Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide

The email reaches the general counsel at 4:40 on a Friday. An identity-provider alert shows a login to the company's code repository from an address in another state, using an account that belongs to an engineer who left six weeks ago. Somebody wants to know if they can call the FBI. Somebody else wants to wipe the account right now. The CEO, who has heard of the Computer Fraud and Abuse Act (CFAA), wants to sue by Monday.

Each of those instincts can damage the case. The same weekend, the former engineer may be getting a very different call, from a friend who says "you still had access, didn't you?" What each side does in the next few days will shape the record on the only three questions a court will care about: did someone pass a gate, did it cost at least $5,000 to deal with, and is the claim timely.

This guide is the procedure. For the doctrine and the case law in depth, read the companion article, The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement.

The short answer

If you are the plaintiff:

• Decide early whether the CFAA is your claim or a side claim. If the person only misused data they could already reach, Van Buren v. United States, 593 U.S. 374 (2021) takes the federal computer claim away, and trade secret and contract claims must carry the case.
• End access in writing and in the system on the same day, and keep proof of both. Under United States v. Eddings, 161 F.4th 199 (3d Cir. 2025), a resignation by itself may not end authorization, and an email can.
• Preserve before you remediate. Logs age out on a schedule nobody remembers until they are gone.
• Build a loss ledger from the first hour, separating system response from business investigation and from legal work. Moxie Pest Control (Utah), LLC v. Nielsen, 164 F.4th 1195 (10th Cir. 2026) counts the first. Nobody counts the others.
• Calendar two years from the first sign of impairment, with a safety margin. Do not wait to learn who did it.

If you are the defendant:

• Stop accessing the system, preserve everything, and do not wipe, reset, or "clean up" anything.
• Get a lawyer before you answer questions, because the same statute carries criminal penalties.
• Look at the Rule 12 motion in this order: authorization, loss, limitations, the damage element, and intent, then the state claims.
• If you lose the motion, attack loss category by category. A jury verdict fell on that ground in the Ryanair case, with $2,457.72 proved against a $5,000 floor.

Part one: the plaintiff's path

Step 1: Triage the facts into one of five boxes (first day, in-house or outside counsel)

Before anything else, sort the event. The box determines the claim.

Scraping and automated access have their own branches: public pages, logged-in pages, and pages after a letter. If that is your problem, read Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims first, then come back here for the mechanics.

Box A clients often want a CFAA count anyway. Resist that. NRA Group, LLC v. Durenleau, 154 F.4th 153 (3d Cir. 2025) affirmed summary judgment against an employer on exactly this kind of theory and went further, remarking that the suit looked preemptive or even retaliatory given the employees' harassment complaints. A claim that cannot survive a gate analysis gives the other side its opening theme and, in some forums, a fee motion.

Step 2: Close the gate, and paper the closing (same day, IT and HR, directed by counsel)

Two separate things have to happen. They are often confused.

Revocation of authorization is a legal event. Send a dated written message to the person, at a personal address as well as any work address, stating that permission to access all company systems has ended. Eddings says the employer must take an affirmative step absent a contract or policy tying access to employment, that a step may be as simple as an email, and that it is for the jury whether the step sufficed. Rel. Ins., Inc. v. Pilot Risk Mgmt. Consulting, LLC, No. 68A25 (N.C. May 22, 2026) held that a cease-and-desist letter telling a departed producer not to use company property or data was enough to revoke her access to online accounts.

Revocation of access is a technical event. Disable the identity-provider account, kill active sessions, rotate shared passwords, revoke personal access tokens, API keys, SSH keys, and OAuth grants, remove the person from SaaS admin consoles, and check for service accounts and forwarding rules they created. Take a screenshot or export of each state before you change it, and log who did what at what time.

Sample language for the first message:

Your authorization to access any [Company] computer system, account, application, or data ended on [date and time]. This includes [email, source code repositories, CRM, cloud consoles, vendor portals held in [Company]'s name], whether or not your credentials continue to function. Do not attempt to log in. Please do not delete anything from any device or account that may contain [Company] information; we will be in touch about its return.

The final sentence matters. You want return and preservation, not panic-deletion. And if the person is still employed in another role or has a contractor agreement, say precisely which systems the notice covers, because Nosal II involved someone who stayed on as a contractor after his credentials were pulled.

If you are dealing with a website or platform rather than a former worker, the letter should name the actor, state that permission to access is revoked, and go out before or along with any technical block. Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016) said in a footnote that bypassing an IP block without more would not be enough because a blocked user may not know why, and the letter is what made the later access knowing.

Step 3: Preserve before you remediate (first 24 to 72 hours, counsel plus forensic vendor)

The duty to preserve attaches when litigation is reasonably anticipated, and for a plaintiff that is usually the moment you start planning suit. Fed. R. Civ. P. 37(e) sanctions the loss of electronically stored information that should have been kept. For the mechanics of a hold, use Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

What to collect, in rough order of how fast it disappears:

Pull the returned laptop out of the re-imaging queue today. Image before anyone browses. Hash every collection, and keep a chain-of-custody log. Certified records of a regularly conducted activity and data copied from an electronic device can be self-authenticated under Fed. R. Evid. 902(13) and (14) with a proper certification, which can spare you a live custodian for each log. The toolkit Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols has a chain-of-custody form and neutral-examiner protocol that adapt well.

Retain the forensic firm through counsel, with an engagement letter that describes the purpose. That helps with work product, but it also serves your loss proof, and those two goals pull in different directions, which is the point of the next step. Expect anything you use to prove loss to be discoverable.

Do not go into the other side's personal accounts. This is the most expensive shortcut in this field. If a former employee left a personal webmail session open on a company laptop, leave it alone. In Van Alstyne v. Electronic Scriptorium, Ltd., 560 F.3d 199 (4th Cir. 2009), a company president began reading an employee's personal email account while she worked there and kept going for more than a year after she left. The Fourth Circuit held that the statutory minimum under the Stored Communications Act requires actual damages, but that punitive damages and fees do not. Brown Jordan International, Inc. v. Carmicle, 846 F.3d 1167 (11th Cir. 2017) shows the same statute being used against an executive who read other employees' email. You do not want to be the counter-defendant in your own case.

Also do not use a subpoena as a shortcut to content. 18 U.S.C. § 2702 generally bars providers from divulging the contents of communications, and Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004) let an SCA claim proceed against people who used a patently invalid subpoena to obtain someone's email from their provider. Serve requests on the account holder under Rule 34; subpoena providers under Rule 45 for subscriber and log data where the statute permits.

Step 4: Open a loss ledger on day one (finance plus counsel, updated weekly)

Treat this as an accounting project. A strong authorization case with a sloppy loss record is a loser.

Open a spreadsheet with one row per expense or block of time, and these columns: date, person or vendor, hours, rate, cost, task description, statutory category, whether the plaintiff actually bore the cost, who was the actor, and supporting document.

Then sort by the categories the courts use:

• Investigating the intrusion (how they got in, what they touched, identifying the person). Counts. Moxie; A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (4th Cir. 2009); Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 774 F.3d 1065 (6th Cir. 2014).
• Damage assessment and integrity checks. Counts.
• Restoration. Counts on any reading, and the safest item in a court that demands technological harm.
• Employee time on response. Counts if documented (Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), where hours spent analyzing and responding exceeded $5,000), at a defensible loaded rate.
• Reasonable blocking and detection measures aimed at the actor. Counted in principle to the extent allocable by the rulings in Ryanair DAC v. Booking.com B.V., No. 20-1191-WCB (D. Del. Jan. 22, 2025), now on appeal to the Third Circuit, though a general security upgrade is suspect.
• Lost revenue or consequential costs. Only because of an "interruption of service" (Nexans Wires S.A. v. Sark-USA, Inc., 166 F. App'x 559 (2d Cir. 2006)).
• Investigating what a competitor did with the data. Does not count under Moxie's business-harm limit.
• Lawyers' fees for the lawsuit. Do not treat these as loss. The statute has no fee-shifting provision.
• Costs passed through to customers or paid by someone else. Not the plaintiff's loss unless you can explain why, as the verification fee in Ryanair showed.

Two structural choices deserve thought.

The window. The statute requires loss "during any 1-year period," and Creative Computing v. Getloaded.com LLC, 386 F.3d 930 (9th Cir. 2004) confirms it need not come from one intrusion. Pick the twelve months that are both richest and best documented, and make sure you have evidence for the whole period. In Ryanair, a gap in hosting-cost testimony for half the chosen year cost the plaintiff dearly.

The defendant. If more than one actor is responsible, allocate. Ryanair's court required loss "attributable to" the one remaining defendant, which reduced a large system-wide cost to a small share. If you sue several unrelated scrapers, do not assume you can pool. Note the statutory phrase "1 or more persons" concerns who suffered the loss, and the parenthetical allowing a related course of conduct affecting other computers is limited to proceedings brought by the United States. 18 U.S.C. § 1030(c)(4)(A)(i)(I).

Know your forum. In the Tenth Circuit, and in the Fourth, Sixth, and Eleventh on their pre-2021 precedent, response costs count without a demonstrated impairment. In the Ninth Circuit, hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022) contains a contrary footnote, and Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) declined to reach the issue. District courts in the Southern District of New York and the District of Columbia (William Gottlieb Management Co. v. Carlin, No. 20-cv-08907 (S.D.N.Y. Mar. 26, 2024), Better Holdco, Inc. v. Beeline Loans, Inc., No. 20-cv-08686 (S.D.N.Y. July 26, 2021), CoStar Group, Inc. v. Leon Capital Group, LLC, No. 21-2227 (D.D.C. Aug. 10, 2023)) have required a link to technological harm. Build the record for the strictest plausible court: have the forensic report describe what was checked on the system and what was found, including any changed data.

Step 5: Pick the claims (week one, lead counsel)

Check your own state as well. Texas pairs Penal Code § 33.02 with a civil remedy in Civil Practice and Remedies Code chapter 143, and most states have some computer crime statute, with widely varying civil remedies. Confirm the current text before you plead.

State counts often have a real advantage. Carfax, Inc. v. Accu-Trade, LLC, No. 1:21-cv-00361 (E.D. Va. Mar. 4, 2022) dismissed a federal CFAA claim but kept the Virginia one because of the different standard. On the flip side, a federal court can decline supplemental jurisdiction under 28 U.S.C. § 1367(c) once the federal claim is gone, as in Royal Truck. If diversity is absent, think about which forum you want. See Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal.

If the person left for a competitor, that competitor's exposure and onboarding process matter too. See Onboarding a Competitor's Employee Without Importing Its Secrets: A Practical Guide for what a careful new employer should be doing, and use it to frame your letter to them.

Step 6: Decide between letter and lawsuit (week one, general counsel with outside counsel)

A letter is often worth sending even if you intend to sue. It revokes, puts the recipient on notice, starts the other side's preservation duty, and gives you a dated record of what they knew. Power Ventures limited damages to the period after the letter, so send it early if the access is continuing. Your target may be able to avoid suit by stopping, and you can usually negotiate return and certification faster than a court can order them.

Three cautions on tone:

1. Do not threaten criminal referral as a bargaining chip without checking your state's ethics rules. ABA Formal Opinion 92-363 addresses when such a threat may be permissible, and some jurisdictions are stricter. The optics are bad regardless. Remember that Eddings began as a demand for money backed by a threat, on the other side.
2. Avoid overstating. Saying "you hacked us" about a Box A employee invites a defamation counterclaim if repeated to others, and it will be Exhibit A at the Rule 11 hearing.
3. Consider whistleblower and retaliation risk. An employee who took documents to report wrongdoing may have immunity under 18 U.S.C. § 1833(b) for trade secret purposes, and a suit filed right after a complaint will be read through that lens. See Whistleblower and Retaliation Claims: SOX, Dodd-Frank, the False Claims Act, and State Law.

The firm's templates for this letter and others are in Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines.

Step 7: Plead facts about gates and dollars (weeks two to six, lead counsel)

A court will look past labels. Van Buren made the location of the information the central fact, and Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) and Ashcroft v. Iqbal, 556 U.S. 662 (2009) require that you plead facts supporting it. Courts have dismissed claims that recite "without authorization" alone, and Afiniti, Ltd. v. Chishti, No. 23-0303 (D.D.C. Aug. 11, 2026) rejected a theory that a defendant directed unnamed persons to enter unspecified systems at an unknown time.

Plead the following, each with dates:

1. The computer and why it is protected (interstate use, the hosted service, where it sits).
2. The gate: how access was limited, by what credential or permission, and what the defendant's role was permitted to reach.
3. The grant and the end of permission: who gave it, when and how it ended, and how the defendant knew. If relying on a contract or policy, quote it, and be ready for footnote 8 of Van Buren, which leaves its role open.
4. The crossing: dates, source addresses, account used, what was accessed. Plead on information and belief only what you cannot yet know.
5. What was obtained, altered, or damaged, under the subsection you invoke.
6. State of mind. After Abu and NRA Group, plead facts showing the defendant knew the area was forbidden or the permission was gone.
7. The factor: loss during a specific one-year period, by category, with an amount.
8. The timing: when you first discovered the impairment.

Sample loss paragraph:

Between [date] and [date], a period of less than one year, [Plaintiff] incurred reasonable costs exceeding $5,000 in responding to Defendant's access, consisting of: (a) $[] paid to [forensic firm] to determine the method and extent of Defendant's access to [system] and to verify the integrity of the data stored there; (b) $[] in time spent by [Plaintiff]'s information security staff reviewing authentication logs, terminating active sessions, and rotating credentials exposed by that access; and (c) $[__] to restore [records] altered on [date] to their prior state. These amounts exclude attorneys' fees and the cost of investigating Defendant's commercial use of the information.

The last sentence is deliberate. It tells the judge you have read Moxie.

For fraud-based counts under § 1030(a)(4), plead the scheme with enough particularity to satisfy Rule 9(b) in case your court applies it. If you do not know who it was, a Doe filing can preserve your claim and open subpoena practice, but Sewell v. Bernardin, 795 F.3d 337 (2d Cir. 2015) warns that you must still identify the person within the limitations period. See Identifying an Anonymous Defendant Online: A Practical Guide. For a foreign defendant or a foreign computer, note that the definition of protected computer expressly includes some located abroad; Ryanair rejected an extraterritoriality challenge at the pleading stage and the issue was pressed again after trial.

The general craft is in Drafting a Complaint That Survives a Motion to Dismiss.

Step 8: Decide on emergency relief (days to weeks, lead counsel)

Section 1030(g) allows injunctive relief, and the usual test from Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008) applies: likelihood of success, likely irreparable harm, balance of equities, public interest. Rule 65(b) allows a temporary restraining order without notice only on specific facts in an affidavit or verified complaint and a certification of why notice should not be required, and Rule 65(c) addresses security. See Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court and Preliminary Injunction and TRO Application Checklist: A Practical Checklist.

What helps:

• Ongoing access. A court can stop something that is still happening. If you have already cut off access, your emergency is really about the data, and the Defend Trade Secrets Act may be the stronger hook.
• Concrete harm evidence. Perplexity is a warning. The Ninth Circuit found evidence of degraded shopping experience "more abstract" than a lost-customer showing, and an expert's cyber-risk evidence limited because he could not fully replicate the risks. The district court's order was vacated. The earlier remedies order in Facebook, Inc. v. Power Ventures, Inc., 252 F. Supp. 3d 765 (N.D. Cal. 2017) entered a permanent injunction where future violations were reasonably likely, but that came after liability was decided.
• Speed. Delay undercuts irreparable harm. If you learned in March and move in August, expect that to be the first paragraph of the opposition.
• Narrow orders. Ask for: no further access; preservation; return or sequestration of identified data; a forensic examination by a neutral under a protocol; a sworn accounting. An order that a judge can sign quickly and enforce easily is worth more than a sweeping one. On enforcement, see Contempt and Enforcing Injunctions: Civil, Criminal, and What an Order Actually Compels.

For a platform against an automated actor, draft the order so the defendant knows what endpoints or conduct it covers. Perplexity also shows that the interests of users, who chose the tool, can weigh in the equities. And in the Ninth Circuit, plaintiffs seeking orders against public-page access should expect hiQ to flip the posture entirely; hiQ was the one who got the injunction.

The Defend Trade Secrets Act's ex parte seizure remedy, 18 U.S.C. § 1836(b)(2), is available only "in extraordinary circumstances," and most cases are better served by a noticed motion with a preservation order.

Step 9: Run discovery around the gate and the ledger (after Rule 26(f))

At the Rule 26(f) conference, address preservation of defendant's devices and accounts, a neutral forensic protocol, and an order under Fed. R. Evid. 502(d). Expect a demand for the plaintiff's own policies, provisioning records, and the forensic firm's file.

Useful requests to the defendant: devices and accounts used from the relevant addresses; authentication artifacts; communications about access or the block; instructions from any new employer; scripts, proxies, or services used. Power Ventures was won in large part through contemporaneous emails about blocks and a discovery admission. Serve requests for admission on the login events; they can be the cheapest proof you get.

Prepare your Rule 30(b)(6) witness on access provisioning, loss categories, and when you first noticed. Your own employee will be asked: when did you first see anything wrong? That answer sets the limitations date.

Retain an expert under Fed. R. Evid. 702 who can explain logs to a jury, and a separate damages witness if the numbers are significant. For allocation methods, have someone test them before trial. Ryanair's witnesses relied on a 2.8 percent share figure and an 80 percent allocation; the court accepted those as supported, but they could not make up for missing evidence.

Worked example: a plaintiff's decisions

Suppose Tern Valley Analytics, a hypothetical 60-person software company in Ohio, parts ways with its chief technology officer, Imogen Vale, on April 1. The separation agreement says nothing about system access. HR disables her email and laptop login that day. Nobody remembers the personal access token she created for the code repository two years earlier. On May 12, the repository's audit log shows the token cloned three private repositories. An engineer sees the alert on May 14. On May 20, Vale announces a new company.

Box. The access on May 12 is Box C if authorization ended. The company took affirmative steps by disabling her login on April 1. A jury could find that was an affirmative step, and the Sixth Circuit, whose law applies in Ohio, has treated firing as cutting off authorization in an unpublished decision that Abu cited with approval. But she left under an agreement, not a firing, and she might say the token was a separate grant. Tern Valley should not rest there. It sends a clear revocation letter May 15, and revokes the token, after exporting its audit trail.

Loss. Forensic firm, $7,800 on how the token was used and whether any code was altered. Security engineers, 40 hours logged, $4,000. Rotating secrets found in the cloned repositories, $2,500 of contractor time. Total: $14,300, all in the same year. A review of Vale's new product against Tern Valley's code, $18,000, goes in a separate column and supports only the trade secret claim.

Claims. CFAA § 1030(a)(2)(C), Defend Trade Secrets Act, Ohio trade secret law, breach of any surviving confidentiality covenant. No § 1030(a)(4) count unless facts show a scheme. No SCA count, since code repositories are unlikely to be a communications facility.

Emergency relief. There has been no more access since the token was revoked, so the urgent issue is the code. Counsel proposes a stipulated order for preservation and a neutral examination, moving for a TRO only if refused.

Calendar. The discovery date is May 14 at the latest. Tern Valley dockets 18 months out as an internal deadline and two years as the hard stop.

Total time from alert to a filing-ready complaint: about three weeks, most of it spent on the forensic scope and on deciding not to plead three counts that the CEO wanted.

Part two: the defendant's path

Step 1: The first 24 hours (individual or company, with counsel immediately)

Stop. If there is any access still occurring, by you, by a script, by a scheduled job, or by a colleague, stop it now and document that you did. A letter may have just ended your authorization, and Power Ventures measures liability from that moment. For a company, identify the owner of the automated process and put a written hold on deployments touching the target.

Preserve. Do not delete, wipe, reset, or reinstall anything, and do not "return the laptop clean." Deleting data can turn a defensible case into a sanctions case under Rule 37(e), and it can create a separate problem under § 1030(a)(5)(A) or obstruction statutes. Tell IT to suspend autodelete. Keep the proxy logs and code from before the letter.

Do not self-investigate in the target's systems. Do not log in "just to check what I had." It is another access event.

Get counsel, and consider separate counsel. Section 1030 is a criminal statute, and Eddings shows prosecutors will sometimes bring cases out of disputes that began as a fight over wages. An individual should not give a statement to the former employer, the new employer's HR, or the FBI before speaking to a lawyer. A new employer and a new hire may not share interests, and joint representation needs a real conflict analysis.

Notify insurers. Cyber, D&O, and employment practices policies may respond, and late notice is an avoidable fight. See Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice.

Reply carefully. A short letter from counsel acknowledging receipt, confirming preservation, and stating that the client is not accessing the systems often resolves more than a long denial. Responding to a Cease and Desist Letter: A Practical Guide has the broader framework. Never promise that nothing was taken until you have checked.

Step 2: Map the claim against the elements (first two weeks, defense counsel)

Build your own chronology of every access event and, for each one, record: which account; which permission granted it; who granted it; whether anything had ended that permission; what the person knew; what was obtained; and whether anything was changed. You will often find that the plaintiff's complaint collapses periods together. Under Power Ventures and Eddings, access before revocation is outside the claim, so the date matters a great deal.

Ask the client the hard questions in a privileged setting. Did anyone share a password? Did you use a proxy after a block? Did someone tell you to stop? A surprising number of defensible cases have one bad email.

Step 3: The Rule 12 sequence (by the response deadline, usually 21 days after service)

Preserve threshold defenses first: personal jurisdiction and venue are waived if omitted from the first Rule 12 motion. See Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants for the general rules. For a foreign or out-of-state scraper, personal jurisdiction may be the best argument you have, and it is lost by inattention.

Then, under Rule 12(b)(6), arrange arguments in this order:

1. No gate crossed. The defendant had permission to reach this information, and the complaint's real grievance is purpose or later use. Cite Van Buren, Royal Truck, WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199 (4th Cir. 2012), United States v. Valle, 807 F.3d 508 (2d Cir. 2015), and in the Third Circuit NRA Group, which rejects claims resting on policy breaches by current employees "absent evidence of code-based hacking." For public pages, cite hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022). For former workers, Eddings: the complaint must allege the employer took a step to end permission. If the plaintiff relies on terms of service, cite Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016) (a terms violation without more is not enough) and Sandvig v. Barr, 451 F. Supp. 3d 73 (D.D.C. 2020).

2. Wrong actor. If software acting at a user's direction did the work, Perplexity says the user may be the one who accessed. Read its limits first: it turned on the fact that the company's servers never communicated with the plaintiff's and is expressly narrow. If the theory is vicarious, cite Afiniti.

3. No cognizable loss. Attack the factor. Common targets: a conclusory "$5,000" with no categories; lost profits with no interruption of service (Nexans, Andrews v. Sirius XM Radio Inc., 932 F.3d 1253 (9th Cir. 2019)); costs of investigating business harm; legal fees. In a court following the technological-harm reading, argue that the complaint identifies no harm to data or systems. In the Tenth Circuit you must argue Moxie's limit instead. Be candid about the split; the judge will find it anyway.

4. Limitations. If the complaint's own dates show discovery of the impairment more than two years before filing, cite Sewell. Note that the clock can differ by claim and by account.

5. Missing subsection elements. For § 1030(a)(5), argue no "damage"; downloading alone does not impair data, as Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., 810 F.3d 1075 (7th Cir. 2016) held. For § 1030(a)(4), argue no intent to defraud or nothing of value, and that the complaint lacks particularity. For § 1030(a)(5)(B) and (C), argue that insiders with authorization fall outside them. For § 1030(b), argue that civil conspiracy is unsettled, or that no agreement is alleged.

6. Intent. Abu and NRA Group require that the person knew they were over the line. At the pleading stage this is usually a supporting point, but where the complaint's own facts show the defendant thought she had permission, as with the employee in NRA Group who believed she was doing what supervisors wanted, it can carry real weight.

7. State claims. Ask the court to decline supplemental jurisdiction if all federal claims fall, 28 U.S.C. § 1367(c)(3), unless you prefer the federal forum. Address each state statute on its own text. Do not assume a state claim falls with the federal one: Carfax shows the opposite, though Perplexity treated California's statute the same way on its facts.

A sample heading structure for the brief:

I. The Complaint Does Not Allege That [Defendant] Entered Any Part of the System Closed to Him. A. Purpose and subsequent use are irrelevant after Van Buren. B. Company policies do not raise gates for a current employee. II. The Complaint Does Not Allege a Qualifying Loss of at Least $5,000 in a One-Year Period. III. Any Claim Based on Events Before [date] Is Untimely. IV. The Court Should Decline Supplemental Jurisdiction Over the Remaining Claims.

Decide whether a Rule 11 letter is warranted. For a Box A case, a short, well-supported letter can change the plaintiff's thinking, and it gives you a record for later. Remember the available fee provisions: in a California § 502 claim, Hay permits a defense fee award if the claim was objectively without foundation; the Florida statute shifts fees to a prevailing party; and 18 U.S.C. § 1836(b)(3)(D) allows fees where a trade secret claim is made in bad faith. The CFAA itself shifts nothing.

Step 4: Opposing a TRO or preliminary injunction (often on days' notice)

Usually the plaintiff's weakest factor is likelihood of success, followed by irreparable harm. Your best moves:

• Offer a stipulated preservation order and a no-access undertaking at once. It removes the emergency and looks responsible.
• Submit a declaration on actual access dates and the current state of access, and describe the steps taken to stop it.
• Point to delay, to the adequacy of money damages, and to the lack of any continuing access.
• Contest the merits with Van Buren, and cite Perplexity for the proposition that an injunction against conduct likely outside the statute does not serve the public interest.
• Ask for security under Rule 65(c), with evidence of what an order would cost you. In Perplexity the district court denied a bond request; the Ninth Circuit's vacatur meant the issue did not need resolving, but the record you make matters.
• Be careful with a defendant's declaration if criminal exposure exists. Everything said under oath can be used later, and an invocation of the Fifth Amendment in civil litigation has its own costs.

If a forensic examination is ordered or agreed, negotiate the protocol: neutral examiner, search terms or hash lists, privilege screen, personal data protections, and return of images.

Step 5: Answer, counterclaim, and discovery

Consider declaratory relief or counterclaims: unpaid wages, retaliation, defamation, or your own SCA claim if the plaintiff went into your accounts. NRA Group involved harassment and retaliation claims that remained pending in the district court after the employer's claims failed.

Discovery priorities for the defense:

1. The grant. How were permissions actually set? A role that allowed the access is your best fact. So is proof of a practice that tolerated what the policy forbade.
2. The end. Any step taken to withdraw permission, and when the client learned of it. Eddings and Carfax make silence valuable.
3. The ledger. Every invoice, time record, and allocation; the engagement letters; what the investigator was asked to do. Ask who paid. Ask when the investigation effectively ended.
4. The first alert. Who saw it and when, for limitations.
5. Policy reality. Whether password sharing, shared accounts, or workarounds were common.

Depose the plaintiff's loss witness early, and pin down each category.

Step 6: Summary judgment and trial

Move for summary judgment under Rule 56 on loss if the record allows. Abu and NRA Group were summary judgment wins on authorization and intent. Ryanair is the model for loss, even though the ruling came after trial: go through each category and ask whether the plaintiff bore the cost, whether it was caused by this defendant, whether it is a response to a violation or an ordinary cost of doing business, and whether any evidence covers the full period.

Make your Rule 50(a) motion complete. In Ryanair, the plaintiff noted that one of Booking.com's arguments had not been raised in the Rule 50(a) motion and could not be raised afterward. Your renewed motion can only be as good as your first one. Propose jury instructions on the definition of loss that distinguish technological from business harm; the Ryanair instruction, which the court quoted, is a useful starting point for either side. Seek instructions on knowledge, too.

Worked example: a defense decision tree

Suppose Bellwether Route, a hypothetical logistics startup, offers a dashboard that pulls shipment data from carriers' customer portals. Customers give Bellwether their portal credentials, and Bellwether's servers log in nightly from its cloud account. One carrier, Oakhaven Freight, sends a letter on March 3: Bellwether is prohibited from accessing the portal for any reason, and Oakhaven has blocked its IP range. The product team, seeing errors the next morning, asks whether to route through a new set of addresses, since "the customers still want it."

Compare the positions:

Pre-letter access looks defensible on Power Ventures' reasoning, since user consent gave arguable permission. Bellwether should stop the nightly jobs on March 3, preserve the job logs, and call counsel, and only then discuss architecture. It should also check what customers' portal terms say, since it may be inducing breach.

Costs and trade-offs

Neither side should treat CFAA litigation as cheap.

For plaintiffs, the forensic work often exceeds the $5,000 threshold on its own, and the damages available may not be much larger, since economic damages under factor (I) track much of the same cost, with no fee recovery. The real value is often the injunction, the discovery into what was taken, and the federal forum. If the trade secret claim is solid, the CFAA count adds complexity and invites a motion, and you should think about whether it earns its place. A narrow complaint with two strong counts tends to survive and settle better than one with seven counts.

For defendants, a motion to dismiss on authorization is comparatively inexpensive and can remove federal jurisdiction entirely, but it educates the plaintiff, who may be allowed to replead under Rule 15. Forensic examination of your client's devices is intrusive and costly, so agreeing to a limited protocol early may save a much broader order later. Individuals with personal exposure may rationally pay for certification and return, even with good defenses, because a criminal referral is a risk that no fee award would repay.

For both, the sequence matters more than the volume. A fast letter and a clean ledger on one side, or a fast stop and an intact hard drive on the other, often decide the case.

Common mistakes

Plaintiffs:

1. Pleading a purpose case as a hacking case. "She accessed it to compete" is a sentence Van Buren wrote out of the statute.
2. Assuming resignation ended access. Absent a contract or policy, Eddings says it did not in the Third Circuit. Send the message.
3. Disabling the account but not the tokens. The API key that survives offboarding is the most common gap, and its survival becomes the defendant's argument that nobody ended anything.
4. Remediating before imaging. The re-imaged laptop is gone for good.
5. Mixing the investigation. One invoice covering "forensics and competitive analysis" invites the court to discount all of it.
6. Counting legal fees as loss. It undermines the credibility of the rest of the ledger.
7. Choosing a loss year you cannot document for all twelve months, or pooling loss across unrelated actors.
8. Treating identity as the limitations trigger. Sewell says discovery of the damage controls.
9. Reading someone's personal email or messages. See Van Alstyne.
10. Suing right after a harassment complaint without thinking about how it will look, as the panel in NRA Group noticed.

Defendants:

1. Wiping the device. Innocent people do this constantly, and then have to explain it.
2. One more login. To retrieve a tax form, a photo, a contact. It may be the only post-revocation access in the case.
3. Rotating around a block after a letter. The block alone may be ambiguous, and the letter is not.
4. Treating user permission as a complete answer. Power Ventures requires the platform's permission too once it has spoken.
5. Reading hiQ too broadly. It concerns public pages and a preliminary injunction, and it invites other claims.
6. Reading Perplexity too broadly. The court said four different ways that it was narrow.
7. Waiving jurisdictional defenses by leaving them out of the first motion.
8. Answering a demand with a detailed narrative before the facts are checked.
9. Assuming a win on the CFAA ends the case. Contract, trade secret, and state computer claims often survive it. In hiQ itself, the CFAA win did not save the company from its contract problem.

A timeline for both sides

Nothing in this guide guarantees a result, because these cases turn on the specific logs, documents, and court. It is general information and not legal advice for a specific situation. If you are on either side of one of these disputes and would like a second look at the facts, early is much better than late.

Related Documents

Related Articles

• The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement: the doctrine, the case law, and the splits behind every step here.
• Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims: the scraping-specific analysis, including contract and copyright.
• Hiring From a Competitor: Inevitable Disclosure, Employee Raiding, and the New Employer's Trade Secret Exposure: the new employer's position when data travels with a hire.
• Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court: the standards and procedure for emergency motions.
• Whistleblower and Retaliation Claims: SOX, Dodd-Frank, the False Claims Act, and State Law: what to weigh before suing someone who has complained.
• Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice: notice issues that arise on day one.

Related Guides

• Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide: the claim usually pleaded alongside the CFAA.
• Onboarding a Competitor's Employee Without Importing Its Secrets: A Practical Guide: preventing the dispute from the hiring side.
• Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal: forum consequences when the federal count is at risk.
• Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants: general Rule 12 practice.
• Identifying an Anonymous Defendant Online: A Practical Guide: Doe filings and early subpoenas.
• Responding to a Cease and Desist Letter: A Practical Guide: handling the letter once it arrives.
• Drafting a Complaint That Survives a Motion to Dismiss: pleading technique.

Related Checklists

• Computer Fraud and Abuse Act Claim Checklist: A Practical Checklist: the desk version of this guide, by side and phase.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: the hold itself.
• Preliminary Injunction and TRO Application Checklist: A Practical Checklist: filing requirements for emergency relief.

Related Toolkits

• Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines: fillable letters, worksheets, and outlines for these steps.
• Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols: forensic protocols and protective order provisions.