1

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

CHRISTIAN W. SANDVIG, et al.,

Plaintiffs,

v. Civil Action No. 16-1368 (JDB)

JEFFERSON B. SESSIONS III, in his 

official capacity as Attorney General of the 

United States,

 Defendant.

 

MEMORANDUM OPINION

It’s a dangerous business, reading the fine print. Nearly every website we visit features 

Terms of Service (“ToS”), those endless lists of dos and don’ts conjured up by lawyers to govern 

our conduct in cyberspace. They normally remain a perpetual click away at the bottom of every 

web page, or quickly scrolled past as we check the box stating that we agree to them. But to 

knowingly violate some of those terms, the Department of Justice tells us, could get one thrown in 

jail. This reading of federal law is a boon to prosecutors hoping to deter cybercrime. Yet it also 

creates a dilemma for those with more benign intentions. Plaintiffs in this case, for instance, are 

researchers who wish to find out whether websites engage in discrimination, but who have to 

violate certain ToS to do so. They have challenged the statute that they allege criminalizes their 

conduct, saying that it violates their free speech, petition, and due process rights. First, however, 

they must show that they have a sufficient injury to make it through the courthouse door, and that 

their suit is plausible enough to continue. For the following reasons, the Court finds that plaintiffs 

have standing, and that they can bring one (but not the rest) of their claims.
2

I. BACKGROUND

 This case centers on a few sections of the Computer Fraud and Abuse Act (CFAA), a law 

dedicated to “deterring the criminal element from abusing computer technology.” H.R. Rep. No. 

98–894, at 4 (1984). Plaintiffs directly challenge one section, referred to here as the Access 

Provision, which sweeps in the greatest amount of conduct. The Access Provision states that 

“[w]hoever . . . intentionally accesses a computer without authorization or exceeds authorized 

access, and thereby obtains . . . information from any protected computer . . . shall be punished as 

provided in subsection (c) of this section.” 18 U.S.C. § 1030(a)(2)(C). The CFAA defines 

“protected computer” to mean, among other things, “a computer . . . which is used in or affecting 

interstate or foreign commerce or communication.” Id. § 1030(e)(2)(B). This definition 

encompasses just about all computers hooked up to the Internet—including computers that house 

website servers. See, e.g., United States v. Nosal, 676 F.3d 854, 859 (9th Cir. 2012). The statute

also defines “exceeds authorized access” as “to access a computer with authorization and to use 

such access to obtain or alter information in the computer that the accesser is not entitled so to 

obtain or alter.” 18 U.S.C. § 1030(e)(6). Thus, the Access Provision applies to anyone who 

purposely accesses an Internet-connected computer without authorization, or uses a legitimate 

authorization to receive or change information that they are not supposed to, and thereby obtains 

information from the computer.

The CFAA provides for a fine and/or imprisonment for up to one year upon a first violation 

of the Access Provision, or up to ten years for any further offenses. Id. § 1030(c)(2)(A), (C). 

However, the punishment for an initial violation rises to a sentence of up to five years’ 

imprisonment if the offense (1) “was committed for purposes of commercial advantage or private 

financial gain,” (2) was “in furtherance of any criminal or tortious act in violation of the 
3

Constitution” or state or federal law, or (3) involved obtaining information valued at more than 

$5,000. Id. § 1030(c)(2)(B). Thus, meeting one of these three conditions makes a first violation 

a felony; if none are met, the first violation is a misdemeanor.

Plaintiffs in this case are four professors and a media organization: Christian W. Sandvig 

of the University of Michigan; Kyratso “Karrie” Karahalios of the University of Illinois; Alan 

Mislove of Northeastern University; Christopher “Christo” Wilson of Northeastern University;

and First Look Media Works, Inc. (“Media Works”), which publishes the online news platform 

The Intercept. Compl. [ECF No. 1] ¶¶ 13–14, 16–17, 19. Plaintiffs are conducting studies to 

respond to new trends in real estate, finance, and employment transactions, which increasingly 

have been initiated on the Internet. Id. ¶¶ 15, 18, 55. Data brokers assemble consumers’ 

information from myriad sources and place consumers into models that include racial, ethnic, 

socioeconomic, gender, and religious inferences about them. Id. ¶¶ 56–57. After brokers create 

consumer profiles, those profiles follow consumers around online through tracking technologies

such as cookies. Id. ¶¶ 58–59. Tracking allows websites and advertisers to display content targeted 

at particular groups, based on consumers’ inferred characteristics or the sorts of websites they visit. 

Id. ¶¶ 59–60. But plaintiffs are concerned, “[g]iven the . . . history of racial discrimination in 

housing and employment,” that this technology may be “harnessed for discriminatory purposes.” 

Id. ¶ 61. They are also concerned that, “when algorithms automate decisions, there is a very real 

risk that those decisions will unintentionally have a prohibited discriminatory effect.” Id. ¶ 62.

One way to determine whether members of protected classes are being discriminated 

against is to engage in “outcomes-based audit testing.” Id. ¶ 67. Such testing commonly involves 

accessing a website or other network service repeatedly, generally by creating false or artificial 

user profiles, to see how websites respond to users who display characteristics attributed to certain 
4

races, genders, or other classes. Id. ¶ 70. This method is similar to classical paired testing 

procedures, in which multiple people—identical but for one legally protected trait—apply for the 

same house or job. Such procedures are often used to uncover violations of housing and 

employment discrimination laws in the physical world. Id. ¶¶ 41, 50, 52. 

Plaintiffs plan to engage, and are engaging, in such audit testing. Sandvig and Karahalios 

are investigating whether computer programs that decide what to display on real estate websites 

discriminate against users based on race or other factors. Id. ¶ 82. They are writing a computer 

program that will create bots—automated agents that will each browse the Internet and interact 

with websites as a human user might. Id. ¶ 88. Each bot will create a number of distinct user 

profiles, each of which is called a “sock puppet.” Id. ¶ 89. Sandvig and Karahalios will program 

the bots to visit real estate websites and search for properties, while also engaging in behaviors 

correlated with members of a particular race. Id. ¶¶ 90–91. Sandvig and Karahalios will use an 

automatic data recording technique known as scraping to record the properties that each bot sees 

on the real estate sites. Id. ¶¶ 90, 92. They can then examine their data to determine whether raceassociated behaviors caused the sock puppets to see different sets of properties. Id. ¶ 93.

Similarly, Mislove and Wilson plan to conduct a study to see whether hiring websites’ 

algorithms end up discriminating against job seekers based on protected statuses like race or 

gender. Id. ¶ 107. They will first use bots to crawl the profiles of a random selection of jobseekers to obtain baseline demographic data, then create fake employer profiles so that they can 

search for candidates and record how the algorithms rank those candidates.1 Id. ¶¶ 114–17. They 

will also create fictitious sock-puppet job seeker profiles, and have the fictitious seekers—who 

 1 This second step involves both crawling the profiles of ranked candidates to determine their demographic 

data and scraping to record the overall rankings. Compl. ¶¶ 114–16.
5

will vary along different demographic axes—apply for fictitious jobs, to examine how the 

algorithms rank the candidates. Id. ¶¶ 118–19, 121–22. Mislove and Wilson will prevent real 

people from applying for the false jobs by giving them titles that say “[t]his is not a real job, do 

not apply,” and will delete the fictitious accounts and jobs when they finish. Id. ¶ 120.

Media Works and its journalists seek to investigate online companies, websites, and 

platforms, including by examining any discriminatory effects of their use of algorithms. Id. ¶ 130.

Mislove and Wilson plan to publish their findings in academic papers, and to bring the 

results of their research to the public. Id. ¶ 123. Media Works intends to use the results of its 

journalistic investigations to inform the public about online business practices. Id. ¶ 132. Sandvig 

and Karahalios do not explicitly claim that they will publish their work, but state that their findings 

“would produce important new scientific knowledge about the operation of computer systems, 

discrimination, and cumulative disadvantage.” Id. ¶ 94.

Plaintiffs are all aware that their activities will violate certain website ToS. Id. ¶¶ 95, 124, 

131. All intend to use scraping to record data, which is banned by many of the websites plaintiffs 

seek to study. Id.; see id. ¶¶ 70–71. Many of the housing websites that Sandvig and Karahalios 

will study prohibit the use of bots. Id. ¶¶ 71, 95. All of the hiring websites that Mislove and 

Wilson will study prohibit the use of sock puppets, and most prohibit crawling. Id. ¶¶ 71, 124. 

Additionally, some websites control when and how visitors may speak about any information 

gained through the site—even in other forums—by including non-disparagement clauses in their 

ToS. Id. ¶ 72. Some sites also have ToS that require advance permission before using the sites 

for research purposes, which, plaintiffs allege, creates the possibility of viewpoint-discriminatory 

permission schemes. Id. ¶ 73. Aside from their ToS violations, plaintiffs’ experiments will have 

at most a minimal impact on the operations of the target websites. Id. ¶¶ 96, 125. All plaintiffs 
6

but Media Works have already begun some of the activities involved in their research plans, 

including activities that require violating websites’ TOS. Id. ¶¶ 98, 126.

Plaintiffs claim that they must either refrain from conducting research, testing, and 

investigations that (they argue) constitute protected speech or expressive activity, or else expose 

themselves to the risk of prosecution under the Access Provision of the CFAA. Id. ¶ 137. Plaintiffs 

therefore filed this suit against the Attorney General, raising four causes of action: (1) a facial 

overbreadth and as-applied challenge under the Free Speech and Free Press Clauses of the First 

Amendment, id. ¶¶ 180–86; (2) a First Amendment Petition Clause challenge, ¶¶ 187–93; (3) a 

vagueness claim under the Fifth Amendment’s Due Process Clause, id. ¶¶ 194–98; and (4) a claim 

of unconstitutional delegation to private parties under the Fifth Amendment, id. ¶¶ 199–202. The 

government has moved to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) 

for lack of standing and failure to state a claim. See Mot. to Dismiss [ECF No. 10].

II. DISCUSSION

We begin with the familiar standards that govern Rule 12(b) analysis. When facing a Rule 

12(b)(1) motion to dismiss for lack of subject-matter jurisdiction, a plaintiff “bears the burden of 

showing that he has standing.” Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009). Just 

because a plaintiff makes it through the courthouse doors on one claim does not mean that other 

claims can tag along; rather, a plaintiff “must demonstrate standing for each claim he seeks to press 

and for each form of relief that is sought.” Town of Chester v. Laroe Estates, Inc., 137 S. Ct. 1645, 

1650 (2017) (citation omitted). On a motion to dismiss, plaintiffs must plead facts that, taken as 

true, raise a plausible standing claim. See Humane Soc’y of the U.S. v. Vilsack, 797 F.3d 4, 8 

(D.C. Cir. 2015). The Court must take all facts alleged in the complaint as true and make all 

reasonable inferences in plaintiffs’ favor. See Gulf Coast Mar. Supply, Inc. v. United States, 867 
7

F.3d 123, 128 (D.C. Cir. 2017). However, the Court “may consider materials outside the pleadings 

in deciding whether to grant a motion to dismiss for lack of jurisdiction.” Id.

To survive a motion to dismiss for failure to state a claim under Rule 12(b)(6), a complaint 

must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible 

on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 

550 U.S. 544, 570 (2007)). Plausibility does not mean certainty, or that a claim is more likely to 

succeed than not, but rather that the claim at issue rises “above the speculative level.” Twombly, 

550 U.S. at 555. In other words: if what plaintiffs lay out in the complaint actually happened, is it 

more than merely possible that the law has been violated? Plaintiffs cannot meet this standard

through “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory 

statements.” Iqbal, 556 U.S. at 678. Likewise, a court need not accept a plaintiff’s legal 

conclusions, even if they are dressed up as factual allegations. See Sickle v. Torres Advanced

Enter. Sols., LLC, 884 F.3d 338, 345 (D.C. Cir. 2018). However, courts must accept as true all 

facts stated in the complaint, making all reasonable inferences in plaintiffs’ favor. Id.

A. THE INTERNET AS PUBLIC FORUM

At the outset, it is necessary to answer a question that affects both the standing and the 

merits inquiries in this case: what is the First Amendment status of the Internet? And, more 

particularly, what powers does the government possess to regulate activity on individual websites? 

The government bases much of its argument that plaintiffs do not have standing, and that 

they have not alleged a First Amendment violation, on the premise that this case is about “a private 

actor’s abridgment of free expression in a private forum.” Reply in Supp. of Def.’s Mot. to Dismiss 

(“Def.’s Reply”) [ECF No. 15] at 2; see Mem. of P. & A. in Supp. of Def.’s Mot. to Dismiss 

(“Def.’s Mem.”) [ECF No. 10-1] at 10–13, 22–24. This argument finds some support in Supreme 
8

Court case law, which has rejected the First Amendment claims of individuals who wished to 

distribute handbills or advertise a strike in shopping centers against the wishes of the property 

owners. See Hudgens v. NLRB, 424 U.S. 507, 520 (1976); Lloyd Corp. v. Tanner, 407 U.S. 551, 

567–68 (1972). Private property, the Court determined, does not “lose its private character merely 

because the public is generally invited to use it for designated purposes.” Lloyd, 407 U.S. at 569. 

Why, then, would it violate the First Amendment to arrest those who engage in expressive activity 

on a privately owned website against the owner’s wishes?

The answer is that, quite simply, the Internet is different. The Internet is a “dynamic, 

multifaceted category of communication” that “includes not only traditional print and news 

services, but also audio, video, and still images, as well as interactive, real-time dialogue.” Reno 

v. Am. Civil Liberties Union, 521 U.S. 844, 870 (1997). Indeed, “the content on the Internet is as 

diverse as human thought.” Id. (citation omitted). Only last Term, the Supreme Court 

emphatically declared the Internet a primary location for First Amendment activity: “While in the 

past there may have been difficulty in identifying the most important places (in a spatial sense) for 

the exchange of views, today the answer is clear. It is cyberspace . . . .” Packingham v. North 

Carolina, 137 S. Ct. 1730, 1735 (2017) (citation omitted). 

With this special status comes special First Amendment protection. The Packingham Court 

applied public forum analysis to a North Carolina law that banned former sex offenders from using 

social media websites, employing intermediate scrutiny because the law was content-neutral. See

id. at 1736. The fact that the statute restricted access to particular websites, run by private 

companies, did not change the calculus. Consider: on one of the sites the Court treated as an 

exemplar of social media, LinkedIn, “users can look for work, advertise for employees, or review 

tips on entrepreneurship,” id. at 1735—the same activities in which Mislove and Wilson wish to 
9

engage for their research. As the Court warned, the judiciary “must exercise extreme caution 

before suggesting that the First Amendment provides scant protection for access to vast networks 

in [the modern Internet].” Id. at 1736. The government’s proposed public/private ownership 

distinction cannot account for the Court’s determination in Packingham that privately-owned sites 

like Facebook, LinkedIn, and Twitter are part of a public forum, government regulation of which 

is subject to heightened First Amendment scrutiny. The Internet “is a forum more in a 

metaphysical than in a spatial or geographic sense, but the same principles are applicable.” 

Rosenberger v. Rector & Visitors of Univ. of Virginia, 515 U.S. 819, 830 (1995).

An analogy to the real world, while necessarily imperfect, may help illustrate the point. 

Stroll out onto the National Mall on any day with decent weather and you will discover a phalanx 

of food trucks lining the streets. Those food trucks are privately owned businesses. Customers 

interact with them for the private purpose of buying a meal. If they were a brick-and-mortar store 

on private property, they would encounter no First Amendment barrier to removing a patron who 

created a ruckus. Yet if a customer standing on a public sidewalk tastes her food and then yells at

those in line behind her that they should avail themselves of the myriad other culinary options 

nearby, the truck could not call the police to arrest her for her comments. She is in a public forum, 

and her speech remains protected even when she interacts with a private business located within 

that forum.

It makes good sense to treat the Internet in this manner. “Each medium of expression . . . 

must be assessed for First Amendment purposes by standards suited to it, for each may present its 

own problems.” Se. Promotions, Ltd. v. Conrad, 420 U.S. 546, 557 (1975). Regulation of the 

Internet presents serious line-drawing problems that the public/private distinction in physical space 

does not. The decisions in Lloyd and Hudgens concerned “property privately owned and used 
10

nondiscriminatorily for private purposes only.” Lloyd, 407 U.S. at 568. It is difficult to argue that 

most websites readily meet this description. As the Supreme Court has recognized, the Internet 

“provides relatively unlimited, low-cost capacity for communication of all kinds.” Reno, 521 U.S. 

at 870. Much of this communication takes place on websites that, in the physical world, would be 

seen solely as private, commercial spaces. Take Amazon.com. As a “popular retail website,” 

Amazon undoubtedly has a private use “as a seller of products.” Packingham, 137 S. Ct. at 1741 

(Alito, J., concurring in the judgment). Yet the site also “facilitates the social introduction of 

people for the purpose of information exchanges,” since it “allows a user to create a personal 

profile” and, “[w]hen someone purchases a product on Amazon, the purchaser can review the 

product and upload photographs, and other buyers can then respond to the review.” Id. 

Conversely, Facebook—to which the Court pointed in Packingham as a quintessential site for 

protected First Amendment activity—allows users to buy and sell products in its Marketplace, and, 

like many social media sites, sells ads to make revenue.2 Simply put: the public Internet is too 

heavily suffused with First Amendment activity, and what might otherwise be deemed private 

spaces are too blurred with expressive spaces, to sustain a direct parallel to the physical world.

At the same time, however, it would be ill-advised to “equate the entirety of the [I]nternet 

with public streets and parks.” Id. at 1738 (emphasis added). To do so would “gloss[] over the 

dual public and private nature of digital arenas,” and subject to heightened scrutiny regulations on

even the Internet’s most secluded nooks and crannies. Note, First Amendment-Freedom of 

Speech-Public Forum Doctrine-Packingham v. North Carolina, 131 Harv. L. Rev. 233, 238 (2017). 

Rifling through a business’s confidential files is no less a trespass merely because those files are 

located in the cloud. A hacker cannot legally break into a Gmail account and copy the account-

 2 See Facebook, Facebook Ads, https://www.facebook.com/business/products/ads; Facebook, Marketplace, 

https://www.facebook.com/marketplace/learn-more.
11

holder’s emails, just as a busybody cannot legally reach into someone else’s mailbox and open her 

mail. The First Amendment does not give someone the right to breach a paywall on a news website 

any more than it gives someone the right to steal a newspaper. 

What separates these examples from the social media sites in Packingham is that the

owners of the information at issue have taken real steps to limit who can access it. But simply

placing contractual conditions on accounts that anyone can create, as social media and many other 

sites do, does not remove a website from the First Amendment protections of the public Internet. 

If it did, then Packingham—which examined a law that limited access to websites that require user 

accounts for full functionality—would have come out the other way. 137 S. Ct. at 1737; see also

Orin S. Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse 

Statutes, 78 N.Y.U. L. Rev. 1596, 1658 (2003) (“Applying a contract-based theory of authorization 

in a criminal context . . . may be constitutionally overbroad, criminalizing a great deal beyond core 

criminal conduct, including acts protected by the First Amendment.”). Rather, only code-based 

restrictions, which “carve[] out a virtual private space within the website or service that requires 

proper authentication to gain access,” remove those protected portions of a site from the public 

forum. Orin S. Kerr, Essay, Norms of Computer Trespass, 116 Colum. L. Rev. 1143, 1171 (2016). 

Stealing another’s credentials, or breaching a site’s security to evade a code-based restriction,

therefore remains unprotected by the First Amendment. 

To return to the National Mall example, suppose that a food truck remains stationed on the 

Mall but boards up for the night, and the owner returns home. By shutting the food in a truck, 

perhaps along with her cooking instructions, the owner has placed a barrier between that property

and the public forum outside. Thus, while the police could not arrest a customer for telling others 

in line that the food tastes terrible, or for reading the menu on the truck’s exterior, they could arrest 
12

that customer for breaking into the boarded-up truck seeking confidential culinary information. 

This is true even if the customer claimed she was doing so in order to broadcast to the world the 

truck’s substandard ingredients and ill-conceived recipes. While the First Amendment has free 

rein on the Mall generally, it does not protect those who circumvent barriers that demarcate private 

areas, even if those private areas are surrounded by an otherwise public forum. This distinction 

guides the Court’s analysis here.

B. STANDING

Before reaching the merits of plaintiffs’ claims, the Court must assure itself that they have 

standing—a sufficient stake to transform this dispute into one of the “Cases” or “Controversies” 

on which federal courts may pass judgment. U.S. Const. art. III, § 2. “The ‘irreducible 

constitutional minimum of standing contains three elements’: (1) injury-in-fact, (2) causation, and 

(3) redressability.” Rainbow/PUSH Coal. v. FCC, 330 F.3d 539, 542 (D.C. Cir. 2003) (quoting 

Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). Plaintiffs must plead or prove each element 

of standing “with the manner and degree of evidence required at the successive stages of the 

litigation.” Lujan, 504 U.S. at 561. Here, therefore, “general factual allegations of injury resulting 

from the defendant’s conduct may suffice” to allege standing, “for on a motion to dismiss we 

‘presum[e] that general allegations embrace those specific facts that are necessary to support the 

claim.’” Id. (alteration in original) (citation omitted). For any given claim or form of relief, “the 

presence of one party with standing is sufficient” to reach the issue. Rumsfeld v. Forum for Acad. 

& Institutional Rights, Inc., 547 U.S. 47, 53 n.2 (2006).

Because this is a pre-enforcement challenge, plaintiffs must meet more specific conditions 

to satisfy the injury-in-fact requirement. They must plausibly allege “an intention to engage in a 

course of conduct [1] arguably affected with a constitutional interest, but [2] proscribed by a 
13

statute, and [3] [that] there exists a credible threat of prosecution thereunder.” Susan B. Anthony 

List v. Driehaus, 134 S. Ct. 2334, 2342 (2014) (quoting Babbitt v. United Farm Workers Nat’l 

Union, 442 U.S. 289, 298 (1979)). The government argues that plaintiffs cannot meet this test. 

See Def.’s Mem. at 8–19. Plaintiffs contend that they do intend to engage in constitutionally 

protected speech, and that they have pled a credible threat of prosecution. See Pls.’ Mem. of P. & 

A. in Opp’n to Def.’s Mot. to Dismiss (“Pls.’ Mem.”) [ECF No. 13] at 18–30. It is clear that any 

injury to plaintiffs is caused by the government’s criminalization of websites’ ToS, and that the 

declaratory and injunctive relief plaintiffs seek, see Compl. at 46–47, would redress the injury. 

Therefore, the question is whether plaintiffs allege a sufficient injury in the first place.

Generally speaking, a court’s standing analysis must be “especially rigorous when reaching 

the merits of the dispute would force us to decide whether an action taken by one of the other two 

branches of the Federal Government was unconstitutional.” Raines v. Byrd, 521 U.S. 811, 819–

20 (1997). However, the D.C. Circuit has interpreted the Supreme Court’s pre-enforcement 

standing doctrine broadly in the First Amendment sphere. Indeed, “the courts have shown special 

solicitude to pre-enforcement challenges brought under the First Amendment.” N.Y. Republican 

State Comm. v. SEC, 799 F.3d 1126, 1135 (D.C. Cir. 2015). Therefore, the Circuit has found, 

“the courts’ willingness to permit pre-enforcement review is ‘at its peak’ when claims are rooted 

in the First Amendment.” Id. at 1135 (citation omitted). “Pre-enforcement review, particularly in 

the First Amendment context, does not require plaintiffs to allege that they ‘will in fact’ violate 

the regulation in order to demonstrate an injury.” U.S. Telecom Ass’n v. FCC, 825 F.3d 674, 739 

(D.C. Cir. 2016) (quoting Driehaus, 134 S. Ct. at 2345), reh’g en banc denied, 855 F.3d 381 (D.C. 

Cir.), cert. docketed, No. 17-504 (U.S. Oct. 3, 2017). Nor need they show that they are likely to 

be prosecuted. Rather, “[s]tanding ‘to challenge laws burdening expressive rights requires only a 
14

credible statement by the plaintiff of intent to commit violative acts and a conventional background 

expectation that the government will enforce the law.’” Id. (quoting Act Now to Stop War & End 

Racism Coal. v. District of Columbia (ANSWER I), 589 F.3d 433, 435 (D.C. Cir. 2009)).

1. “Arguably Affected With a Constitutional Interest”

Plaintiffs assert that their conduct falls within three categories of First Amendmentprotected activity. Scraping data from their target websites, they allege, is subject to the First 

Amendment right to record or preserve information. Pls.’ Mem. at 10–14. Moreover, employing 

bots and sock puppets and creating false user accounts constitute harmless false speech. Id. at 14–

17. And their planned post-research activities are protected by the right to publish. Id. at 17–18. 

All of these claims are sufficiently plausible to conclude that plaintiffs’ proposed conduct is 

“arguably affected with a constitutional interest.” Driehaus, 134 S. Ct. at 2342.

First, scraping plausibly falls within the ambit of the First Amendment. “[T]he First 

Amendment goes beyond protection of the press and the self-expression of individuals to prohibit 

government from limiting the stock of information from which members of the public may draw.” 

First Nat. Bank of Boston v. Bellotti, 435 U.S. 765, 783 (1978). The Supreme Court has made a 

number of recent statements that give full First Amendment application to the gathering and 

creation of information.3 Additionally, six courts of appeals have found that individuals have a 

First Amendment right to record at least some matters of public interest, in order to preserve and 

 3 See Packingham, 137 S. Ct. at 1737 (holding that banning people from “gain[ing] access to information,” 

“knowing current events,” and “checking ads for employment” through social media inhibits “the legitimate exercise 

of First Amendment rights”); Sorrell v. IMS Health Inc., 564 U.S. 552, 570 (2011) (“This Court has held that the 

creation and dissemination of information are speech within the meaning of the First Amendment. Facts, after all, are 

the beginning point for much of the speech that is most essential to advance human knowledge and to conduct human 

affairs.” (citations omitted)); Brown v. Entm’t Merchants Ass’n, 564 U.S. 786, 792 n.1 (2011) (“Whether government 

regulation applies to creating, distributing, or consuming speech makes no difference.”); Citizens United v. FEC, 558 

U.S. 310, 340 (2010) (“Laws enacted to control or suppress speech may operate at different points in the speech 

process . . . .”).
15

disseminate ideas.4

 That plaintiffs wish to scrape data from websites rather than manually record 

information does not change the analysis. Scraping is merely a technological advance that makes 

information collection easier; it is not meaningfully different from using a tape recorder instead of 

taking written notes, or using the panorama function on a smartphone instead of taking a series of 

photos from different positions. And, as already discussed, the information plaintiffs seek is 

located in a public forum. Hence, plaintiffs’ attempts to record the contents of public websites for 

research purposes are arguably affected with a First Amendment interest.

Second, plaintiffs have a First Amendment interest in harmlessly misrepresenting their 

identities to target websites. The complaint alleges that plaintiffs’ research requires them to create 

false employer and job-seeker profiles on employment websites, and to use sock puppets to make 

it appear to a number of housing and employment sites that multiple people are accessing the 

information they have made available. Compl. ¶¶ 88–93, 114–21. Because “some false statements 

are inevitable if there is to be an open and vigorous expression of views in public and private 

conversation,” and because “[t]he Government has not demonstrated that false statements 

generally should constitute a new category of unprotected speech,” false claims that are not “made 

to effect a fraud or secure moneys or other valuable considerations” fall within First Amendment 

protection. United States v. Alvarez, 567 U.S. 709, 718, 722–23 (2012). Plaintiffs allege that their 

conduct will cause minimal, if any, harm to the targeted websites, and that they will take steps to 

avoid affecting third-party users of the website (such as informing job seekers that their fake 

 4 See Gericke v. Begin, 753 F.3d 1, 7 (1st Cir. 2014); Fields v. City of Philadelphia, 862 F.3d 353, 359 (3d 

Cir. 2017); Turner v. Lieutenant Driver, 848 F.3d 678, 688–89 (5th Cir. 2017); ACLU of Ill. v. Alvarez, 679 F.3d 583, 

595 (7th Cir. 2012); Animal Legal Def. Fund v. Wasden, 878 F.3d 1184, 1203 (9th Cir. 2018); W. Watersheds Project 

v. Michael, 869 F.3d 1189, 1195–97 (10th Cir. 2017); Smith v. City of Cumming, 212 F.3d 1332, 1333 (11th Cir. 

2000); see also Rideout v. Gardner, 838 F.3d 65, 75 (1st Cir. 2016), cert. denied, 137 S. Ct. 1435 (2017) (stating that 

“[t]here are strong First Amendment interests” in photographically recording one’s own completed ballot, because the

“‘use of illustrations or pictures . . . serves important communicative functions’” (citation omitted)).
16

positions are fake). Compl. ¶¶ 96, 120, 125. Thus, plaintiffs’ harmless false or misleading speech 

to website owners is arguably affected with a constitutional interest.5

Third, plaintiffs contend that they have the right, and the desire, to publish the results of 

their research, and that some sites’ ToS prohibit them from doing so without prior permission or 

else employ anti-disparagement clauses. Pls.’ Mem. at 17. The Supreme Court has made very 

clear that the right to publish falls within the core of the First Amendment’s protections. See, e.g., 

Bartnicki v. Vopper, 532 U.S. 514, 527 (2001) (“As a general matter, ‘state action to punish the 

publication of truthful information seldom can satisfy constitutional standards.’” (quoting Smith 

v. Daily Mail Publishing Co., 443 U.S. 97, 102 (1979)). Applying criminal sanctions for 

publishing original material that uses publicly available information, or for making negative 

statements about a website, triggers First Amendment scrutiny.

The government raises two overarching objections to all of these alleged rights. It initially 

claims that the First Amendment does not regulate the decisions that private entities make about 

how to control access to their private websites—in other words, that there is no state action here.

See Def.’s Mem. at 21–24; Def.’s Reply at 6–12; see also Columbia Broad. Sys., Inc. v. 

Democratic Nat. Comm., 412 U.S. 94, 114 (1973) (“[The First Amendment] is a restraint on 

government action, not that of private persons.”). However, private speech prohibitions can still 

implicate the First Amendment when given the imprimatur of state protection through civil or 

criminal law. See, e.g., New York Times Co. v. Sullivan, 376 U.S. 254, 265 (1964). Moreover, 

plaintiffs claim injury from a potential criminal action against them—and “a criminal prosecution 

under the CFAA would undoubtedly constitute state action” because the government itself is 

 5 The government counters that Alvarez and the cases that follow it do not “address facially neutral statutes 

of general applicability, such as the CFAA.” Def.’s Reply at 10. However, that goes to the standard of review on the

merits rather than to whether plaintiffs’ activities are imbued with any First Amendment interest at all.
17

policing website ToS violations. hiQ Labs, Inc. v. LinkedIn Corp., 273 F. Supp. 3d 1099, 1114

n.12 (N.D. Cal. Aug. 14, 2017), appeal docketed, No. 17-16783 (9th Cir. Sept. 6, 2017).

The government also claims that the First Amendment does not protect plaintiffs’ conduct

because, under Zemel v. Rusk, 381 U.S. 1, 16–17 (1965), and Houchins v. KQED, Inc., 438 U.S. 

1, 10–11 (1978) (plurality opinion), the First Amendment does not create a right to acquire 

information in whatever manner one desires. Def.’s Mem. at 10–12. In Zemel, the Court held that 

the government did not implicate any First Amendment rights by refusing to issue the plaintiff a 

passport to visit Cuba, which the plaintiff claimed interfered with his ability to acquaint himself 

with the effects of the government’s policies in relation to Cuba. 381 U.S. at 16. The Court 

rejected the claim, stating that “[t]he right to speak and publish does not carry with it the 

unrestrained right to gather information.” Id. at 17. Then, in Houchins, the Court held that 

journalists had no special First Amendment right to access inmates in a jail just because they sought 

to write stories about the jail; the Court rejected the “notion that the First Amendment confers a 

right of access to news sources.” 438 U.S. at 11. However, the Court did note that “[t]he right to 

receive ideas and information is not the issue in this case,” and that “[t]he issue is a claimed special 

privilege of access.” Id. at 12. Thus, “[t]here is an undoubted right to gather news ‘from any 

source by means within the law,’” but the First Amendment does not “compel[] others—private 

persons or governments—to supply information.” Id. at 11. 

Here, plaintiffs are not asking the Court to force private websites to provide them with 

information that others cannot get. Instead, they seek only to prevent the government from 

prosecuting them for obtaining or using information that the general public can access—though 

they wish to do so in a manner that could have private consequences, such as a website banning 

them or deleting their accounts. See Compl. ¶ 4 (“[Plaintiffs] have no intent . . . to access any data 
18

or information that is not made available to the public.”). Because plaintiffs neither want a special 

privilege of access nor seek to force websites to give them otherwise unobtainable information, 

the Zemel and Houchins line of cases is inapposite here. Plaintiffs therefore plausibly allege that 

their conduct is arguably affected with a constitutional interest.

2. “Proscribed by a Statute”

Under D.C. Circuit precedent, “at the motion to dismiss stage, a plaintiff’s non-frivolous 

contention regarding the meaning of a statute must be taken as correct for purposes of standing.” 

Info. Handling Servs., Inc. v. Def. Automated Printing Servs., 338 F.3d 1024, 1030 (D.C. Cir. 

2003). Because plaintiffs’ reading of the statute to encompass all ToS violations is not frivolous, 

and because plaintiffs allege that their conduct would violate websites’ ToS, it is clear for standing 

purposes that their intended actions would violate the statute.

The government contests this conclusion in only one instance. In two sentences in its reply 

brief, the government claims that plaintiffs lack standing for any injuries relating to their ability to 

publish. As the government sees it, “[t]he Complaint contains no allegation that any website on 

which plaintiffs intend to conduct their activity contains” a restriction on future publication, “and 

plaintiffs lack standing to assert claims based on hypothetical circumstances.” Def.’s Reply at 12. 

This argument is unavailing. True, plaintiffs do not explicitly allege that their target 

websites restrict subsequent publication. But the complaint does allege that “[p]laintiffs wish to 

. . . report on their findings to the public,” and that “[t]he research, testing, and investigative 

methods they have designed would, if carried out, violate the [Access] Provision, because they all

require violating the [ToS] of the targeted website.” Compl. ¶¶ 134–35 (emphasis added); see also

id. ¶ 160 (“Plaintiffs wish to have the option of publishing the results of their research, including 

any findings of discrimination, even if a target website’s ToS prohibit doing so.”). “[O]n a motion 
19

to dismiss we presum[e] that general allegations embrace those specific facts that are necessary to 

support the claim.” Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C. Cir. 2015)

(second alteration in original) (citation omitted). Plaintiffs’ allegations allow for the presumption

that reporting on their research findings would violate some targeted websites’ ToS. While far 

from the degree of proof necessary for summary judgment, see Lujan, 504 U.S. at 561, at this early 

stage plaintiffs have plausibly alleged that the CFAA prevents all of their conduct.

3. “Credible Threat of Prosecution”

Even if plaintiffs’ intended conduct is arguably affected with a constitutional interest, and 

is prohibited by the CFAA, plaintiffs still must show that there is a credible threat of prosecution 

for that conduct under the statute. See Driehaus, 134 S. Ct. at 2342. The government asserts that 

plaintiffs cannot meet this test, because “plaintiffs make no allegation that the government has 

threatened them with CFAA enforcement,” plaintiffs “cite no instances in which the government 

has enforced the challenged provision for harmless [ToS] violations,” and DOJ “has expressly 

stated that it has no intention of prosecuting harmless [ToS] violations that are not in furtherance 

of other criminal activity or tortious conduct.” Def.’s Reply at 13. The government is, for the 

most part, correct on the facts. The complaint does not allege that plaintiffs have actually been 

threatened with prosecution. The two cases plaintiffs cite to show that prosecutors have used the 

Access Provision to punish ToS violations did, in fact, involve harmful conduct. And DOJ’s 

guidance to federal prosecutors does discourage them—though somewhat tepidly—from bringing 

CFAA cases based solely on harmless ToS violations. See U.S. Att’y Gen., Intake and Charging 

Policy for Computer Crimes Matters (“Charging Policy”) (Sept. 11, 2014) [ECF No. 15–1] at 5.

However, both Supreme Court and D.C. Circuit precedent create a low standing bar in 

cases like this one. Because plaintiffs “challenge [a] law[] burdening expressive rights,” and 
20

because their complaint provides “a credible statement . . . of intent to commit violative acts,” 

plaintiffs may rely on the “conventional background expectation that the government will enforce 

the law.” U.S. Telecom Ass’n, 825 F.3d at 739 (citation omitted); accord Act Now to Stop War 

& End Racism Coal. v. District of Columbia (ANSWER II), 846 F.3d 391, 401–02 (D.C. Cir. 

2017), cert. denied, 138 S. Ct. 334 (2017) (mem.). Indeed, the D.C. Circuit has occasionally found 

standing without inquiring into whether the government has actually enforced the challenged 

restriction. See U.S. Telecom Ass’n, 825 F.3d at 739–40.

Here, there are sufficient indications of a credible threat to enforce the Access Provision, 

both in general and as applied to plaintiffs’ activities. To begin with, the parties have sparred over 

whether DOJ has enforced the Access Provision specifically against harmless ToS violations. See

Compl. ¶ 31; Def.’s Mem. at 14–17; Pls.’ Mem. at 3–4, 25. Yet a number of cases have looked to 

whether the statutory provision as a whole—or at least the particular term being challenged—has 

been enforced through prosecutions, without asking whether the facts were similar to those the 

plaintiffs alleged. See, e.g., Holder v. Humanitarian Law Project, 561 U.S. 1, 16 (2010); Babbitt, 

442 U.S. at 302; N. Carolina Right to Life, Inc. v. Bartlett, 168 F.3d 705, 710 (4th Cir. 1999). If 

one need only find a history of enforcement of the Access Provision generally, or enforcement of 

the “exceeds authorized access” language in particular, plaintiffs would have no trouble showing 

that there is a significant history. Indeed, the Supreme Court decided a case just two years ago

that involved a prosecution under the Access Provision, in part for exceeding authorized access. 

Musacchio v. United States, 136 S. Ct. 709, 713 & n.1 (2016).

6

 6 For some other recent examples, see United States v. Batti, 631 F.3d 371, 372 (6th Cir. 2011); United States 

v. Willis, 476 F.3d 1121, 1124 (10th Cir. 2007); United States v. Cave, No. 8:12CR417, 2013 WL 3766550, at *1 (D. 

Neb. July 16, 2013); United States v. Roque, No. CRIM. 12-540 KM, 2013 WL 2474686, at *1 (D.N.J. June 6, 2013); 

United States v. Auernheimer, No. 11-CR-470 SDW, 2012 WL 5389142, at *1 (D.N.J. Oct. 26, 2012), rev’d, 748 F.3d 

525 (3d Cir. 2014); United States v. Aleynikov, 737 F. Supp. 2d 173, 190 (S.D.N.Y. 2010).
21

Even looking more closely at similar factual scenarios, plaintiffs have shown that 

prosecutions have stemmed from close enough facts that it would be credible to fear a future 

prosecution for their own activities. Plaintiffs cite two cases in which individuals were prosecuted 

under the Access Provision for violating ToS agreements: United States v. Lowson, No. 10-cr-114 

(KSH), 2010 WL 9552416 (D.N.J. Oct. 12, 2010), and United States v. Drew, 259 F.R.D. 449 

(C.D. Cal. 2009). Compl. ¶ 31. Lowson, as the government points out, did not solely involve 

violations of website ToS; it also involved ticket scalpers’ attempts “to defeat code-based security 

restrictions” on Ticketmaster’s website. 2010 WL 9552416, at *5. However, the indictment 

alleged “both contract- and code-based violations,” id. at *6, and laid out the websites’ prohibitions 

that the defendants allegedly violated, see Superseding Indictment at 5–9, Lowson, 2010 WL 

9552416 (No. 10-cr-114), ECF No. 10-2. More directly on point is Drew, in which the government 

prosecuted a woman for lying about her age and creating a false account on Myspace in order to 

cyberbully her daughter’s teenage classmate—thus violating Myspace’s ToS in order to commit 

the tort of intentional infliction of emotional distress. 259 F.R.D. at 452. Prosecutors included 

both a felony count under the Access Provision—because the violation was in furtherance of a 

tortious act—and a misdemeanor count for the standalone ToS violations. Id. at 451. The jury 

acquitted Drew on the felony count, id.; the court then dismissed the misdemeanor conviction, as 

coverage of ToS violations rendered the Access Provision unconstitutionally vague, id. at 467. 

That the government brought the Drew case without enough evidence to ultimately prove 

the added harm required for a felony conviction, and chose to include a misdemeanor count for 

harmless ToS violations, lendssome credibility to plaintiffs’ fears of prosecution. The government 

also does not know whether prosecutors may have employed the Access Provision to obtain plea 

agreements in which defendants admitted to harmless ToS violations. See Tr. of Mot. Hr’g [ECF 
22

No. 20] at 17:15–18:13.7

 These prior prosecutions, whether under the Access Provision generally 

or under related factual circumstances, provide “somewhat more than the ‘conventional 

background expectation that the government will enforce the law.’” ANSWER I, 589 F.3d at 435 

(citation omitted). Thus, even if more were necessary, plaintiffs have provided it.

Finally, the government has not expressly disavowed any intent to prosecute plaintiffs, 

which would defeat the normal expectation of enforcement. The government points to a 2014 

memorandum that the Attorney General sent to United States Attorneys regarding charging policy 

under the CFAA, which the government claims is the current “binding guidance” on this issue. 

Def.’s Reply at 14. According to the government, plaintiffs’ fear of prosecution is “implausible” 

because (1) the charging policy focuses on several factors that would not apply to harmless ToS

violations, (2) prosecutions based solely on such violations are discouraged, and (3) attorneys must 

consult with the Criminal Division of DOJ before making CFAA charging decisions. Id. 

However, to disprove an otherwise credible threat of prosecution, courts have normally required 

an explicit statement “that plaintiffs will not be prosecuted if they do what they say they wish to 

do.” Humanitarian Law Project, 561 U.S. at 16. The government has not made such a declaration. 

DOJ’s charging policy states that, “if the defendant exceeded authorized access solely by violating 

an access restriction contained in a contractual agreement or [ToS] with an Internet service 

provider or website, federal prosecution may not be warranted.” Charging Policy at 5 (emphasis 

added). This is a far cry from the sort of disavowal required by case law.8 

 7 It also matters that the CFAA is a civil as well as a criminal statute. The possibility of administrative or 

private civil actions, even without a threat of criminal prosecution, may buttress—or perhaps independently provide—

standing for pre-enforcement challenges. See, e.g., Babbitt, 442 U.S. at 302 n.13; Chamber of Commerce v. FEC, 69 

F.3d 600, 603 (D.C. Cir. 1995).

8 The government also offers the statement of the Deputy Assistant Attorney General for the Criminal 

Division before a congressional subcommittee in 2015, in which the DAAG stated that DOJ “has no interest in 

prosecuting harmless violations of use restrictions” and suggested amending the CFAA so that it would essentially 

only apply to the acts that currently give rise to a felony under the Access Provision. Statement of David M. Bitkower, 

Deputy Ass’t Att’y Gen., Crim. Div., Dep’t of Justice, Before the Subcomm. On Crime and Terrorism, S. Comm. on 
23

In an attempt to provide such a disavowal, and at the Court’s suggestion, the government 

filed an affidavit from John T. Lynch, Jr., Chief of the Computer Crime and Intellectual Property 

Section of the Criminal Division of DOJ. Aff. of John T. Lynch, Jr. [ECF No. 21-1]. He points 

to the charging factors mentioned above, id. at 2–3, and states that he “do[es] not expect that the 

Department would bring a CFAA prosecution based on such facts and de minimis harm,” id. at 3. 

But many things that we do not expect in fact come to pass. An official’s prognostication does not 

substitute for a declaration of non-prosecution. Moreover, even explicit disavowals are most 

valuable when they are made “on the basis of the Government’s own interpretation of the statute 

and its rejection of plaintiffs’ interpretation as unreasonable.” Blum v. Holder, 744 F.3d 790, 798

(1st Cir. 2014). Here, the government has implicitly—and in past prosecutions, explicitly—read 

the Access Provision to include ToS violations. See Charging Policy at 4–5. “[T]o rely upon 

prosecutorial discretion to narrow the otherwise wide-ranging scope of a criminal statute’s highly 

abstract general statutory language places great power in the hands of the prosecutor.” Marinello

v. United States, No. 16-1144, 2018 WL 1402426, at *6 (U.S. Mar. 21, 2018). The Constitution 

“does not leave us at the mercy of noblesse oblige,” United States v. Stevens, 559 U.S. 460, 480 

(2010), which is all the government ultimately offers.

One final point. Until now, this standing analysis has focused on plaintiffs’ First 

Amendment challenge. But plaintiffs also bring due process claims. In Seegars v. Gonzales, 396 

F.3d 1248 (D.C. Cir. 2005), the D.C. Circuit applied a more rigorous “imminence” standard for 

non-First-Amendment constitutional claims. But the court took pains to point out that it was forced 

to follow circuit precedent that conflicted with the Supreme Court’s and the D.C. Circuit’s own 

 

the Judiciary (July 8, 2015) [ECF No. 10-3] at 6. However, this is no stronger a disavowal than is DOJ’s statement in 

its charging policy. Moreover, Congress never adopted DOJ’s proposed amendments.
24

laxer standing test for First Amendment pre-enforcement challenges. See id. at 1252–54. 

Subsequent cases have confirmed that the “more demanding standard” required by Seegars does 

not apply when challenging “laws burdening expressive rights.” ANSWER I, 589 F.3d at 435. 

Here, plaintiffs’ Fifth Amendment claims allege an injury-in-fact essentially identical to that 

alleged for their First Amendment claims. Pls.’ Mem. at 23 n.2. Both the Supreme Court and the 

D.C. Circuit have upheld standing for dual First- and Fifth-Amendment pre-enforcement 

challenges, under a less rigorous imminence standard, without distinguishing between the two 

amendments for standing purposes. See Humanitarian Law Project, 561 U.S. at 11–12, 15–16; 

ANSWER II, 846 F.3d at 396, 401–02; ANSWER I, 589 F.3d at 434–35. Plaintiffs therefore have 

standing to bring their Fifth Amendment claims along with their First Amendment ones.

For the foregoing reasons, plaintiffs have plausibly pled standing at the motion to dismiss 

stage, and the government’s Rule 12(b)(1) motion will be denied.

C. INTERPRETING THE STATUTE

Plaintiffs allege only constitutional claims in this case. Likely because they are bringing a 

pre-enforcement challenge, they are not claiming that the statute, properly read, does not apply to 

them. However, nearly all of their claims require the Court to determine the reach of the Access 

Provision before deciding the constitutional question. Since the Court does not accept plaintiffs’ 

legal conclusions as true for purposes of a motion to dismiss under Rule 12(b)(6), see Doe v. 

Rumsfeld, 683 F.3d 390, 391 (D.C. Cir. 2012), plaintiffs’ reading of the statute to cover their 

conduct does not control. Instead, the Court must interpret the law.

Courts are split as to how to read the relevant provisions. The CFAA defines the phrase 

“exceeds authorized access” as “to access a computer with authorization and to use such access to 

obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” 
25

18 U.S.C. § 1030(e)(6). The Second, Fourth, and Ninth Circuits have held that this language

prohibits only unauthorized access to information. See United States v. Valle, 807 F.3d 508, 523–

28 (2d Cir. 2015); WEC Carolina Ener. Solutions LLC v. Miller, 687 F.3d 199, 206 (4th Cir. 

2012); Nosal, 676 F.3d at 863; see also Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 

F.3d 295, 304 (6th Cir. 2011) (stating, based on Ninth Circuit precedent, that “an individual who 

is authorized to use a computer for certain purposes but goes beyond those limitations . . . has 

‘exceed[ed] authorized access’” (citation omitted) (alteration in original)). Meanwhile, the First, 

Fifth, and Eleventh Circuits have held that it also covers (at least in some instances) unauthorized 

use of information that a defendant was authorized to access only for specific purposes. See EF 

Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 583 (1st Cir. 2001); United States v. John, 

597 F.3d 263, 271 (5th Cir. 2010); United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 

2010); see also Int’l Airport Centers, LLC v. Citrin, 440 F.3d 418, 420–21 (7th Cir. 2006) (holding 

that an employee who deleted his employer’s files in violation of his employment contract had 

terminated the agency relationship that authorized him to access the information). Courts have 

also split over whether violating a website’s ToS exceeds authorized access for purposes of the 

CFAA.9 The D.C. Circuit has never opined on either question. Several district judges in this 

 9 Compare Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016) (“[A] violation of 

the terms of use of a website—without more—cannot establish liability under the CFAA.”), cert. denied 138 S. Ct. 

313 (2017) (mem.); Valle, 807 F.3d at 528 (rejecting unauthorized use reading of “exceeds authorized access” because 

“the government’s interpretation of ‘exceeds authorized access’ makes every violation of a private computer use policy 

a federal crime”); WEC Carolina, 687 F.3d at 206 (noting that the unauthorized use reading “would impute liability 

to an employee who with commendable intentions disregards his employer’s policy against downloading information 

to a personal computer so that he can work at home”), with EarthCam, Inc. v. OxBlue Corp., 703 Fed. App’x 803, 

808 & n.2 (11th Cir. 2017) (stating that “one of the lessons from [circuit precedent] may be that a person exceeds 

authorized access if he or she uses the access in a way that contravenes any policy or term of use governing the 

computer in question,” and noting the dissenting views of other circuits); CollegeSource, Inc. v. AcademyOne, Inc., 

597 Fed. App’x 116, 130 (3d Cir. 2015) (suggesting that defendants can be prosecuted under the CFAA if they 

“breach[ed] any technological barrier or contractual term of use”); EF Cultural Travel BV v. Zefer Corp., 318 F.3d 

58, 62 (1st Cir. 2003) (“A lack of authorization could be established by an explicit statement on the website restricting 

access. . . . Many webpages contain lengthy limiting conditions, including limitations on the use of scrapers.”).
26

Circuit, however, have held that the provision only applies to unauthorized access to information, 

not to unauthorized use of properly accessed material. See Hedgeye Risk Mgmt., LLC v. Heldman, 

271 F. Supp. 3d 181, 194–95 (D.D.C. 2017) (collecting cases).

At one point in their briefing, plaintiffs suggest a different dividing line: a limiting 

construction that carves out harmless ToS violations from the statute. Pls.’ Mem. at 31–33, 35. 

However, “[t]he text will not bear such a reading.” INS v. Yueh-Shaio Yang, 519 U.S. 26, 30 

(1996). It is one thing to carve out such violations by determining that the statute is 

unconstitutional as applied, but the text of the statute itself—“exceeds authorized access”—and its 

statutory definition do not appear to allow for such a surgical slicing off of conduct. How does 

the text differentiate between ToS violations and violations of employers’ computer use policies, 

for instance? And how does the text distinguish between “[ToS] violations alone,” Pls.’ Mem. at 

35, and ToS violations that cause damage or involve fraud, which plaintiffs admit are covered by 

§§ 1030(a)(4) and (a)(5), id. at 31–32? One can just as easily “use [authorized] access to obtain 

or alter information in the computer that the accesser is not entitled so to obtain or alter,” 

§ 1030(e)(6), whether it is a website or some other entity that is doing the authorizing, and whether 

the violation is harmful or harmless.

The question thus remains whether “exceeds authorized access” refers to access alone or 

to access, use, and other violations. The Court finds the narrow interpretation adopted by the 

Second, Fourth, and Ninth Circuits—and by numerous other district judges in this Circuit—to be 

the best reading of the statute. First, the text itself more naturally reads as limited to violations of 

the spatial scope of one’s permitted access. To “exceed[] authorized access,” one must have 

permission to access the computer at issue, and must “use such access”—i.e., one’s authorized 

presence on the computer—“to obtain or alter information in the computer.” Id. Thus, unlike the 
27

phrase “unauthorized access” used alongside it in several CFAA provisions, the phrase “exceeds 

authorized access” refers not to an outside attack but rather to an inside job. See, e.g., Nosal, 676 

F.3d at 858. The rest of the definition requires that the information at issue be information “that

the accesser is not entitled so to obtain or alter.” Id. The key word here is “entitled.” “And, in 

context, the most ‘sensible reading of “entitled” is as a synonym for “authorized.”’” Hedgeye, 271 

F. Supp. 3d at 194 (quoting Nosal, 676 F.3d at 857). The focus is thus on whether someone is 

allowed to access a computer at all, in the case of “unauthorized access,” or on whether someone

is authorized to obtain or alter particular information, in the case of “exceeds authorized access.”

In neither instance does the statute focus on how the accesser plans to use the information.10

The statutory context buttresses this narrower reading of the text. Reading “exceeds 

authorized access” to turn on the accesser’s purpose in seeking out the information would eliminate 

a major difference between the Access Provision—which has no purpose requirement—and other 

provisions that require intent to defraud. E.g., 18 U.S.C. § 1030(a)(4). It would also water down 

the difference between the misdemeanor penalty provisions and the felony provisions that enhance 

sentences for violations committed for fraud or financial gain. Id. § 1030(c)(2); see also S. Rep. 

No. 104-357, at 8 (1996) (“[T]he statutory penalties are structured to provide that obtaining 

information of minimal value is only a misdemeanor, but obtaining valuable information, or 

misusing information in other more serious ways, is a felony.” (emphasis added)). After all, just 

about any attempt to use proprietary information to defraud or for personal or commercial gain 

would likely violate a computer use policy or website ToS. See Nosal, 676 F.3d at 858 n.4. 

 10 Nor does the word “so,” which has inspired a good deal of exegesis in prior opinions, see WEC Carolina, 

687 F.3d at 205–06; Nosal, 676 F.3d at 857–58, meaningfully change this focus. Read in the context of the phrase 

“so to obtain or alter,” “so” most naturally refers back to the earlier phrase “such access,” emphasizing that the accesser 

must not have been entitled to obtain or alter that particular information through the particular authorization used—

even if, theoretically, there were another way in which the accesser might legally obtain or alter the information.
28

Congress knew how to draft a specific intent requirement, and did so in these other sections of the 

CFAA. It would be rather odd, then, for Congress to also smuggle a specific intent factor into its 

definition of the actus reus of the offense. While this context is certainly not dispositive—

Congress often drafts overlapping or even redundant provisions—it is best to avoid readings that 

“would render superfluous another part of the same statutory scheme.” Marx v. Gen. Revenue 

Corp., 568 U.S. 371, 386 (2013).

Legislative history also points to an access-based, rather than an intended-use-based, 

reading of “exceeds authorized access.” The Second Circuit has already canvassed in great detail 

the congressional intent and history behind the definition of “exceeds authorized access,” see

Valle, 807 F.3d at 525–26, and this Court will not repeat it here. This Court agrees with the Second 

Circuit, however, that “the legislative history consistently characterizes the evil to be remedied—

computer crime—as ‘trespass’ into computer systems or data, and correspondingly describes 

‘authorization’ in terms of the portion of the computer’s data to which one’s access rights extend.” 

Id. at 525. Congress thus viewed exceeding authorized access as the digital equivalent of being 

allowed into a house but entering a room within it that the owner has declared to be off-limits. A 

sensible conception, particularly considering that the language at issue was written in 1986—

before the World Wide Web or websites existed. See Kerr, Norms of Computer Trespass, supra, 

at 1161.

The amendment history of the definition supports this reading. The initial language of the 

CFAA applied to anyone who, knowingly “having accessed a computer with authorization, uses 

the opportunity such access provides for purposes to which such authorization does not extend, 

and thereby obtains information.” Counterfeit Access Device and Computer Fraud and Abuse Act 

of 1984, Pub. L. No. 98-473, tit. II, ch. 21, § 2102(a), 98 Stat. 1837, 2190–91 (emphasis added). 
29

In 1986, however, in a section entitled “Modification of Authorized Access Aspect of Offenses,” 

Congress replaced this language with the phrase “exceeds authorized access,” and, in a section 

entitled “Conforming Amendments to Definitions Provision,” added the current definition of that 

phrase. See Computer Fraud and Abuse Act of 1986, Pub. L. No. 99-474, § 2(c), (g)(4), 100 Stat. 

1213, 1215. It is not clear that Congress intended this language change to be substantive. See S. 

Rep. No. 99-432, at 9 (1986) (“The Committee intends this change to simplify the language in 18 

U.S.C. 1030(a)(1) and (2), and the phrase ‘exceeds authorized access’ is defined separately in 

Section (2)(g) of the bill.”); 132 Cong. Rec. 28,821 (1986) (statement of Rep. Hughes) (stating, as 

the chairman of the drafting subcommittee just before final passage, that “the basic thrust of this 

bill remains its three new offenses with some minor changes in the existing law”). Yet it is notable 

that Congress did not simply transpose the existing, purpose-oriented language into the definition 

section—which still would have simplified the language of § 1030(a), as desired—but instead 

replaced it with new language that focuses on authorization to access particular information. 

Indeed, if Congress did not think it was making a substantive change, the legislative history 

suggests that this was because Congress thought the initial language also was limited to access, 

since “when Congress referenced the user’s ‘purposes,’ it spoke in terms of the particular computer 

files or data to which the user’s access rights extended.” Valle, 807 F.3d at 526.

Finally, plaintiffs raise numerous First and Fifth Amendment concerns with the Access 

Provision that would arise out of reading “exceeds authorized access” to include the purpose or 

use restrictions that appear in many ToS. When a court is “deciding which of two plausible 

statutory constructions to adopt,” and when “one of them would raise a multitude of constitutional 

problems, the other should prevail.” Clark v. Martinez, 543 U.S. 371, 380–81 (2005). This maxim 

holds doubly true for criminal statutes. See Marinello, 2018 WL 1402426, at *4 (“[Courts] have 
30

traditionally exercised restraint in assessing the reach of a federal criminal statute, both out of 

deference to the prerogatives of Congress and out of concern that ‘a fair warning should be given 

to the world in language that the common world will understand, of what the law intends to do if 

a certain line is passed.’” (citation omitted)). While the CFAA’s text and legislative history point 

strongly toward an access-only interpretation of “exceeds authorized access,” a broader reading is 

not entirely implausible; therefore, constitutional avoidance applies. Cf. Jennings v. Rodriguez, 

138 S. Ct. 830, 842 (2018). In interpreting the statutory text, the Court need not determine whether 

plaintiffs’ constitutional arguments would actually win the day. Rather, the Court undertakes “a 

narrow inquiry” into whether one reading “presents a significant risk that [constitutional 

provisions] will be infringed.” NLRB v. Catholic Bishop of Chicago, 440 U.S. 490, 533 (1979).

Here, significant risks abound. By providing for both civil and criminal enforcement of 

websites’ limitless ToS—including enforcement by the same entities that write the ToS—a broader 

reading of the CFAA “would appear to criminalize a broad range of day-to-day activity” and

“subject individuals to the risk of arbitrary or discriminatory prosecution and conviction,” raising 

Fifth Amendment concerns. United States v. Kozminski, 487 U.S. 931, 949 (1988); see Valle, 807 

F.3d at 527–28; Nosal, 676 F.3d at 862. By incorporating ToS that purport to prohibit the purposes 

for which one accesses a website or the uses to which one can put information obtained there, the 

CFAA threatens to burden a great deal of expressive activity, even on publicly accessible 

websites—which brings the First Amendment into play. See Packingham, 137 S. Ct. at 1736. If 

“exceeds authorized access” is read broadly, plaintiffs claim, the Access Provision could even run 

afoul of the Fifth Amendment by delegating power to private parties to define restrictions 

“limitless in time and space,” which can then operate as petty civil and criminal codes. Pls.’ Mem. 

at 10; see Ass’n of Am. R.Rs. v. U.S. Dep’t of Transp. (Ass’n of Am. R.Rs. II), 821 F.3d 19, 31 
31

(D.C. Cir. 2016) (“[T]he Supreme Court has consistently concluded the delegation of coercive 

power to private parties can raise . . . due process concerns.”); Note, The Vagaries of Vagueness: 

Rethinking the CFAA as a Problem of Private Nondelegation, 127 Harv. L. Rev. 751, 768–71

(2013) (arguing that a broadly-read CFAA violates the nondelegation doctrine). One need neither 

slay nor succumb to this Hydra-headed set of objections to acknowledge it as formidable.

All of these factors, therefore, lead the Court to adopt a narrow reading of the term “exceeds 

authorized access.”11 Just as an individual “accesses a computer ‘without authorization’ when he 

gains admission to a computer without approval,” an individual “‘exceeds authorized access’ when 

he has approval to access a computer, but uses his access to obtain or alter information that falls 

outside the bounds of his approved access.” WEC Carolina, 687 F.3d at 204.

This interpretation gets us far, but not all the way. At oral argument, both parties agreed 

that the Access Provision applies only to access restrictions. See Tr. of Mot. Hr’g at 19:17–20:3, 

34:10–35:22. But they have very different ideas about what that means. The government treats 

this difference as a largely temporal one. It argues that “the moment the violation occurs is on 

access,” so that subsequent usage of information lawfully obtained does not constitute a CFAA 

violation. Id. at 20:12–:18. But the government also claims that “it’s appropriate to analyze the 

issue of whether access is authorized according to a broad context of background facts that could 

include limitations on the purpose for which information is accessed,” such as “access restrictions 

that are contained in the [ToS] that the website itself has prepared.” Id. at 19:21–20:2. Plaintiffs, 

 11 A number of other courts have applied the rule of lenity to limit the scope of “exceeds authorized access.” 

See Valle, 807 F.3d at 526; WEC Carolina, 687 F.3d at 204; Nosal, 676 F.3d at 363. The rule of lenity “requires 

ambiguous criminal laws to be interpreted in favor of the defendants subjected to them.” DePierre v. United States, 

564 U.S. 70, 88 (2011) (citation omitted). However, lenity is to be used “only ‘at the end of the process of construing 

what Congress has expressed’ when the ordinary canons of statutory construction have revealed no satisfactory 

construction.” Lockhart v. United States, 136 S. Ct. 958, 968 (2016) (citation omitted). Text, context, legislative 

history, congressional intent, and constitutional avoidance all point in one direction here. Because these tools “allow

[the Court] to make far more than ‘a guess as to what Congress intended,’ the rule of lenity does not apply.” DePierre, 

564 U.S. at 89. If the question were closer, however, lenity would undoubtedly come to plaintiffs’ aid.
32

on the other hand, argue that the distinction between access and use turns on the conduct being 

prohibited, rather than whether the website attempts to cast the conduct as related to access rather 

than use. Id. at 61:17–:23. Plaintiffs’ reading is the more natural one, and better reflects the 

constitutional avoidance concerns that support the Court’s interpretation of the statute. Therefore, 

the Court must make an objective inquiry into the conduct alleged to violate websites’ ToS. The 

focus is on what information plaintiffs plan to access, not on why they wish to access it, the manner 

in which they use their authorization to access it, or what they hope to do with it.

Applying this standard, it becomes clear that most of plaintiffs’ proposed activities fall 

outside the CFAA’s reach. Scraping or otherwise recording data from a site that is accessible to 

the public is merely a particular use of information that plaintiffs are entitled to see. The same 

goes for speaking about, or publishing documents using, publicly available data on the targeted 

websites. The use of bots or sock puppets is a more context-specific activity, but it is not covered 

in this case. Employing a bot to crawl a website or apply for jobs may run afoul of a website’s 

ToS, but it does not constitute an access violation when the human who creates the bot is otherwise 

allowed to read and interact with that site. See Kerr, Norms of Computer Trespass, supra, at 1170.

The website might purport to be limiting the identities of those entitled to enter the site, so that 

humans but not robots can get in. See Star Wars: Episode IV – A New Hope (Lucasfilm 1977) 

(“We don’t serve their kind here! . . . Your droids. They’ll have to wait outside.”). But bots are 

simply technological tools for humans to more efficiently collect and process information that they 

could otherwise access manually. Cf. Star Wars: Episode II – Attack of the Clones (Lucasfilm 

2002) (“[I]f droids could think, there’d be none of us here, would there?”). 

Out of plaintiffs’ proposed activities, then, only Mislove and Wilson’s plan to create

fictitious user accounts on employment sites would violate the CFAA. Unlike plaintiffs’ other 
33

conduct, which occurs on portions of websites that any visitor can view, creating false accounts 

allows Mislove and Wilson to access information on those sites that is both limited to those who 

meet the owners’ chosen authentication requirements and targeted to the particular preferences of 

the user.

12 Creating false accounts and obtaining information through those accounts would 

therefore fall under the Access Provision. With that in mind, the Court must turn to the 

government’s motion to dismiss plaintiffs’ constitutional claims.

D. FREEDOM OF SPEECH AND FREEDOM OF THE PRESS

Plaintiffs first claim that the Access Provision violates the First Amendment’s guarantees 

of freedom of speech and of the press.

13 They assert that the provision is both facially overbroad 

and unconstitutional as applied to their own conduct. The Court will analyze these claims in turn.

1. Facial Overbreadth

Plaintiffs allege that the Access Provision “creates virtually limitless restrictions on speech 

and expressive activity,” such that the statute “is unconstitutionally overbroad on its face.” Compl. 

¶ 183. In a typical facial challenge, plaintiffs must show “‘that no set of circumstances exists under 

which [the Access Provision] would be valid,’ . . . or that the statute lacks any ‘plainly legitimate 

sweep.’” Stevens, 559 U.S. at 472 (citations omitted). However, First Amendment cases allow 

for “‘a second type of facial challenge,’ whereby a law may be invalidated as overbroad if ‘a 

substantial number of its applications are unconstitutional, judged in relation to the statute’s plainly 

 12 Professor Kerr argues that “a website that appears to require a username and password to access the 

contents of the site, but that actually grants access for any username and password combination,” should not be seen 

as creating an access restriction, because it “would appear to a user to regulate by code, but would actually work more 

like a system of regulation by contract.” Kerr, Cybercrime’s Scope, supra, at 1646. The distinction between codebased and contract-based barriers matters for First Amendment analysis, see supra Part II.A, but it does not quite line 

up with the Court’s reading of the CFAA. Social media sites like Facebook, for instance, grant access for any 

username and password combination, but they still allow those with accounts to access data that those who merely 

visit the site without signing up cannot. Hence, conditions placed on account creation can still be access restrictions. 13 Courts normally subject free speech and free press claims to the same level of scrutiny. See, e.g., Citizens 

United, 558 U.S. at 352; McConnell v. FEC, 251 F. Supp. 2d 176, 234–35 (D.D.C.) (three-judge court) (per curiam), 

aff’d in part, rev’d in part, 540 U.S. 93 (2003). The Court will thus treat the speech claim as a proxy for both.
34

legitimate sweep.’” Id. at 473 (citation omitted). This second, lower bar is the one against which 

plaintiffs—and the Court—measure their challenge.

The government argues that plaintiffs have failed to state a plausible overbreadth claim.

See Def.’s Reply at 18–19. The Court agrees. “The first step in overbreadth analysis is to construe 

the challenged statute; it is impossible to determine whether a statute reaches too far without first 

knowing what the statute covers.” United States v. Williams, 553 U.S. 285, 293 (2008). The 

Court has now done so. Plaintiffs have operated under the assumption that the Access Provision 

covers all ToS violations; but, properly read, the Access Provision incorporates only those ToS 

that limit access to particular information. This fact alone is enough to dispose of plaintiffs’ 

overbreadth claim. “Invalidation for overbreadth is strong medicine,” id. (citation omitted), to be 

“employed . . . sparingly and only as a last resort,” Broadrick v. Oklahoma, 413 U.S. 601, 613 

(1973). A court should not invalidate a provision for overbreadth “when a limiting construction 

has been or could be placed on the challenged statute.” Id. 

Plaintiffs concede that a limiting construction would address their overbreadth concerns—

though they contend that the Access Provision would need to be “construed not to reach [ToS] 

violations alone.” Pls.’ Mem. at 35. While the Court’s reading of “exceeds authorized access” is 

not as narrow as the reading plaintiffs might prefer, it does eliminate many of the potentially 

unconstitutional applications of the Access Provisions. To be overbroad, a statute’s 

unconstitutional scope must be “substantial, not only in an absolute sense, but also relative to the 

statute’s plainly legitimate sweep.” Williams, 553 U.S. at 292. As purpose, use, or manner 

restrictions fall outside the Access Provision’s reach, plaintiffs have not plausibly alleged that the 

provision’s potentially unconstitutional applications are substantial relative to its legitimate ones. 

Moreover, plaintiffs also bring an as-applied claim, and facial challenges are disfavored when a 
35

case “may be disposed of on narrower grounds.” Texas v. Johnson, 491 U.S. 397, 403 n.3 (1989). 

Hence, Plaintiffs’ overbreadth claim will be dismissed.

2. As-Applied Challenge

Plaintiffs allege that, “[a]s applied to the[m],” the Access Provision “unconstitutionally 

restricts their protected speech.” Compl. ¶ 184. “[T]o prevail on an as-applied First Amendment 

challenge,” plaintiffs “must show that the [Access Provision is] unconstitutional as applied to their 

particular speech activity.” Edwards v. District of Columbia, 755 F.3d 996, 1001 (D.C. Cir. 2014). 

“‘[T]he distinction between facial and as-applied challenges . . . goes to the breadth of the remedy 

employed by the Court, not what must be pleaded in a complaint.’ . . . The substantive rule of law 

is the same for both challenges.” Id. (citations omitted).

Aside from the overarching objections that the Court has already rejected, the 

government’s primary response to plaintiffs’ as-applied claim is that the Access Provision 

regulates conduct, rather than speech, and is therefore subject to limited scrutiny. See Def.’s Mem.

at 21, 27. But even if a law “says nothing about speech on its face,” it is “subject to First 

Amendment scrutiny” if “it restricts access to traditional public fora.” McCullen v. Coakley, 134 

S. Ct. 2518, 2529 (2014). As the Access Provision both limits access to and burdens speech in the 

public forum that is the public Internet, see supra Part II.A, heightened First Amendment scrutiny 

is appropriate. “In particular, the guiding First Amendment principle that the ‘government has no 

power to restrict expression because of its message, its ideas, its subject matter, or its content’

applies with full force in a traditional public forum.” Id. (citation omitted). Content- or viewpointbased restrictions receive strict scrutiny. See Reed v. Town of Gilbert, 135 S. Ct. 2218, 2226 

(2015); Rosenberger, 515 U.S. at 829. On the other hand, if a statute is content-neutral and only 

“impose[s] reasonable restrictions on the time, place, or manner of protected speech,” McCullen, 
36

134 S. Ct. at 2529, it is subjected to intermediate scrutiny. “In order to survive intermediate 

scrutiny, a law must be ‘narrowly tailored to serve a significant governmental interest,’”

Packingham, 137 S. Ct. at 1736 (citation omitted), and must “leave open ample alternative 

channels for communication of the information,” McCullen, 134 S. Ct. at 2529.14

Plaintiffs claim that the Access Provision allows websites to impose direct speech 

restrictions, including content-based restrictions, and that it is therefore subject to strict scrutiny. 

Pls.’ Mem. at 34–35. However, the statute itself does not target speech, or impose content-based 

regulations, on its face. Nor have plaintiffs plausibly alleged that the government’s purpose is to 

restrict speech based on its content or viewpoint. Indeed, while the government has not yet been 

able to proffer much evidence of the purposes behind the provision, the legislative history indicates 

that Congress was interested in passing the Access Provision to prevent the digital equivalent of 

theft. See S. Rep. 104–357, at 7 (“The proposed subsection 1030(a)(2)(C) is intended to protect 

against the interstate or foreign theft of information by computer. . . . This subsection would 

ensure that the theft of intangible information by the unauthorized use of a computer is prohibited 

in the same way theft of physical items are protected [sic].”). Therefore, strict scrutiny does not 

apply. See Pursuing America’s Greatness v. FEC, 831 F.3d 500, 509 (D.C. Cir. 2016) (stating that 

courts must determine content neutrality based on text, and then purpose). 

 14 The standard that governs expressive conduct prohibitions with “incidental limitations on First Amendment 

freedoms,” see United States v. O’Brien, 391 U.S. 367, 376 (1968), is inapposite to this as-applied claim. “The law 

here may be described as directed at conduct, . . . but as applied to plaintiffs the conduct triggering coverage under the 

statute consists of communicating a message.” Humanitarian Law Project, 561 U.S. at 28. Plaintiffs are informing 

the websites of who they are, and claiming to be employers, much in the same way that the defendant in Alvarez had 

claimed to be a decorated war veteran, or the plaintiffs in Humanitarian Law Project had sought to train terrorists to 

engage in peaceful activity. All of these forms of conduct communicate messages to the recipients. Moreover, it is 

the content of plaintiffs’ speech to the targeted websites—that they represent their identities falsely or misleadingly 

instead of truthfully—that triggers the sites’ ToS and, thereby, the criminal penalties of the CFAA. In other words, 

Mislove and Wilson would violate the Access Provision “because of the [false] content of [their] particular message.” 

Id. In these circumstances, the government must meet a “more demanding standard” than the O’Brien test. Id.

(quoting Johnson, 491 U.S. at 403). Even if that test were applicable, however, “in the last analysis [it] is little, if any, 

different from the standard applied to time, place, or manner restrictions,” Johnson, 491 U.S. at 407, and incorporates

narrow tailoring requirements, see Edwards, 755 F.3d at 1002–03, so the analysis would not meaningfully change.
37

From the information available so far, significant interests appear to underlie the Access 

Provision. In addition to the legislative history regarding theft prevention, the government 

suggests that the Court analogize the CFAA to trespass law, arguing that Congress was also trying 

to prohibit the digital equivalent of trespassing. Def.’s Reply at 3–5. While plaintiffs dispute the 

trespass analogy, they recognize that the CFAA was passed to prevent computer theft and other 

cybercrime, and have not disputed that this is a significant interest. Pls.’ Mem. at 31. The question 

is thus whether the statute fails narrow tailoring as applied to Mislove and Wilson’s plan to 

“creat[e] profiles containing false information,” Compl. ¶ 124, and “access[] websites using 

artificial tester profiles, in violation of [ToS] that prohibit providing false information,” id. ¶ 154.

“To satisfy narrow tailoring, the [government] must prove the challenged regulations 

directly advance its asserted interests.” Edwards, 755 F.3d at 1003. This means “the government 

must show ‘a close fit between ends and means,’” such “that the regulation ‘promotes a substantial 

government interest that would be achieved less effectively absent the regulation,’” and does “not 

‘burden substantially more speech than is necessary to further the government’s legitimate 

interests.’” A.N.S.W.E.R. Coalition v. Basham, 845 F.3d 1199, 1213–14 (D.C. Cir. 2017) 

(citations omitted). At this early stage, the government has not put forward any evidence to show 

that prosecuting those who provide false information when creating accounts, without more, would 

advance its interest in preventing digital theft or trespass. 

Indeed, presuming the allegations in the complaint to be true, it appears that the 

government’s interest “is not implicated on these facts” at all. Johnson, 491 U.S. at 410. Plaintiffs 

allege that their conduct “will not cause material harm to the target websites’ operations,” and that 

“they have no intent to commit fraud or to access any data or information that is not made available 

to the public.” Compl. ¶ 4. It is difficult to argue that trespass or theft concerns can justify 
38

restricting—or even apply to—viewing information that a website makes available to anyone who 

chooses to create a username and password. Cf. Kerr, Cybercrime’s Scope, supra, at 1646. And 

any inadvertent “fraud” plaintiffs may perpetrate against the target websites by creating fictitious 

accounts will be, plaintiffs allege, harmless. The CFAA already punishes harmful, intentional 

fraud in a separate section, see 18 U.S.C. § 1030(a)(4), providing additional evidence that the 

government can further its legitimate interests just as well without applying the Access Provision 

to plaintiffs’ bare false statements. At this stage, “absent any evidence that the speech [would be] 

used to gain a material advantage,” Alvarez, 567 U.S. at 723, plaintiffs’ false speech on public 

websites retains First Amendment protection, see id. at 722, and rendering it criminal does not 

appear to advance the government’s proffered interests. Hence, plaintiffs have plausibly alleged 

an as-applied First Amendment claim, and the motion to dismiss that claim will be denied.

E. RIGHT TO PETITION

In addition to their free speech and press claims, plaintiffs allege that the Access Provision 

violates their rights under the Petition Clause of the First Amendment. Compl. ¶ 193. That clause 

states: “Congress shall make no law . . . abridging . . . the right of the People . . . to petition the 

Government for a redress of grievances.” U.S. Const. amend. I. Plaintiffs assert that the Access 

Provision, by criminalizing websites’ prohibitions on critical speech or publishing, prevents people 

from using any information they might gain from plaintiffs’ planned research to inform Congress 

or agencies about potential discrimination by those websites. Id. ¶¶ 162–67, 189. They also assert 

that, for the same reasons, the Access Provision prevents people from accessing the courts to 

enforce Title VII or the Fair Housing Act: nobody who had visited a website with a nondisparagement clause in its ToS could bring discrimination claims against that site in court without 

opening him- or herself up to a potential CFAA prosecution. Id. ¶¶ 168–69, 190.
39

These allegations are focused on ToS that restrict subsequent speech: disparagement, for 

instance, or use of the sites’ information in court. However, such ToS constitute restrictions on 

the use of information, not on access to it. They therefore do not fall within the Access Provision’s 

ambit, as properly interpreted. But even if one assumes that plaintiffs allege that access restrictions 

criminalized by the Access Provision violate the Petition Clause, see Compl. ¶ 162, plaintiffs’ 

petition challenge is, at best, no stronger than their free speech challenge. Speech and petition

rights are “generally subject to the same constitutional analysis,” Wayte v. United States, 470 U.S. 

598, 610 n.11 (1985), unless “the special concerns of the Petition Clause would provide a sound 

basis for a distinct analysis,” Borough of Duryea v. Guarnieri, 564 U.S. 379, 389 (2011). Here, 

the rights appear to overlap: plaintiffs’ Petition Clause claim focuses on speech restrictions that 

could then affect the petitioning process. Thus, plaintiffs “just as easily could have alleged”—and 

do, in fact, allege—a Speech Clause violation on the same set of facts. Id. at 387.

And it is on that free speech claim that plaintiffs’ First Amendment case must rise or fall. 

The Speech and Press Clauses, rather than the Petition Clause, provide the more natural home for 

plaintiffs’ concerns about the Access Provision. Plaintiffs assert that the CFAA “prevents them 

from engaging in” petitioning because some websites’ ToS (and thus the Access Provision) 

“prohibit the speech necessary to engage in . . . petitioning.” Pls.’ Mem. at 43. The real concern, 

then, is the Access Provision’s alleged restrictions on speech, which have ripple effects in a variety 

of contexts. The application of the Access Provision to the petitioning process constitutes one 

small subset of the speech and conduct the provision allegedly prohibits. Any effect the statute 

might have on plaintiffs’ petition rights, then, is an extra step removed from the central speech 

harm, and is thus too attenuated to state a plausible claim for relief.
40

Ultimately, “the Petition Clause protects the right of individuals to appeal to courts and 

other forums established by the government for resolution of legal disputes,” and “[i]nterpretation 

of the Petition Clause must be guided by the objectives and aspirations that underlie the right.” 

Borough of Duryea, 564 U.S. at 387–88. As the government notes, the clause is not aimed at the 

right to gather facts, or to speak while doing so, as a preliminary step to help prepare that petition 

in a preferred way. See Def.’s Mem. at 28. That right is more naturally the province of the Speech 

and Press Clauses than of the Petition Clause. See Burt Neuborne, Madison’s Music: On Reading 

the First Amendment 11–12, 89 (2015) (arguing that the First Amendment’s protected rights form 

“a rigorous chronological narrative of free citizens governing themselves in an ideal democracy,” 

and that the Petition Clause “concludes Madison’s narrative, protecting [an] idea’s introduction 

into the formal democratic process, forcing the legislature to place the issue on its agenda”). 

Hence, plaintiffs’ Petition Clause claim will be dismissed.

F. VAGUENESS

Plaintiffs next allege that the Access Provision violates the Due Process Clause because it 

is unconstitutionally vague. A statute is void if it is “[1] so vague that it fails to give ordinary 

people fair notice of the conduct it punishes, or [2] so standardless that it invites arbitrary 

enforcement.” Johnson v. United States, 135 S. Ct. 2551, 2556 (2015). Plaintiffs allege that the 

Access Provision meets both prongs of this test. Compl. ¶¶ 171–72. Because of potential chilling 

effects, “a more stringent vagueness test” applies when a law “interferes with the right of free 

speech.” Vill. of Hoffman Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 499 (1982). 

Properly interpreted, however, the Access Provision is not unconstitutionally vague. “A

plaintiff whose speech is clearly proscribed cannot raise a successful vagueness claim” based on a 

lack of fair notice. Expressions Hair Design v. Schneiderman, 137 S. Ct. 1144, 1151–52 (2017)
41

(quoting Humanitarian Law Project, 561 U.S. at 20). Nor can that plaintiff bring a facial vagueness 

challenge “based on the speech of others.” Humanitarian Law Project, 561 U.S. at 20. As we have 

already seen, the Access Provision plainly proscribes the creation of false accounts, but does not 

prohibit plaintiffs’ other activities. Indeed, plaintiffs allege that they are aware that their proposed 

conduct would violate their target websites’ ToS restrictions on creating false accounts. Compl. 

¶ 124. As the Court has determined that the Access Provision applies to one of their activities but 

not to the others, and as plaintiffs admit that they have the requisite mens rea to commit the crime,

no facial claim or as-applied notice claim can go forward.

Nor can plaintiffs plausibly allege that the Access Provision invites arbitrary enforcement. 

“[A] statute’s vagueness is either susceptible to judicial construction or is void for vagueness based 

on the application of traditional rules for statutory interpretation.” United States v. Bronstein, 849 

F.3d 1101, 1106 (D.C. Cir. 2017). Thus, “before striking a federal statute as impermissibly vague,”

courts must “consider whether the prescription is amenable to a limiting construction.” Welch v. 

United States, 136 S. Ct. 1257, 1268 (2016) (citation omitted). The Court has already determined 

that a more limited construction is not only possible, but is in fact more natural than the broad 

reading that raises vagueness concerns. Read to apply only to access, and not to use, restrictions, 

the Access Provision severely curtails both websites’ ability to define the law and prosecutors’ 

freedom arbitrarily to enforce it. Plaintiffs’ Fifth Amendment vagueness claim will be dismissed.

G. NONDELEGATION DOCTRINE

Finally, plaintiffs allege that the Access Provision violates the Fifth Amendment because 

it delegates the content of criminal law to private parties. Compl. ¶¶ 173–77, 201. The primary 

case laying out the private nondelegation doctrine is Carter v. Carter Coal Co., 298 U.S. 238 

(1936). The statute at issue in that case delegated to coal industry groups the power to create 
42

binding codes for the regulation of coal miners’ wages and hours. Id. at 310–11. The Court stated 

that this power “is legislative delegation in its most obnoxious form; for it is not even delegation 

to an official or an official body, presumptively disinterested, but to private persons whose interests 

may be and often are adverse to the interests of others in the same business.” Id. at 311. Prior to 

Carter Coal, the Supreme Court also twice struck down ordinances that sanctioned a “standardless 

delegation of power to a limited group of property owners.” City of Eastlake v. Forest City 

Enterprises, Inc., 426 U.S. 668, 678 (1976) (discussing Eubank v. Richmond, 226 U.S. 137 (1912),

and Washington ex rel. Seattle Title Trust Co. v. Roberge, 278 U.S. 116 (1928)). 

The D.C. Circuit has gleaned two rules from these cases. First, “[f]ederal lawmakers 

cannot delegate regulatory authority to a private entity.” Ass’n of Am. R.Rs. v. U.S. Dep’t of 

Transp. (Ass’n of Am. R.Rs. I), 721 F.3d 666, 670 (D.C. Cir. 2013), vacated and remanded on 

other grounds, 135 S. Ct. 1225 (2015). Unlike with delegations to agencies, “[e]ven an intelligible 

principle cannot rescue a statute empowering private parties to wield regulatory authority.” Id. at 

671. And second, “the due process of law is violated when a self-interested entity is ‘intrusted 

with the power to regulate the business . . . of a competitor.’” Ass’n of Am. R.Rs. II, 821 F.3d at

31 (quoting Carter Coal, 298 U.S. at 311). Plaintiffs claim that the Access Provision violates the 

first of these principles. They allege that the law allows website owners to define the content of a 

crime—thus sweeping beyond other statutes that merely enforce private contractual agreements—

and that the statute relinquishes any government control over the lawmaking process. Compl.

¶¶ 174–76. They also assert that the Access Provision provides no standards to guide what website 

owners may effectively criminalize. See Pls.’ Mem. at 40.

Plaintiffs raise an intriguing argument, but it is ultimately an unsuccessful one. As with 

First Amendment overbreadth and vagueness, the courts can avoid nondelegation concerns by 
43

“giving narrow constructions to statutory delegations that might otherwise be thought to be 

unconstitutional.” Mistretta v. United States, 488 U.S. 361, 373 n.7 (1989). Plaintiffs assert that 

the Access Provision provides a limitless, standardless delegation of power to individual websites 

to define crimes. But that assertion is based on a reading of the provision that sweeps in use, 

purpose, or manner restrictions on obtaining or altering information. Properly read as applying

only to access restrictions, websites can write whatever ToS they please, but a congressionallyimposed standard limits which ToS can lead to liability or prosecution. Nor do websites have the 

power to impose formal rules on an industry or otherwise exercise regulatory authority in the 

manner that courts have found constitutionally impermissible. See, e.g., Yakus v. United States, 

321 U.S. 414, 424 (1944); Carter Coal, 298 U.S. at 310–11; Ass’n of Am. R.Rs. I, 721 F.3d at

670–72. Plaintiffs have cited no case—nor has the Court found one—in which a court struck down 

on private nondelegation grounds a statute that incorporated private parties’ chosen restrictions, 

which are only binding on those who interact with those parties’ individual businesses. It is thus 

difficult to argue that the Access Provision improperly delegates legislative or regulatory authority.

Indeed, when read narrowly, the Access Provision looks similar to many criminal laws that 

are rendered operative by a private party’s decision whether to authorize certain conduct. 

Examples cited in the government’s brief, see Def.’s Mem. at 32–33, include criminal trespass 

laws, see D.C. Code § 22–3302; 25 C.F.R. § 11.411, and laws against misappropriation of trade 

secrets, see 18 U.S.C. § 1831, copyrights, see 17 U.S.C. §§ 106, 506, individuals’ identities, see

18 U.S.C. § 1029, and money (e.g., embezzlement). In none of these instances does a private 

party’s control over the law’s operation render it a nondelegation problem. Rather, “a legislative 

delegation to private citizens” is constitutional so long as “[1] the underlying exercise of authority 

[is] a reasonable regulation within the power of the government . . . . and [2] the legislature’s 
44

restriction [is] in the form of a general prohibition, and the delegation [is] in the form of permitting 

private citizens to waive the protection of that prohibition.” Silverman v. Barry, 845 F.2d 1072, 

1086 (D.C. Cir. 1988). A different rule would make it so that “[a]lmost any system of private or

quasi-private law could be subject to the” nondelegation doctrine. New Motor Vehicle Bd. of Cal.

v. Orrin W. Fox Co., 439 U.S. 96, 109 (1978). Since the Access Provision creates a blanket 

prohibition on accessing information in protected computers, which owners of those computers 

can waive through permission, plaintiffs do not plausibly allege that the provision 

unconstitutionally delegates legislative power. Hence, the nondelegation claim will be dismissed.

CONCLUSION

This case raises important questions about the government’s ability to criminalize vast 

swaths of everyday activity on the Internet. However, the Court need not answer all of them today, 

because it concludes that the CFAA prohibits far less than the parties claim (or fear) it does. For 

the reasons explained above, plaintiffs have plausibly alleged that they have standing to sue, and 

that the Access Provision violates the Free Speech and Free Press Clauses of the First Amendment 

as applied to them. The government’s motion to dismiss for lack of standing and on this single asapplied claim will therefore be denied. But the Access Provision, as the Court reads it, does not 

sweep widely enough to render plausible plaintiffs’ First Amendment overbreadth and petition 

claims, or their Fifth Amendment vagueness and nondelegation claims. The government’s motion 

to dismiss those claims, therefore, will be granted. A separate order will issue on this date.

 /s/ 

 JOHN D. BATES

 United States District Judge

Dated: March 30, 2018