Chegg, Inc. v. Doe

Opinion

CHEGG, INC., Case No. 22-cv-07326-CRB

Plaintiff,

ORDER DENYING MOTION FOR v. PRELIMINARY INJUNCTION AND SERVICE BY ALTERNATIVE Defendant.

Plaintiff Chegg, Inc. (“Chegg”), an online learning platform, brings this action against the individual or entity that owns or controls Homeworkify, a website that allows users to obtain Chegg content for free. Chegg brings four claims against Homeworkify: for violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030; the California Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502; breach of contract; and trademark infringement under the Lanham Act. Compl. (dkt. 1) ¶¶ 49–82. After many unsuccessful attempts at unmasking the individual or entity behind Homeworkify, Chegg brings this motion for a preliminary injunction and for service by alternative means, through the email associated with Homeworkify’s domain registration. Mot. (dkt. 33). Chegg also seeks an injunction ordering Homeworkify’s domain registry to seize its registered domain name and transfer it to Chegg. See Proposed Order (dkt. 36) at 5. As of this date, Homeworkify has not been served, because the individual or entity behind it remains anonymous. As a result, Homeworkify has not appeared or responded to the motion. The Court held a hearing on the motion on June 30, 2023. causes Chegg irreparable harm, and because Chegg has failed to demonstrate that Homeworkify is a foreign entity, the Court DENIES Chegg’s motion, without prejudice to a future motion that addresses the concerns discussed below. Chegg is an online learning platform that offers Chegg Study, a service that provides step-by-step solutions to problems in commonly used textbooks for high school and college students. Compl. ¶ 12. Such solutions are hidden behind a paywall: a Chegg user must create an account, agree to Chegg’s terms of use, and, after a free trial period, pay a subscription fee to see Chegg’s solutions. Id. ¶¶ 17, 39. Chegg alleges that Homeworkify has circumvented Chegg’s paywall by allowing members of the public to copy Chegg URLs into Homeworkify and view Chegg’s solutions, without making an account on Chegg.com. Id. ¶¶ 36–38. Chegg hypothesizes that Homeworkify has gained access to ten million pieces of Chegg content by making free trial accounts on Chegg.com—thereby getting past Chegg’s paywall and gaining access to its library of solutions—and using automated means to steal large amounts of Chegg solutions at once (often called “scraping”). Heasman Decl. ¶¶ 18, 25. If Homeworkify has procured its library of Chegg solutions in this manner, Chegg contends that it has violated Chegg’s terms of use. Compl. ¶ 19; Ex. B. At one point, Homeworkify utilized the Chegg name and logo on its website, but according to Chegg, since the start of this litigation, it has halted this practice. Heasman Decl. ¶ 32. While Homeworkify no longer advertises on its homepage that it provides Chegg solutions specifically, Chegg alleges that Homeworkify has used, and continues to use, Chegg’s name in its Google advertising. See Compl. ¶ 48 (“Unblur Chegg”); id. (“Free Chegg Answers”); Heasman Decl. ¶ 31. Chegg has taken multiple steps to unmask the person or entity behind Homeworkify, all to no avail. Because the contact information in Homeworkify’s domain registration is cloaked, Chegg began by issuing cease-and-desist orders to Homeworkify’s associated with Homeworkify’s domain registration.1 Saber Decl. (dkt. 35) ¶¶ 3–6. Chegg then subpoenaed NameCheap and Cloudflare, seeking to uncloak the name in Homeworkify’s domain registration, and any IP addresses associated with its login information. Id. ¶ 7. Both services complied, but the names they provided were a dead end: Chegg’s investigator concluded that the name in Homeworkify’s domain registration was fake; and the account holders of the IP addresses associated with Homeworkify’s login information had no knowledge of Homeworkify or the entity behind it, suggesting that Homeworkify was using their IP addresses as a shield to keep Chegg from finding out where Homeworkify was based. Id. ¶¶ 7–8; 10–14. After these fruitless attempts to unmask the defendant, Chegg brought the instant motion. At the hearing on this motion, Chegg stated that the person or entity behind Homeworkify likely has notice of this suit for two reasons: First, after Chegg’s counsel sent the instant motion to the email address in Homeworkify’s domain registration, Homeworkify launched a new domain, homeworkify.eu, suggesting that Homeworkify might be concerned that it might lose the homeworkify.net domain; and second, one day after Chegg initiated proceedings in Germany to take down this new domain, Chegg.com experienced a cyberattack. A. Legal Standard A preliminary injunction is an “extraordinary remedy that may only be awarded upon a clear showing that the plaintiff is entitled to such relief.” See Winter v. Natural Res. Def. Council, Inc., 555 U.S. 7, 22 (2008). The party seeking a preliminary injunction must establish: (1) a likelihood of success on the merits; (2) a likelihood of irreparable harm absent preliminary relief; (3) that the balance of equities tips in the plaintiff’s favor; and (4) that an injunction is in the public interest. See id. at 20. Alternatively, the moving party must demonstrate that “serious questions going to the merits were raised and the balance of hardships tips sharply in the plaintiff’s favor,” and that the other two Winter elements are met. Alliance for Wild Rockies v. Cottrell, 632 F.3d 1127, 1134–35 (9th Cir. 2011). B. Discussion The Court addresses the Winter factors in the following order: (1) likelihood of success on the merits; (2) irreparable harm; (3) balance of the equities; and (4) public interest. 1. Likelihood of Success on the Merits a. CFAA Under the CFAA, a party may be subject to liability if it “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer.” 18 U.S.C § 1030(a)(2).2 Chegg argues that by making free accounts, from which Chegg’s millions of solutions may be accessed, and using sophisticated systems to take those solutions for its own gain in violation of Chegg’s terms of use, Homeworkify has “exceed[ed] authorized access” under the CFAA. Mot. at 8–9. Chegg is incorrect. “[A] violation of the terms of use of a website—without more—cannot establish liability under the CFAA.” Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016); see also Van Buren v. United States, 141 S. Ct. 1648, 1661 (2021) (disapproving of a reading of the CFAA that would interpret “exceeds authorized access” to impute liability for a failure “to follow specified terms of service”). Because the CFAA is “best understood as an anti-intrusion statute and not a ‘misappropriation statute,’” the fact that Homeworkify has clearly flouted Chegg’s terms of use—if it has obtained Chegg’s solutions by using free trial accounts3—has no bearing 2 A “protected computer” includes essentially any computer connected to the Internet. See hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195 (9th Cir. 2022).

3 The fact that Chegg solutions are only viewable to those who have created accounts, as opposed on whether it has violated the CFAA. hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1196 (9th Cir. 2022) (quoting United States v. Nosal, 676 F.3d 854, 857–58 (9th Cir. 2012)). Whether, assuming Homeworkify continued to “use bots to scrape Chegg’s content” after Chegg sent a cease-and-desist letter to Homeworkify in November, Homeworkify then violated the CFAA, presents a closer issue. Heasman Decl. ¶ 25. In Power Ventures, the Ninth Circuit squarely held that when a website sends a cease-and- desist and imposes technical barriers to entry (such as blocking an IP address), that act signifies a withdrawal of authorization under the CFAA, meaning that by continuing to access the website’s content, a defendant “exceeds authorized access.” Power Ventures, 844 F.3d at 1067. If Chegg’s cease-and-desist specifically outlawed continued access to Chegg’s solutions through free trial accounts and Chegg imposed technological barriers to stop Homeworkify from doing so, and Homeworkify continued to access Chegg content in this manner, Power Ventures teaches that this may very well constitute a CFAA violation. But Chegg does not provide sufficient facts to demonstrate a likelihood of success on this theory. First, Chegg did not provide the text of the cease-and-desist letter it sent to Homeworkify. Thus, the Court cannot determine what Chegg ordered Homeworkify to cease and desist from doing. See Saber Decl. ¶ 6; Ex. 4. Second, Chegg only speculates that Homeworkify has continued to access Chegg content since it ordered Homeworkify to cease and desist in November; it does not provide any evidence that Homeworkify is in access as a “gates-up-or-down inquiry—one either can or cannot access a computer system, and either can or cannot access certain areas within the system.” Van Buren, 141 S. Ct. at 1658–59; see also hiQ Labs, 31 F.4th at 1197–98 (explaining the Ninth Circuit’s similar three-computer- system approach, with the second being “computers for which authorization is required and has been given”). Based on Chegg’s explanation of how its authorization system works, a user with an account may access all of its solutions, either during a free trial period or when they begin to pay for full access to Chegg. Compl. ¶ 12. Thus, if Homeworkify signed up for a free trial account (as Chegg assumes that it has) it gained access to all of Chegg’s solutions. In other words, the “gate” was up, or “authorization was required and has been given,” even if Homeworkify used that authorization in a way that contravened Chegg’s terms. Van Buren, 141 fact doing so.4 And third, while Chegg details its technical efforts to stop Homeworkify from using the data it had already obtained, it does not provide any specific examples of its technical efforts to stop Homeworkify from accessing additional data, beyond its general protections against bots (which clearly were not effective against Homeworkify). See Heasman Decl. ¶¶ 15, 26–30. Because the CFAA only prohibits unauthorized access, not misuse, see Van Buren, 141 S. Ct. at 1662, if Chegg only ordered Homeworkify to cease and desist from its use of Chegg content it had already “scraped” from Chegg’s website, that would not be a withdrawal of access under the CFAA. Accordingly, Chegg has not demonstrated a likelihood of success on its CFAA claim.5 b. Section 502 California’s CFAA counterpart, the Comprehensive Computer Data Access and Fraud Act, imposes liability on a person who “[k]nowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.” Cal. Penal Code § 502(c)(2). While these statutes are “different,” as the Ninth Circuit held in Power Ventures, “the analysis under both statutes is similar in the present case.” Power Ventures, 844 F.3d at 1069. Just as “[the defendant] had implied authorization to access Facebook’s computers” and thus “it did not, at first, violate the statute,” Homeworkify, through its free trial accounts, had implied authorization to access Chegg’s solutions, if not 4 Of course, if Chegg can persuasively demonstrate that Homeworkify is behind the cyberattack Chegg.com recently experienced, that might change this conclusion.

5 Chegg also argues that Homeworkify has violated another provision of the statute, by “knowingly caus[ing] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer.” Mot. at 8 (quoting 18 U.S.C § 1030(a)(5)(A)). But Chegg has not shown that Homeworkify has caused “damage” as it is defined in the CFAA: “impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). Chegg has only shown that Homeworkify took Chegg’s data and used it for its own purposes; Chegg has not to violate Chegg’s terms of use. Id. Though it might be argued that Chegg’s cease-and- desist letter and its technical restrictions on Homeworkify’s use of Chegg’s data put Homeworkify on notice that its access had been revoked—thereby “[k]nowingly access[ing] and without permission . . . mak[ing] use” of Chegg’s solutions—Chegg has not provided sufficient evidence to demonstrate a likelihood of success on the merits of this claim, either. c. Breach of Contract To prevail on a claim for breach of contract under California law, a plaintiff must demonstrate “(1) the existence of the contract, (2) plaintiff’s performance or excuse for nonperformance, (3) defendant’s breach and (4) the resulting damages to the plaintiff.” Oasis West Realty, LLC v. Goldman, 51 Cal.4th 811, 821 (2011). Based on Chegg’s submissions, there is a likelihood that the parties entered an enforceable contract that Homeworkify breached. Assuming that Homeworkify created an account on Chegg’s website to access Chegg’s solutions, it assented to Chegg’s terms of use. See Compl. ¶ 70 (showing the “Create Account” button, which is accompanied by text that states “[b]y clicking ‘Create account’ you agree to the Terms and Privacy Policy,” where “Terms” and “Privacy Policy” are hyperlinked). Chegg’s terms prohibit users from using Chegg’s data for commercial purposes, and requires them to agree “not to view, copy, or procure content or information from the Services by automated means (such as scripts, bots, spiders, crawlers, or scrapers), or to use other data mining technology or processes to frame, mask, extract data or other materials from the Chegg Content.” Heasman Decl. ¶ 14, Ex. 2. By “scraping” Chegg solutions in huge quantities and publishing them on Homeworkify for free (while simultaneously earning ad revenue, see Compl. ¶ 45), Homeworkify likely breached Chegg’s terms, resulting in damage to Chegg. See, e.g., Facebook, Inc. v. Sahinturk, No. 20-CV-08153-JSC, 2022 WL 1304471 (N.D. Cal. May 2, 2022) (granting default judgment on breach of contract claim where the defendant scraped Instagram data and monetized it in violation of Facebook’s terms of d. Trademark Infringement and False Designation of Origin To succeed on the merits of its Lanham Act claims, Chegg must show “(1) a protectible ownership interest in the mark; and (2) a likelihood of consumer confusion in defendant’s use of its allegedly infringing mark.” Lodestar Anstalt v. Bacardi & Co. Ltd., 31 F.4th 1228, 1245 (9th Cir. 2022) (internal quotation marks omitted). Because Chegg has demonstrated a protectable ownership interest in its marks, see Heasman Decl. Ex. 5, the Court applies the Sleekcraft factors to determine the likelihood of confusion: (1) the similarity of the marks; (2) the strength of the mark allegedly infringed upon; (3) the proximity between the two entities’ goods and services; (4) the likelihood that the infringer will expand into the infringee’s market; (5) the degree of care likely to be exercised by purchasers of the services; (6) evidence of actual confusion in the marketplace; (7) the similarity of the marketing channels used; and (8) the infringer’s intent in selecting the mark. Brookfield Comm’cns, Inc. v. W. Coast Ent. Corp., 174 F.3d 1036, 1053–54 (9th Cir. 1999) (citing AMF Inc. v. Sleekcraft Boats, 599 F.2d 341, 348–49 (9th Cir. 1979)). Chegg has demonstrated a likelihood of success on its Lanham Act claims as well. Homeworkify’s use of the Chegg mark—on its website (though now removed) and in its Google advertising, Heasman Decl. ¶¶ 31–32—is patently intended to induce web users to mistake Homeworkify for Chegg or assume that Homeworkify is associated with Chegg in some way. The parties offer the same service—solutions to textbook questions—and while Chegg offers those answers for a fee, Homeworkify offers them for free, enticing Google users to “Unblur Chegg . . . Answers.”6 Id. ¶ 31. Homeworkify has employed Chegg’s marks to inform users that “Homeworkify supports viewing answers” from Chegg’s website, piggybacking on Chegg’s status among college and high school students to siphon some of Chegg’s users. Id. ¶ 32. Further, Chegg has proffered evidence of a Reddit post asking if Homeworkify is a “scam,” suggesting that Homeworkify’s effort to associate itself with Chegg has at least partially successfully confused some consumers. Id. ¶ 34. Accordingly, Chegg has shown a likelihood of success on its Lanham Act claims. 2. Irreparable Harm “[M]onetary injury is not normally considered irreparable.” Los Angeles Mem’l Coliseum Comm’n v. Nat’l Football League, 634 F.2d 1197, 1202 (9th Cir. 1980). Rather, to show irreparable harm for an injury to one’s business, a plaintiff must show a monetary injury that approximates a threat of “extinction.” See hiQ Labs, 31 F.4th at 1188. And contrary to Chegg’s representations in its briefing, irreparable harm is no longer presumed where there is a strong case of trademark infringement. Herb Reed Enterprises, LLC v. Fla. Ent. Mgmt., Inc., 736 F.3d 1239, 1249 (9th Cir. 2013). Loss of goodwill and the ability to control one’s mark can amount to irreparable harm, but a plaintiff must point to actual evidence to demonstrate that “irreparable injury is likely in the absence of an injunction.” Id. at 1250 (quoting Winter, 555 U.S. at 22). Chegg has not demonstrated a significant threat to its business posed by Homeworkify, or actual evidence of loss of goodwill or reputation as a result of Homeworkify’s use of Chegg’s marks or solutions. Certainly, the scraping of millions of Chegg’s solutions and offering those solutions up for free on a competing site is troubling and might indeed amount to irreparable harm.7 But Chegg has not demonstrated, for example, that significant numbers of students are foregoing subscriptions to Chegg in favor of obtaining free solutions from Homeworkify, and that such a loss in subscriptions threatens the possibility of Chegg’s “extinction,” rather than a monetary loss that may be compensable through damages. The best evidence Chegg has provided indicates that one solution on Homeworkify has received 34 “thumbs up” votes, and, extrapolating from that evidence, concluded that “it can be appreciated that Homeworkify does significant 7 Certainly, if Homeworkify is the source of the cyberattack on Chegg.com referenced by Chegg’s counsel at the hearing on this motion, that (perhaps ongoing) threat to Chegg’s systems could financial and other harm to Chegg.” Compl. ¶ 47; Ex. G.8 This is far from sufficient to demonstrate loss of goodwill or loss of business significant enough to constitute irreparable harm. Additionally, Chegg argues that, absent injunctive relief, Homeworkify may continue to “disseminate Chegg’s stolen content on Homeworkify with impunity.” Mot. at 15. Chegg may well be right. But a movant is not entitled to injunctive relief because harm is ongoing or may continue, or because there is a likelihood of success on the merits of some of its claims. Just as Chegg has not shown on this record that it has suffered irreparable harm from Homeworkify’s past dissemination of Chegg’s solutions, it has not shown that Homeworkify poses a risk of additional irreparable harm in the future. 3. Balance of the Equities The balance of the equities, however, tips in favor of Chegg. Homeworkify’s business model seems to depend on siphoning content from other sites (including but not limited to Chegg) and providing that content for free. Homeworkify’s continued use of the solutions it has “scraped” from Chegg likely constitutes a continued breach of Chegg’s terms of use. It is certainly possible that Homeworkify has agreements with other sites to use their content without incurring liability, rendering some portion of Homeworkify’s business legitimate. But the ongoing injury to Chegg through Homeworkify’s use of Chegg’s library of solutions outweighs any injury to Homeworkify through its inability to use those solutions for its own gain. 4. Public Interest The public interest, too, favors an injunction. Homeworkify’s prior use of Chegg’s mark, coupled with its continued use of Chegg’s solutions, is very likely to continue to cause consumer confusion, the “usual public interest in trademark cases.” See Internet Specialties W., Inc. v. Milon-DiGiorgio Enters., Inc., 559 F.3d 985, 993 (9th Cir. 2009). 8 Chegg has also noted a single question on Reddit asking whether Homeworkify is a “scam.” Heasman Decl. ¶ 34. While this is relevant to the question of consumer confusion underpinning The public interest is compounded by the fact that customers may, in their confusion about whether Homeworkify is associated with Chegg, give their private information to an entity they know nothing about. See, e.g., Heasman Decl. ¶¶ 34–35. C. Conclusion While the Ninth Circuit continues to employ a sliding scale approach to preliminary injunctions, a plaintiff must still satisfy every Winter factor. See Cottrell, 632 F.3d at 1135. Therefore, even though the balance of the equities and the public interest tips in Chegg’s favor, and Chegg has arguably demonstrated a likelihood of success on the merits on at least some of its claims, it has not demonstrated that irreparable harm would result from Homeworkify’s continued operation while Chegg litigates this case. Particularly given the extraordinary remedy Chegg seeks—not just shutting down Homeworkify, but the transfer of Homeworkify’s domain to Chegg—Chegg’s motion for a preliminary injunction is denied, without prejudice to a future motion that addresses the concerns outlined herein. Additionally, Chegg seeks to serve Homeworkify by alternative means pursuant to Rule 4(f)(3). Because Chegg has not demonstrated that the person or entity behind Homeworkify is foreign, Chegg’s request to serve Homeworkify by email is denied without prejudice to a future motion. Federal Rule of Civil Procedure 4 provides different processes for serving foreign individuals and corporations and serving domestic individuals and corporations. Service upon foreign corporations is governed by Rule 4(h)(2), which allows foreign corporations to be served in the same manner as foreign individuals under Rule 4(f). See Fed. R. Civ. P. 4(h)(2). Domestic corporations, however, may be served in the same manner as domestic individuals, or by delivering a copy of the summons and complaint to an agent of the corporation. Id. 4(h)(1). Thus, whether service by alternative means under Rule 4(f)(3) is available depends on whether the defendant is a foreign person or entity. and whether they are based inside or outside the United States. See Heasman Decl. ¶¶ 6–8. It is understandable that, given Homeworkify’s technical prowess and its apparent resistance to being unmasked and served, Chegg would wish to serve it by email. But Chegg provides no case that allows Rule 4(f)(3) to be used to serve an entirely unknown defendant without any evidence that that defendant is foreign.9 The only authority Chegg cites (and that the Court can find) are cases in which the plaintiff has discovered that the defendant is a foreign individual or corporation, but its precise address is unknown. See Rio Properties, Inc. v. Rio Int’l Interlink, 284 F.3d 1007, 1013, 1018–19 (9th Cir. 2002) (allowing the plaintiff to serve process by email on a Costa Rican entity with an unknown address); Elsevier, Inc. v. Siew Yee Chew, 287 F. Supp. 3d 374, 377, 380 (S.D.N.Y. 2018) (service by email on defendants that plaintiff learned were based out of China and Malaysia but whose location could not otherwise be determined); see also Assef v. Does 1- 10, No. 15-CV-01960-MEJ, 2016 WL 1191683, at *3–4 (N.D. Cal. Mar. 28, 2016) (allowing alternative service under Rule 4(f)(3) in part because “plaintiffs have learned that Defendants are likely based in either Singapore or Australia”). These cases do not stand for the proposition that when a defendant’s location is entirely unknown, a court may assume that it is based outside of the United States and may be served under Rule 4(f)(3). Accordingly, Chegg’s request to serve Homeworkify by email is denied without prejudice to a further motion providing more evidence underpinning Chegg’s belief that the person or entity behind Homeworkify is based outside the United States. Alternatively, if Chegg believes that the person or entity behind Homeworkify is based in the United

9 Although the name of the person or entity behind Homeworkify is redacted for privacy in the registration of the Homeworkify domain, some of the registrant’s address is visible, pointing to Reykjavik, Iceland. See Saber Decl. Ex. 1. However, when Chegg subpoenaed Homeworkify’s registrar and proxy server to determine Homeworkify’s IP address, they identified addresses in the United States, associated with people who claimed to have nothing to do with Homeworkify. See Saber Decl. ¶¶ 13–14; Exs. 11–13. Therefore, Chegg does not appear to believe that the person or entity behind Homeworkify is located in Iceland. Additionally, Chegg traced the Google AdSense account associated with Homeworkify to a bank account in the Philippines, but Chegg does not argue that this indicates that the entity or individual behind Homeworkify is based in the 1 States, it must follow Rule 4(h)(1) and serve Homeworkify in a manner that comports with 2 Rule 4(e)(1)."° 3 IV. CONCLUSION 4 For the foregoing reasons, Chegg’s motion is DENIED. 6 Dated: July 3, 2023 a CHARLES R. BREYER 7 United States District Judge 8 9 10 11 12

& 17

1g Zz 19 20 21 22 23 24 25 26 ‘0 The Court notes that service by publication is available under California law if “it appears to the PP 27 satisfaction of the court in which the action is pending that the party to be served cannot with reasonable diligence be served in another manner specified in this article” and “[a] cause of action 2g || exists against the party upon whom service is to be made.” Cal. Code Civ. Proc. § 415.50(a).