The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement

In January 2021, a compliance manager at a Pennsylvania debt collector was home sick with COVID when a state licensing deadline landed on her. The fine was $250. The chief executive wanted it paid that day and, by his own email, had no intention of learning the licensing system himself. She could not remember her password, but she kept all her passwords in a spreadsheet, so she called a friend at the office, gave her the login, and asked her to look it up. The next day the friend emailed her the file. Its name, the Third Circuit noted, "[t]o the dismay of IT professionals everywhere," was "My Passwords.xlsx."

Her employer later sued both women under the federal anti-hacking statute, and at oral argument its lawyer leaned hard on the emoji in the email's subject line as proof of an intent to deceive. The court's opinion in NRA Group, LLC v. Durenleau, 154 F.4th 153 (3d Cir. 2025) opens with a sentence worth framing: "In the wrong hands, the law becomes a hammer in search of a nail."

That is the Computer Fraud and Abuse Act (CFAA) in one lawsuit. Congress wrote it to stop people from breaking into computers. Because every internet-connected device is now a "protected computer," and because the statute carries a private right of action, it became a tempting add-on to every departure dispute, competitor fight, and scraping complaint. The Supreme Court cut much of that away in 2021. What remains is narrower, more technical, and in several places still contested.

The short answer

• Purpose no longer matters; position does. After Van Buren v. United States, 593 U.S. 374 (2021), a person "exceeds authorized access" only by getting into a part of a system that is off limits to that person. Doing something disloyal with data you were allowed to reach is not a CFAA violation, however ugly the motive.
• Employers lost the easy claim and kept the hard one. The employee who downloads the customer list on her last day, using her own login, is usually outside the statute. The former employee who logs in after the company ended her permission, or who borrows a coworker's password after being locked out, is usually inside it.
• You revoke authorization by doing something. The Third Circuit held in United States v. Eddings, 161 F.4th 199 (3d Cir. 2025) that a resignation alone does not end authorization absent a contract or policy saying so, and also that the employer need not change the locks. An email can do it. Silence cannot.
• Public web pages are probably not gated at all, at least in the Ninth Circuit. hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022) says so at the preliminary-injunction stage. Log-in walls change the analysis, and a targeted cease-and-desist letter plus continued access behind a log-in is liability under Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016).
• The question the Court expressly reserved is still open. Footnote 8 of Van Buren left unresolved whether a gate can be made of contract or policy rather than code. Courts have not converged.
• A civil plaintiff also has to prove loss, and there is now a split on what that means. Several courts read Van Buren to require technological harm. The Tenth Circuit in Moxie Pest Control (Utah), LLC v. Nielsen, 164 F.4th 1195 (10th Cir. 2026) called that passage dicta and held that reasonably necessary investigative costs count. A verdict can still die on the arithmetic, as Ryanair learned in 2025.
• The clock is short. Civil claims must be filed within two years of the act or of discovering the damage, and the discovery of the damage, not of who did it, starts that clock.

A statute built for WarGames that now covers your toaster

Congress enacted the first federal computer-crime statute in 1984 and passed the CFAA two years later. Van Buren tells the origin story briefly: hackers made headlines, and traditional theft and trespass statutes fit badly because a computer intrusion often does not deprive the owner of anything in the traditional sense. The original statute protected a short list of machines, those holding national security information or financial data and those run by or for the government. As the Ninth Circuit observed in hiQ, none of those were open to the public, and legislative reports of the period compared the offense to breaking and entering.

The first famous prosecution involved a graduate student's worm. In United States v. Morris, 928 F.2d 504 (2d Cir. 1991), the Second Circuit upheld the conviction of the author of a program that spread across the early internet and crippled machines, holding that the government did not need to prove he intended the damage, only the unauthorized access. The word "authorization," the court thought, needed no special definition.

Then the statute grew and the world grew faster. In 1996 Congress extended § 1030(a)(2)(C) to information from any "protected computer," and later amendments dropped the interstate-communication qualifier. The definition now reaches any computer "used in or affecting interstate or foreign commerce or communication." 18 U.S.C. § 1030(e)(2)(B). The Supreme Court's own gloss is that the prohibition applies, at a minimum, to all information from all computers that connect to the internet. Your phone qualifies. So does a server hosting a public web page, and so, presumably, does an internet-connected refrigerator.

A criminal statute with that reach and an undefined core term ("authorization") was bound to produce trouble, and the private right of action added in 1994 meant the trouble would mostly arrive through civil complaints. Because the same words govern both settings, every civil plaintiff's aggressive reading is also a proposed expansion of federal criminal law. Courts have repeatedly said so, and that fact drives much of the case law below. See WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199 (4th Cir. 2012) and Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444 (9th Cir. Aug. 4, 2026) (applying the rule of lenity, the canon that resolves true ambiguity in a penal statute against liability, in civil cases).

How § 1030 is built

Lawyers talk about "the CFAA" as if it were one offense. It is seven, plus attempt and conspiracy, and the ones that matter in civil litigation have different elements. A complaint that pleads them all without thinking usually loses several.

Three features of that table reward attention.

First, § 1030(a)(5)(A) has no access element, so a current employee with every permission in the world can still violate it. United States v. Thomas, 877 F.3d 591 (5th Cir. 2017) involved an IT operations manager who, angry that a coworker had been fired, spent a weekend deleting more than 600 files, disabling backups, and setting a time bomb on remote access, costing the company over $130,000. His permission to manage the systems was no defense, because the statute asks whether the damage was authorized. And Pulte Homes, Inc. v. Laborers' International Union of North America, 648 F.3d 295 (6th Cir. 2011) reinstated a transmission claim against a union whose members flooded a builder's phones and email in a corporate campaign, even though the same opinion held that the public could contact the company, so the access-based claims failed. Floods can be "damage." Simply downloading records is not, as Fidlar held.

Second, § 1030(a)(5)(B) and (C) reach only access "without authorization," not excess access. An insider who goes somewhere he should not and breaks something is a different problem from an outsider who does.

Third, § 1030(a)(7) is underused. In SkyHop Technologies, Inc. v. Narra, 58 F.4th 1211 (11th Cir. 2023), a software developer's emails saying it would hand over a client's source code and passwords only on payment of $1.1 million plausibly stated a claim under § 1030(a)(7)(A), which in turn supported personal jurisdiction over the developer in Florida. Anyone who has watched a vendor dispute turn into a hostage negotiation should read it.

The term "damage" means "any impairment to the integrity or availability of data, a program, a system, or information." § 1030(e)(8). "Loss" is separately defined and discussed below. They are different things, and the distinction decides cases.

Before Van Buren: two theories of authorization

The statute defines "exceeds authorized access" as accessing a computer with authorization and using that access "to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." § 1030(e)(6). It does not define "without authorization." Into that gap walked two rival theories.

The broad camp saw authorization as something that could evaporate because of what you were doing. Judge Posner's opinion in International Airport Centers, L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006) is the purest version. An employee decided to go into business for himself, then ran a secure-erasure program on his company laptop before returning it. The court reasoned that his breach of the duty of loyalty ended his agency relationship and with it his authority to use the laptop. The difference between the two statutory phrases, Posner remarked, "is paper thin." United States v. John, 597 F.3d 263 (5th Cir. 2010) held that a Citigroup employee who pulled customer data for a fraud scheme exceeded her access. United States v. Rodriguez, 628 F.3d 1258 (11th Cir. 2010) reached the same result for a Social Security Administration employee who looked up women he was interested in. EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001) treated a confidentiality agreement as a possible limit on access in a case about a scraper that ran 30,000 queries against a competitor's site.

The narrow camp saw authorization as a question of what the owner had given you, full stop. LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009) held that an employee who emailed documents to himself while still employed did not act without authorization, because the employer had not rescinded permission. Sitting en banc, the Ninth Circuit in United States v. Nosal, 676 F.3d 854 (9th Cir. 2012) (en banc) then held that "exceeds authorized access" reaches "restrictions on access to information, and not restrictions on its use." Chief Judge Kozinski's opinion is the funniest serious opinion in this field. "Minds have wandered since the beginning of time," he wrote, warning that under the government's reading, sudoku fans might get "more than enough time to hone their sudoku skills behind bars." The dissent had a real point too: the case, it said, had "nothing to do with playing sudoku," and everything to do with stealing an employer's data for a competing business.

The Fourth Circuit joined the narrow view in WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199 (4th Cir. 2012) (employee downloaded proprietary files before resigning and pitched a customer for a competitor; no CFAA claim). The Second Circuit did so on lenity grounds in United States v. Valle, 807 F.3d 508 (2d Cir. 2015), reversing the conviction of an NYPD officer who searched restricted databases with no law enforcement purpose. The Sixth Circuit added Royal Truck & Trailer Sales & Service, Inc. v. Kraft, 974 F.3d 756 (6th Cir. 2020), where two salespeople forwarded quotes and pay records to personal email and wiped their company devices. The conduct might violate company policy, state law, or another federal statute, the court said, but the company conceded they were authorized to reach the information. That was the end of the CFAA claim.

Van Buren, read closely

The facts were not sympathetic. Nathan Van Buren, a Georgia police sergeant, asked an acquaintance for a loan. The acquaintance recorded the request and took it to the authorities, and the FBI built a sting. For around $5,000, Van Buren ran a license plate through a state law enforcement database, using his patrol-car computer and his valid credentials, for a man who said he wanted to be sure a woman he met at a strip club was not an undercover officer. Department policy limited the database to law enforcement purposes, and Van Buren knew it. A jury convicted, and he got 18 months.

Justice Barrett, writing for six Justices, reversed. The holding fits in a sentence: an individual exceeds authorized access "when he accesses a computer with authorization but then obtains information located in particular areas of the computer," such as "files, folders, or databases," that "are off limits to him." 593 U.S. at 396. Four parts of the reasoning matter for later cases.

The word "so." The whole textual fight concerned a two-letter word in "not entitled so to obtain." The government said "so" pulled in any limit on the circumstances of obtaining the information, stated anywhere: a statute, a private agreement, a policy. The Court said "so" refers back to what the definition had just stated, obtaining information by using a computer one is authorized to access. If the information sits in "Folder Y," which you can reach, your purpose is irrelevant. If it sits in "Folder X," which you cannot, you are liable. And the word does some work against defendants as well: someone who hacks an electronic personnel file cannot defend by saying he could have walked down the hall and asked HR for a paper copy.

The structure, and the gates. Here is the sentence every later opinion quotes. Liability under both clauses "stems from a gates-up-or-down inquiry," under which "one either can or cannot access a computer system, and one either can or cannot access certain areas within the system." 593 U.S. at 390. "Without authorization" protects computers from outside hackers; "exceeds authorized access" protects areas within them from inside hackers. The government's reading made one clause a gate and the other a circumstance, without any reason why the statute would forbid accessing information for a bad purpose but not the computer itself.

The civil remedies as a structural clue. This is the passage now causing a circuit split. The Court observed that "damage" and "loss" "focus on technological harms," giving "the corruption of files" as its example, and that this makes sense for a scheme aimed at "the typical consequences of hacking" but is "ill fitted" to remedying misuse of information by employees who may permissibly reach it. Van Buren's license-plate search had not impaired the data or harmed the database.

The consequences. The Court disclaimed reliance on lenity but said the fallout was "extra icing on a cake already frosted." The government's reading "would attach criminal penalties to a breathtaking amount of commonplace computer activity," from a personal email at work to "embellishing an online-dating profile." It would also make liability turn on whether an employer happened to phrase a rule as a limit on access or on use.

Justice Thomas, joined by the Chief Justice and Justice Alito, dissented with a property analogy that is still the best statement of the other side: a valet may take your car to park it but not for a joyride. Whatever you think of the analogy, it explains why this area keeps generating plaintiffs. People feel the wrong. The majority's answer is that the feeling should go to a different cause of action.

Note what Van Buren did not hold. It did not construe "without authorization" directly. It did not resolve what a gate is made of. And the loss passage came in service of an argument about the meaning of "exceeds authorized access," in a criminal case with no civil plaintiff before the Court.

Footnote 8: what is a gate made of?

The most consequential sentence in Van Buren is a footnote: "For present purposes, we need not address whether this inquiry turns only on technological (or 'code-based') limitations on access, or instead also looks to limits contained in contracts or policies." The footnote cites Professor Orin Kerr's amicus brief urging the code-based answer. His article, Norms of Computer Trespass, 116 Colum. L. Rev. 1143 (2016), argues that authorization rests on shared norms about uninvited entry, and that an authentication requirement divides open space from closed space on the web. Patricia Bellia's article, A Code-Based Approach to Unauthorized Access Under the Computer Fraud and Abuse Act, 84 Geo. Wash. L. Rev. 1442 (2016), which the Court cites in footnote 9 for the point that the password-trafficking provision contemplates authentication, is the other standard reference.

Footnote 9 points toward code without saying so. Section 1030(a)(6) bars trafficking in passwords "through which a computer may be accessed without authorization," which suggests that authorization turns on whether credentials let you past the gate. But the Court stopped there, and the appellate courts since have taken noticeably different routes.

The Sixth Circuit: many sources, and intent as the filter. Abu v. Dickson, 107 F.4th 508 (6th Cir. 2024) is the most careful post-Van Buren opinion on the question. An IT administrator, "the consummate computer insider," searched the mailboxes of a business that had been sold, using his administrator credentials, to preserve emails for litigation. Chief Judge Sutton called code-based permission one clear source of authorization, then said "sanction or permission" can also come from agency principles, employer policies, and contracts, citing Kerr's treatise on code, contract, and norms. The court declined to choose, because the case could be decided on a word most litigants ignore. "Intentionally" modifies "exceeds." So an insider must "purposefully access an area of a computer and know that it is forbidden." No evidence showed the administrator knew. The same analysis disposed of the Stored Communications Act claim.

The Third Circuit: no code, no claim, at least for current employees. NRA Group announced that, "absent evidence of code-based hacking, the CFAA does not countenance claims premised on a breach of workplace computer-use policies by current employees." The gates were up, the court wrote, even if the road signs told the women to stop and turn around. The employer's firewall and VPN argument failed too: the employee could reach her machine, and policy, not code, was what barred her from doing so from home. A footnote adds an intent backstop much like Abu's.

But the same court, two months later, refused to require code for revocation. Eddings holds that an employer can end authorization without cutting off technical access: the charity "did not have to lock her out." Access and authorization are distinct, the court explained: you can have one without the other, as anyone who has let a work password lapse knows. And Eddings pointedly reserves whether a contract or an adequately noticed manual could tie authorization to employment. So in the Third Circuit a current employee's policy violation is not enough, while a former worker can lose authorization through words alone. Those positions fit together if you think of code and contract as different questions: code matters for what the insider can reach, and a clear communication matters for whether the permission still exists.

The Ninth Circuit: gates need a baseline. hiQ reads Van Buren to mean that a user with authorization is free of limits "whether those limitations are 'code-based' or 'contained in contracts or policies,'" while requiring a generally applicable permission requirement before the concept applies at all. Power Ventures treats a written, individualized revocation as effective, and also says a terms-of-use violation alone is not. So a contract cannot raise a gate where none exists, but a targeted letter can close one that does.

North Carolina: a rule might be enough. In Rel. Ins., Inc. v. Pilot Risk Mgmt. Consulting, LLC, No. 68A25 (N.C. May 22, 2026), the state supreme court, applying the federal statute, found a triable issue where a chief operating officer testified that producers "didn't have access to" a database because "That's just a Relation rule." If the rule existed, the court said, pulling the lists from that database would exceed authorized access. It is hard to square that with a strict code-based approach, and the court did not try. State courts have concurrent jurisdiction here, and a state high court's reading of a federal criminal statute may not be the last word.

The Justice Department: code or configuration. The Department's charging policy, Justice Manual § 9-48.000 (updated May 2022), instructs prosecutors that "exceeds authorized access" requires a computer divided into areas through "computer code or configuration," not contracts, terms of service, or employee policies. It binds only prosecutors and gives no one enforceable rights. It is also useful evidence in a brief about how the government itself now reads the statute.

For a practitioner, the honest summary is this. Code-based barriers always count. Contract and policy alone are weak and getting weaker for insiders. On a system that requires permission, an individualized communication ending that permission has worked in every appellate court to reach the question. A plaintiff relying on anything softer should expect a fight.

Insiders and departures after Van Buren

Most civil CFAA suits grow out of someone leaving a job. The modern rules, assembled from several circuits, look like this.

Still employed, own login, own permissions. No claim, whatever the motive. Van Buren, Royal Truck, WEC, and NRA Group all point the same direction. Trade secret law and the employment contract do the work. For the employer's better tools, see Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide.

Still employed, reaching somewhere the permissions do not allow. This is the true inside hacker, and it remains a violation. Think of the sales rep who finds the HR share through a misconfigured group, or the engineer who uses a colleague's admin token to open a repository his own role cannot see. Mind the intent requirement: Abu requires knowledge that the area is forbidden.

Fired. The Sixth Circuit's United States v. Shahulhameed, 629 F. App'x 685 (6th Cir. 2015) held that a contractor who launched an attack from a still-working account was without authorization once he had been told, by phone and midnight email, that he was fired and should not return. The Third Circuit reserved this question in Eddings but contrasted resignation, the employee's act, with termination, the employer's.

Resigned, and nobody did anything. This is Eddings. A short-lived hire at a cancer charity had a link on her home computer to a board member's email. She quit, then kept reading and downloading, and a friend threatened to release the documents unless the charity paid. The government's theory was that resignation alone ended authorization. The panel majority vacated the friend's conviction. "Proving she resigned was not enough." The employer "must perform some affirmative act," though "[i]t might take nothing more than an email." A dissent would have let the jury infer that the end of employment ended the permission, relying in part on the state-of-mind requirement to protect the innocent. The panel distinguished United States v. Steele, 595 F. App'x 208 (4th Cir. 2014), a Fourth Circuit unpublished decision where the company had collected the laptop and cut off main system access.

After a cease-and-desist letter. Power Ventures says a written revocation works. Relation Insurance applied that to a departed producer: a letter telling her not to use company property or data was enough to make her later log-in to a carrier portal, which set off security alerts, "without authorization."

Locked out, then back in through a friend. This is United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016). After Korn/Ferry revoked their credentials, former employees persuaded an assistant who had stayed to let them use hers to pull data from a proprietary database. "Unequivocal revocation of computer access closes both the front door and the back door." The conviction under § 1030(a)(4) stood over a dissent worried about criminalizing ordinary password sharing, which the majority answered by saying "[t]his appeal is not about password sharing" and pointing to the revocation and the intent to defraud. (The restitution part of Nosal II was later overruled in Lagos v. United States, 584 U.S. 577 (2018).)

Bought or bribed credentials. In Moxie, a rival's sales president gave a former employee $2,000 and a pair of Nike sneakers to join the plaintiff, get access to its sales system, and hand over the login. The defendants did not even dispute the violation at the pleading stage. The Tenth Circuit said flatly that using a pilfered username and password to reach confidential data is unauthorized access. The same goes for consent procured by deception: Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004) compared a defendant who used a patently unlawful subpoena to get a provider's cooperation to "the busybody who gets permission to come inside by posing as a meter reader."

Worked example: the rep who kept her login

Suppose Dana is a regional sales rep for Harbor Lane Dental Supply, a hypothetical distributor. On her last Friday she exports the full customer list from the CRM (customer relationship management system), which her role allows, and sends it to her personal Gmail. She resigns Monday by email. IT, as IT does, deactivates her account three weeks later. During those three weeks she logs in twice to check a commission report and once to export an updated price list for her new employer.

The Friday export is outside the CFAA under Van Buren and Royal Truck. The company should think about its confidentiality agreement and the Defend Trade Secrets Act.

The log-ins are the interesting part. In the Third Circuit, under Eddings, the question is what Harbor Lane did after Monday. If its offer letter says access ends with employment, or its acknowledged handbook says so, it has an argument the court expressly left open. If HR replied to the resignation with "please stop using company systems," authorization ended with that email. If nobody said anything, the claim is weak, and the commission check looks particularly bad as a federal offense. In a Ninth Circuit court, Harbor Lane would cite Brekka's dictum about access after leaving, and Dana would cite Eddings' careful explanation of why that language was not a holding.

Harbor Lane's cheapest fix would have cost one sentence, sent on Monday.

Scrapers, public pages, and the limits of a letter

The firm has a full treatment of scraping across copyright, contract, and computer fraud in Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims, so this section stays on the CFAA mechanics.

hiQ's core move was to sort computers into three kinds: those open to the general public, those requiring authorization that has been given, and those requiring authorization that has not. Public LinkedIn profiles were in the first bin, so "that computer has erected no gates to lift or lower in the first place." A violation occurs "when a person circumvents a computer's generally applicable rules regarding access permissions, such as username and password requirements." The court drew support from the "breaking and entering" language in the legislative history, from Congress's parallel treatment of restricted websites in the Stored Communications Act (see Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002)), and from lenity.

Read the opinion for what it is. It affirmed a preliminary injunction on the ground that hiQ had raised "serious questions," which the Ninth Circuit's sliding scale allows, and said what "appears" and "is likely." A public-facing server can also have private areas, and accessing those without authorization still violates the statute. And the court went out of its way to tell scraping targets they were not helpless: trespass to chattels, copyright, misappropriation, unjust enrichment, breach of contract, and privacy claims "may also lie."

Other courts have not all gone along. Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178 (N.D. Cal. 2013), decided before hiQ, held that a public site's owner could revoke a particular user's authorization by cease-and-desist letter and IP block, reasoning that Congress used "nonpublic" in § 1030(a)(3) and not in (a)(2)(C). hiQ rejected the same textual argument. Ticketmaster L.L.C. v. Prestige Entertainment West, Inc., 315 F. Supp. 3d 1147 (C.D. Cal. 2018), also pre-hiQ, sustained a claim based on the violation of a cease-and-desist letter against ticket-buying bots. Outside the Ninth Circuit, those arguments remain available. In Ryanair DAC v. Booking Holdings Inc., 636 F. Supp. 3d 490 (D. Del. 2022), a Delaware court allowed a claim to proceed where booking required an account and login, and the plaintiff alleged anti-bot technology, including a program called Shield, was being circumvented; it also accepted a vicarious theory where specific third parties were named. The case went to trial, as discussed below.

Power Ventures marks the other pole. Power, a social network aggregator, collected Facebook users' data with their permission and sent promotional messages through Facebook. The court announced two rules: a defendant can violate the statute when permission is absent or has been explicitly revoked, and once it has, "technological gamesmanship or the enlisting of a third party to aid in access will not excuse liability"; and a terms-of-use violation without more is not enough. Before the December 1, 2008 letter, user consent gave Power at least arguable permission. After it, Power needed both the users' and Facebook's permission, as someone with a key to a friend's safe deposit box still needs the bank to let him in the building. Liability ran only from the letter forward, and on remand the district court entered $79,640.50 in compensatory damages and a permanent injunction.

Two limits in Power Ventures get overlooked. The court called an individualized letter "a far cry from the permission skirmishes that ordinary Internet users may face." And it wrote, in a footnote, that "[s]imply bypassing an IP address, without more, would not constitute unauthorized use," because a blocked user gets no notice and might blame a roommate. The gate needs a message attached. Contract theories proceed on their own track, which is why Meta Platforms, Inc. v. Bright Data Ltd., No. 23-cv-00077 (N.D. Cal. Jan. 23, 2024), and X Corp. v. Bright Data Ltd., No. 3:23-cv-03698 (N.D. Cal. May 9, 2024) turned on the scope of the terms and preemption rather than § 1030, and why a platform losing the CFAA argument should read Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration.

What a gate looks like at the system level

Courts tend to write about "gates" as if they were physical. Engineers know a request is just bytes arriving at a server that decides how to respond. It helps to look at each control at that level, because the same word can describe several very different mechanisms. The right-hand column is my assessment, based on the cases cited and their logic; no appellate court has worked through this list.

Either side can sort most disputes by asking three questions in order. Was access generally restricted? Did this person or bot have permission, from someone able to give it? If that permission ended, how and when did the person learn?

Worked example: three phases of a rate-shopping bot

Suppose Fernhill Rates, a hypothetical comparison startup, collects insurance quotes from Quillpath, a hypothetical carrier.

Phase one. Fernhill's crawler fetches Quillpath's public rate pages, ignoring a robots.txt that disallows them. In the Ninth Circuit this is category one under hiQ: no gate, so no CFAA claim, though Quillpath may have contract or tort theories. Elsewhere, Fernhill should expect 3Taps-style arguments if Quillpath sends a letter.

Phase two. Detailed quotes require a free account. Fernhill creates twenty accounts with invented names. Now there is a login, so hiQ's public-site reasoning stops helping. But each account was issued by Quillpath's own automated process, so Fernhill argues the gate went up for it, and that a false name is a terms violation, which Van Buren warns should not be a crime. Theofel's meter reader and the fake-profile facts in the district court's later contract rulings in the hiQ litigation are what Quillpath will reach for. This is the contested middle, and I would not advise relying on either answer.

Phase three. Quillpath sends a letter by name, closes the accounts, and blocks Fernhill's addresses. Fernhill opens new accounts through residential proxies. That is Power Ventures, and liability from the date of the letter is a realistic outcome.

The same crawler, and the same data, can land in three different legal positions.

AI agents and the question of who "accessed"

Most of the case law asks whether a person was authorized. Perplexity asks an earlier question: who did the accessing?

Perplexity makes Comet, a browser with an optional AI agent called the Assistant. A user can tell it to shop on Amazon. The browser, running on the user's machine, fetches pages from Amazon. The Assistant takes screenshots and sends them to Perplexity's servers, which send back instructions on how to navigate. Amazon told Perplexity its agents were not welcome, wanted a user-agent string that would let it block them, and when it did not get one, sued. The district court found strong evidence of unauthorized access to password-protected accounts, and "essentially undisputed" loss above $5,000, chiefly engineering hours spent detecting and blocking Comet. It granted a preliminary injunction.

The Ninth Circuit vacated. Starting from Van Buren's definition of access as entering a computer system, the court reasoned that the statute punishes "[w]hoever" accesses, and that the Assistant, however advanced, "is a tool, not a person for statutory purposes." The real question was therefore whether Perplexity used a tool to gain entry. On this record it had not, because its servers never communicated directly with Amazon's. "It is the user who 'accesses' Amazon's computers." The court distinguished Power Ventures as a case that had assumed access without analyzing it. Lenity reinforced the result, and the panel noted that Amazon's theory could turn ordinary users into conspirators. California's statute, though worded more broadly, fell the same way, because it too looks to the person accessing or causing access.

Now the fine print, which the court spelled out at unusual length. It reserved whether Perplexity might gain entry "on a different record or new facts" by exercising more control. It said "[w]e do not establish a new legal regime governing agentic AI," and that it was not addressing tort liability. It did not reach authorization or the scope of "loss." It said Amazon can still regulate access through terms of service. The court did not say so, but on its reasoning an agent running from the vendor's own cloud servers, logging in with stored user credentials, would present very different facts: there the vendor's machine would be the one talking to the plaintiff's. The Ninth Circuit denied rehearing en banc on September 10, 2026; check for a certiorari petition and for what happens on remand before relying on the opinion.

Those architecture details are now legal facts. A developer who moves agent execution from the client to the cloud has changed the CFAA analysis.

The civil claim: what § 1030(g) actually requires

"Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief." 18 U.S.C. § 1030(g). The sentence that follows limits it: the conduct must involve one of five factors in § 1030(c)(4)(A)(i), namely (I) loss to one or more persons during any one-year period aggregating at least $5,000; (II) modification or impairment of medical care; (III) physical injury; (IV) a threat to public health or safety; or (V) damage to a government computer used in the administration of justice, national defense, or national security. Almost everyone relies on (I). The sixth factor, damage to ten or more computers, is notably left out of the civil provision.

A few consequences follow from the text. Damages for a claim resting only on factor (I) "are limited to economic damages." There is no fee-shifting; as Infotek Corp. v. Preston, No. 1:18-cv-01386 (D. Md. Sept. 23, 2026) recently put it, the statute "does not provide for fee-shifting in litigation." No action lies "for the negligent design or manufacture of computer hardware, computer software, or firmware," which keeps ordinary software defect suits out. And a plaintiff needs a violation of a subsection (a) offense on top of the factor, so you must still identify which one, with its mental state.

Whether civil liability extends to attempt and conspiracy under § 1030(b) divides district courts, and the jury in the Ryanair trial rejected the conspiracy count on the facts. Vicarious liability gets more traction: Abu treated an agent's completed offense as attributable to the principal, and Ryanair accepted such a theory where the plaintiff named specific third parties. Bare allegations fail. Afiniti, Ltd. v. Chishti, No. 23-0303 (D.D.C. Aug. 11, 2026) dismissed a theory that a defendant had directed unnamed persons to access unspecified systems at unknown times.

Pleading follows Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) and Ashcroft v. Iqbal, 556 U.S. 662 (2009) in the usual way, and some courts apply Rule 9(b) to § 1030(a)(4) fraud allegations, though the statute's "intent to defraud" has been read by others in a less demanding way. The article on Drafting a Complaint That Survives a Motion to Dismiss covers the general technique, and the companion Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide applies it here.

Loss after Van Buren: the split

"Loss" means "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." § 1030(e)(11).

What was settled before 2021

The definition has two halves. The first covers direct response costs and needs no outage. The second covers consequential harm, but only if it flows from an interruption of service. Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 774 F.3d 1065 (6th Cir. 2014) (a witness's 200 to 300 hours investigating false bids qualified) and Brown Jordan International, Inc. v. Carmicle, 846 F.3d 1167 (11th Cir. 2017) (paying a consultant to determine how an executive had accessed email) say so, and A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (4th Cir. 2009) held that the definition "plainly contemplates" costs of responding, "including the investigation of an offense." On the other side of the line, Nexans Wires S.A. v. Sark-USA, Inc., 166 F. App'x 559 (2d Cir. 2006) rejected a claim for $10 million in lost profits from misappropriated data where no service had been interrupted, and Andrews v. Sirius XM Radio Inc., 932 F.3d 1253 (9th Cir. 2019) said the definition's focus is on "harms caused by computer intrusions, not general injuries unrelated to the hacking itself." Employee time counts: Power Ventures accepted that Facebook employees spent many hours, worth more than $5,000, analyzing and responding.

The technological-harm reading

After Van Buren, many courts took the "focus on technological harms" passage as a rule of decision. hiQ said in a footnote that the civil provision requires such a showing. Better Holdco, Inc. v. Beeline Loans, Inc., No. 20-cv-08686 (S.D.N.Y. July 26, 2021) and William Gottlieb Management Co. v. Carlin, No. 20-cv-08907 (S.D.N.Y. Mar. 26, 2024) in the Southern District of New York held that plaintiffs must tie their response costs to damage or impairment; in Gottlieb, an investigation that merely confirmed what the company already knew, that a fired employee was still in its Dropbox, was not enough. CoStar Group, Inc. v. Leon Capital Group, LLC, No. 21-2227 (D.D.C. Aug. 10, 2023) is the most dramatic: the court, having earlier sustained the claim, "belatedly" agreed that a database provider's costs did not qualify, holding that the plaintiff needed either an interruption of service or resources spent responding to technological harm. X Corp. v. Center for Countering Digital Hate, Inc., 724 F. Supp. 3d 948 (N.D. Cal. 2024), went the same way, according to the Tenth Circuit's description of it.

Moxie and the other reading

In January 2026, Moxie became the first published circuit opinion I have found that squarely rejects that view. The district court had dismissed because the investigation identified no harm to data or systems. The Tenth Circuit reversed: "the CFAA does not require plaintiffs to plead loss from a technological harm." Its reasoning has three parts. The Van Buren passage is dicta, used to show that certain conduct is not a violation, and says nothing about what is recoverable once a violation exists. Even on its own terms, the passage says loss "relates to" costs caused by harm to data or systems, a phrase broad enough to reach an investigation. And the structure supports that result, since only a few of the many ways to violate the statute require actual damage to a computer, which the court thought made it unsurprising that other circuits had counted the cost of responding.

The opinion also sets a limit that matters as much as the holding. Costs "reasonably necessary to respond" to an offense, such as "identifying the perpetrator or the method by which the offender accessed the protected information," qualify. Expenses related to business harms, "such as the costs of investigating how a competitor used protected information," do not. That line traces through a 2024 Ryanair ruling to the district court's remand decision in Nosal, and the Ryanair jury instruction used a similar formulation. It is probably the most useful sentence in this area. It asks what the investigator was looking at: the system, or the marketplace?

The Ninth Circuit could revisit its footnote, but in Perplexity it expressly declined to reach the scope of loss. So as of this writing, the Tenth Circuit stands with the pre-2021 decisions of the Fourth, Sixth, and Eleventh, while the footnote in hiQ and a substantial group of district courts stand on the other side. A court in an undecided circuit could go either way, and the safe course is to build a loss record that would satisfy both.

Ryanair: losing at the calculator

Pleading is the easy part. In Ryanair DAC v. Booking.com B.V., No. 20-1191-WCB (D. Del. Jan. 22, 2025), a jury found that Booking.com had violated § 1030(a)(4) and (a)(5) by reaching the logged-in part of Ryanair's site, directly or through a vendor, and awarded $5,000. Judge Bryson, a Federal Circuit judge sitting by designation, granted judgment as a matter of law because the loss evidence collapsed category by category.

Ryanair claimed about $177,000 and proved less than half of what it needed. The attribution method also deserves attention: because the claim concerned one defendant, the plaintiff allocated by that defendant's share of third-party bookings (2.8 percent), and the court required the loss to be "attributable to Booking.com." Ryanair has appealed to the Third Circuit (No. 25-1374), and the judge deferred ruling on a conditional new trial. I could not confirm a decision as of this document's date, so check the docket.

Infotek makes a similar point about timing. A federal court in Maryland, applying the Fourth Circuit's iParadigms rule and citing Moxie for the "reasonably necessary" limit, held in September 2026 that payments after the company had forensically confirmed who was responsible could not be recovered as response costs, that litigation fees are not loss even when a defendant's perjury drove them up, that invoices predating the intrusion had no nexus to it, and that moving to a more secure platform did not count without evidence the intrusion necessitated it. The court cited an earlier case asking why a simple password change would not have been enough.

The $5,000 is measured differently than many defendants hope. Creative Computing v. Getloaded.com LLC, 386 F.3d 930 (9th Cir. 2004) rejected the argument that each intrusion must separately cause $5,000: "the $5,000 floor applies to how much damage or loss there is to the victim over a one-year period, not from a particular intrusion." The statute also says loss can run "to 1 or more persons."

Worked example: adding up an incident

Suppose Larkspur Logistics, a hypothetical carrier, discovers that a departed dispatcher's still-active login was used to export driver files after HR emailed him that his access had ended. It totals its costs.

The first three lines total $6,060, enough in a Moxie jurisdiction. In a strict technological-harm court, the restoration item plainly qualifies, while the investigation depends on framing. The lesson is to scope the engagement letter around the system from day one and to keep the invoices separate. The toolkit Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines has a worksheet built for this.

Two years, and the clock starts sooner than you think

"No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage." § 1030(g). In Sewell v. Bernardin, 795 F.3d 337 (2d Cir. 2015), a woman found she could not log in to her AOL account in August 2011. She learned later who she thought was responsible and sued in January 2014. The AOL claim was late. It did not matter that she had not known "exactly what happened or why she could not log in." The clock runs from discovery of the impairment, and identity is not part of the trigger; a plaintiff can sue a Doe defendant but must identify the hacker in time. The Facebook claim, discovered six months later, survived because it was a separate impairment. The Stored Communications Act has its own two-year clock running from when the claimant discovered or had a reasonable opportunity to discover the violation, 18 U.S.C. § 2707(f), and state statutes vary. On tracing an unknown intruder, see Identifying an Anonymous Defendant Online: A Practical Guide.

Note the awkward fit for pure information takings. If nothing was impaired, "damage" may never have occurred in the statutory sense, which raises the question of when the discovery prong operates at all. Assume the earlier date.

The rest of the toolbox

The CFAA is rarely the best claim in the complaint. The neighbors have different gates and different thresholds.

Carfax, Inc. v. Accu-Trade, LLC, No. 1:21-cv-00361 (E.D. Va. Mar. 4, 2022) shows why these matter. The court dismissed the CFAA count where the plaintiff alleged that permission to use a VIN-lookup tool ended when contract talks collapsed, without alleging that it had disabled access or sent a clear message, but let the Virginia count proceed because "without authority" under Virginia law is a separate standard. A state statute can survive what the federal one does not, and if the federal claim goes early, 28 U.S.C. § 1367(c) gives the court discretion to drop the state claims too, as happened in Royal Truck. The article on Federal Subject-Matter Jurisdiction: Arising Under, Diversity, Supplemental Claims, and the Defect That Never Waives explains the stakes.

Prosecutors and researchers

Van Buren criticized the Department of Justice's 2014 policy for saying only that a terms-of-service prosecution "may not be warranted." In May 2022 the Department went further. Justice Manual § 9-48.000 now limits "without authorization" charges to cases where the defendant was "not authorized to access the protected computer under any circumstances" and knew the facts making access unauthorized; requires for "exceeds authorized access" that a computer be divided into areas through code or configuration; and bars charges resting solely on an access restriction in a contract or terms of service. It also lists good-faith security research among the factors, instructing that prosecutors "should decline prosecution if available evidence shows" conduct of that kind, defined as accessing a computer "solely for purposes of good-faith testing, investigation, and/or correction of a security flaw," in a manner designed to avoid harm, with the information used primarily to improve security. Claiming to be a researcher while seeking payment for silence does not qualify.

Three cautions. The policy creates no enforceable rights and can be changed. It binds federal prosecutors, not state attorneys general and not civil plaintiffs, who can still sue under § 1030(g) if they can show loss. And there remains real uncertainty in the case law about research conduct: in United States v. Auernheimer, 748 F.3d 525 (3d Cir. 2014), a pair of men scraped email addresses of iPad owners from AT&T's public-facing login URLs; the Third Circuit vacated the conviction on venue and did not decide whether doing so was unauthorized. Sandvig v. Barr, 451 F. Supp. 3d 73 (D.D.C. 2020) held that creating fake accounts for discrimination testing in violation of terms of service does not violate the statute, and Van Buren cited the opinion for the Department's past testimony about terms-of-service prosecutions. For the practical side, see Reporting or Receiving a Security Vulnerability: A Practical Guide for Researchers and Companies and Paid Vulnerability Disclosure and the Line Between Research and Extortion.

What this means on Monday

If you run a company, treat access as something you end deliberately. Tie it to employment in writing, send a dated message at departure, and revoke credentials the same day, including API keys, personal access tokens, OAuth grants, and shared service accounts. Limit who can reach what with real permissions rather than policy language, because after Van Buren a policy describes your wishes and a permission setting describes the gate. Your departure routine is the cheapest CFAA evidence you will ever create; Employee Departure Trade Secret Protection Checklist: A Practical Checklist covers the trade secret side. If you hire from competitors, the exposure runs the other way; see Hiring From a Competitor: Inevitable Disclosure, Employee Raiding, and the New Employer's Trade Secret Exposure.

If you run a platform, decide which pages are public and which are behind a gate, since that decision largely determines your federal remedy. Send individualized letters rather than relying on terms. Log your detection and blocking work with time and cost from the first day, and split it by actor if more than one is involved. Ryanair is what happens when you do not.

If you build scrapers or agents, stay on public pages if you want hiQ's protection, assume a letter changes things, do not rotate around a block after notice, and do not use someone else's credentials on a theory of implied permission unless the platform has blessed it. Document the architecture too, since Perplexity makes it evidence. Being right under the CFAA still leaves contract, copyright, and tort exposure.

If you have been accused, take a breath. A demand letter citing the CFAA is often weaker than it sounds, and the question is whether anyone reached something they could not otherwise reach, not whether what they did was disloyal. Still, stop accessing the system, preserve your devices rather than wiping them, and be careful: deleting evidence is how a weak claim becomes a strong spoliation motion, as Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case explains. A letter that reaches you is also, potentially, the moment your authorization ended. Responding to a Cease and Desist Letter: A Practical Guide is a good place to start.

What remains unsettled

• Footnote 8. Whether a contract or policy can define a gate for an insider or restrict access generally. Eddings reserved it; NRA Group limited it for current employees; Relation Insurance entertained a rule.
• Loss. Whether Van Buren's language restricts recoverable costs. Moxie says no; hiQ's footnote and many district courts say yes. The Ninth and Second Circuits have the most to resolve.
• Public websites outside the Ninth Circuit. No other circuit has adopted hiQ in a precedential merits holding I have found, and hiQ itself is a preliminary-injunction ruling.
• Termination versus resignation. Eddings reserved firing; Shahulhameed, unpublished, treats it as sufficient.
• Software agents. Perplexity is limited to its facts and architecture. Cloud-hosted agents and agents with greater vendor control have not been tested.
• The mental state for "without authorization." Abu and NRA Group read "intentionally" to require knowledge of the limit for excess access, and Eddings suggested the same for access without authorization. How much knowledge, and how to prove it, will be the next round of cases.

The statute is forty years old and will keep generating new problems for as long as computers keep changing what "entering" means. For help thinking through a specific situation, or for research into how a particular court has handled these questions, a lawyer familiar with computer access disputes can apply the case law to your facts, and UpLaw (uplaw.us) is a useful place to read the opinions cited here. This article is general information and not legal advice for any specific situation.

Related Documents

Related Articles

• Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims: the full scraping analysis across copyright, contract, and computer fraud.
• Hiring From a Competitor: Inevitable Disclosure, Employee Raiding, and the New Employer's Trade Secret Exposure: what happens on the receiving side when a departing employee brings data along.
• Federal Subject-Matter Jurisdiction: Arising Under, Diversity, Supplemental Claims, and the Defect That Never Waives: why a dismissed CFAA claim can take the whole case out of federal court.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: preservation duties for logs, devices, and accounts.
• Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration: the contract route when the CFAA does not reach.
• Paid Vulnerability Disclosure and the Line Between Research and Extortion: where security research meets § 1030(a)(7) and its state cousins.

Related Guides

• Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide: the step-by-step companion to this article, for both sides.
• Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide: the claim that usually fits a data-taking insider better.
• Reporting or Receiving a Security Vulnerability: A Practical Guide for Researchers and Companies: how researchers and companies can manage CFAA risk.
• Identifying an Anonymous Defendant Online: A Practical Guide: tracing an unknown intruder before the two years run.
• Responding to a Cease and Desist Letter: A Practical Guide: first steps when the letter arrives.

Related Checklists

• Computer Fraud and Abuse Act Claim Checklist: A Practical Checklist: element-by-element evaluation for each side.
• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: the departure routine that also creates revocation evidence.

Related Toolkits

• Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines: revocation letters, the loss worksheet, forensic instructions, and pleading outlines.
• Vulnerability Disclosure Toolkit: VDP Policies, Safe Harbor Terms, Researcher Agreements, and Response Letters: authorization language for researchers.