Gecko Robotics, Inc., retained Thrive Operations, LLC, to provide managed cybersecurity services on Gecko’s computer systems. The parties entered into a Master Services Agreement (“MSA”) followed by a series of Service Orders. In February 2025, Gecko sent written notice asserting that Thrive was in material breach of its contractual obligations. Thirty days later, Gecko sent a letter stating that it was terminating the parties’ contracts, revoking Thrive’s authorization to access Gecko’s systems, and demanding that Thrive remove software agents it had placed on Gecko’s systems.
Thrive took the position that Gecko had not complied with the MSA’s termination provisions, Gecko therefore had no right to terminate any aspect of the parties’ contracts for cause, and Thrive would accept the letter either as non-renewal of the active Service Orders or as an early termination without cause that (according to Thrive) would require payment of early termination fees (“ETFs”) under the terms of Thrive’s Service Orders. Gecko then stopped paying Thrive’s invoices.
Thrive responded by suing Gecko for breach of contract, breach of the implied covenant of good faith and fair dealing, and (in the alternative) recovery of unjust enrichment.
In its answer, Gecko asserts counterclaims for breach of contract, breach of the implied covenant, violation of G.L. c. 93A, § 11, and violation of the Federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (the “CFAA”). Gecko also asserts affirmative defenses that the ETFs constitute an unenforceable penalty
Thrive has moved to dismiss the counterclaims under Mass. R. Civ. P. 12(b)(6) and to strike the affirmative defenses challenging the ETFs. The Court will deny the motion to dismiss the counterclaims because the factual allegations made by Gecko plausibly suggest that it may be entitled to relief under any or
-1-
all of its causes of action.[1] It will also deny the motion to strike the affirmative defenses that the ETFs are unenforceable penalties because that issue cannot be resolved on the pleadings.
1. Breach of Contract claim. Thrive argues that the counterclaim for breach of contract fails because Gecko failed to provide sufficient notice of Thrive’s alleged breaches of contract before terminating the parties’ contractual relationship. The Court is not convinced.
Assuming without deciding that providing a sufficiently detailed notice of breach was a condition precedent not only to termination of the contract but also to asserting claims for breach of contract, as Thrive contends, the facts alleged in Gecko’s counterclaims plausibly suggest that Gecko gave sufficient notice of breach in its February 2025 letter.
First, Gecko notified Thrive that it had “fail[ed] to meet the standard of professional and sufficient performance” by not adequately responding to Gecko’s request for items relating to its information security audits, providing “poor response rates” on trouble tickets, and marking tickets as closed without actually resolving the problem. Gecko also stated that, at least in these respects, Thrive had failed “to perform the services in a professional manner.”
This appears to have put Thrive on notice that it was in breach of the contract as a whole, including each of the Service Orders, by failing-- in the manner identified by Gecko—to provide workmanlike performance. Under ¶ 5(a) of the parties’ MSA, Thrive contracted to perform all of the Services “in a professional manner conforming in all material respects to prevailing industry standards and practices[.]” This is essentially a codification of the implied warranty of workmanlike performance that would apply in the absence of any express warranty. See Herbert A. Sullivan, Inc. v. Utica Mut. Ins. Co., 439 Mass. 387, 395–396 (2003) (“When a party binds himself by contract to do a work or to perform a service, he agrees by implication to do a workmanlike job and to use reasonable and appropriate care and skill in doing it.”) (quoting Abrams v. Factory Mut. Liab. Ins. Co., 298 Mass. 141, 143 [1937]) see also Standard Paper & Merchandise Co. v. City of Springfield, 356 Mass. 475, 476 (1969) (implied
--------------------------------------------
[1] To survive a motion to dismiss under Mass. R. Civ. P. 12(b)(6), a complaint or counterclaims must make factual allegations that, if true, would “plausibly suggest … an entitlement to relief.” Lopez v. Commonwealth, 463 Mass. 696, 701 (2012), quoting Iannacchino v. Ford Motor Co., 451 Mass. 623, 636 (2008), and Bell Atl. Corp. v. Twombly, 550 U.S. 544, 557 (2007).
-2-
warranty of workmanlike performance requires exercise of “reasonable judgment, skill and care, according to the approved usages” of the relevant trade) (quoting Kelley v. J.A. Laraway, 223 Mass. 182, 184 [1916]).
Gecko’s assertion that in specified ways Thrive failed to provide “professional and sufficient performance” gave Thrive sufficient notice that it was being accused of breaching the express warranty that Thrive would perform all Services “in a professional manner.”
Nothing in the MSA required Gecko to “identify the specific Service allegedly breached” (as Thrive contends) where Gecko was putting Thrive on notice that it had allegedly breached its duty of workmanlike performance across all of the Services that Thrive had agreed to provide.
Though the MSA provided that Gecko was to provide “relevant supporting documentation” with any notice of default, Thrive points to no contractual argument to support its assertion that this was an “express condition precedent” to Gecko exercising any right to terminate the contracts. If contracting parties want to create a condition precedent, they can do so by saying that a right may later be exercised “on the condition that,” “provided that, or “if” some condition is satisfied, or by using similarly explicit language. Massachusetts Port Auth. v. Johnson Controls, Inc., 54 Mass. App. Ct. 541, 544 (2002). “ ‘Emphatic words’ are generally considered necessary to create a condition precedent that will limit or forfeit rights under an agreement.” Massachusetts Mun. Wholesale Elec. Co. v. Town of Danvers, 411 Mass. 39, 46 (1991). Without a clear indication that the parties intended to do so, a contract does not create a condition precedent to the exercise of a right or performance of an obligation. MassPort v. Johnson Controls, supra; accord Halstrom v. Dube, 481 Mass. 480, 483 n.8 (2019). The MSA does not use any emphatic words suggesting that providing relevant documentation with a notice of default was a condition precedent to termination.
Second, Gecko’s letter also provided notice that Thrive was in default because Gecko was “paying for 370 end points to be protected via EDR functionality, and yet, per a Thrive report dated February 20, 2025, EDR protection is only installed on 102 endpoints.” Though Gecko does not specify which Service Order or Orders Thrive was breaching as a result, a reasonable fact finder could conclude that this provided Thrive with sufficient notice that it was not delivering everything it was contractually obligated to provide, as well as
-3-
sufficient notice for Thrive to understand which Services it was being accused of not providing properly.
2. Implied Covenant claim. The facts alleged in Gecko’s counterclaims plausibly suggest that Thrive is liable for breaching the implied covenant of good faith and fair dealing.
Like every contract governed by Massachusetts law,[2] the parties’ contract includes an implied covenant of good faith and fair dealing, which provides “that neither party shall do anything which will have the effect of destroying or injuring the right of the other party to receive the fruits of the contract.” Weiler v. PortfolioScope, Inc., 469 Mass. 75, 82 (2014), quoting Druker v. Roland Wm. Jutras Assocs., Inc., 370 Mass. 383, 385 (1976).
Thrive’s assertion that Gecko was required to allege with “requisite specificity that Thrive acted in bad faith or [with an] ulterior purpose when performing its Services under the Agreement” is incorrect. To establish that this covenant has been violated, “[t]here is no requirement that bad faith be shown; instead, the plaintiff has the burden of proving a lack of good faith.” See, e.g., A.L. Prime Energy Consultant, Inc. v. Massachusetts Bay Transp. Auth., 479 Mass. 419, 434 (2018), quoting Robert and Ardis James Foundation v. Meyers, 474 Mass. 181, 189 (2016).
The facts alleged by Gecko plausibly suggest that Thrive failed to act in good faith when it threatened to enforce a contractual liquidated damages provision that Thrive knew or should have known did not apply because Gecko had given notice that it was terminating the parties’ contracts for cause. The Service Orders provide that Gecko would be liable for ETFs only if it terminated the contract early and did so “other than as permitted by and in accordance with the terms and conditions of the [MSA] following Thrive’s breach hereof[.]” Since the facts alleged in the counterclaims plausibly suggest that Gecko gave adequate notice of termination for cause after multiple breaches of contract by Thrive, they also plausibly suggest that Thrive had no good faith basis for threatening to enforce the ETF provisions.
In addition, the facts alleged in the counterclaims also plausibly suggest that Thrive knew or should have known that the ETF clause constituted an unenforceable penalty provision. For this reason as well, the counterclaims
[2] The MSA provides that the parties’ contract “will be governed by an construed in accordance with” Massachusetts law.”
-4-
plausibly suggests that Thrive had no good faith basis for threating to collect ETFs.
The covenant of good faith and fair dealing imposes a duty to carry out a contract without taking “an extreme and unwarranted view of [one’s] rights under the contract.” Robert and Ardis James Foundation, supra, at 191. It is evident that Gecko contends, and has alleged facts plausibly suggesting, that Thrive failed to act in good faith because it refused to honor the termination notice and then threatened Gecko based on an “extreme and unwarranted view” of Thrive’s contractual rights.
Thrive argues that “enforcement of a valid contract right or obligation alone cannot form the basis of a bad faith claim” (emphasis added). That is a correct statement of the law in the abstract. See Owen v. Kessler, 56 Mass. App. Ct. 466, 471 (2002) (enforcing contractual “time is of the essence” clause was not breach of implied covenant of good faith and fair dealing).
But the Court cannot determine on the pleadings whether Gecko properly terminated the contracts for cause or whether the ETF provision was valid and enforceable, as discussed above.
3. Chapter 93A claim. For much the same reasons, Gecko’s counterclaims also state a viable claim that Defendants committed an unfair trade practice in violation of G.L. c. 93A.
The allegations that state a plausible claim under the implied covenant of good faith and fair dealing also state a plausible claim that Defendants violated c. 93A. See Massachusetts Employers Ins. Exchange v. Propac-Mass, Inc., 420 Mass. 39, 43 (1995) (breach of implied covenant, involving “conduct undertaken as leverage to destroy the rights of another party to the agreement,” may constitute unfair or deceptive act or practice that violates c. 93A); Brewster Wallcovering Co. v. Blue Mountain Wallcoverings, Inc., 68 Mass. App. Ct. 582, 605– 606 (2007) (finding that party breached implied covenant would provide sufficient basis for finding that it also violated c. 93A); Community Builders, Inc. v. Indian Motorcycle Assocs., Inc., 44 Mass. App. Ct. 537, 559 (1998) (violation of implied covenant by withholding payment required by contract in effort to pressure other party to compromise “furnished a basis for c. 93A liability”).
4. Computer Fraud and Abuse Act claim. Gecko’s counterclaims also state a viable claim under the CFAA.
-5-
This Federal statute imposes civil (and criminal) liability on any who “accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers [an] intended fraud and obtains anything of value[.]” 18 U.S.C. § 1030(a)(4). “[T]he term ‘exceeds authorized access’ means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6).
Gecko alleges that it revoked its prior authorization for Thrive to access Gecko’s computer systems and instructed Thrive to remove its agents from those systems, Thrive refused to do so, and as a result Thrive’s agents continued to access information on Gecko’s systems.
One may reasonably infer from the facts alleged in the counterclaims that Thrive’s computerized agents were continuing to scan and collect information about Gecko’s systems, and to send that information to Thrive, even after Gecko rescinded its authorization for Thrive to access Gecko’s systems. In deciding Thrive’s Rule 12(b)(6) motion to dismiss, the Court must assume that all of the factual allegations in the counterclaims are true, and must draw “every reasonable inference in favor of” Gecko from those allegations. Rafferty v. Merck & Co., Inc., 479 Mass. 141, 147 (2018).
These allegations and reasonable inferences plausibly suggest that Thrive is liable for violating the CFAA by allowing its agents to continue to access information on Gecko’s systems, and apparently to send some of that information to Thrive, after Gecko revoke authorization for Thrive to do so. A party “accesses a computer ‘without authorization,’ “ and thereby violates the CFAA, when the owner of the computer system “has rescinded permission to access the computer and the defendant uses the computer anyway.” United States v. Eddings, 161 F.4th 199, 205 (3d Cir. 2025), quoting LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1135 (9th Cir. 2009).
Thrive cannot avoid liability on the ground that after Gecko revoked authorization Thrive only accessed Gecko’s systems from the inside, through agents that it had previously downloaded, and did not continue to access the systems from outside. “Once permission has been revoked, technological gamesmanship … to aid in access will not excuse liability.” Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016). “The CFAA does not limit its own reach to ‘personal’ or ‘direct’ access. To the contrary, it penalizes even indirect access to a ‘protected computer.’ ” Bowen v. Porsche Cars, N.A.,
-6-
Inc., 561 F. Supp. 3d 1362, 1369 (N.D. Ga. 2021), quoting Florida Atlantic Univ. Bd. of Trustees v. Parsont, 465 F. Supp. 3d 1279, 1291 (S.D. Fla. 2020); accord Teva Pharmaceuticals USA, Inc. v. Sandhu, 291 F.Supp.3d 659, 671 (E.D. Pa. 2018).
5. Early Termination Fee defenses. Finally, Thrive has not established any reason to strike Gecko’s affirmative defenses that the ETF provisions in the Service Orders are unenforceable penalty provisions.
A liquidated damages provision, like the contractual requirement that Gecko pay ETFs if it terminates the parties’ contracts without cause, is enforceable “provided two criteria are satisfied: first, that at the time of contracting the actual damages flowing from a breach were difficult to ascertain; and second, that the sum agreed on as liquidated damages represents a ‘reasonable forecast of damages expected to occur in the event of a breach.’ ” NPS, LLC v. Minihane, 451 Mass. 417, 420 673 (2008), quoting Cummings Props., LLC v. National Communications Corp., 449 Mass. 490, 494 (2007).
Thus, a liquidated damages provision “will not be enforced if the sum is ‘grossly disproportionate to a reasonable estimate of actual damages’ made at the time of contract formation.” Kelly v. Marx, 428 Mass. 877, 880 (1999), quoting Lynch v. Andrew, 20 Mass. App. Ct. 623, 628 (1985). In other words, “[a] term fixing unreasonably large liquidated damages is unenforceable on grounds of public policy as a penalty.” Kelly, supra, 882 n.6, quoting Restatement (Second) of Contracts § 356(1), at 157 (1981). “In assessing reasonableness, we look to the circumstances at the time of contract formation; we do not take a ‘second look’ at the actual damages after the contract has been breached.” NPS, 451 Mass. at 420, quoting Kelly, supra, at 878.
As the party challenging the liquidated damages provision at issue here, Gecko has the “burden to show that the amount of liquidated damages is ‘unreasonably and grossly disproportionate to the real damages from a breach’ or ‘unconscionably excessive.’ ” NPS, supra, at 421, quoting TAL Financial Corp. v. CSC Consulting, Inc., 446 Mass. 422, 423 (2006). That is why Gecko was required to raise its challenge to the enforceability of the liquidated damages provision as an affirmative defense, as it did.
Although the question of “[w]hether a liquidated damages provision in a contract is an unenforceable penalty is a question of law” for the court to decide, NPS, supra, at 419, it turns on questions of fact regarding whether the amount of liquidated damages was a reasonable estimate at the time of contract
-7-
of future actual damages. “Since there is ‘no bright line separating an agreement to pay a reasonable measure of damages from an unenforceable penalty clause,’ the reasonableness of the measure of anticipated damages depends on the circumstances of each case.” NPS, 451 Mass. at 420, quoting TAL Financial, 446 Mass. at 431. “Determining the validity of a liquidated damages clause is usually a fact-specific exercise.” Honey Dew Assocs., Inc. v. M & K Food Corp., 241 F.3d 23, 28 (1st Cir. 2001) (applying Massachusetts law).
As a result, whether Gecko will be able to meet its burden of proving that the ETF provision constitutes an unenforceable penalty cannot be resolved on the pleadings alone. See Honey Dew Assocs., supra (trial judge erred in deciding whether liquidated damages provision was unenforceable penalty “without the benefit of any pertinent evidence”). It follows that there is no basis for striking this affirmative defense.
ORDER
Plaintiff’s motion to dismiss the counterclaims (docket no. 13) is denied. Plaintiff’s separate motion to strike the affirmative defense repeated in paragraphs 77 and 85 of the answer (docket no. 14) is also denied.
/s/Kenneth W. Salinger Justice of the Superior Court
March 25, 2026