Computer Fraud and Abuse Act Claim Checklist: A Practical Checklist

A claim under 18 U.S.C. § 1030 usually fails for one of three reasons: nobody crossed a gate, nobody can prove $5,000 of the right kind of cost, or nobody filed in time. Every box below tests one of those, or helps you avoid wrecking a good position while you find out.

How to use this checklist

Phase 0 is for both sides, and should be finished within the first day or two. Phases 1 through 6 are for the party considering a claim. Phases 7 through 10 are for the party accused. Phase 11 applies to both at summary judgment and trial.

A claim can be sound on every box and still lose if one box comes back empty, because § 1030(g) adds its loss factor on top of the violation. Work the phases in order, and stop to reconsider any time a red flag applies. Items cite the governing authority. This area moves quickly, so run a citator on any case you plan to rely on; several decisions below are recent, and two (Ryanair and Perplexity) may have further proceedings ahead.

For the reasoning behind these tasks, read The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement. For the narrative sequence with sample language, see Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide. Forms are in Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines.

Phase 0: Clock, forum, and fact pattern (both sides)

• Identify the earliest possible limitations date. Two years from the act or from discovery of the damage. 18 U.S.C. § 1030(g). Note: Discovery of the impairment, not of the wrongdoer's identity, starts the period. Sewell v. Bernardin, 795 F.3d 337 (2d Cir. 2015). Separate accounts can have separate dates.
• Identify the controlling circuit and any published ruling on loss. The Tenth Circuit counts reasonably necessary investigative costs without technological harm, Moxie Pest Control (Utah), LLC v. Nielsen, 164 F.4th 1195 (10th Cir. 2026); the Ninth has a contrary footnote in hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022) and left the issue open in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026).
• Identify the controlling law on authorization. Note whether your court has addressed code versus contract under footnote 8 of Van Buren v. United States, 593 U.S. 374 (2021). Note: Compare NRA Group, LLC v. Durenleau, 154 F.4th 153 (3d Cir. 2025) (policy breach by current employees is not enough absent code-based hacking), Abu v. Dickson, 107 F.4th 508 (6th Cir. 2024) (several possible sources, with intent as the filter), and Rel. Ins., Inc. v. Pilot Risk Mgmt. Consulting, LLC, No. 68A25 (N.C. May 22, 2026) (an internal rule may suffice to create a fact issue).
• Classify the actor. Current employee; former employee; contractor or vendor; competitor; stranger; bot or scraper; software agent running at a user's direction.
• Classify the system. Open to the public, or closed behind some authentication requirement, using the three categories in hiQ.
• Classify the conduct. Reading or taking data; altering or destroying data; flooding a service; threatening; trafficking in passwords. This selects the subsection. § 1030(a)(2), (a)(4), (a)(5), (a)(6), (a)(7).
• Issue a legal hold for email, chat, logs, devices, and accounts on anticipating litigation. Fed. R. Civ. P. 37(e). Note: Use Litigation Hold and Evidence Preservation Checklist: A Practical Checklist for the details.
• Flag criminal exposure on either side and decide who speaks to whom. The statute is mainly a criminal one, and the same reading applies in both settings. United States v. Eddings, 161 F.4th 199 (3d Cir. 2025) and NRA Group both discuss this.

Red flag (both sides): Do not delete, reset, or "tidy" anything during triage. In Royal Truck & Trailer Sales & Service, Inc. v. Kraft, 974 F.3d 756 (6th Cir. 2020), the plaintiff's own theory featured wiped devices. A wiped drive is rarely good for anyone, and Rule 37(e) can reach the party that wiped it.

Phase 1: Is there a violation? The gate (claimant)

• Write down exactly what the defendant accessed, by system, area, date, and account.
• State the permission the defendant actually had, by role, group, or license, and pull the provisioning record that proves it. Note: If the role allowed the access, stop here on "exceeds authorized access." Van Buren, 593 U.S. at 396; Royal Truck & Trailer Sales & Service, Inc. v. Kraft, 974 F.3d 756 (6th Cir. 2020); WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199 (4th Cir. 2012); United States v. Valle, 807 F.3d 508 (2d Cir. 2015).
• Delete purpose from the theory. Competing, disloyalty, or personal use do not make access unauthorized. Van Buren; United States v. Nosal, 676 F.3d 854 (9th Cir. 2012) (en banc).
• Test the agency theory out of the file. If any draft relies on the duty of loyalty ending authority, remove it; International Airport Centers, L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006) is a pre-Van Buren decision that the Court listed on the losing side of the split.
• For insider claims, identify the off-limits area. Is it "files, folders, or databases" that the permissions actually closed? Van Buren. Note: A rule with no technical enforcement is the footnote 8 question. It survived summary judgment in Relation Insurance and would fail for current employees under NRA Group.
• For password sharing, identify who authorized what. Account holder with permission to delegate? NRA Group (coworker logging in at another employee's request is not a violation). Revoked user going through a friend? United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016). Purchased login? Moxie. Consent gained by deceit? Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004).
• For a public website, identify the gate. Without an authentication requirement, hiQ says there is none to cross, at least at the likelihood-of-success stage in the Ninth Circuit. Note: Outside the Ninth Circuit, compare Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178 (N.D. Cal. 2013), which allowed revocation on a public site by letter and IP block. Scraping-specific tasks are in Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims.
• For logged-in areas reached by automation, identify the facts on circumvention. See Ryanair DAC v. Booking Holdings Inc., 636 F. Supp. 3d 490 (D. Del. 2022) (account requirement and anti-bot measures alleged).
• For software agents, identify whose machine talked to yours. Perplexity held that on its record the user, not the vendor, accessed the site, and reserved different facts. Note: Collect the network evidence showing the source of requests and any vendor control.
• For destruction or flooding, go to § 1030(a)(5)(A). No access element is required. United States v. Thomas, 877 F.3d 591 (5th Cir. 2017) (IT manager's sabotage); Pulte Homes, Inc. v. Laborers' International Union of North America, 648 F.3d 295 (6th Cir. 2011) (flood of calls and emails). Mere downloading is not damage. Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., 810 F.3d 1075 (7th Cir. 2016).
• For a vendor's threats or lockout, read § 1030(a)(7). SkyHop Technologies, Inc. v. Narra, 58 F.4th 1211 (11th Cir. 2023).

Phase 2: Did permission end, and can you prove it? (claimant)

• Locate every contract or policy that ties access to employment or engagement. Eddings left open that such terms may end authorization automatically.
• Find the affirmative act. Absent such a term, the employer must take a step to rescind. United States v. Eddings, 161 F.4th 199 (3d Cir. 2025). Note: A resignation alone was insufficient there. An email may suffice. The Third Circuit left firing open, while United States v. Shahulhameed, 629 F. App'x 685 (6th Cir. 2015) treated it as enough.
• Collect the proof of technical revocation: credential disablement, token revocation, device collection. United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016); United States v. Steele, 595 F. App'x 208 (4th Cir. 2014).
• Collect the proof of notice: letter, email, delivery or read receipt, reply. Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016); Relation Insurance.
• Identify all credentials that remained live, including tokens, API keys, OAuth grants, and shared accounts.
• Build the before-and-after timeline. Access before revocation is usually outside the claim. Power Ventures limited liability to the period after the letter.
• For a platform target, confirm the letter is individualized and says permission is withdrawn. Power Ventures contrasted an individualized letter with ordinary permission disputes. See also Ticketmaster L.L.C. v. Prestige Entertainment West, Inc., 315 F. Supp. 3d 1147 (C.D. Cal. 2018).
• Do not rely on an IP block alone. Power Ventures said that, without more, bypassing one is not unauthorized use.

Red flag (claimant): If the only evidence that permission ended is that the person stopped working for you, expect an Eddings motion, and consider sending a clear revocation now to protect against any later access.

Phase 3: State of mind and attribution (claimant)

• Match the mental state to the subsection. Intentional for (a)(2); knowing with intent to defraud for (a)(4); knowing transmission and intentional damage for (a)(5)(A). § 1030(a).
• Collect evidence that the defendant knew. For exceeding access, the insider must purposefully enter an area and know it is forbidden. Abu; NRA Group n.7. Note: Warnings, login banners, role explanations, emails about the block, and evasion all help. In Power Ventures, the company's discovery admissions and its evasion of IP blocks after the letter carried the appeal, and the chief executive's contemporaneous emails weighed heavily in the remedies ruling on remand.
• For § 1030(a)(4), test intent to defraud and the thing of value. Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., 810 F.3d 1075 (7th Cir. 2016) affirmed summary judgment for lack of intent. The post-trial ruling in Ryanair (cited in Phase 4) discusses value and intent as well.
• Identify the actual person at the keyboard. Logs, device identifiers, carrier records. Note: For an unknown intruder, see Identifying an Anonymous Defendant Online: A Practical Guide. Doe filing does not stop the requirement to identify within the limitations period. Sewell.
• If suing a company for someone else's access, plead specific facts of direction or agency. Afiniti, Ltd. v. Chishti, No. 23-0303 (D.D.C. Aug. 11, 2026) rejected a conclusory theory, citing Ryanair DAC v. Booking Holdings Inc., 636 F. Supp. 3d 490 (D. Del. 2022) where specific third parties were named. Abu assumes agents' acts can be attributed.
• If relying on conspiracy under § 1030(b), research your district. Courts are divided on civil use, and the Ryanair jury rejected the count on the facts.

Phase 4: The factor and the loss ledger (claimant)

• Select the § 1030(c)(4)(A)(i) factor. (I) $5,000 loss; (II) medical care; (III) physical injury; (IV) public health or safety; (V) government justice or security computer. § 1030(g). Note: Factor (VI), ten computers, is not a civil factor. Factor (I) limits you to economic damages.
• Choose a twelve-month window and confirm evidence for every month. Ryanair DAC v. Booking.com B.V., No. 20-1191-WCB (D. Del. Jan. 22, 2025). Creative Computing v. Getloaded.com LLC, 386 F.3d 930 (9th Cir. 2004) confirms that the $5,000 is measured over the year, not per intrusion.
• Sort each cost by statutory phrase: responding to the offense; damage assessment; restoration; lost revenue or consequential damage because of interruption of service. § 1030(e)(11); Brown Jordan International, Inc. v. Carmicle, 846 F.3d 1167 (11th Cir. 2017); Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 774 F.3d 1065 (6th Cir. 2014).
• Count investigation tied to the system or the intruder's method and identity. Moxie; A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (4th Cir. 2009).
• Exclude investigation of commercial use by the competitor. Moxie.
• Exclude lost profits and lost customers without an interruption of service. Nexans Wires S.A. v. Sark-USA, Inc., 166 F. App'x 559 (2d Cir. 2006); Andrews v. Sirius XM Radio Inc., 932 F.3d 1253 (9th Cir. 2019).
• Exclude litigation fees and litigation-driven expert work. Infotek Corp. v. Preston, No. 1:18-cv-01386 (D. Md. Sept. 23, 2026).
• Stop counting investigation when the question was answered. Infotek cut off costs after forensic confirmation of the person responsible.
• Exclude general security upgrades unless necessitated by the event. Infotek.
• Document staff time with date, hours, task, and loaded rate. Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016); Yoder.
• Confirm that the plaintiff bore the cost. In Ryanair, verification fees passed through to customers did not count.
• Allocate shared costs among actors, and to this defendant, with a stated method. Ryanair.
• Confirm cause. Pure cost-of-business items, such as a per-booking vendor fee charged no matter who books, are not loss. Ryanair.
• Test the claim under the stricter reading. Would the record show a link to harm to data or systems? CoStar Group, Inc. v. Leon Capital Group, LLC, No. 21-2227 (D.D.C. Aug. 10, 2023); William Gottlieb Management Co. v. Carlin, No. 20-cv-08907 (S.D.N.Y. Mar. 26, 2024); Better Holdco, Inc. v. Beeline Loans, Inc., No. 20-cv-08686 (S.D.N.Y. July 26, 2021).
• Have a qualified witness ready for logs and numbers. Fed. R. Evid. 702; Fed. R. Evid. 902(13), (14).

Red flag (claimant): If your total is under about $10,000 and half of it is ambiguous, the CFAA count may not survive a careful defendant. Ryanair claimed about $177,000 and could prove only $2,457.72 in the end. Consider whether a state count without a dollar floor is the better vehicle.

Phase 5: Parallel claims and forum (claimant)

• Evaluate the Stored Communications Act if mail or messages were reached. 18 U.S.C. § 2701; § 2707. Note: No $5,000 floor. Punitive damages and fees without actual damages, though the statutory minimum needs actual damages. Van Alstyne v. Electronic Scriptorium, Ltd., 560 F.3d 199 (4th Cir. 2009).
• Evaluate the Defend Trade Secrets Act. 18 U.S.C. § 1836; § 1839. Note: Passwords are not themselves trade secrets. NRA Group. Causation depends on the remedy. Moxie. Check the employee notice under § 1833(b). Use Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide.
• Evaluate state computer crime statutes. Cal. Penal Code § 502 (three years; fee award available; scope-of-employment exception in subdivision (h)); Va. Code §§ 18.2-152.1 et seq. and § 18.2-152.12 ("without authority" includes reasonably should have known; limitations under § 8.01-40.1); Fla. Stat. §§ 668.801 to 668.805; Tex. Civ. Prac. & Rem. Code ch. 143. Note: Carfax, Inc. v. Accu-Trade, LLC, No. 1:21-cv-00361 (E.D. Va. Mar. 4, 2022) dismissed the federal count but kept the Virginia count. Confirm current state text and effective dates before filing.
• Weigh California's fee risk. Hay v. Marinkovich, No. D082561 (Cal. Ct. App. Feb. 6, 2025) allows fees to a prevailing defendant if the claim was objectively without foundation.
• Evaluate contract, conversion, and trespass to chattels. hiQ lists these. See X Corp. v. Bright Data Ltd., No. 3:23-cv-03698 (N.D. Cal. May 9, 2024) on copyright preemption of some scraping theories.
• Decide the forum. Without diversity, the federal hook may be the CFAA alone. 28 U.S.C. § 1331; § 1367(c); Federal Jurisdiction and Removal Checklist: A Practical Checklist.
• Screen for retaliation and whistleblower issues. NRA Group remarked that the timing of the employer's suit looked preemptive or retaliatory. § 1833(b).

Phase 6: Letter, complaint, and emergency relief (claimant)

• Send the revocation and preservation letter before or with any block, and keep proof of delivery. Power Ventures. Note: Do not threaten criminal referral without checking your state's ethics rules. Use Drafting a Demand Letter: A Practical Checklist.
• Do not access the defendant's personal accounts. Van Alstyne; Brown Jordan International, Inc. v. Carmicle, 846 F.3d 1167 (11th Cir. 2017).
• Do not use a civil subpoena to obtain message content from a provider. 18 U.S.C. § 2702; Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004).
• Plead dated facts: the computer, the gate, the grant, the end of permission, the crossing, what was obtained or changed, knowledge, and loss by category. Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007); Ashcroft v. Iqbal, 556 U.S. 662 (2009); Fed. R. Civ. P. 8.
• Consider Rule 9(b) particularity for (a)(4) counts. Fed. R. Civ. P. 9(b).
• Include only subsections the facts support. Rule 11 applies. Fed. R. Civ. P. 11.
• Assess a TRO or preliminary injunction honestly. Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008); Fed. R. Civ. P. 65. Note: Perplexity vacated an injunction for weak merits and weak harm evidence. Is access continuing? Is the harm concrete? Have you delayed? See Preliminary Injunction and TRO Application Checklist: A Practical Checklist.
• Propose a narrow, enforceable order: no access, preservation, return, and neutral forensics.
• Calendar the two-year date and an internal date well ahead of it.

Red flag (claimant): Filing a seven-count complaint against a departing employee for emailing herself documents she could already open is what Van Buren and NRA Group warn against. Plead trade secret and contract, and leave § 1030 out unless facts support it.

Phase 7: Containment (accused)

• Stop all access, human and automated, immediately on any notice, and record when and how. Note: Under Power Ventures and Relation Insurance, a letter can end permission. Check scheduled jobs, integrations, and shared logins.
• Do not log in to check anything. Even a brief visit may be the only post-revocation access in the case.
• Do not evade a block with new addresses, proxies, or a friend's account. Power Ventures; Nosal II.
• Preserve devices, accounts, code, and logs. Do not wipe or reset. Fed. R. Civ. P. 37(e). Note: A hold covers personal accounts holding relevant data.
• Do not return devices wiped. Return through counsel, with a record, after considering imaging.
• Hire counsel before making any statement. The statute is criminal too, and prosecutions do arise from small disputes. Eddings.
• Assess conflicts between the individual and any new employer. See Competitor Hire Trade Secret Checklist: A Practical Checklist.
• Notify insurers. See D&O and Cyber Insurance Review Checklist.
• Respond in writing through counsel, confirming preservation and cessation, without narrative. See Responding to a Cease and Desist Letter: A Practical Guide.

Red flag (accused): If you are thinking "I will just delete what I took," stop. Return and certification negotiated by counsel are usually available, and deletion can become its own claim.

Phase 8: Evaluate the claim (accused)

• Make a privileged chronology of every access event, with account, permission, status of that permission, what was seen, and what was changed.
• Sort events into before and after any revocation. Eddings; Power Ventures.
• Identify the permission your role gave. A role that allowed the access is usually a complete answer. Van Buren.
• Ask who else was sharing logins or working around rules, and whether management knew. NRA Group.
• Identify the first date the plaintiff knew anything. Sewell.
• Assess whether the plaintiff can reach $5,000 of qualifying cost. Ask what it could have spent on the system itself.
• Look for the plaintiff's own overreach: reading your personal accounts, or misusing a subpoena. 18 U.S.C. § 2707; Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004).
• For security researchers, assemble the good-faith record. Justice Manual § 9-48.000 (May 2022) directs prosecutors to decline in good-faith research cases, but creates no rights and does not bind civil plaintiffs. Note: See Vulnerability Disclosure Program and Safe Harbor Checklist: A Practical Checklist and Reporting or Receiving a Security Vulnerability: A Practical Guide for Researchers and Companies.

Phase 9: Rule 12 sequence (accused)

• Raise jurisdiction and venue in the first motion or lose them. Fed. R. Civ. P. 12(b), (h)(1).
• Argue no gate crossed. Van Buren; Royal Truck; WEC; NRA Group; hiQ; Sandvig v. Barr, 451 F. Supp. 3d 73 (D.D.C. 2020).
• Argue no affirmative revocation if the theory is former employment. Eddings.
• Argue the wrong actor where software acted at a user's direction, or the vicarious allegations are thin. Perplexity; Afiniti.
• Argue insufficient loss. Conclusory amounts; no interruption of service; business harm; fees. Nexans; Andrews; Gottlieb; CoStar. Note: Address Moxie directly. In the Tenth Circuit it binds, so argue its business-harm limit; elsewhere, argue why the court should not follow it.
• Argue limitations from the face of the complaint. Sewell.
• Argue missing subsection elements: no damage from downloading (Fidlar); no intent to defraud; no "without authorization" for an insider under (a)(5)(B), (C).
• Argue lack of intent where the complaint itself shows belief in permission. Abu; NRA Group.
• Address state claims separately, and request dismissal under 28 U.S.C. § 1367(c)(3) if appropriate. Royal Truck.
• Decide on a Rule 11 letter or a fee position. Fed. R. Civ. P. 11; Hay; 18 U.S.C. § 1836(b)(3)(D). Note: General practice points are in Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants.

Phase 10: Emergency motion response (accused)

• Offer a stipulated preservation and no-access order early.
• File a factual declaration on access dates and current state, weighing Fifth Amendment consequences first.
• Contest irreparable harm with delay, money damages, and cessation. Perplexity.
• Request security under Fed. R. Civ. P. 65(c), with evidence.
• Negotiate any forensic protocol: neutral examiner, search method, privilege screen, private data carve-outs, and deletion after review. See Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols.

Phase 11: Summary judgment and trial (both sides)

• Claimant: confirm admissible proof for each element and each loss category, with a sponsoring witness. Fed. R. Civ. P. 56; Fed. R. Evid. 901.
• Accused: move on loss, category by category. Who paid? Was it caused by this defendant? Was it a response to a violation? Is any evidence missing for part of the year? Ryanair.
• Accused: move on authorization and intent. Abu and NRA Group were both resolved at summary judgment.
• Both: propose a jury instruction on loss. The Ryanair instruction distinguishes costs directed at technological harm from business harm. Moxie gives comparable language.
• Both: propose instructions on authorization and knowledge. United States v. Eddings, 161 F.4th 199 (3d Cir. 2025) leaves to the jury whether a step taken by an employer was enough.
• Accused: put every ground in the Rule 50(a) motion. Fed. R. Civ. P. 50. In Ryanair, the plaintiff objected that an argument missing from the Rule 50(a) motion could not be raised afterward.
• Both: check the appellate docket before arguing. Ryanair went to the Third Circuit (No. 25-1374), and I could not confirm a decision when this was written. In Perplexity, the Ninth Circuit denied rehearing en banc on September 10, 2026, and the case returned to the district court; check for any certiorari petition.

Red flag (both sides): Do not assume a win on § 1030 ends the case. hiQ told scraping targets that other causes of action might lie, and Carfax shows a state count surviving the federal dismissal.

This checklist is general information and not legal advice for a specific situation.

Related Documents

Related Articles

• The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement: the doctrine and case law behind each item.
• Hiring From a Competitor: Inevitable Disclosure, Employee Raiding, and the New Employer's Trade Secret Exposure: exposure for a new employer named with the departing employee.

Related Guides

• Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide: the same process in narrative form, with sample language.
• Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal: forum choices when the federal count is at risk.

Related Checklists

• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: preventive steps at departure that also supply revocation evidence.
• Trade Secret Cybersecurity Incident Response Checklist: A Practical Checklist: incident response when trade secrets may be involved.
• Competitor Hire Trade Secret Checklist: A Practical Checklist: the receiving employer's tasks.
• Federal Jurisdiction and Removal Checklist: A Practical Checklist: subject matter and removal tasks.

Related Toolkits

• Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines: the letters, worksheets, and outlines these boxes call for.
• Data Breach and Incident Response Toolkit: From Detection to Notification: forms for when an access event is also a reportable breach.