EF Cultural Travel v. Explorica Inc

• Decision Date: 01 October 2001
• Docket Number: No. 01-2000,01-2000
• Citation: 274 F.3d 577
• Parties: (1st Cir. 2001) EF CULTURAL TRAVEL BV, EF CULTURAL TOURS BV, EF INSTITUTE FOR CULTURAL EXCHANGE, INC., EF CULTURAL SERVICES BV, AND GO AHEAD VACATIONS, INC., Plaintiffs, Appellees, v. EXPLORICA, INC., OLLE OLSSON, PETER NILSSON, PHILIP GORMLEY, ALEXANDRA BERNADOTTE, ANDERS ERIKSSON, DEBORAH JOHNSON, AND STEFAN NILSSON, Defendants, Appellants. Heard
• Court: U.S. Court of Appeals — First Circuit

Page 577

274 F.3d 577 (1st Cir. 2001)

EF CULTURAL TRAVEL BV, EF CULTURAL TOURS BV, EF INSTITUTE FOR CULTURAL EXCHANGE, INC., EF CULTURAL SERVICES BV, AND GO AHEAD VACATIONS, INC., Plaintiffs, Appellees, v. EXPLORICA, INC., OLLE OLSSON, PETER NILSSON, PHILIP GORMLEY, ALEXANDRA BERNADOTTE, ANDERS ERIKSSON, DEBORAH JOHNSON, AND STEFAN NILSSON, Defendants, Appellants.

No. 01-2000

United States Court of Appeals For the First Circuit

Heard Oct. 1, 2001

Decided December 17, 2001

Amended January 14, 2002

APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS. Hon. Morris E. Lasker, Senior U.S. District Judge

Anthony M. Feeherry, with whom James W. Nagle, R. David Hosp, and Goodwin Proctor LLP were on brief, for appellants.

Nathaniel H. Akerman, with whom Seyfarth Shaw was on brief, for appellees.

Before Boudin, Chief Judge, Coffin, Senior Circuit Judge, and Lynch, Circuit Judge.

COFFIN, Senior Circuit Judge.

Appellant Explorica, Inc. ("Explorica") and several of its employees challenge a preliminary injunction issued against them for alleged violations of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030.¹ We affirm the district court's conclusion that appellees will likely succeed on the merits of their CFAA claim, but rest on a narrower basis than the court below.

I. Background

Explorica was formed in 2000 to compete in the field of global tours for high school students. Several of Explorica's employees formerly were employed by appellee EF, which has been in business for more than thirty-five years. EF and its partners and subsidiaries make up the world's largest private student travel organization.

Shortly after the individual defendants left EF in the beginning of 2000, Explorica began competing in the teenage tour market. The company's vice president (and former vice president of information strategy at EF), Philip Gormley, envisioned that Explorica could gain a substantial advantage over all other student tour companies, and especially EF, by undercutting EF's already competitive prices on student tours. Gormley considered several ways to obtain and utilize EF's prices: by manually keying in the information from EF's brochures and other printed materials; by using a scanner to record that same information; or, by manually searching for each tour offered through EF's website. Ultimately, however, Gormley engaged Zefer, Explorica's Internet consultant, to design a computer program called a "scraper" to glean all of the necessary information from EF's website. Zefer designed the program in three days.

The scraper has been likened to a "robot," a tool that is extensively used on the Internet. Robots are used to gather information for countless purposes, ranging from compiling results for search engines such as Yahoo! to filtering for inappropriate content. The widespread deployment of robots enables global Internet users to find comprehensive information quickly and almost effortlessly.

Like a robot, the scraper sought information through the Internet. Unlike other robots, however, the scraper focused solely on EF's website, using information that other robots would not have. Specifically, Zefer utilized tour codes whose significance was not readily understandable to the public. With the tour codes, the scraper accessed EF's website repeatedly and easily obtained pricing information for those specific tours. The scraper sent more than 30,000 inquiries to EF's website and recorded the pricing information into a spreadsheet.²

Zefer ran the scraper program twice, first to retrieve the 2000 tour prices and then the 2001 prices. All told, the scraper downloaded 60,000 lines of data, the equivalent of eight telephone directories of information.³ Once Zefer "scraped" all of the prices, it sent a spreadsheet containing EF's pricing information to Explorica, which then systematically undercut EF's prices.⁴ Explorica thereafter printed its own brochures and began competing in EF's tour market.

The development and use of the scraper came to light about a year and a half later during state-court litigation regarding appellant Olsson's departure from appellee EFICE. EF then filed this action, alleging violations of the CFAA; the Copyright Act of 1976, 17 U.S.C. § 101; the Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. § 1961; and various related state laws. It sought a preliminary injunction barring Explorica and Zefer from using the scraper program and demanded the return of all materials generated through use of the scraper.

On May 30, 2001, the district court granted a preliminary injunction against Explorica based on the CFAA, which criminally and civilly prohibits certain access to computers. See 18 U.S.C. § 1030(a)(4). The court found that EF would likely prove that Explorica violated the CFAA when it used EF's website in a manner outside the "reasonable expectations" of both EF and its ordinary users. The court also concluded that EF could show that it suffered a loss, as required by the statute, consisting of reduced business, harm to its goodwill, and the cost of diagnostic measures it incurred to evaluate possible harm to EF's systems, although it could not show that Explorica's actions physically damaged its computers. In a supplemental opinion⁵ the district court further articulated its "reasonable expectations" standard and explained that copyright, contractual and technical restraints sufficiently notified Explorica that its use of a scraper would be unauthorized and thus would violate the CFAA.

The district court first relied on EF's use of a copyright symbol on one of the pages of its website and a link directing users with questions to contact the company,⁶ finding that "such a clear statement should have dispelled any notion a reasonable person may have had that the 'presumption of open access' applied to information on EF's website." The court next found that the manner by which Explorica accessed EF's website likely violated a confidentiality agreement between appellant Gormley and EF, because Gormley provided to Zefer technical instructions concerning the creation of the scraper. Finally, the district court noted without elaboration that the scraper bypassed technical restrictions embedded in the website to acquire the information. The court therefore let stand its earlier decision granting the preliminary injunction. Appellants contend that the district court erred in taking too narrow a view of what is authorized under the CFAA and similarly mistook the reach of the confidentiality agreement. Appellants also argue that the district court erred in finding that appellees suffered a "loss," as defined by the CFAA, and that the preliminary injunction violates the First Amendment.

II. Standard of Review

A district court may issue a preliminary injunction only upon considering "(1) the likelihood of success on the merits; (2) the potential for irreparable harm if the injunction is denied; (3) the balance of relevant impositions . . . ; and (4) the effect (if any) of the court's ruling on the public interest." Ross-Simons of Warwick, Inc. v. Baccarat, Inc., 102 F.3d 12, 15 (1st Cir. 1996). Appellants challenge only the district court's finding that appellees are likely to succeed on the merits, and we thus confine our review to that factor. As in any other appeal, we review the merits of a preliminary injunction depending on the issue under consideration. "Generally speaking, pure issues of law (e.g., the construction of a statute) are reviewed de novo, findings of fact for clear error, and 'judgment calls' with considerable deference. . . ." Langlois v. Abington Hous. Auth., 207 F.3d 43, 47 (1st Cir. 2000). Each of these is applicable here, where the district court's judgment relied on both its analysis of the CFAA and its assessment of the voluminous documentary evidence.

III. The Computer Fraud and Abuse Act

Although appellees alleged violations of three provisions of the CFAA, the district court found that they were likely to succeed only under section 1030(a)(4).⁷ That section provides

[Whoever] knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value . . . shall be punished.

18 U.S.C. § 1030(a)(4).⁸

Appellees allege that the appellants knowingly and with intent to defraud accessed the server hosting EF's website more than 30,000 times to obtain proprietary pricing and tour information, and confidential information about appellees' technical abilities. At the heart of the parties' dispute is whether appellants' actions either were "without authorization" or "exceed[ed] authorized access" as defined by the CFAA.⁹ We conclude that because of the broad confidentiality agreement appellants' actions "exceed[ed] authorized access," and so we do not reach the more general arguments made about statutory meaning, including whether use of a scraper alone renders access unauthorized.¹⁰

A. "Exceeds authorized access"

Congress defined "exceeds authorized access," as accessing "a computer with authorization and [using] such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). EF is likely to prove such excessive access based on the confidentiality agreement between Gormley and EF. Pertinently, that agreement provides:

Employee agrees to maintain in strict confidence and not to disclose to any third party, either orally or in writing, any Confidential or Proprietary Information . . . and never to at any time (i) directly or indirectly publish, disseminate or otherwise disclose, deliver or make available to anybody any Confidential or Proprietary Information or (ii) use such Confidential or [P]roprietary Information for Employee's own benefit or for the benefit of any other person or business entity other than...