Computer Fraud and Abuse Act/CFAA
Subscribe to Computer Fraud and Abuse Act/CFAA's Posts

Case exterminated too soon: DTSA and CFAA claims survive

The US Court of Appeals for the Tenth Circuit partially reversed and partially affirmed a series of district court rulings arising from alleged corporate espionage between competitors in the pest control industry. The decision clarifies the scope of recoverable “loss” under the Computer Fraud and Abuse Act (CFAA) after Van Buren and underscores that causation requirements under the Defend Trade Secrets Act (DTSA) and state trade secret law depend on the remedy sought. Moxie Pest Control LLC, et al. v. Kyle Nielsen, et al., Case No. 24-4076 (10th Cir. Jan. 21, 2026) (Hartz, Moritz, Rossman, JJ.)

Moxie sued rival Aptive Environmental, alleging that Aptive employees bribed current and former Moxie sales representatives to obtain confidential sales data stored in Moxie’s password-protected SalesRoutes system. According to Moxie, Aptive used this data (particularly sales leaderboards) to recruit door-to-door sales representatives by portraying Aptive as the more lucrative employer. Moxie brought claims under the CFAA, Racketeer Influenced and Corrupt Organizations (RICO) Act, DTSA, and Utah’s Uniform Trade Secrets Act (UTSA).

The district court dismissed Moxie’s CFAA claim at the pleading stage, denied motions to compel broad damages discovery, and granted Aptive summary judgment on the RICO, DTSA, and UTSA claims based on a lack of causation. Moxie appealed.

CFAA claim reinstated

The Tenth Circuit found that the district court erred in dismissing Moxie’s CFAA claim for failure to plead a qualifying “loss.” The district court had interpreted Van Buren v. United States as requiring plaintiffs to allege a technological harm, such as damage to data or systems, to recover under the CFAA. The Tenth Circuit rejected that interpretation, explaining that Van Buren addressed what conduct constitutes a CFAA violation, not the scope of recoverable loss once a violation has occurred.

Under the statute’s plain language, “loss” includes reasonable costs incurred in responding to an offense or conducting a damage assessment. Moxie’s allegations that it spent more than $5,000 investigating the unauthorized access (specifically identifying the perpetrators, methods, and scope of access) fell squarely within that definition. The Tenth Circuit emphasized that investigative costs aimed at understanding the breach itself are recoverable, even absent data corruption or system impairment.

Discovery rulings affirmed

The Tenth Circuit affirmed the district court’s denial of Moxie’s motions to compel expansive damages discovery. While acknowledging that some requested information could be relevant, the Court concluded that the district court acted within its discretion by limiting initial disclosures and inviting more targeted follow-up discovery. Moxie’s failure to pursue narrower discovery after the district court’s ruling weighed against a finding of abuse of discretion.

Trade secret and RICO claims

The Tenth Circuit agreed that Moxie failed to establish causation sufficient to sustain its RICO claim or to recover unjust-enrichment damages under the DTSA and UTSA. Evidence showing that Aptive sought Moxie’s data, used it in recruitment meetings, and experienced revenue growth during the same period amounted to correlation, not proof that the misappropriation caused Aptive’s profits. Without evidence tying the stolen data to actual financial gain, unjust-enrichment theories failed.

However, the [...]

Continue Reading




read more

Ninth Circuit Once Again Preserves Competitor’s Data-Scraping Rights

On remand from the Supreme Court of the United States, the US Court of Appeals for the Ninth Circuit reaffirmed its own 2019 opinion that preliminarily enjoined a professional networking platform from denying a data analytics company access to publicly available profiles. HiQ Labs, Inc. v. LinkedIn Corporation, Case No. 17-16783, (9th Cir., Apr. 18, 2022) (Wallace, Berzon, Berg (sitting by designation) JJ.).

Previously, the Supreme Court had granted certiorari in this case, but subsequently vacated the judgment and remanded back to the Ninth Circuit for further consideration in view of its  2021 decision in Van Buren v. United States. In Van Buren, the Supreme Court attempted to clarify the reach of the Computer Fraud and Abuse Act of 1986 (CFAA), holding that authorized computer access for arguably improper purposes likely does not constitute a violation of the CFAA. On remand, the Ninth Circuit concluded that Van Buren reinforced its determination that hiQ had raised “serious questions” about whether LinkedIn may invoke the CFAA to preempt hiQ’s claim of tortious interference.

HiQ is a data company that sells “people analytics” focused on predictive employee data. HiQ’s data is largely obtained by scraping public LinkedIn profiles with automated bots. In 2017, LinkedIn sent a demand letter to hiQ asserting that hiQ’s scraping activity was in violation of the CFAA, the Digital Millennium Copyright Act (DMCA), the California penal code and common law. HiQ immediately filed suit seeking injunctive relief and a declaratory judgment that LinkedIn could not lawfully invoke the asserted claims. Granting hiQ’s motion for the preliminary injunction, the district court ordered LinkedIn to remove, and to refrain from implementing, any technical barriers to hiQ’s access to the LinkedIn public profiles.

The Ninth Circuit stated that a plaintiff seeking a preliminary injunction must establish the following:

  • It is likely to succeed on the merits.
  • It is likely to suffer irreparable harm absent the injunction.
  • The balance of equities tips in its favor.
  • The injunction is in the public interest.

This analysis required the Ninth Circuit to focus only on whether hiQ had raised serious questions on the merits of the factual and legal issues presented. The Ninth Circuit’s re-examination of these factors was nearly identical to its 2019 holding.

Starting with irreparable harm, the Ninth Circuit found that the survival of hiQ’s business was threatened since it depends on being able to access public LinkedIn member profiles. The Court also agreed, once again, with the district court’s determination that the balance of the equities tipped in hiQ’s favor. The Court found that the privacy interests of individuals who have opted to maintain a public LinkedIn profile did not outweigh hiQ’s interests in continuing its business. On this factor, the Court noted that “little evidence” suggested that LinkedIn users who choose to make their profiles public actually maintain an expectation of privacy with respect to publicly posted information. The Court also noted that LinkedIn does not own its users’ data, since users retain [...]

Continue Reading




read more

STAY CONNECTED

TOPICS

ARCHIVES