34:10–35:22. But they have very different ideas about what that means. The government treats
this difference as a largely temporal one. It argues that “the moment the violation occurs is on
access,” so that subsequent usage of information lawfully obtained does not constitute a CFAA
violation. Id. at 20:12–:18. But the government also claims that “it’s appropriate to analyze the
issue of whether access is authorized according to a broad context of background facts that could
include limitations on the purpose for which information is accessed,” such as “access restrictions
that are contained in the [ToS] that the website itself has prepared.” Id. at 19:21–20:2. Plaintiffs,
11
A number of other courts have applied the rule of lenity to limit the scope of “exceeds authorized access.”
See Valle, 807 F.3d at 526; WEC Carolina, 687 F.3d at 204; Nosal, 676 F.3d at 363. The rule of lenity “requires
ambiguous criminal laws to be interpreted in favor of the defendants subjected to them.” DePierre v. United States,
564 U.S. 70, 88 (2011) (citation omitted). However, lenity is to be used “only ‘at the end of the process of construing
what Congress has expressed’ when the ordinary canons of statutory construction have revealed no satisfactory
construction.” Lockhart v. United States, 136 S. Ct. 958, 968 (2016) (citation omitted). Text, context, legislative
history, congressional intent, and constitutional avoidance all point in one direction here. Because these tools “allow
[the Court] to make far more than ‘a guess as to what Congress intended,’ the rule of lenity does not apply.” DePierre,
564 U.S. at 89. If the question were closer, however, lenity would undoubtedly come to plaintiffs’ aid.
31
on the other hand, argue that the distinction between access and use turns on the conduct being
prohibited, rather than whether the website attempts to cast the conduct as related to access rather
than use. Id. at 61:17–:23. Plaintiffs’ reading is the more natural one, and better reflects the
constitutional avoidance concerns that support the Court’s interpretation of the statute. Therefore,
the Court must make an objective inquiry into the conduct alleged to violate websites’ ToS. The
focus is on what information plaintiffs plan to access, not on why they wish to access it, the manner
in which they use their authorization to access it, or what they hope to do with it.
Applying this standard, it becomes clear that most of plaintiffs’ proposed activities fall
outside the CFAA’s reach. Scraping or otherwise recording data from a site that is accessible to
the public is merely a particular use of information that plaintiffs are entitled to see. The same
goes for speaking about, or publishing documents using, publicly available data on the targeted
websites. The use of bots or sock puppets is a more context-specific activity, but it is not covered
in this case. Employing a bot to crawl a website or apply for jobs may run afoul of a website’s
ToS, but it does not constitute an access violation when the human who creates the bot is otherwise
allowed to read and interact with that site. See Kerr, Norms of Computer Trespass, supra, at 1170.
The website might purport to be limiting the identities of those entitled to enter the site, so that
humans but not robots can get in. See Star Wars: Episode IV – A New Hope (Lucasfilm 1977)
(“We don’t serve their kind here! . . . Your droids. They’ll have to wait outside.”). But bots are
simply technological tools for humans to more efficiently collect and process information that they
could otherwise access manually. Cf. Star Wars: Episode II – Attack of the Clones (Lucasfilm
2002) (“[I]f droids could think, there’d be none of us here, would there?”).
Out of plaintiffs’ proposed activities, then, only Mislove and Wilson’s plan to create
fictitious user accounts on employment sites would violate the CFAA. Unlike plaintiffs’ other
32
conduct, which occurs on portions of websites that any visitor can view, creating false accounts
allows Mislove and Wilson to access information on those sites that is both limited to those who
meet the owners’ chosen authentication requirements and targeted to the particular preferences of
the user. 12 Creating false accounts and obtaining information through those accounts would
therefore fall under the Access Provision. With that in mind, the Court must turn to the
government’s motion to dismiss plaintiffs’ constitutional claims.
D. FREEDOM OF SPEECH AND FREEDOM OF THE PRESS
Plaintiffs first claim that the Access Provision violates the First Amendment’s guarantees
of freedom of speech and of the press. 13 They assert that the provision is both facially overbroad
and unconstitutional as applied to their own conduct. The Court will analyze these claims in turn.
1. Facial Overbreadth
Plaintiffs allege that the Access Provision “creates virtually limitless restrictions on speech
and expressive activity,” such that the statute “is unconstitutionally overbroad on its face.” Compl.
¶ 183. In a typical facial challenge, plaintiffs must show “‘that no set of circumstances exists under
which [the Access Provision] would be valid,’ . . . or that the statute lacks any ‘plainly legitimate
sweep.’” Stevens, 559 U.S. at 472 (citations omitted). However, First Amendment cases allow
for “‘a second type of facial challenge,’ whereby a law may be invalidated as overbroad if ‘a
substantial number of its applications are unconstitutional, judged in relation to the statute’s plainly
12
Professor Kerr argues that “a website that appears to require a username and password to access the
contents of the site, but that actually grants access for any username and password combination,” should not be seen
as creating an access restriction, because it “would appear to a user to regulate by code, but would actually work more
like a system of regulation by contract.” Kerr, Cybercrime’s Scope, supra, at 1646. The distinction between code-
based and contract-based barriers matters for First Amendment analysis, see supra Part II.A, but it does not quite line
up with the Court’s reading of the CFAA. Social media sites like Facebook, for instance, grant access for any
username and password combination, but they still allow those with accounts to access data that those who merely
visit the site without signing up cannot. Hence, conditions placed on account creation can still be access restrictions.
13
Courts normally subject free speech and free press claims to the same level of scrutiny. See, e.g., Citizens
United, 558 U.S. at 352; McConnell v. FEC, 251 F. Supp. 2d 176, 234–35 (D.D.C.) (three-judge court) (per curiam),
aff’d in part, rev’d in part, 540 U.S. 93 (2003). The Court will thus treat the speech claim as a proxy for both.
33
legitimate sweep.’” Id. at 473 (citation omitted). This second, lower bar is the one against which
plaintiffs—and the Court—measure their challenge.
The government argues that plaintiffs have failed to state a plausible overbreadth claim.
See Def.’s Reply at 18–19. The Court agrees. “The first step in overbreadth analysis is to construe
the challenged statute; it is impossible to determine whether a statute reaches too far without first
knowing what the statute covers.” United States v. Williams, 553 U.S. 285, 293 (2008). The
Court has now done so. Plaintiffs have operated under the assumption that the Access Provision
covers all ToS violations; but, properly read, the Access Provision incorporates only those ToS
that limit access to particular information. This fact alone is enough to dispose of plaintiffs’
overbreadth claim. “Invalidation for overbreadth is strong medicine,” id. (citation omitted), to be
“employed . . . sparingly and only as a last resort,” Broadrick v. Oklahoma, 413 U.S. 601, 613
(1973). A court should not invalidate a provision for overbreadth “when a limiting construction
has been or could be placed on the challenged statute.” Id.
Plaintiffs concede that a limiting construction would address their overbreadth concerns—
though they contend that the Access Provision would need to be “construed not to reach [ToS]
violations alone.” Pls.’ Mem. at 35. While the Court’s reading of “exceeds authorized access” is
not as narrow as the reading plaintiffs might prefer, it does eliminate many of the potentially
unconstitutional applications of the Access Provisions. To be overbroad, a statute’s
unconstitutional scope must be “substantial, not only in an absolute sense, but also relative to the
statute’s plainly legitimate sweep.” Williams, 553 U.S. at 292. As purpose, use, or manner
restrictions fall outside the Access Provision’s reach, plaintiffs have not plausibly alleged that the
provision’s potentially unconstitutional applications are substantial relative to its legitimate ones.
Moreover, plaintiffs also bring an as-applied claim, and facial challenges are disfavored when a
34
case “may be disposed of on narrower grounds.” Texas v. Johnson, 491 U.S. 397, 403 n.3 (1989).
Hence, Plaintiffs’ overbreadth claim will be dismissed.
2. As-Applied Challenge
Plaintiffs allege that, “[a]s applied to the[m],” the Access Provision “unconstitutionally
restricts their protected speech.” Compl. ¶ 184. “[T]o prevail on an as-applied First Amendment
challenge,” plaintiffs “must show that the [Access Provision is] unconstitutional as applied to their
particular speech activity.” Edwards v. District of Columbia, 755 F.3d 996, 1001 (D.C. Cir. 2014).
“‘[T]he distinction between facial and as-applied challenges . . . goes to the breadth of the remedy
employed by the Court, not what must be pleaded in a complaint.’ . . . The substantive rule of law
is the same for both challenges.” Id. (citations omitted).
Aside from the overarching objections that the Court has already rejected, the
government’s primary response to plaintiffs’ as-applied claim is that the Access Provision
regulates conduct, rather than speech, and is therefore subject to limited scrutiny. See Def.’s Mem.
at 21, 27. But even if a law “says nothing about speech on its face,” it is “subject to First
Amendment scrutiny” if “it restricts access to traditional public fora.” McCullen v. Coakley, 134
S. Ct. 2518, 2529 (2014). As the Access Provision both limits access to and burdens speech in the
public forum that is the public Internet, see supra Part II.A, heightened First Amendment scrutiny
is appropriate. “In particular, the guiding First Amendment principle that the ‘government has no
power to restrict expression because of its message, its ideas, its subject matter, or its content’
applies with full force in a traditional public forum.” Id. (citation omitted). Content- or viewpoint-
based restrictions receive strict scrutiny. See Reed v. Town of Gilbert, 135 S. Ct. 2218, 2226
(2015); Rosenberger, 515 U.S. at 829. On the other hand, if a statute is content-neutral and only
“impose[s] reasonable restrictions on the time, place, or manner of protected speech,” McCullen,
35
134 S. Ct. at 2529, it is subjected to intermediate scrutiny. “In order to survive intermediate
scrutiny, a law must be ‘narrowly tailored to serve a significant governmental interest,’”
Packingham, 137 S. Ct. at 1736 (citation omitted), and must “leave open ample alternative
channels for communication of the information,” McCullen, 134 S. Ct. at 2529. 14
Plaintiffs claim that the Access Provision allows websites to impose direct speech
restrictions, including content-based restrictions, and that it is therefore subject to strict scrutiny.
Pls.’ Mem. at 34–35. However, the statute itself does not target speech, or impose content-based
regulations, on its face. Nor have plaintiffs plausibly alleged that the government’s purpose is to
restrict speech based on its content or viewpoint. Indeed, while the government has not yet been
able to proffer much evidence of the purposes behind the provision, the legislative history indicates
that Congress was interested in passing the Access Provision to prevent the digital equivalent of
theft. See S. Rep. 104–357, at 7 (“The proposed subsection 1030(a)(2)(C) is intended to protect
against the interstate or foreign theft of information by computer. . . . This subsection would
ensure that the theft of intangible information by the unauthorized use of a computer is prohibited
in the same way theft of physical items are protected [sic].”). Therefore, strict scrutiny does not
apply. See Pursuing America’s Greatness v. FEC, 831 F.3d 500, 509 (D.C. Cir. 2016) (stating that
courts must determine content neutrality based on text, and then purpose).
14
The standard that governs expressive conduct prohibitions with “incidental limitations on First Amendment
freedoms,” see United States v. O’Brien, 391 U.S. 367, 376 (1968), is inapposite to this as-applied claim. “The law
here may be described as directed at conduct, . . . but as applied to plaintiffs the conduct triggering coverage under the
statute consists of communicating a message.” Humanitarian Law Project, 561 U.S. at 28. Plaintiffs are informing
the websites of who they are, and claiming to be employers, much in the same way that the defendant in Alvarez had
claimed to be a decorated war veteran, or the plaintiffs in Humanitarian Law Project had sought to train terrorists to
engage in peaceful activity. All of these forms of conduct communicate messages to the recipients. Moreover, it is
the content of plaintiffs’ speech to the targeted websites—that they represent their identities falsely or misleadingly
instead of truthfully—that triggers the sites’ ToS and, thereby, the criminal penalties of the CFAA. In other words,
Mislove and Wilson would violate the Access Provision “because of the [false] content of [their] particular message.”
Id. In these circumstances, the government must meet a “more demanding standard” than the O’Brien test. Id.
(quoting Johnson, 491 U.S. at 403). Even if that test were applicable, however, “in the last analysis [it] is little, if any,
different from the standard applied to time, place, or manner restrictions,” Johnson, 491 U.S. at 407, and incorporates
narrow tailoring requirements, see Edwards, 755 F.3d at 1002–03, so the analysis would not meaningfully change.
36
From the information available so far, significant interests appear to underlie the Access
Provision. In addition to the legislative history regarding theft prevention, the government
suggests that the Court analogize the CFAA to trespass law, arguing that Congress was also trying
to prohibit the digital equivalent of trespassing. Def.’s Reply at 3–5. While plaintiffs dispute the
trespass analogy, they recognize that the CFAA was passed to prevent computer theft and other
cybercrime, and have not disputed that this is a significant interest. Pls.’ Mem. at 31. The question
is thus whether the statute fails narrow tailoring as applied to Mislove and Wilson’s plan to
“creat[e] profiles containing false information,” Compl. ¶ 124, and “access[] websites using
artificial tester profiles, in violation of [ToS] that prohibit providing false information,” id. ¶ 154.
“To satisfy narrow tailoring, the [government] must prove the challenged regulations
directly advance its asserted interests.” Edwards, 755 F.3d at 1003. This means “the government
must show ‘a close fit between ends and means,’” such “that the regulation ‘promotes a substantial
government interest that would be achieved less effectively absent the regulation,’” and does “not
‘burden substantially more speech than is necessary to further the government’s legitimate
interests.’” A.N.S.W.E.R. Coalition v. Basham, 845 F.3d 1199, 1213–14 (D.C. Cir. 2017)
(citations omitted). At this early stage, the government has not put forward any evidence to show
that prosecuting those who provide false information when creating accounts, without more, would
advance its interest in preventing digital theft or trespass.
Indeed, presuming the allegations in the complaint to be true, it appears that the
government’s interest “is not implicated on these facts” at all. Johnson, 491 U.S. at 410. Plaintiffs
allege that their conduct “will not cause material harm to the target websites’ operations,” and that
“they have no intent to commit fraud or to access any data or information that is not made available
to the public.” Compl. ¶ 4. It is difficult to argue that trespass or theft concerns can justify
37
restricting—or even apply to—viewing information that a website makes available to anyone who
chooses to create a username and password. Cf. Kerr, Cybercrime’s Scope, supra, at 1646. And
any inadvertent “fraud” plaintiffs may perpetrate against the target websites by creating fictitious
accounts will be, plaintiffs allege, harmless. The CFAA already punishes harmful, intentional
fraud in a separate section, see 18 U.S.C. § 1030(a)(4), providing additional evidence that the
government can further its legitimate interests just as well without applying the Access Provision
to plaintiffs’ bare false statements. At this stage, “absent any evidence that the speech [would be]
used to gain a material advantage,” Alvarez, 567 U.S. at 723, plaintiffs’ false speech on public
websites retains First Amendment protection, see id. at 722, and rendering it criminal does not
appear to advance the government’s proffered interests. Hence, plaintiffs have plausibly alleged
an as-applied First Amendment claim, and the motion to dismiss that claim will be denied.
E. RIGHT TO PETITION
In addition to their free speech and press claims, plaintiffs allege that the Access Provision
violates their rights under the Petition Clause of the First Amendment. Compl. ¶ 193. That clause
states: “Congress shall make no law . . . abridging . . . the right of the People . . . to petition the
Government for a redress of grievances.” U.S. Const. amend. I. Plaintiffs assert that the Access
Provision, by criminalizing websites’ prohibitions on critical speech or publishing, prevents people
from using any information they might gain from plaintiffs’ planned research to inform Congress
or agencies about potential discrimination by those websites. Id. ¶¶ 162–67, 189. They also assert
that, for the same reasons, the Access Provision prevents people from accessing the courts to
enforce Title VII or the Fair Housing Act: nobody who had visited a website with a non-
disparagement clause in its ToS could bring discrimination claims against that site in court without
opening him- or herself up to a potential CFAA prosecution. Id. ¶¶ 168–69, 190.
38
These allegations are focused on ToS that restrict subsequent speech: disparagement, for
instance, or use of the sites’ information in court. However, such ToS constitute restrictions on
the use of information, not on access to it. They therefore do not fall within the Access Provision’s
ambit, as properly interpreted. But even if one assumes that plaintiffs allege that access restrictions
criminalized by the Access Provision violate the Petition Clause, see Compl. ¶ 162, plaintiffs’
petition challenge is, at best, no stronger than their free speech challenge. Speech and petition
rights are “generally subject to the same constitutional analysis,” Wayte v. United States, 470 U.S.
598, 610 n.11 (1985), unless “the special concerns of the Petition Clause would provide a sound
basis for a distinct analysis,” Borough of Duryea v. Guarnieri, 564 U.S. 379, 389 (2011). Here,
the rights appear to overlap: plaintiffs’ Petition Clause claim focuses on speech restrictions that
could then affect the petitioning process. Thus, plaintiffs “just as easily could have alleged”—and
do, in fact, allege—a Speech Clause violation on the same set of facts. Id. at 387.
And it is on that free speech claim that plaintiffs’ First Amendment case must rise or fall.
The Speech and Press Clauses, rather than the Petition Clause, provide the more natural home for
plaintiffs’ concerns about the Access Provision. Plaintiffs assert that the CFAA “prevents them
from engaging in” petitioning because some websites’ ToS (and thus the Access Provision)
“prohibit the speech necessary to engage in . . . petitioning.” Pls.’ Mem. at 43. The real concern,
then, is the Access Provision’s alleged restrictions on speech, which have ripple effects in a variety
of contexts. The application of the Access Provision to the petitioning process constitutes one
small subset of the speech and conduct the provision allegedly prohibits. Any effect the statute
might have on plaintiffs’ petition rights, then, is an extra step removed from the central speech
harm, and is thus too attenuated to state a plausible claim for relief.
39
Ultimately, “the Petition Clause protects the right of individuals to appeal to courts and
other forums established by the government for resolution of legal disputes,” and “[i]nterpretation
of the Petition Clause must be guided by the objectives and aspirations that underlie the right.”
Borough of Duryea, 564 U.S. at 387–88. As the government notes, the clause is not aimed at the
right to gather facts, or to speak while doing so, as a preliminary step to help prepare that petition
in a preferred way. See Def.’s Mem. at 28. That right is more naturally the province of the Speech
and Press Clauses than of the Petition Clause. See Burt Neuborne, Madison’s Music: On Reading
the First Amendment 11–12, 89 (2015) (arguing that the First Amendment’s protected rights form
“a rigorous chronological narrative of free citizens governing themselves in an ideal democracy,”
and that the Petition Clause “concludes Madison’s narrative, protecting [an] idea’s introduction
into the formal democratic process, forcing the legislature to place the issue on its agenda”).
Hence, plaintiffs’ Petition Clause claim will be dismissed.
F. VAGUENESS
Plaintiffs next allege that the Access Provision violates the Due Process Clause because it
is unconstitutionally vague. A statute is void if it is “[1] so vague that it fails to give ordinary
people fair notice of the conduct it punishes, or [2] so standardless that it invites arbitrary
enforcement.” Johnson v. United States, 135 S. Ct. 2551, 2556 (2015). Plaintiffs allege that the
Access Provision meets both prongs of this test. Compl. ¶¶ 171–72. Because of potential chilling
effects, “a more stringent vagueness test” applies when a law “interferes with the right of free
speech.” Vill. of Hoffman Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 499 (1982).
Properly interpreted, however, the Access Provision is not unconstitutionally vague. “A
plaintiff whose speech is clearly proscribed cannot raise a successful vagueness claim” based on a
lack of fair notice. Expressions Hair Design v. Schneiderman, 137 S. Ct. 1144, 1151–52 (2017)
40
(quoting Humanitarian Law Project, 561 U.S. at 20). Nor can that plaintiff bring a facial vagueness
challenge “based on the speech of others.” Humanitarian Law Project, 561 U.S. at 20. As we have
already seen, the Access Provision plainly proscribes the creation of false accounts, but does not
prohibit plaintiffs’ other activities. Indeed, plaintiffs allege that they are aware that their proposed
conduct would violate their target websites’ ToS restrictions on creating false accounts. Compl.
¶ 124. As the Court has determined that the Access Provision applies to one of their activities but
not to the others, and as plaintiffs admit that they have the requisite mens rea to commit the crime,
no facial claim or as-applied notice claim can go forward.
Nor can plaintiffs plausibly allege that the Access Provision invites arbitrary enforcement.
“[A] statute’s vagueness is either susceptible to judicial construction or is void for vagueness based
on the application of traditional rules for statutory interpretation.” United States v. Bronstein, 849
F.3d 1101, 1106 (D.C. Cir. 2017). Thus, “before striking a federal statute as impermissibly vague,”
courts must “consider whether the prescription is amenable to a limiting construction.” Welch v.
United States, 136 S. Ct. 1257, 1268 (2016) (citation omitted). The Court has already determined
that a more limited construction is not only possible, but is in fact more natural than the broad
reading that raises vagueness concerns. Read to apply only to access, and not to use, restrictions,
the Access Provision severely curtails both websites’ ability to define the law and prosecutors’
freedom arbitrarily to enforce it. Plaintiffs’ Fifth Amendment vagueness claim will be dismissed.
G. NONDELEGATION DOCTRINE
Finally, plaintiffs allege that the Access Provision violates the Fifth Amendment because
it delegates the content of criminal law to private parties. Compl. ¶¶ 173–77, 201. The primary
case laying out the private nondelegation doctrine is Carter v. Carter Coal Co., 298 U.S. 238
(1936). The statute at issue in that case delegated to coal industry groups the power to create
41
binding codes for the regulation of coal miners’ wages and hours. Id. at 310–11. The Court stated
that this power “is legislative delegation in its most obnoxious form; for it is not even delegation
to an official or an official body, presumptively disinterested, but to private persons whose interests
may be and often are adverse to the interests of others in the same business.” Id. at 311. Prior to
Carter Coal, the Supreme Court also twice struck down ordinances that sanctioned a “standardless
delegation of power to a limited group of property owners.” City of Eastlake v. Forest City
Enterprises, Inc., 426 U.S. 668, 678 (1976) (discussing Eubank v. Richmond, 226 U.S. 137 (1912),
and Washington ex rel. Seattle Title Trust Co. v. Roberge, 278 U.S. 116 (1928)).
The D.C. Circuit has gleaned two rules from these cases. First, “[f]ederal lawmakers
cannot delegate regulatory authority to a private entity.” Ass’n of Am. R.Rs. v. U.S. Dep’t of
Transp. (Ass’n of Am. R.Rs. I), 721 F.3d 666, 670 (D.C. Cir. 2013), vacated and remanded on
other grounds, 135 S. Ct. 1225 (2015). Unlike with delegations to agencies, “[e]ven an intelligible
principle cannot rescue a statute empowering private parties to wield regulatory authority.” Id. at
671. And second, “the due process of law is violated when a self-interested entity is ‘intrusted
with the power to regulate the business . . . of a competitor.’” Ass’n of Am. R.Rs. II, 821 F.3d at
31 (quoting Carter Coal, 298 U.S. at 311). Plaintiffs claim that the Access Provision violates the
first of these principles. They allege that the law allows website owners to define the content of a
crime—thus sweeping beyond other statutes that merely enforce private contractual agreements—
and that the statute relinquishes any government control over the lawmaking process. Compl.
¶¶ 174–76. They also assert that the Access Provision provides no standards to guide what website
owners may effectively criminalize. See Pls.’ Mem. at 40.
Plaintiffs raise an intriguing argument, but it is ultimately an unsuccessful one. As with
First Amendment overbreadth and vagueness, the courts can avoid nondelegation concerns by
42
“giving narrow constructions to statutory delegations that might otherwise be thought to be
unconstitutional.” Mistretta v. United States, 488 U.S. 361, 373 n.7 (1989). Plaintiffs assert that
the Access Provision provides a limitless, standardless delegation of power to individual websites
to define crimes. But that assertion is based on a reading of the provision that sweeps in use,
purpose, or manner restrictions on obtaining or altering information. Properly read as applying
only to access restrictions, websites can write whatever ToS they please, but a congressionally-
imposed standard limits which ToS can lead to liability or prosecution. Nor do websites have the
power to impose formal rules on an industry or otherwise exercise regulatory authority in the
manner that courts have found constitutionally impermissible. See, e.g., Yakus v. United States,
321 U.S. 414, 424 (1944); Carter Coal, 298 U.S. at 310–11; Ass’n of Am. R.Rs. I, 721 F.3d at
670–72. Plaintiffs have cited no case—nor has the Court found one—in which a court struck down
on private nondelegation grounds a statute that incorporated private parties’ chosen restrictions,
which are only binding on those who interact with those parties’ individual businesses. It is thus
difficult to argue that the Access Provision improperly delegates legislative or regulatory authority.
Indeed, when read narrowly, the Access Provision looks similar to many criminal laws that
are rendered operative by a private party’s decision whether to authorize certain conduct.
Examples cited in the government’s brief, see Def.’s Mem. at 32–33, include criminal trespass
laws, see D.C. Code § 22–3302; 25 C.F.R. § 11.411, and laws against misappropriation of trade
secrets, see 18 U.S.C. § 1831, copyrights, see 17 U.S.C. §§ 106, 506, individuals’ identities, see
18 U.S.C. § 1029, and money (e.g., embezzlement). In none of these instances does a private
party’s control over the law’s operation render it a nondelegation problem. Rather, “a legislative
delegation to private citizens” is constitutional so long as “[1] the underlying exercise of authority
[is] a reasonable regulation within the power of the government . . . . and [2] the legislature’s
43
restriction [is] in the form of a general prohibition, and the delegation [is] in the form of permitting
private citizens to waive the protection of that prohibition.” Silverman v. Barry, 845 F.2d 1072,
1086 (D.C. Cir. 1988). A different rule would make it so that “[a]lmost any system of private or
quasi-private law could be subject to the” nondelegation doctrine. New Motor Vehicle Bd. of Cal.
v. Orrin W. Fox Co., 439 U.S. 96, 109 (1978). Since the Access Provision creates a blanket
prohibition on accessing information in protected computers, which owners of those computers
can waive through permission, plaintiffs do not plausibly allege that the provision
unconstitutionally delegates legislative power. Hence, the nondelegation claim will be dismissed.
CONCLUSION
This case raises important questions about the government’s ability to criminalize vast
swaths of everyday activity on the Internet. However, the Court need not answer all of them today,
because it concludes that the CFAA prohibits far less than the parties claim (or fear) it does. For
the reasons explained above, plaintiffs have plausibly alleged that they have standing to sue, and
that the Access Provision violates the Free Speech and Free Press Clauses of the First Amendment
as applied to them. The government’s motion to dismiss for lack of standing and on this single as-
applied claim will therefore be denied. But the Access Provision, as the Court reads it, does not
sweep widely enough to render plausible plaintiffs’ First Amendment overbreadth and petition
claims, or their Fifth Amendment vagueness and nondelegation claims. The government’s motion
to dismiss those claims, therefore, will be granted. A separate order will issue on this date.
/s/
JOHN D. BATES
United States District Judge
Dated: March 30, 2018
44