Home › Case briefs › Constitutional Law

Sandvig v. Sessions

United States District Court for the District of Columbia · 2020 · Constitutional Law

Constitutional LawFirst AmendmentComputer Fraud and Abuse ActStatutory InterpretationStandingRipenessMootnessCFAA

Facts

Plaintiffs Wilson and Mislove are computer science professors who planned audit-testing research to determine whether employment websites discriminate based on race or gender. Their planned methods included creating fictitious job seeker profiles and fictitious job postings, which would violate target websites' terms of service by providing false information or creating fake accounts. They stated they would minimize harm, disclose that postings or profiles were not real, comply with payment requirements where required, and not use authenticating real-world business information. They sued because they believed the CFAA might criminalize this planned conduct and chill their research.

Issue

Does the CFAA's Access Provision, 18 U.S.C. § 1030(a)(2), criminalize plaintiffs' planned violations of consumer websites' terms of service, such that their as-applied First Amendment challenge remains live? Relatedly, did plaintiffs establish a ripe pre-enforcement controversy with standing to seek relief?

Rule

Under 18 U.S.C. § 1030(a)(2), a user accesses a computer 'without authorization' only by bypassing an authenticating permission requirement or authentication gate, such as a password restriction, and does not violate the statute merely by violating a public website's terms of service. Likewise, on public consumer websites, violating terms of service does not, without more, constitute 'exceed[ing] authorized access.' In a pre-enforcement First Amendment challenge, plaintiffs may establish injury by showing an intent to engage in conduct arguably protected and arguably proscribed, plus a credible threat of enforcement.

🔒

See the holding & full analysis

Create a free KwikCourt account to unlock the rest of this brief — and practice the case.

The court's holding and reasoning
Doctrine tests, pitfalls & exam hypotheticals
10 practice questions + 4 AI-graded essays on this case

Free sample · practice this case

Test yourself

One of 10 multiple-choice questions for this case. Pick an answer to see why.

In Chicago, Priya Desai and Evan Cole, two sociology professors at Lakefront Research Center, want to study whether apartment-listing websites display different rental opportunities based on perceived ethnicity. They have obtained grant funding, secured internal ethics approval, identified several public housing websites they plan to test, and state that they intend to create fictitious renter profiles that would violate those sites’ terms of service, but they have not yet assigned staff or fixed a launch date.

If they bring a pre-enforcement First Amendment challenge to the federal computer access statute, what is the strongest argument that they have suffered an injury in fact?

Explanation. The governing rule permits pre-enforcement standing where plaintiffs intend to engage in conduct arguably affected with a constitutional interest, arguably proscribed, and face a credible threat of enforcement. Concrete plans do not require fully operational implementation; funding, ethics approval, identified target sites, and specific intended conduct are enough to move beyond a mere 'some day' intention. (Derived from Sandvig v. Sessions (n.d.).)