Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines

Computer access disputes are won and lost on paper created before anyone has a lawyer: the HR email on the day someone leaves, the IT ticket closing an account, the invoice describing what the forensic firm did. Each document below exists to make one of those papers come out right, or to deal with the consequences when it did not.

How to use this toolkit

Each template opens with purpose, owner, and timing, then the form, then drafting notes tied to authority. Bracketed text is for you to complete or choose. Adapt the forms to your state and your circuit, because the law differs on points flagged in the notes. Have counsel review anything that goes to an adversary.

The doctrine is explained in The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement, the sequence of decisions in Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide, and the element check in Computer Fraud and Abuse Act Claim Checklist: A Practical Checklist.

The forms reflect the law as of August 2026. Three things move quickly: the split over what counts as "loss" after Moxie Pest Control (Utah), LLC v. Nielsen, 164 F.4th 1195 (10th Cir. 2026), the reach of Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) on AI agents, and whether a contract or policy can define a gate after footnote 8 of Van Buren v. United States, 593 U.S. 374 (2021).

Template 1: Access-end clause

Purpose: ties permission to a defined event, so authorization does not hang on a later email. Owner: employment counsel and HR; procurement for vendors. Timing: at offer, annual policy acknowledgment, and vendor contracting.

Access to Company Systems. The Company grants you permission to access Company Systems solely while you are [employed by / engaged by] the Company, and only those parts of Company Systems made available to your assigned role. Your permission to access all Company Systems ends automatically and immediately on the earliest of: (a) the date and time your [employment / engagement] ends, for any reason, including your resignation; (b) the effective date stated in any written notice from the Company ending or narrowing your access; or (c) [the end of the statement of work]. After that time you are not authorized to access Company Systems, even if your credentials, tokens, keys, or devices continue to function. "Company Systems" means computers, networks, accounts, applications, repositories, cloud services, and data owned, leased, licensed, or administered by the Company, including accounts held in the Company's name with third parties.

Credentials. You will not share your credentials with anyone, and you may not use anyone else's, unless the Company's information security team has approved it in writing.

Drafting notes. United States v. Eddings, 161 F.4th 199 (3d Cir. 2025) held that a resignation does not itself end authorization "in the absence of any contract linking authorization with employment," and expressly left open that a contract or an adequately noticed manual might do it. This clause tries to take that path. It is not guaranteed; the role of contract in setting a gate remains the open footnote 8 question, and NRA Group, LLC v. Durenleau, 154 F.4th 153 (3d Cir. 2025) refused to treat a password-sharing policy as a gate for current employees. Treat the clause as a supplement to Templates 2 and 3, not a substitute. The sentence about functioning credentials answers the argument, which Eddings rejected, that having access proves having authorization. Having the worker sign or acknowledge helps show notice and intent under Abu v. Dickson, 107 F.4th 508 (6th Cir. 2024). The role-limited language helps only if your permissions actually match it, so keep the two in sync. If you need a carve-out so a former worker can reach a benefits or pay portal, state it, or you will create a trivial violation on day one.

Template 2: Revocation notice to a departing employee or contractor

Purpose: the affirmative act that ends permission, and a preservation request. Owner: HR sends; counsel approves the form. Timing: same day as the departure or the resignation; do not wait for the exit interview.

Subject: Your access to [Company] systems has ended

[Name]:

This confirms that [your employment with / your engagement by] [Company] [ended / will end] on [date]. Effective [date and time, time zone], [Company] has ended your permission to access any [Company] computer, network, account, application, repository, cloud service, or data, including [list the main systems] and any account held in [Company]'s name with a third party.

This applies whether or not your password, token, API key, saved session, or device still works. If you discover that any of them still works, do not use it. Please tell [contact] so we can close it.

If you need something from those systems (a pay record, for example), ask [contact] and we will provide it.

Please keep, and do not delete or alter, any [Company] documents or data in your possession, including on personal devices or personal email or cloud accounts, until we have arranged for its return. [Contact] will contact you about returning equipment by [date].

Nothing in this message limits any right you may have to report possible violations of law to a government agency.

[Name, title]

Drafting notes. Send it to personal and work addresses, because the work mailbox may already be closed, and keep the delivery record. Eddings says the step might be "nothing more than an email," and United States v. Shahulhameed, 629 F. App'x 685 (6th Cir. 2015) accepted a phone call and a midnight email. Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016) and Rel. Ins., Inc. v. Pilot Risk Mgmt. Consulting, LLC, No. 68A25 (N.C. May 22, 2026) treat a written message as revocation. The pay-record sentence removes the most sympathetic excuse for one more login. The preservation sentence avoids prompting deletion, which is a common reaction, and the final sentence guards against a retaliation claim and pairs with the immunity notice required by 18 U.S.C. § 1833(b) in agreements on confidential information. Do not accuse anyone of anything in this message. If you suspect misconduct, a separate letter from counsel can address it.

Variant for a person who will continue as a contractor or in another role:

Your new role does not include access to [systems]. Permission to access those systems ended on [date and time]. Your access to [systems] continues only for [purpose].

Korn/Ferry pulled credentials from someone staying on as a contractor in United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016), and the court treated that revocation, rather than the change in role, as the event that mattered.

Template 3: Departing-user access shutdown runbook

Purpose: a repeatable technical sequence that closes real gates and proves it. Owner: IT or security, with HR triggering. Timing: within [one hour] of a termination, and on a schedule agreed with HR for a planned resignation.

Drafting notes. Steps 2 and 3 come before changes because they prove what the person was allowed to reach, which is the central fact under Van Buren ("one either can or cannot access certain areas within the system"), and because logs roll off. Steps 7 and 8 fill the most common gap: a token outlives the login. Step 9 reflects United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016), where the way around a revoked account was someone else's credentials, and Moxie, where a borrowed login was the whole scheme. Step 13 exists for the same reason as a hold: Fed. R. Civ. P. 37(e) is unforgiving, and the routine re-image is how evidence usually disappears. Step 15 can also become your first evidence of an attempt. For planned resignations, coordinate with counsel on whether immediate shutdown is appropriate, and see Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

Time the IT staff spend on routine offboarding is not a CFAA loss. Time spent investigating and responding after an incident is. Keep a separate ticket once an incident begins (Template 8).

Template 4: Revocation letter to an automated actor or platform user

Purpose: ends any permission a scraper, aggregator, or integration may claim, and creates clear notice. Owner: outside or in-house counsel, with engineering input. Timing: on identifying the actor, before or at the same time as technical blocks.

[Date]

By email and overnight courier

[Name], [Title] [Company] [Address]

Re: Revocation of permission to access [Service]

[Client] operates [Service], which [requires a login / includes areas available only to authenticated users]. Since at least [date], [Company], or those acting for it, has accessed [the logged-in areas / specific endpoints] of [Service] using [describe: accounts, automated scripts, customer credentials, network addresses], as shown by [brief description of evidence].

Effective on your receipt of this letter, [Client] revokes any permission [Company] may have had to access [the computers and logged-in areas of] [Service] for any purpose, by any means, directly or through anyone acting for it, including through credentials supplied by [Client]'s users. This revocation applies regardless of any consent from individual users. [Client] may also take technical steps to block access. Any such step, or its absence, does not change this revocation.

[Client] also asks that [Company]: (1) confirm in writing by [date] that the access has stopped; (2) preserve all documents and data relating to the access, including scripts, logs, account records, and information obtained; and (3) identify the data it has obtained, so the parties can discuss its return or deletion. Do not delete anything before that discussion.

[Optional business path: If [Company] wishes to obtain data from [Service] through an authorized route, please contact [name] about [API program / license].]

This letter is not a complete statement of the facts or of [Client]'s rights and remedies, all of which are reserved.

[Signature]

Drafting notes. This letter models Power Ventures. It is individualized, it states that permission is gone, and it addresses user consent directly, since that court required permission from both the users and the platform once the platform had spoken. Do not rest it on terms of use; that court said a terms violation alone does not suffice, and the letter there worked because it also made plain that access itself was no longer allowed. See also Ticketmaster L.L.C. v. Prestige Entertainment West, Inc., 315 F. Supp. 3d 1147 (C.D. Cal. 2018), which relied on the letter rather than the terms. Send the letter even if you plan to block, since a block alone may not give notice, as a footnote in Power Ventures explains.

Know the limits. For pages open to the public, hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022) says a letter does not create a gate, at least as a Ninth Circuit prediction at the injunction stage. Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178 (N.D. Cal. 2013) goes the other way, but predates it. So the bracketed language is written for logged-in areas, and a letter about public pages should rest on contract, copyright, or trespass instead. If the actor uses an on-device agent, read Perplexity first and consider whether the letter should address its users' access or the company's own systems. See Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims and Drafting a Demand Letter: A Practical Checklist. Avoid threats of criminal referral; check local ethics rules.

Template 5: Authorization matrix

Purpose: one-page map of who could reach what, when, and how that changed. It usually exposes the case's strength or weakness within an hour. Owner: counsel with a security engineer. Timing: first week; update as discovery proceeds.

Fill in the last column from this key:

Drafting notes. Keep this privileged. Defense counsel use the same form with the rows sorted by the revocation date. Row by row is the right level of detail: Power Ventures split liability at a single date, and Rel. Ins., Inc. v. Pilot Risk Mgmt. Consulting, LLC, No. 68A25 (N.C. May 22, 2026) sorted the claims employee by employee and act by act, finding triable issues on two theories and remanding a third, which lacked record evidence, so the trial court could apply its spoliation ruling.

Template 6: Forensic preservation instructions to IT

Purpose: stops well-meaning staff from destroying evidence during the first hours. Owner: counsel issues; security lead carries out. Timing: immediately; before remediation where safety allows.

PRIVILEGED AND CONFIDENTIAL: PREPARED AT THE DIRECTION OF COUNSEL

To: [Security lead, IT lead] From: [Counsel] Date/time: [ ] Re: Preservation concerning [matter name]

We anticipate a possible legal dispute over access to [systems] by [person or unknown actor] since about [date]. Please do the following now and tell me when each is done. Call me before doing anything not on this list that would change a system.

Do not: re-image, reset, upgrade, or return to service any device used by [person]; delete accounts (disable them instead); clear logs; run antivirus cleanup or remediation on the affected machines before imaging, unless needed to stop active harm, in which case call me first; browse the contents of [person]'s devices or accounts; log in to any personal account of [person], even if a session is open.

Do:

1. Suspend automatic deletion and log rotation for [identity provider, email, chat, code hosting, cloud, VPN, firewall, endpoint tool]. Tell me the current retention period of each.
2. Export existing logs for [date range], in native format, and record SHA-256 hash values.
3. Take the following devices out of circulation and store them in [locked location]: [list]. Leave them off if they are off, and call me about any that are on.
4. Record the current state of [person]'s account: groups, roles, tokens, keys, forwarding rules, and active sessions. Then disable them, in that order, unless active harm requires otherwise.
5. Start a dated log of each action: who, what, when, and why.
6. Record your time on this in [ticket number], with a short description of the task, and use that ticket only for this.
7. Limit discussion to [names]. Do not speculate in chat. Direct questions to me.

Drafting notes. "Disable, do not delete" keeps the data and also shows the moment access ended. The instruction against reading personal accounts reflects Van Alstyne v. Electronic Scriptorium, Ltd., 560 F.3d 199 (4th Cir. 2009) and Brown Jordan International, Inc. v. Carmicle, 846 F.3d 1167 (11th Cir. 2017), where people on the employer's side faced Stored Communications Act liability. Item 6 feeds Template 8. Labeling a document privileged does not make it so, and facts remain discoverable, so write it to be read by a judge. Logs and copied data can be self-authenticated with a qualified person's certification under Fed. R. Evid. 902(13) and (14); plan on that from the start, and see Rule 901 for the fallback. Broader hold mechanics are in Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case, and incident-response coordination is in Responding to a Data Breach: The First Seventy-Two Hours.

Template 7: Forensic engagement scope and chain-of-custody log

Purpose: defines work so the invoice proves loss rather than undermining it, and keeps the evidence admissible. Owner: counsel with vendor. Timing: at engagement.

Scope language for the engagement letter:

Provider will perform the following, each billed under a separate task code:

Task A (Intrusion investigation). Determine how the [account/device/credential] was used to access [systems]; the method, source, dates, and scope of access; and the identity of the person or device responsible.

Task B (Damage assessment and integrity). Determine whether data, programs, or systems were altered, deleted, or impaired, and verify their integrity.

Task C (Restoration and containment). Assist in restoring affected data and systems to their prior condition and in closing the method of access.

Task D (Business and litigation support). Any review of how information was later used, comparison with third-party products, or expert support for litigation, only on counsel's separate written instruction.

Each invoice will show date, timekeeper, hours, rate, task code, and a description sufficient to identify the system or question addressed. Provider will report when Task A's questions have been answered and will not continue under that task afterward without instruction.

Chain-of-custody log:

Drafting notes. The task codes follow the line drawn in Moxie: costs "reasonably necessary to respond," such as identifying the offender or the method, count, and costs of investigating how a competitor used the data do not. They also follow the statute's own words in 18 U.S.C. § 1030(e)(11). Task B matters most in courts following the technological-harm reading, such as William Gottlieb Management Co. v. Carlin, No. 20-cv-08907 (S.D.N.Y. Mar. 26, 2024) and CoStar Group, Inc. v. Leon Capital Group, LLC, No. 21-2227 (D.D.C. Aug. 10, 2023), since a report saying "we checked integrity and here is what we found" ties response costs to the system. Stop-work language guards against open-ended investigation charged after the question has been answered. Use a neutral protocol if the examination reaches the other side's devices; see Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols.

Template 8: Loss worksheet and coding rules

Purpose: a running, defensible statement of loss, for pleading and proof. Owner: finance or a paralegal, reviewed by counsel monthly. Timing: open on day one; freeze for each filing. The accused can use the same sheet to test the plaintiff's numbers.

Header: Matter: [ ]. Defendant or actor: [ ]. Twelve-month window: [start] to [end]. Prepared by: [ ]. Date: [ ].

Codes and treatment:

Totals box:

Drafting notes. Measure for the worst plausible reading. The "strict reading" line tells you whether the claim survives in a court that reads Van Buren's "technological harms" language as a limit; hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022) says so in a footnote, Moxie rejects it, and Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) left it undecided. The $5,000 aggregates over a year rather than per intrusion under Creative Computing v. Getloaded.com LLC, 386 F.3d 930 (9th Cir. 2004), but it must be attributable to the defendant under Ryanair DAC v. Booking.com B.V., No. 20-1191-WCB (D. Del. Jan. 22, 2025), where one category failed for lack of evidence on half the window and the entire $177,000 claim came down to $2,457.72. That decision is on appeal (No. 25-1374 in the Third Circuit), so check its status. Damages under factor (I) are limited to economic damages, § 1030(g). The exclusion lines are not wasted effort: the same figures often support Defend Trade Secrets Act remedies, on which see Trade Secret Remedies Toolkit: Damages Models, Head Start Analyses, and Injunction Briefing.

Worksheet example (hypothetical). Northfield Tile Works pays a forensic firm $5,200 on Task A and $1,100 on Task B; IT spends 18 logged hours at $70 on resets ($1,260); the firm then spends $3,000 on Task D comparing a rival's price list. Countable: $7,560. Strict reading: $1,100 plus any IT time spent on integrity. If Northfield's court follows Gottlieb, the report had better document system findings, or the claim is in trouble.

Template 9: Complaint outline

Purpose: forces facts about gates, knowledge, and dollars before anyone writes a count. Owner: lead counsel. Timing: weeks two to six; before the limitations date.

I. Parties and jurisdiction. Federal question, 28 U.S.C. § 1331. Supplemental, § 1367. Diversity if available, pleaded separately in case the federal count falls. Personal jurisdiction facts, with attention to where the computers are and where the defendant acted. Venue.

II. The computers. Identify each system. Allege use in interstate commerce. § 1030(e)(2)(B).

III. How access is controlled. Authentication, roles, permissions. Who could reach what. The written terms, quoted. Avoid describing policy as if it were a technical limit.

IV. The defendant's permission. Date, source, and scope.

V. How permission ended (if a "without authorization" theory). The step taken, date, method, and how the defendant received it. Any contract term tying permission to an event.

VI. The access. Table of dates, account, source, area, what was obtained or altered.

VII. Knowledge. Facts: warnings, letters, evasion, statements.

VIII. Harm. Loss in a specified one-year period by category and amount. Damage, if alleged, described in terms of integrity or availability. Interruption of service, if alleged, with dates.

IX. Discovery. When the plaintiff first noticed the problem. Allege facts showing timeliness.

Count 1: 18 U.S.C. § 1030(a)(2)(C), [without authorization / exceeds authorized access], § 1030(g), factor (c)(4)(A)(i)(I).

[Count 2]: § 1030(a)(4), only with facts on the intended fraud and the thing of value, pleaded under Rule 9(b).

[Count 3]: § 1030(a)(5)(A) or (B)/(C), only with facts on damage.

[Count 4]: 18 U.S.C. § 2701 and § 2707, if messages in electronic storage were reached.

[Count 5]: 18 U.S.C. § 1836, with secrets described at the appropriate level.

[Counts 6 and following]: state computer crime statute (e.g., Cal. Penal Code § 502(c), (e); Va. Code §§ 18.2-152.3, 18.2-152.4, 18.2-152.12; Fla. Stat. § 668.803); breach of contract; conversion; trespass to chattels.

Relief: Compensatory (economic) damages, injunction, return of data; fees only under statutes that provide them.

Drafting notes. Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) and Ashcroft v. Iqbal, 556 U.S. 662 (2009) apply; see Drafting a Complaint That Survives a Motion to Dismiss. After Van Buren, an allegation that someone acted "without authorization in violation of company policy" invites dismissal under Royal Truck & Trailer Sales & Service, Inc. v. Kraft, 974 F.3d 756 (6th Cir. 2020) and NRA Group. Plead in the alternative where facts support it, but do not plead a purpose theory as a gate theory. Attribution needs facts; Afiniti, Ltd. v. Chishti, No. 23-0303 (D.D.C. Aug. 11, 2026) refused a claim that a defendant directed unnamed persons to enter unspecified systems at an unknown time. Do not use a "Doe" as a limitations shelter: Sewell v. Bernardin, 795 F.3d 337 (2d Cir. 2015) warns you must identify the person within the period. Plead state claims so they stand alone, since Carfax, Inc. v. Accu-Trade, LLC, No. 1:21-cv-00361 (E.D. Va. Mar. 4, 2022) shows they can survive independently and Royal Truck shows they may be sent away if the federal claim fails. Choose the forum on purpose, using Federal Jurisdiction Toolkit: Notices of Removal, Remand Motions, and Jurisdictional Allegations.

Template 10: Rule 12 outline

Purpose: a ready structure for the motion to dismiss. Owner: defense counsel. Timing: by the response date, 21 days after service unless extended or waived.

Preliminary statement. One paragraph: the complaint describes a [business or employment dispute], not an entry into a closed system.

Background from the complaint. Only pleaded facts and documents incorporated by reference (the policy, the agreement, the letter).

Argument.

[I. Lack of personal jurisdiction or improper venue.] Fed. R. Civ. P. 12(b)(2), (3). Include or waive.

II. The complaint does not allege access without authorization or in excess of it. A. [Insider] The information was available to Defendant's role. Van Buren, 593 U.S. at 396; Royal Truck; WEC; United States v. Valle, 807 F.3d 508 (2d Cir. 2015). B. [Policy] Terms and workplace rules are not gates. NRA Group; Power Ventures; Sandvig v. Barr, 451 F. Supp. 3d 73 (D.D.C. 2020). C. [Former worker] The complaint alleges no affirmative step ending permission. Eddings. D. [Public site] No authentication barrier exists. hiQ. E. [Agent or user-directed tool] Defendant did not itself access the computers. Perplexity. F. [Vicarious] No specific facts on who did what at whose direction.

III. The complaint does not allege the required intent. Abu; NRA Group n.7; for (a)(4), Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., 810 F.3d 1075 (7th Cir. 2016).

IV. The complaint does not allege a qualifying loss of at least $5,000 in one year. A. Conclusory amount; no categories. B. Lost business or profits without an interruption of service. Nexans; Andrews. C. Costs directed at business harm or at the suit, not the system. Moxie; [Gottlieb, CoStar, Better Holdco in courts following them].

V. The claim is untimely, on the complaint's own dates. § 1030(g); Sewell.

VI. Subsection-specific defects. No "damage" (Fidlar); (a)(5)(B) and (C) reach only access "without authorization"; § 1030(b) lacks an agreement or is unavailable civilly in this district [research].

VII. State claims. Each on its own text; alternatively, decline jurisdiction under § 1367(c)(3).

Conclusion. Dismissal with prejudice where amendment would be futile.

Drafting notes. Cite adverse authority in your circuit, and explain it. Courts frequently decide what "without authorization" means as a question of law on the pleadings, as in Carfax. Do not over-read Perplexity: it was decided on a preliminary injunction record with specific architecture and expressly reserves other facts. Do not over-read hiQ, which ruled on "serious questions." If you have a Moxie problem, say so and turn to its business-harm limit. Be careful about attaching declarations: outside-the-pleadings material can convert the motion. General guidance is in Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants and Motion Practice Toolkit: Dispositive, Discovery, and In Limine Motions.

Template 11: Response to an allegation letter

Purpose: a measured reply that stops the bleeding, preserves defenses, and admits nothing. Owner: defense counsel. Timing: within the time demanded, if reasonable, or with a short request for more time.

[Date]

Re: Your letter of [date]

We represent [Client] and ask that you direct all communications on this subject to us.

[Client] takes your letter seriously. Without admitting any of its assertions, [Client] has taken the following steps: (1) [Client] is not accessing, and has been told not to access, [identified systems]; (2) [Client] has been instructed to preserve documents and data that may relate to this matter; and (3) [optional: Client's new employer has been notified].

Your letter does not identify [the specific systems, dates, or accounts at issue / the basis for the claim that access was unauthorized / the loss claimed]. So that we can respond meaningfully, please provide: (a) the dates, systems, and accounts at issue; (b) any contract or policy on which you rely; (c) any notice you contend ended [Client]'s permission, and when it was sent; and (d) the categories of data you believe are in [Client]'s possession.

[Optional: Our preliminary view is that this is a dispute over [the use of information to which Client had access], which the Computer Fraud and Abuse Act does not reach. See Van Buren v. United States, 593 U.S. 374 (2021).]

[Optional: To resolve this efficiently, [Client] is prepared to discuss an arrangement for identifying and returning or sequestering any [Company] information under a mutually agreed protocol, without any admission.]

We expect [Sender] to preserve its own records, including authentication and audit logs, provisioning records, and the records of any investigation.

This letter is not a complete statement of the facts or of [Client]'s rights, all of which are reserved.

[Signature]

Drafting notes. Never state that nothing was taken until you know. Item 1 cuts off further exposure from the date of the letter, the key date under Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016). Item (c) quietly raises the United States v. Eddings, 161 F.4th 199 (3d Cir. 2025) issue. The preservation demand is reciprocal and often overlooked. If the client has criminal exposure, talk through whether even this letter should say anything beyond cessation and preservation. If you are responding for a researcher, adapt it with Vulnerability Disclosure Toolkit: VDP Policies, Safe Harbor Terms, Researcher Agreements, and Response Letters. More broadly, see Responding to a Cease and Desist Letter: A Practical Guide. A new employer named in a letter should also look at Lateral Hire Toolkit: Candidate Certifications, Onboarding Instructions, and Cease-and-Desist Responses.

Template 12: Internal stop-and-preserve notice for an accused company

Purpose: gets engineers and sales staff to stop the conduct and keep the evidence. Owner: general counsel, with engineering leadership. Timing: within hours of a letter or complaint.

PRIVILEGED AND CONFIDENTIAL: FROM COUNSEL

We have received a [letter/complaint] from [Sender] about access to [Service]. Effective immediately:

1. Stop. No person or automated process may access [Service] or its logged-in areas. [Engineering owner] will disable [jobs, connectors, keys] by [time] and confirm to me. Do not route around any block, change network addresses, change how our software identifies itself, or use a customer's or colleague's login to test anything.
2. Keep. Do not delete or change code, configuration, logs, data pulled from [Service], or messages about [Service], including chat and personal devices used for work. Automatic deletion is suspended for [systems].
3. Do not investigate on your own. Do not visit [Service] to see what happened.
4. Do not discuss this in chat or email, or with customers or [Sender]. Refer questions to me. If you have concerns or information, call me.
5. Do not ship any change to how the product interacts with [Service] until you have spoken with me.

Drafting notes. The "changes how our software identifies itself" line reflects the disputed user-agent facts in Perplexity. Item 5 matters because an architecture change after notice may look like evasion in the eyes of a jury, whatever its legal effect. The contemporaneous internal emails in Power Ventures, including a chief executive's prediction of a block and a fight, were devastating. Employees should be told plainly who the lawyer represents; if individuals may have personal exposure, consider separate counsel and give an appropriate warning.

Template 13: Jury instruction starting points

Purpose: first drafts to fight over. Owner: trial counsel. Timing: pretrial order. Conform to your circuit's model instructions, if any.

Loss (plaintiff-friendly formulation, drawing on Moxie):

"Loss" means any reasonable cost to [Plaintiff], including the cost of responding to the violation, conducting a damage assessment, and restoring data, a program, a system, or information to its prior condition, and any revenue lost, cost incurred, or other consequential damages incurred because of an interruption of service. A cost of responding may be a loss even if the violation did not impair the computer, if the cost was reasonably necessary to respond to the violation, for example by identifying the person responsible or the method of access.

Loss (defense-oriented additions, drawing on the Ryanair instruction and ruling):

A cost is not a loss if it was directed at business or other harms, such as investigating how information was used for commercial gain. Do not include costs that [Plaintiff] did not itself bear, or costs [Plaintiff] would have incurred regardless of the conduct. Attorney's fees for this lawsuit are not a loss. You must find that a loss of at least $5,000 during a single one-year period was caused by [this Defendant].

Revocation (drawing on Eddings):

Permission to use a computer, once given, continues until the person who controls access takes some step to withdraw it [or until an event stated in an agreement between the parties occurs]. The fact that [Defendant] stopped working for [Plaintiff] does not by itself end permission. [Plaintiff] was not required to block [Defendant]'s technical ability to log in. It is for you to decide whether the step [Plaintiff] took was enough, and whether [Defendant] knew permission had ended.

Exceeds authorized access (drawing on Van Buren and Abu):

A person exceeds authorized access only by obtaining information located in a part of the computer that was off limits to that person, and by doing so knowing it was off limits. A person who obtains information available to that person does not exceed authorized access, even if the person had a wrong or improper purpose.

Drafting notes. Expect a fight in non-Tenth Circuit courts over whether a technological-harm limit belongs in the loss instruction. The quoted instruction in the Ryanair opinion is a good neutral starting point: it allowed response costs without actual technological harm so long as they were directed at technological harm rather than business harm. Eddings is a criminal case with a dissent, and courts outside the Third Circuit may not follow it. The knowledge language in the fourth instruction relies on a Sixth Circuit reading that the Third Circuit endorsed in a footnote, and others have not all addressed it. Preserve your objections, and put every sufficiency ground in a Rule 50(a) motion.

This toolkit is general information and not legal advice for a specific situation.

Related Documents

Related Articles

• The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement: the law behind every template.
• Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims: background for revocation letters to automated actors.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: the preservation duty behind Templates 3, 6, and 12.

Related Guides

• Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide: when and why to use each of these forms, side by side.
• Onboarding a Competitor's Employee Without Importing Its Secrets: A Practical Guide: how a new employer avoids receiving the Template 2 letter's subject matter.
• Responding to a Cease and Desist Letter: A Practical Guide: the wider approach behind Template 11.

Related Checklists

• Computer Fraud and Abuse Act Claim Checklist: A Practical Checklist: element checks to run before using Templates 9 and 10.
• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: departure steps that accompany Templates 1 to 3.

Related Toolkits

• Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols: neutral examination protocols and protective orders.
• Lateral Hire Toolkit: Candidate Certifications, Onboarding Instructions, and Cease-and-Desist Responses: the competitor-side papers for a departing-employee dispute.
• Federal Jurisdiction Toolkit: Notices of Removal, Remand Motions, and Jurisdictional Allegations: jurisdictional allegations and removal papers.
• Vulnerability Disclosure Toolkit: VDP Policies, Safe Harbor Terms, Researcher Agreements, and Response Letters: authorization language for security researchers.