Sandvig v. Sessions

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

CHRISTIAN W. SANDVIG, et al., Plaintiffs,

v. Civil Action No. 16-1368 (JDB)

1

WILLIAM P. BARR, in his official capacity as Attorney General of the United States, Defendant.

MEMORANDUM OPINION

Plaintiffs are academic researchers who intend to test whether employment websites discriminate based on race and gender. In order to do so, they plan to provide false information to target websites, in violation of these websites’ terms of service. Plaintiffs bring a pre-enforcement challenge, alleging that the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, as applied to their intended conduct of violating websites’ terms of service, chills their First Amendment right to free speech. Without reaching this constitutional question, the Court concludes that the CFAA does not criminalize mere terms-of-service violations on consumer websites and, thus, that plaintiffs’ proposed research plans are not criminal under the CFAA. The Court will therefore deny the parties’ cross-motions for summary judgment and dismiss the case as moot.

1 Pursuant to Fed. R. Civ. P. 25(d), William P. Barr, the current Attorney General of the United States, is automatically substituted as the defendant in this matter.

2

BACKGROUND

A. Research Plans Christopher Wilson and Alan Mislove are professors of computer science at Northeastern University. Decl. of Pl. Christopher “Christo” Wilson (“First Wilson Decl.”) [ECF No. 48-1] ¶ 1; Decl. of Pl. Alan Mislove (“First Mislove Decl.”) [ECF No. 48-2] ¶ 1. For their research, Wilson and Mislove “intend to access or visit certain online hiring websites for the purposes of conducting academic research regarding potential online discrimination.” Pls.’ Statement of Undisputed Material Facts (“SMF”) [ECF No. 47-2] ¶ 61. Their plans include “audit testing” to examine whether various hiring websites’ proprietary algorithms discriminate against online users “based on characteristics, such as race or gender, that constitute a protected class status under civil rights laws.” Id. ¶¶ 64, 66. To conduct these audit tests, plaintiffs “will create profiles for fictitious job seekers, post fictitious job opportunities, and compare their fictitious users’ rankings in a list of candidates for the fictitious jobs” in order to see “whether [the] ranking is influenced by race, gender, age, or other attributes.” Id. ¶ 71.

Wilson and Mislove state that they will take steps to minimize the impact of their research both on the targeted websites’ servers and on other users of those websites. Id. at ¶¶ 75–78. For instance, they will make it apparent to real job seekers and employers that their postings are fake by “stat[ing] in any fictitious job posting, or in any fictitious job seeker profile, that the job or the job seeker is not real.” Id. at ¶¶ 75–78. Both researchers also intend to “comply with the payment requirement” of certain employment websites. Decl. of Pl. Christopher “Christo” Wilson (“Second Wilson Decl.”) [ECF No. 65-1] ¶ 5; Decl. of Pl. Alan Mislove (“Second Mislove Decl.”) [ECF No. 65-2] ¶ 5. But Wilson and Mislove acknowledge that their research plan will violate the target websites’ terms of service prohibiting the provision of false information and/or creating fake

3

accounts. SMF ¶ 86.

B. Procedural History In June 2016, Wilson and Mislove, as well as two other researchers (Christian W. Sandvig and Kyratso Karahalios) and the nonprofit journalism group First Look Media Works, Inc., brought a pre-enforcement constitutional challenge to a provision of the CFAA. Compl. [ECF No. 1] ¶¶ 180– 202. The provision at issue, 18 U.S.C. § 1030(a)(2)(C), or the “Access Provision,” makes it a crime to “intentionally access[] a computer without authorization or exceed[] authorized access, and thereby obtain[] . . . information from any protected computer.” Plaintiffs argue that this provision violates the First and Fifth Amendments. Compl. ¶¶ 180–202. Specifically, they claim that the Access Provision (1) is overbroad and chills their First Amendment right to freedom of speech; (2) as applied to their research activities, unconstitutionally restricts their protected speech; (3) interferes with their ability to enforce their rights and therefore violates the Petition Clause; (4) is void for vagueness under the Fifth Amendment Due Process Clause; and (5) unconstitutionally delegates lawmaking authority to private actors in violation of the Fifth Amendment Due Process Clause. See id. On March 30, 2018, this Court partially granted the government’s motion to dismiss. See Sandvig v. Sessions, 315 F. Supp. 3d 1, 34 (D.D.C. 2018). The Court dismissed all but the as-applied First Amendment free speech claim brought by Wilson and Mislove. Id.

Now before the Court are the parties’ cross-motions for summary judgment. Wilson and Mislove renew their pre-enforcement challenge to the Access Provision of the CFAA, alleging that it unconstitutionally restricts their First Amendment rights to free speech by criminalizing their research plans and journalistic activities that involve violating websites’ terms of service. Pls.’ Mem. P. & A. in Supp. of Mot. for Summ. J. (“Pls.’ Mem.”) [ECF No. 48] at 1. The government, for its part, argues that plaintiffs have failed to establish standing and that the First Amendment’s

4

protections do not shield plaintiffs from private websites’ choices about whom to exclude from their servers. Def.’s Mem. in Supp. of Cross-Mot. for Summ. J. & in Opp’n to Pls.’ Mot. for Summ. J. (“Gov’t’s Opp’n”) [ECF No. 50-1] at 1–4. The Court held a motions hearing on November 15, 2019, and subsequently ordered another round of briefing to clarify plaintiffs’ specific research plans and both parties’ understanding of particular terms within the CFAA. See November 26, 2019 Order [ECF No. 63] at 1–2. The parties each responded, see Def.’s Resp. to Court’s Order for Clarification (“Def.’s Resp. for Clarification”) [ECF No. 64]; Pls.’ Mem. in Resp. to Court’s Order [ECF No. 65], and the matter is now ripe for consideration.

LEGAL STANDARD

Summary judgment is appropriate when “the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). The party seeking summary judgment “bears the initial responsibility of informing the district court of the basis for its motion, and identifying those portions of [the record] . . . demonstrat[ing] the absence of a genuine issue of material fact.” Celotex Corp. v. Cartrett, 477 U.S. 317, 323 (1986); see Fed. R. Civ. P. 56(c)(1)(A) (explaining that a moving party may demonstrate that a fact is undisputed or not by citing “depositions, documents, electronically stored information, affidavits or declarations, stipulations . . . , admissions, interrogatory answers, or other materials”).

In determining whether a genuine issue of material fact exists, the Court must “view the facts and draw reasonable inferences in the light most favorable to the party opposing the motion.” Scott v. Harris, 550 U.S. 372, 378 (2007) (internal quotation marks and alteration omitted). But a non- moving party must establish more than the “mere existence of a scintilla of evidence” in support of its position. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 252 (1986). To avoid summary judgment, “there must be evidence on which the jury could reasonably find for the [non-moving

5

party].” Id.

ANALYSIS

I. Jurisdictional Standing To have Article III standing, a “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)). This Court previously concluded that plaintiffs had plausibly alleged standing on their First Amendment claims at the motion-to-dismiss stage, Sandvig, 315 F. Supp. 3d at 16–22, but plaintiffs must now demonstrate standing “with specific facts set out by affidavit or other admissible evidence,” In re Navy Chaplaincy, 323 F. Supp. 3d 25, 39 (D.D.C. 2018) (internal quotation marks omitted).

There are two ways in which litigants like plaintiffs here may establish the requisite ongoing injury when seeking to enjoin a statute alleged to violate the First Amendment. First, plaintiffs may show that they intend “to engage in a course of conduct arguably affected with a constitutional interest, but proscribed by a statute, and there exists a credible threat of prosecution thereunder.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 159 (2014) (quoting Babbitt v. United Farm Workers Nat. Union, 442 U.S. 289, 298 (1979)). Second, they may refrain from exposing themselves to sanctions under the statute, making a sufficient showing of self-censorship—i.e., they may establish a chilling effect on their free expression. See Laird v. Tatum, 408 U.S. 1, 11–14 (1972). In either case, a constitutionally affected interest and a credible threat of enforcement are required; without them, plaintiffs can establish neither a realistic threat of legal sanction for engaging in protected speech nor an objectively good reason for self-censoring by not conducting their planned research. Here, plaintiffs take the first path and argue that they intend to engage in conduct

6

“arguably” proscribed by statute.

The government responds that plaintiffs lack standing for three reasons. First, regardless of whether the Department of Justice would prosecute their conduct, plaintiffs “lack any concrete plans for conducting future research covered by their as-applied claim, i.e., involving fake or misleading accounts.” Gov’t’s Opp’n at 10. Second, assuming concrete research plans, “[p]laintiffs have not demonstrated a credible threat of prosecution for . . . such research.” Id. And third, plaintiffs’ “claims are too abstract to be evaluated and therefore are not ripe.” Id. The government does not appear to dispute that, if plaintiffs can satisfy the injury-in-fact requirements, they can also meet the causation and redressability tests to establish standing. See Spokeo, 136 S. Ct. at 1547.

A. Concrete Plans The government first argues that plaintiffs have failed to establish the existence of “any concrete plans for conducting further research covered by their as-applied claim.” See Gov’t’s Opp’n at 10–11. To support this argument, the government quotes testimony from Wilson and Mislove that they have no “concrete plans” for research involving the provision of false information or the creation of fake accounts in violation of websites’ terms of service. Id.

This framing—and selective quotation—of plaintiffs’ testimony mischaracterizes the extent of their plans. “Pre-enforcement review, particularly in the First Amendment context, does not require plaintiffs to allege that they will in fact violate the regulation in order to demonstrate an injury.” U.S. Telecom Ass’n v. FCC, 825 F.3d 674, 739 (D.C. Cir. 2016) (internal quotation marks omitted). “Standing to challenge laws burdening expressive rights requires only a credible statement by the plaintiff of intent to commit violative acts and a conventional background expectation that the government will enforce the law.” Id. (emphasis added) (internal quotation marks omitted).

Plaintiffs here satisfy this standard. Wilson later clarified that, when he said he did not have

7

concrete plans, “what [he] meant was [they] don’t have software, [they] don’t have a timeframe. There [are] no students assigned to it.” Oral Depo. of Christopher Wilson (“Wilson Depo.”) [ECF No. 54-3] at 215:25–216:4. But Wilson has already “applied and received . . . funding” and approval from the Institutional Review Board (“IRB”) for such projects. Id. at 217:15–18. Likewise, Mislove testified that he has “specific research plans [and] specific platforms that [his lab is] studying . . . in the sense that this is an area of [his] research that [he] intend[s] to conduct work[] in.” Oral Depo. of Alan E. Mislove (“Mislove Depo.”) [ECF No. 52-3] at 47:4–8. In response to the government’s interrogatory asking for “any and all platforms and/or websites that Plaintiffs intend to access in the future for purposes” of research, plaintiffs identified specific websites, including LinkedIn, Monster, Glassdoor, and Entelo, and noted that they intended to conduct research that might violate these sites’ terms of service by “creating accounts using false information and/or providing false or misleading information.” Pls.’ Third Suppl. Resps. & Objs. to Def.’s First Set of Interrogs. Nos. 2–3 [ECF No. 52-6] at 3–4.

The government argues in response that “‘some day’ intentions—without any description of concrete plans, or indeed even any specification of when the some day will be—do not support a finding of the actual or imminent injury.” Gov’t’s Opp’n at 10–11 (quoting Defs. of Wildlife, 504 U.S. at 564). But unlike the amorphous “‘some day’ intentions” to visit endangered species on another continent at issue in Defenders of Wildlife, see 504 U.S. at 564, these researchers’ plans are already in motion, even if the specifics of their study are still being developed. The fact that plaintiffs have secured funding and IRB clearance to engage in conduct covered by their as-applied challenge evinces a sufficient demonstration of injury in fact. Cf. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 183–84 (2000) (concluding that organizational plaintiffs’ members suffered an injury in fact because they had “reasonable concerns” rising above the level of

8

“speculative some day intentions” that the discharge of pollutants would “directly affect[]” their “recreational, aesthetic, and economic interests” (internal quotation marks omitted)).

The government also argues that plaintiffs’ two declarations, clarifying the meaning of their earlier statements about “concrete plans,” must be disregarded under the so-called “sham affidavit rule.” Gov’t’s Opp’n at 11–12; see also First Wilson Decl.; First Mislove Decl. This argument fails, however, because these affidavits’ descriptions of plaintiffs’ research plans merely clarify plaintiffs’ prior answers and contextualize their use of the term “concrete.” See Galvin v. Eli Lilly & Co., 488 F.3d 1026, 1030 (D.C. Cir. 2007). Mislove and Wilson said they have no “concrete” plans in order to explain that they are not currently implementing any of those research plans, notwithstanding their intent to do so in the future. Moreover, there is no indication that plaintiffs, in their earlier statements, intended to use the term “concrete plans” in its specific meaning as a legal term of art.

Finally, in its reply brief, the government states that the clearest examples of concrete steps taken by Wilson actually concern a different research project than the proposed discrimination project at issue in this case. Def.’s Reply Mem. in Supp. of Cross-Mot. for Summ. J. (“Gov’t’s Reply”) [ECF No. 56] at 4 n.1. The government does not clearly articulate the distinction between the different research projects, however, and this Court has already recognized that Wilson and Mislove intend both to “create fake employer profiles” and to “create fictitious sock-puppet job seeker profiles” as part of the research at issue in this case. Sandvig, 315 F. Supp. 3d at 9–10.

B. Credible Threat Under their theory of standing, plaintiffs must show that they intend to engage in conduct arguably both protected by the First Amendment and proscribed by the statute they challenge, and that there is a “credible threat” that the statute will be enforced against them when they do so. See Driehaus, 573 U.S. at 158–63. The government argues that plaintiffs fail to establish a credible threat

9

of prosecution under the CFAA, contending that (1) plaintiffs’ testimony shows that they do not fear prosecution (and, indeed, already have engaged in such research); (2) past CFAA prosecutions do not establish a credible threat that plaintiffs’ proposed conduct will be prosecuted; and (3) the government’s charging policies and public statements undercut plaintiffs’ attempt to establish a credible threat of prosecution. Gov’t’s Opp’n at 12–18.

“Standing to challenge laws burdening expressive rights requires only a credible statement by the plaintiff of intent to commit violative acts and a conventional background expectation that the government will enforce the law” U.S. Telecom Ass’n, 825 F.3d at 739 (internal quotation marks omitted). As previously noted, plaintiffs satisfy the first half of this test; the question thus becomes whether the “conventional background expectation” of criminal enforcement holds here. Id. Again, plaintiffs have the stronger arguments.

First, plaintiffs’ testimony that they do not subjectively fear prosecution under this statute—

and that they have even engaged in the allegedly “chilled” conduct previously—does not undermine their legal claim. The question is whether there exists “a credible threat,” which is an objective, rather than subjective, inquiry. See id. Mislove also testifies that he does subjectively fear facing criminal consequences for his future research. See, e.g., Mislove Depo. at 147:12–19 (“[I]t really weigh[s] heavily on my mind . . . [that I am] exposing my students to criminal—to potential criminal prosecution or the risk.”).

Second, even assuming the absence of prior prosecutions, but see Sandvig, 314 F. Supp. 3d at 19–20 (discussing two previous prosecutions under the Access Provision), plaintiffs still are not precluded from bringing this pre-enforcement action. When constitutionally protected conduct falls within the scope of a criminal statute, and the government “has not disavowed any intention of invoking the criminal penalty provision,” plaintiffs are “not without some reason in fearing

10

prosecution” and have standing to bring the suit. Babbitt, 442 U.S. at 302. Indeed, at the pleadings stage, the Court already rejected the contention that the lack of similar past CFAA prosecutions undermines a credible threat of prosecution now. See Sandvig, 315 F. Supp. 3d at 18–21.

Third, the government points to guidance from the Attorney General that “expressly cautions against prosecutions based on [terms-of-service] violations,” as well as statements to Congress by Department of Justice officials, as evidence that plaintiffs face no credible threat of prosecution. Gov’t’s Opp’n at 16–17. But the absence of a specific disavowal of prosecution by the Department undermines much of the government’s argument. See Babbitt, 442 U.S. at 302. The government insists that it is not a defendant’s burden to “come forward with proof of a non-existent threat of prosecution.” Gov’t’s Opp’n at 17. But while the burden of demonstrating standing remains on the plaintiffs, this Court has previously ruled that in the absence of an “explicit statement” disavowing prosecution, these various advisory and non-binding statements and Department of Justice policies do not eliminate the reasonable fear of prosecution. Sandvig, 315 F. Supp. 3d at 20–21. Furthermore, as noted above the government has brought similar Access Provision prosecutions in the past and thus created a credible threat of prosecution. Id. at 19–20.

Discovery has not helped the government’s position. John T. Lynch, Jr., the Chief of the Computer Crime and Intellectual Property Section of the Criminal Division of the Department of Justice, testified at his deposition that it was not “impossible for the Department to bring a CFAA prosecution based on [similar] facts and de minimis harm.” Dep. of John T. Lynch, Jr. [ECF No. 48- 4] at 154:3–7. Although Lynch has also stated that he does not “expect” the Department to do so, Aff. of John T. Lynch, Jr. [ECF No. 21-1] ¶ 9, “[t]he Constitution ‘does not leave us at the mercy of noblesse oblige,’” Sandvig, 315 F. Supp. 3d at 21 (quoting United States v. Stevens, 559 U.S. 460, 480 (2010)). Absent a specific disavowal or a clear indication that plaintiffs’ conduct falls outside

11

the scope of the criminal provisions, plaintiffs adequately demonstrate a credible threat for standing purposes.

C. Ripeness The government also argues that plaintiffs’ claims are not ripe for adjudication. “Plaintiffs have not yet identified the specific websites that they intend to access for their research,” the government says, and hence it is “impossible to know what those websites’ [terms of service] will be at the time of Plaintiffs’ research”—or whether any violation of the terms of service will run afoul of the Court’s narrow construction of the CFAA. Gov’t’s Opp’n at 18. Because plaintiffs do not know what their research will entail, the government argues, the Court cannot evaluate the potential harms caused by their hypothetical research. Id. at 18–19. Hence, according to the government, the Court cannot meaningfully examine plaintiffs’ First Amendment claim on the merits and fashion a proper injunction under Rule 65 because it cannot “describe in reasonable detail—and not by referring to the complaint or other document—the act or acts restrained or required.” Id. at 19 (quoting Fed. R. Civ. P. 65(d)(1)(B), (C)).

Plaintiffs respond first that, because terms of service are always subject to change, it will always be impossible to know what a website’s exact terms of service will be in the future, or whether research violating those terms will implicate the Access Provision. Pls.’ Mem. in Opp’n to Def.’s Mot. for Summ. J. & Reply in Supp. of Pls.’ Mot. for Summ. J. (“Pls.’ Reply”) [ECF No. 54] at 10– 11. Accordingly, “[p]laintiffs would have to actually undertake the research—taking note of the [terms of service] actually in effect at the time and exposing themselves to criminal liability—in order to challenge the Access Provision’s application to them,” a drastic and risky step that plaintiffs argue is not required by the First Amendment. Id. at 11. Next, plaintiffs say that how exactly they plan to carry out their research—for instance, the number of fictitious accounts or postings that will

12

be necessary or how long each account or posting will exist—is irrelevant to the First Amendment question. Id. Finally, plaintiffs argue that their complaint and declarations clarify in detail the research goals, methodologies, and precautions that will be taken to mitigate potential harm. Id. at 11–12.

The question of ripeness presents a closer call than the previous two standing issues. For instance, if this Court were to reach the First Amendment analysis urged by plaintiffs and evaluate the Access Provision under intermediate scrutiny, it would have to determine whether the government has “show[n] ‘a close fit between ends and means’” such “that the regulation ‘promotes a substantial government interest that would be achieved less effectively absent the regulation,’” and does “not ‘burden substantially more speech than is necessary to further the government’s legitimate interests.’” A.N.S.W.E.R. Coal. v. Basham, 845 F.3d 1199, 1213–14 (D.C. Cir. 2017) (citations omitted); see also Sandvig, 315 F. Supp. 3d at 30. Absent specific direction from plaintiffs, it will be difficult to engage in this analysis. The Court is not well placed, for instance, to forecast what technological or security risks might be generated by permitting such research.

Still, based on the record before it, the Court concludes that the present dispute is ripe.

Plaintiffs listed several websites—LinkedIn, Monster, Glassdoor, and Entelo—that they plan to visit, and they described intending to violate these sites’ terms of service by “creating accounts using false information and/or providing false or misleading information.” Pls.’ Third Suppl. Resps. & Objs. to Def.’s First Set of Interrogs. No. 3, at 3–4. Wilson and Mislove also both testified that their research plans were designed to have, at most, a de minimis effect on the targeted websites, further demonstrating that specific concrete steps have been taken in their research. First Wilson Decl. ¶ 46; First Mislove Decl. ¶ 43. The governments’ own exhibits make clear the extent to which websites, like LinkedIn, both prohibit and attempt to eliminate false accounts. See, e.g., Decl. of Paul Rockwell

13

(“LinkedIn Decl.”) [ECF No. 52-11] at 3–12; Decl. of Thomas O’Brien (“GlassDoor Decl.”) [ECF No. 52-13] at 5–6; Affirmation of Leonard Kardon (“Monster Aff.”) [ECF No. 52-14] at 1–2. These various pieces of evidence reveal a ripe dispute over whether criminally prosecuting plaintiffs under the CFAA for violations of public websites’ terms of service runs afoul of the First Amendment.

* * *

Finally, the Court turns to the question of whether plaintiffs’ “intended future conduct is ‘arguably . . . proscribed by’” the CFAA. Driehaus, 573 U.S. at 162 (quoting Babbitt, 442 U.S. at 298). The government does not appear to question that plaintiffs plan to engage in proscribed conduct, but the Court has “an independent obligation to assure that standing exists.” Summers v. Earth Island Inst., 555 U.S. 488, 499 (2009). The Court is also mindful that its ultimate interpretation of the CFAA, see infra, at 15–28, excludes plaintiffs’ conduct from criminal liability and, at minimum, moots their First Amendment claim. Still, the question remains whether the Court’s ultimate determination that the CFAA does not criminalize plaintiffs’ intended conduct eliminates plaintiffs’ injury-in-fact, see Driehaus, 573 U.S. 158–59, or merely moots the First Amendment dispute, see Powell v. McCormack, 395 U.S. 486, 496 (1969) (“[A] case is moot when the issues presented are no longer ‘live’ . . . .”).

The resolution to this question turns on the meaning of Driehaus’s holding that plaintiffs’

intended conduct must be “arguably . . . proscribed by statute,” Driehaus, 573 U.S. at 159; see also Woodhull Freedom Found. v. United States, 948 F.3d 363, 371 (D.C. Cir. 2020) (holding that courts should look to Driehaus’s test for determining whether a plaintiff faces an “imminent threat” of prosecution in a pre-enforcement action). The Second Circuit has taken this standard to mean that, as long as plaintiffs propose a reasonable interpretation of the statute under which they credibly fear prosecution, then they satisfy the standing requirement. See Knife Rights, Inc. v. Vance, 802 F.3d

14

377, 384–86 (2d Cir. 2015) (holding that plaintiff had standing where, despite believing its knife design was not proscribed, plaintiff could not “confidently determine which such knives defendants will deem proscribed gravity knives”). This “reasonable interpretation” approach stems from a line of pre-Driehaus cases in which the Second Circuit was interpreting Babbitt, from which Driehaus borrowed the “arguably proscribed” standard. See Vt. Right to Life Comm., Inc. v. Sorrell, 221 F.3d 376, 382 (2d Cir. 2000). The Second Circuit understood Babbitt to require only that an interpretation proscribing plaintiffs’ intended conduct be “reasonable enough that [they] may legitimately fear that [they] will face enforcement of the statute.” Id. at 383.

The D.C. Circuit’s recent decision in Woodhull Freedom Foundation suggests a slightly different approach. Although not as explicit as the Second Circuit in stating how plausible an interpretation needs to be to satisfy plaintiffs’ standing requirements, the court engaged in considerable statutory construction before deciding that plaintiffs did, in fact, have standing. See Woodhull Freedom Found., 948 F.3d at 371–73. As Judge Katsas suggested in concurrence, a district court is first to decide the statute’s meaning and then to decide if, arguably, the plaintiffs’ conduct falls within its “[p]roperly construed” bounds. Id. at 375 (Katsas, J., concurring).

Unlike in Woodhull Freedom Foundation, which concerned a plain-meaning interpretation relying on dictionaries and precedent, see id. at 372–73, Wilson and Mislove challenge an ambiguous statute that this Court has already deemed may apply to their conduct, see Sandvig, 315 F. Supp. 3d at 18. As will be discussed below, substantive canons of interpretation, like the rule of lenity and constitutional avoidance, guide this Court’s ultimate decision. Under such circumstances, the Court concludes that plaintiffs’ intended conduct is “arguably . . . proscribed by statute,” Driehaus, 573 U.S. at 159. To rule otherwise, and decide this complicated statutory matter under the rubric of standing, would risk converting the “arguably . . . proscribed by statute” standard of Babbitt and

15

Driehaus into one of certainty. Cf. Hedges v. Obama, 724 F.3d 170, 199 (2d Cir. 2013) (noting an unease with “allowing a preenforcement standing inquiry to become the vehicle by which a court addresses” important and complex matters of statutory interpretation).

II. Interpreting the CFAA Assuming, then, that plaintiffs have satisfied the injury-in-fact requirement, the Court nevertheless concludes that their First Amendment claim is moot. As will be discussed below, courts have disagreed as to the breadth of the CFAA’s Access Provision. If this Court determines that the Access Provision does not actually criminalize plaintiffs’ proposed conduct—namely, violating consumer websites’ terms of service—then the Court need not dive, and judicial economy would advise against diving, into the First Amendment issue. See Bond v. United States, 572 U.S. 844, 855 (2014) (“[I]t is a well-established principle governing the prudent exercise of this Court’s jurisdiction that normally the Court will not decide a constitutional question if there is some other ground upon which to dispose of the case.” (internal quotation marks omitted)). Rather, the Court concludes that the First Amendment claims plaintiffs “presented are no longer ‘live’” and will dismiss the case as moot. Powell, 395 U.S. at 496.

a. Accessing Without Authorization The CFAA prohibits “intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected computer.” 18 U.S.C. § 1030(a)(2). The term “protected computer” refers to any computer “used in or affecting interstate or foreign commerce or communication,” Id. § 1030(e)(2)(B), and no party disputes that the servers and other computers associated with the websites in question here, like LinkedIn, constitute “protected computer[s].”

Although the CFAA does not define “authorization,” courts have found the term “clear” and

16

given it a “straightforward meaning.” United States v. Nosal (“Nosal II”), 844 F.3d 1024, 1035 (9th Cir. 2016). The Ninth Circuit, for instance, has consistently interpreted “authorization” to mean “permission or power granted by an authority.” LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009); see also hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985, 1000 (9th Cir. 2019) (“Authorization is an affirmative notion, indicating that access is restricted to those specially recognized or admitted.” (internal quotation marks omitted)); Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016) (“[A] defendant can run afoul of the CFAA when he or she has no permission to access a computer or when such permission has been revoked explicitly.”); Nosal II, 844 F.3d at 1033 (“Not surprisingly, there has been no division among the circuits on the straightforward ‘without authorization’ prong of [§ 1030(a)].”). At least the Second, Fourth, and Sixth Circuits have come to the same conclusion. See, e.g., United States v. Valle, 807 F.3d 508, 524 (2d Cir. 2015) (“[C]ommon usage of ‘authorization’ suggests that one ‘accesses a computer without authorization’ if he accesses a computer without permission to do so at all.”); WEC Carolina Energy Sols. v. Miller, 687 F.3d 199, 204 (4th Cir. 2012) (“[B]ased on the ordinary, contemporary, common meaning of ‘authorization,’ . . . an employee is authorized to access a computer when his employer approves or sanctions his admission to that computer.”); Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d 295, 303–04 (6th Cir. 2011) (“Commonly understood, . . . a defendant who accesses a computer ‘without authorization’ does so without sanction or permission.”).

The statutory text is less clear, however, when it comes to the entire phrase “accesses a computer without authorization.” The CFAA does not define this phrase, but “the wording of the statute, forbidding ‘access[] . . . without authorization,’ . . . suggests a baseline in which access is not generally available and so permission is ordinarily required.” hiQ Labs, 938 F.3d at 1000. This

17

wording thus contemplates a view of the internet as divided into at least two realms—public websites (or portions of websites) where no authorization is required and private websites (or portions of websites) where permission must be granted for access. Because many websites on the internet are open to public inspection, a website or portion of a website becomes “private” only if it is “delineated as private through use of a permission requirement of some sort.” Id. at 1001.2 Most courts agree with the hiQ Labs court’s interpretation of “accesses . . . without authorization” as contemplating a “two-realm internet.” See, e.g., WEC Carolina Energy Sols., 687 F.3d at 204 (“[A user] accesses a computer ‘without authorization’ when he gains admission to a computer without approval.” (emphasis added)); United States v. Nosal (“Nosal I”), 676 F.3d 854, 858 (9th Cir. 2012) (en banc) (“‘[W]ithout authorization’ would apply to outside hackers (individuals who have no authorized access to the computer at all) and ‘exceeds authorized access’ would apply to inside hackers (individuals whose initial access to a computer is authorized but who access unauthorized information or files).”). Courts have interpreted this provision to involve transitioning from a public area of the internet to a private, permission-restricted area, often requiring some form

2 The hiQ Labs court faced the additional wrinkle of whether sending a cease-and-desist letter to specific users, who were allegedly violating LinkedIn’s terms of service, was enough to revoke authorization even for otherwise “public” parts of the website. See 938 F.3d at 999 (“The pivotal CFAA question here is whether once hiQ received LinkedIn’s cease-and-desist letter, any further scraping and use of LinkedIn’s data was ‘without authorization’ within the meaning of the CFAA and thus a violation of the statute.”); see also Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178, 1182 (N.D. Cal. 2013) (describing “the question here” as “whether Craigslist had the power to revoke, on a caseby -case basis, the general permission it granted to the public to access the information on its website”). Because no such letters have been sent in this case, the Court need not decide whether they would constitute a revocation of authorization and thereby make any further visits by the recipients to the otherwise public portions of LinkedIn a CFAA violation. See also Pet. for Writ of Cert. at 25, LinkedIn Corp. v. hiQ Labs, Inc., No. 19-1116 (U.S. Mar. 9, 2020) (“Where a website owner sets up technical measures to deny a third-party scraper access to its website or sends a cease-and-desist letter, thereby putting the scraper indisputably on notice that access is not authorized, any further efforts to access that website are ‘without authorization.’”).

At the same time, the fact that receipt of a cease-and-desist letter might render the recipient’s future visits to an otherwise public website “unauthorized” does provide one possible distinction between § 1605(a)(2) and § 1605(a)(3) that helps to give meaning to the term “nonpublic” in the latter provision. Cf. 3Taps, 964 F. Supp. 2d at 1182–83 (“Congress apparently knew how to restrict the reach of the CFAA to only certain kinds of information, and it appreciated the public vs. nonpublic distinction—but § 1030(a)(2)(C) contains no such restrictions or modifiers.”).

18

of authentication before a viewer is granted access. See, e.g., hiQ Labs, 938 F.3d at 1001 (“[A]uthorization is only required for password-protected sites or sites that otherwise prevent the general public from viewing the information.”); Valle, 807 F.3d at 524 (“‘[W]ithout authorization’ most naturally refers to a scenario where a user lacks permission to access the computer at all.”).

The statutory and legislative history of the CFAA support this public-private reading of the provision. Originally part of the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub. L. No. 98-473, § 2102(a), 98 Stat. 2190, 2190–92, the CFAA “has been substantially modified” over the intervening decades. See Orin S. Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 Minn. L. Rev. 1561, 1561 (2010). Throughout this history, however, Congress has consistently analogized violations of § 1030 to physical-world crimes. For example, “[t]he 1984 House Report on the CFAA explicitly analogized the conduct prohibited by section 1030 to forced entry.” hiQ Labs, 938 F.3d at 1000. That Report notes that “[d]ifficulties in coping with computer abuse arise because much of the property involved does not fit well into categories of property subject to abuse or theft.” H.R. Rep. No. 98-894, at *9 (1984) (emphasis added). Instead of focusing on what was stolen, the CFAA relied on “an ‘unauthorized access’ concept,” wherein “the conduct prohibited is analogous to that of ‘breaking and entering’ rather than using a computer (similar to the use of a gun) in committing the offense.” Id. at *20.

Likewise, when the CFAA was amended in 1996 to cover federal government computers and those in interstate commerce (i.e., “protected computers”), the Senate Report described the bill as “protect[ing] against the interstate or foreign theft of information by computer” (emphasis added), suggesting a comparison to the physical-world crime of theft. S. Rep. No. 104-357, at *7 (1996). This Report reveals that a central motivation behind these amendments was “to increase protection for the privacy and confidentiality of computer information,” id., further suggesting that “access[ing]

19

a computer without authorization” involves “obtain[ing]” information from non-public websites, see 18 U.S.C. § 1030(a)(2).

This interpretation rooted in property norms also aligns with judicial readings of similar language in the Stored Communications Act. See 18 U.S.C. § 2701(a) (criminalizing “intentionally access[ing] without authorization a facility through which an electronic communication service is provided” or “intentionally exceed[ing] an authorization to access [such a] facility”); see also Wachovia Bank v. Schmidt, 546 U.S. 303, 305 (2006) (“[U]nder the in pari materia canon, statutes addressing the same subject matter generally should be read as if they were one law . . . .” (internal quotation marks omitted)). For example, interpreting the Act in light of the common law, the Ninth Circuit focused on “the essential nature” of the relationship between the computer owner and the accesser, and concluded that “[p]ermission to access a stored communication does not constitute valid authorization if it would not defeat a trespass claim in analogous circumstances.” Theofel v. Farey-Jones, 359 F.3d 1066, 1073 (9th Cir. 2004) (emphasis added).

Likewise, in amending 18 U.S.C. § 2510, the Patriot Act defined “computer trespasser” as “a person who accesses a protected computer without authorization and thus has no reasonable expectation of privacy in any communication transmitted to, through, or from the protected computer.” Pub. L. 107–56, 115 Stat. 272 (2001). That the Patriot Act cites § 1030 for the definition of “protected computer” makes the connection between these two statutes all the clearer: “access[ing] a computer without authorization” is the computer equivalent of trespassing in the physical world.

Adopting the formulation of the Ninth Circuit in hiQ Labs, this Court will call the barriers between the public internet and private authorization-based computers “permission requirements.” 938 F.3d at 1001. Under this interpretation, the question becomes what sort of “permission

20

requirement” constitutes enough of a barrier to trigger criminal liability under § 1030(a)(2) if bypassed. The government suggests that such “permission requirements” can be minimal. See Tr. Mots. H’rg [ECF No. 62] at 54:15–56:17. An announcement on the homepage of a website that access to any further content is conditioned on agreeing to lengthy terms of service—or even one term of service—would, the government argues, constitute such a requirement. Id. at 54:22–24.

The Court concludes that agreeing to such contractual restrictions, although that may have consequences for civil liability under other federal and state laws, is not sufficient to trigger criminal liability under the CFAA. In other words, terms of service do not constitute “permission requirements” that, if violated, trigger criminal liability.

A number of considerations lead the Court to this conclusion. First, websites’ terms of service provide inadequate notice for purposes of criminal liability. These protean contractual agreements are often long, dense, and subject to change. While some websites force a user to agree to the terms before access—so-called “clickwrap”—others simply provide a link at the bottom of the webpage, or place the terms, often in fine print, elsewhere on the page. “Significant notice problems arise if we allow criminal liability to turn on the vagaries of private polices that are lengthy, opaque, subject to change and seldom read.” Nosal I, 676 F.3d at 860.

Second, although not a paradigmatic example of a “nondelegation” problem, enabling private website owners to define the scope of criminal liability does raise concerns for the Court. See The Vagaries of Vagueness: Rethinking the CFAA as a Problem of Private Nondelegation, 127 Harv. L. Rev. 751, 768–71 (2013). Previously, this Court determined that a narrow interpretation of the CFAA limited to “access restrictions” saved § 1030(a)(2) from becoming “a limitless, standardless delegation of power to individual websites to define crimes.” Sandvig, 315 F. Supp. 3d at 33. The Court also concluded that merely “incorporat[ing] private parties’ chosen restrictions, which are only

21

binding on those who interact with those parties’ individual [websites],” did not necessarily constitute an improper delegation of legislative or regulatory authority. Id. at 33–34.

Upon further reflection, and now presented with additional evidence of the nature of the target websites’ terms of service, the Court finds that it is necessary to answer another question: whether terms-of-service conditions, rather than authentication gates, constitute adequate “permission requirements” for criminal liability under the CFAA. Again, the Court concludes that the narrower interpretation is the wiser path. The government analogizes website owners to real property owners, who have historically been allowed to exclude whomever they choose from their private, non- commercial land, Gov’t’s Opp’n at 23–24, but the analogy between real property and the internet is not perfect. The internet is inherently open and public, see Reno v. Am. Civil Liberties Union, 521 U.S. 844, 880 (1997) (observing that “most Internet forums—including chat rooms, newsgroups, mail exploders, and the Web—are open to all comers”), and users constantly move from one website to another and navigate between various sections of a given website. Under such circumstances, the CFAA’s prohibition on “access[ing] a computer without authorization,” even though phrased “in the form of a general prohibition” that can often escape nondelegation worries, see Silverman v. Barry, 845 F.2d 1072, 1086 (D.C. Cir. 1988), becomes unworkable and standardless. Criminalizing terms- of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature. Such an arrangement, wherein each website’s terms of service “is a law unto itself,” Emp’t Div., Dep’t of Human Res. of Or. v. Smith, 494 U.S. 872, 890 (1990), would raise serious problems. This concern, then, supports a narrow interpretation of the CFAA.

Third, both the rule of lenity and the avoidance canon weigh in favor of this narrow interpretation as well. “When interpreting a criminal statute, we do not play the part of a mindreader.” United States v. Santos, 553 U.S. 507, 515 (2008). If “a reasonable doubt persists about a statute’s

22

intended scope even after resort to the language and structure, legislative history, and motivating policies of the statute,” Moskal v. United States, 498 U.S. 103, 108 (1990) (internal quotation marks omitted), courts must adopt the narrower interpretation. See Yates v. United States, 135 S. Ct. 1074, 1088 (2015) (“[I]f . . . recourse to traditional tools of statutory construction leaves any doubt about the meaning of [a statutory term] . . . , we would invoke the rule that ambiguity concerning the ambit of criminal statutes should be resolved in favor of lenity.” (internal quotation marks omitted)). Here, none of the traditional tools of statutory interpretation definitively resolves the question of what constitutes “access[ing] . . . without authorization,” so the Court opts to interpret the provision narrowly and as not encompassing terms-of-service violations.

Likewise, constitutional avoidance weighs in favor of interpreting “accesses . . . without authorization” narrowly. If the Court were to conclude that plaintiffs’ terms-of-service violations do violate the CFAA, then it would have to decide whether prosecuting them for such actions violates the First Amendment. As the Court previously observed, it “need not determine whether plaintiffs’ constitutional arguments would actually win the day,” but rather “whether one reading ‘presents a significant risk that [constitutional provisions] will be infringed.’” Sandvig, 315 F. Supp. 3d at 25 (quoting NLRB v. Catholic Bishop of Chi., 440 U.S. 490, 502 (1979)). Plaintiffs’ First Amendment challenge raises such risks, see Sandvig, 315 F. Supp. 3d at 28–30, and thus weighs in favor of a narrow interpretation under the avoidance canon.

Given all these concerns, a user should be deemed to have “accesse[d] a computer without authorization,” 18 U.S.C. § 1030(a)(2), only when the user bypasses an authenticating permission requirement, or an “authentication gate,” such as a password restriction that requires a user to demonstrate “that the user is the person who has access rights to the information accessed,” Orin S. Kerr, Norms of Computer Trespass, 116 Colum. L. Rev. 1143, 1147, 1164 (2016) (hereinafter

23

“Norms”). Although bypassing code-based restrictions, like a social-security-number or credit-card requirement, are paradigmatic examples of an “authentication gate,” see Orin S. Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse Statutes, 78 N.Y.U. L. Rev. 1596, 1664 (2003), “[t]he key point is not that some code was circumvented but rather that the computer owner conditioned access on authentication of the user and the access was outside the authentication,” Norms at 1164.

Here, neither Wilson nor Mislove attempt to bypass an authentication gate. For websites requiring “login credentials—i.e., usernames and passwords”—Wilson and Mislove intend to provide the information that they “generated when [they] created tester accounts.” Second Wilson Decl. ¶ 6; Second Mislove Decl. ¶ 6. And for websites that require payments, they intend to “comply with the payment requirement.” Second Wilson Decl. ¶ 5; Second Mislove Decl. ¶ 5. None of their research plans, then, involve bypassing authenticating “permission requirements,” and thus none of them when executed will constitute violations of the CFAA as interpreted herein.

The record does reflect that at least Wilson previously used borrowed business information for authentication purposes on CareerBuilder.com. See Wilson E-mails Regarding CareerBuilder Receipt, PID7243-46 (July 2016) [ECF No. 52-16] at 3. At the motions hearing, however, counsel for plaintiffs stated that “they only intend to access parts of a website that are otherwise open to the public or available to anyone who creates a [username] and password.” Mots. Hr’g Tr. at 8:15–17. The Court asked for clarification, see Nov. 26, 2019 Order at 1–2, and declarations from both researchers now clarify that, although they may pay for access to some public employment websites, their future research plans entail no provision of “authenticating, real-world business information . . . , such as real-world business license information.” Second Wilson Decl. ¶ 2; Second Mislove Decl. ¶ 2. The Court thus has no occasion to determine whether provision of either false or borrowed

24

real-world business information to access otherwise private portions of employment websites would violate the CFAA.

b. Exceeding Authorized Access Turning to the second part of the Access Provision, the CFAA prohibits “exceed[ing]

authorized access, and thereby obtain[ing] . . . information from any protected computer.” The CFAA defines “the term ‘exceeds authorized access’ [to] mean[] to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” 18 U.S.C § 1030(e)(6).

This language suggests that an individual cannot “exceed[] authorized access” without first legitimately passing through a “permission requirement.” After all, the violator must “use such [authorized] access” in order to “obtain or alter information” to which the violator “is not entitled,” implying that barriers are passed through permissibly. Id. (emphasis added). This interpretation aligns with the Ninth Circuit’s distinction between “accesses . . . without authorization” applying to “outside hackers” and “exceeds authorized access” applying to “inside hackers.” Nosal I, 676 F.3d at 858.

If bypassing a “permission requirement” is not the action that triggers criminal liability, however, then the question remains what type of conduct does constitute a criminal act. In other words, what distinguishes information that an authorized accesser is “entitled to obtain or alter” from information to which he is not entitled? Does plaintiffs’ anticipated provision of false information to their target websites, in violation of these websites’ terms of services, cross that line and “exceed[] authorized access”?

The resolution of this question turns, in part, on the meaning of “entitled” in the statutory definition of “exceeds authorized access” at § 1030(e)(6). The government argues that “entitled”

25

means “to furnish with a right,” and “supports [a] broader interpretation of the phrase ‘exceeds authorized access’ . . . , in which all relevant facts (including policies set by the computer owners) may be considered in determining the scope of a person’s authorized access.” Def.’s Resp. for Clarification at 5–6. By this approach, the meaning of “exceeds authorized access” is context- dependent: “Because the computer owner furnishes an individual with the right to access its systems and obtain information from them, explicit policies restricting that right determines when an individual ‘exceeds authorized access.’” Id. at 6. According to the government, such “explicit policies” include employers’ computer-use policies and the terms of service of public websites. See id. at 6; Gov’t’s Opp’n at 53–54.

Plaintiffs seem to have agreed with this interpretation for much of the litigation and assumed that such terms-of-service violations do fall afoul of the CFAA. See Pls.’ Mem. at 2–3, 9–11. Rather than interpreting the statute narrowly, they argued that their actions are protected by the First Amendment. But plaintiffs now suggest that they would be satisfied with “declaratory and injunctive relief” barring prosecution under the CFAA for violations of websites’ terms of service—in other words, with a narrow interpretation of the CFAA that it does not encompass terms-of-service violations. See Pls.’ Mem. in Resp. to Court’s Order at 1.

Courts have come to a range of views on the best interpretation of “exceeds authorized access,” and the circuits are currently divided on whether, in the employment context, an employee’s violation of company policy constitutes a CFAA violation. The First, Fifth, Seventh, and Eleventh Circuits have concluded that a person with access to a computer for business purposes exceeds authorized access when the accesser “obtain[s] . . . information for a nonbusiness reason.” United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010); see also United States v. John, 597 F.3d 263, 272 (5th Cir. 2010) (concluding that an employee’s “access[ing] account information for

26

individuals whose accounts she did not manage, remov[ing] this highly sensitive and confidential information from [the employer’s] premises, and ultimately us[ing] this information to perpetrate fraud on [the employer] and its customers” constituted a CFAA violation); Int’l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418, 420–21 (7th Cir. 2006) (similar); EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 582–83 (1st Cir. 2001) (similar).3 The Second and Fourth Circuits have come to the opposite conclusion. See Valle, 807 F.3d at 512–13, 528 (applying the rule of lenity and not imposing liability for accessing a government database of personal information for no law enforcement purpose); WEC Carolina Energy Sols., 687 F.3d at 205–07 (refusing to impose liability when employees violated company policy).

Far fewer courts have weighed in on the facts before this Court: namely, whether violating the terms of service of consumer websites constitutes a criminal CFAA violation. But the majority of courts that have examined this question has determined that there is no liability. See, e.g., Facebook, 844 F.3d at 1067 (“[A] violation of the terms of use of a website—without more—cannot establish liability under the CFAA.”); Bittman v. Fox, 107 F. Supp. 3d 896, 900–01 (N.D. Ill. 2015) (concluding that defendants did not “exceed[] authorized access” by creating “a fake social media account in violation of a social media company’s terms of service”); United States v. Drew, 259 F.R.D. 449, 464–65 (C.D. Cal. 2009) (interpreting “exceeds authorized access” to exclude mere terms-of-service violations to avoid rendering the statute void for vagueness). But see United States v. Lowson, Crim. No. 10-114 (KSH), 2010 WL 9552416, at *5 (D.N.J. Oct. 12, 2010) (not dismissing

3 The First Circuit later extended its holding in Explorica, which was based upon confidentiality agreements signed by former employees, to Zefer, a third-party website. See EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58 (1st Cir. 2003). Although the decision did suggest that terms of service may create CFAA liability by “say[ing] just what non-password protected access they purport to forbid,” id. at 64, the First Circuit’s holding relied upon the “relatively narrow grounds” that the injunction against Explorica applied to “anyone else with notice” and thus “precluded [Zefer] from acting to assist the enjoined party from violating the decree [and] from doing so on behalf of that party,” id. at 61, 63.

27

a case wherein the defendants “implement[ed] ‘hacks’ and us[ed] ‘backdoors’ to enable automated programs to purchase tickets” from online vendors).

The Court agrees with the clear weight of relevant authority and adopts a narrow interpretation of “exceeds authorized access.” Without weighing in on the circuit split over employers’ computer-use policies, the Court concludes that violating public websites’ terms of service, as Wilson and Mislove propose to do for their research, does not constitute a CFAA violation under the “exceeds authorized access” provision.

In coming to this determination, the Court is guided by many of the same reasons that led to a narrow interpretation of “accesses . . . without authorization” that excludes terms-of-service violations. See supra, at 20–22. First, consumer websites’ terms of service do not provide adequate notice for purposes of criminal liability. See Drew, 259 F.R.D. at 464–66; see also United States v. Thomas, 877 F.3d 591, 596 (5th Cir. 2017) (recognizing that “a narrow reading of [§ 1030(a)(2)] avoids criminalizing common conduct—like violating contractual terms of service for computer use or using a work computer for personal reasons—that lies beyond the antihacking purpose of the access statutes”). Second, criminalizing violations of private websites’ terms of service raises considerable nondelegation issues. See supra, at 20–21.

Third, the rule of lenity and the constitutional avoidance canon weigh against a broad interpretation of “exceeds authorized access” as encompassing terms-of-service violations. As noted above, courts have come to varying opinions on what type of conduct violates this provision. Compare Rodriguez, 628 F.3d at 1263; John, 597 F.3d at 272; Citrin, 440 F.3d at 420–21; Explorica, 274 F.3d at 582–83, with Valle, 807 F.3d at 512–13, 528; WEC Carolina Energy Sols., 687 F.3d at 205–07. Legislative history and statutory structure provide little guidance one way or the other. See, e.g., Valle, 807 F.3d at 526 (finding the legislative history inconclusive on whether a public employee

28

“exceed[ed] authorized access” in using government computers for personal ends). Because the traditional tools of statutory interpretation do not point definitively one way or the other for whether “exceeds authorized access” encompasses terms-of-service violations on public websites, the rule of lenity requires that the Court adopt the narrower construction. See id. at 526–28. And because this narrow interpretation obviates the need to engage with plaintiffs’ thorny First Amendment concerns, constitutional avoidance, too, counsels in favor of this narrow reading. See Bond, 572 U.S. at 855.

Taken together, these considerations make clear that, even if reading “exceeds authorized access” to exclude terms-of-service violations on public websites is not the only reasonable interpretation, adopting the narrow approach is the wisest path forward. In agreement with the clear weight of relevant cases, then, the Court adopts this narrow interpretation of the CFAA and concludes that plaintiffs’ proposed research plans do not violate either provision of § 1030(a)(2).

CONCLUSION

For the foregoing reasons, the Court concludes that plaintiffs’ research plans do not violate the Access Provision of the CFAA. Because their actions are not criminal, the Court need not wade into the question whether plaintiffs’ proposed conduct should receive First Amendment protection. Instead, the Court concludes that the parties’ cross-motions for summary judgment are moot, and the case will be dismissed. A separate order will be issued on this date.

/s/

JOHN D. BATES

United States District Judge Dated: March 27, 2020