Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 1 of 41 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA CHRISTIAN W. SANDVIG et al., Plaintiffs, v. Case No. 1:16-cv-1368 (JDB) LORETTA LYNCH, in her official capacity as Attorney General of the United States, Defendant. MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF DEFENDANT’S MOTION TO DISMISS Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 2 of 41 TABLE OF CONTENTS STATUTORY OVERVIEW .............................................................................................. 4 FACTUAL BACKGROUND ............................................................................................. 5 LEGAL STANDARD......................................................................................................... 6 ARGUMENT ...................................................................................................................... 7 I. II. Plaintiffs Fail to Allege Facts Sufficient to Establish Standing to Sue................... 7 A. Plaintiffs Fail to Allege that the Challenged Provision of the CFAA Chills Conduct Protected Under the First Amendment .............................. 9 B. Plaintiffs Fail to Assert a Credible Threat of Prosecution. ....................... 12 C. The Doctrine of “Tester Standing” Is Inapplicable in this Context. ......... 18 Plaintiffs Fail to State a Claim Upon Which Relief Can Be Granted. .................. 19 A. Plaintiffs Fail to State a Freedom of Speech Claim. ................................. 20 B. Plaintiffs Fail to State a Claim Under the Overbreadth Doctrine. ............ 24 C. Plaintiffs Fail to State a Claim Under the Petition Clause. ....................... 27 D. Plaintiffs Fail to State a Claim Under the Fifth Amendment Vagueness Doctrine. ................................................................................. 28 E. Plaintiffs Fail to State a Claim Under the Non-Delegation Doctrine..................................................................................................... 31 CONCLUSION ................................................................................................................. 33 i Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 3 of 41 TABLE OF AUTHORITIES CASES Am. Bus Ass’n v. Rogoff, 649 F.3d 734 (D.C. Cir. 2011) ...................................................................................... 28 Am. Library Ass’n v. Barr, 956 F.2d 1178 (D.C. Cir. 1992) .............................................................................. 13, 18 A.N.S.W.E.R. v. D.C., 589 F.3d 433 (D.C. Cir. 2009) ................................................................................ 13, 18 Ark. Educ. Television Com’n v. Forbes, 523 U.S. 666 (1998) ...................................................................................................... 23 Ashcroft v. Iqbal, 556 U.S. 662 (2009) ........................................................................................................ 7 Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) ........................................................................................................ 7 Blum v. Holder, 744 F.3d 790 (1st Cir. 2014) ......................................................................................... 13 Borough of Duryea v. Guarnieri, 564 U.S. 379 (2011) .................................................................................................. 8, 27 Branzburg v. Hayes, 408 U.S. 665 (1972) ...................................................................................................... 11 Broadrick v. Oklahoma, 413 U.S. 601 (1973) .................................................................................... 24, 25, 26, 27 Browning v. Clinton, 292 F.3d 235 (D.C. Cir. 2002) ........................................................................................ 7 *Carter v. Carter Coal Co., 298 U.S. 238 (1936) ................................................................................................ 31, 32 Chai v. Dep’t of State, 466 F.3d 125 (D.C. Cir. 2006) ........................................................................................ 9 Chamber of Commerce of U.S. v. Fed. Election Comm’n, 69 F.3d 600 (D.C. Cir. 1995) .............................................................................. 8, 12, 13 City of Chicago v. Morales, 527 U.S. 41 (1999) ........................................................................................................ 29 Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138, (2013) ................................................................................................... 8 Colautti v. Franklin, 439 U.S. 379 (1979) ...................................................................................................... 30 Cornelius v. NAACP Legal Def. & Educ. Fund, Inc., 473 U.S. 788 (1985) ............................................................................................ 9, 20, 21 Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178 (N.D. Cal. 2013) ........................................................................ 30 Cyber Promotions, Inc. v. American Online, Inc., 948 F. Supp. 436 (E.D. Pa. 1996) ................................................................................. 23 Firearms Imp./Exp. Roundtable Trade Grp. v. Jones, 854 F. Supp. 2d 1 (D.D.C. 2012) .................................................................................. 18 ii Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 4 of 41 Gonzales v. Carhart, 550 U.S. 124 (2007) ................................................................................................ 29, 30 Grand Lodge of the Fraternal Order of Police v. Ashcroft, 185 F. Supp. 2d 9 (D.D.C. 2001) ................................................................................ 6, 7 Havens Realty Corp. v. Coleman, 455 U.S. 363 (1982) ................................................................................................ 18, 19 Hill v. City of Houston, 789 F.2d 1103 (5th Cir. 1986) ...................................................................................... 13 Hodge v. Talkin, 799 F.3d 1145 (D.C. Cir. 2015) .................................................................................... 10 Holder v. Humanitarian Law Project, 561 U.S. 1 (2010) ............................................................................................................ 9 Houchins v. KQED, Inc., 438 U.S. 1 (1978) .................................................................................................... 11, 12 Hudgens v. NLRB, 424 U.S. 507 (1976) ................................................................................................ 22, 24 Humanitarian Law Project v. Reno, 205 F.3d 1130 (9th Cir. 2000) ........................................................................................ 9 Hurley v. Irish-Am. Gay, Lesbian, and Bisexual Grp. of Bos., 515 U.S. 557 (1995) ...................................................................................................... 10 Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006) .................................................................................... 4, 25 Jerome Stevens Pharms., Inc. v. FDA, 402 F.3d 1249 (D.C. Cir. 2005) ...................................................................................... 7 Johnson v. D.C., 71 F. Supp. 3d 155 (D.D.C. 2014) .................................................................... 13, 16, 17 Jordan v. De George, 341 U.S. 223 (1951) ...................................................................................................... 29 L.A. Police Dep’t v. United Reporting Publ’g Corp., 528 U.S. 32 (1999) ........................................................................................................ 24 Lewis–Burke Assocs. LLC v. Widder, 725 F. Supp. 2d 187 (D.D.C. 2010) ................................................................................ 5 Lloyd Corp. v. Tanner, 407 U.S. 551 (1972) ...................................................................................................... 22 Lujan v. Defs. of Wildlife, 504 U.S. 555 (1992) ........................................................................................................ 8 Members of City Council of Los Angeles v. Taxpayers for Vincent, 466 U.S. 789 (1984) ...................................................................................................... 25 Minn. State Bd. for Cmty. Colleges v. Knight, 465 U.S. 271 (1984) ...................................................................................................... 28 Mistretta v. United States, 488 U.S. 361 (1989) ...................................................................................................... 31 Nat'l Ass'n for the Advancement of MultiJurisdiction Practice v. Roberts, Civ. Action No. 13-01963-NMG, 2015 WL 10459071 (D.D.C. Dec. 31, 2015) ......... 28 Navegar, Inc. v. United States, 103 F.3d 994 (D.C. Cir. 1997) ...................................................................................... 17 iii Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 5 of 41 New Motor Vehicle Bd. of Cal. v. Orrin W. Fox Co., 439 U.S. 96 (1978) ........................................................................................................ 32 New York State Club Ass’n, Inc. v. City of New York, 487 U.S. 1 (1988). ................................................................................................... 24, 25 Putnam Pit, Inc. v. City of Cookeville, 221 F.3d 834 (6th Cir. 2000) ............................................................................ 11, 12, 22 R.A.V. v. City of St. Paul, 505 U.S. 377 (1992) ...................................................................................................... 24 Raines v. Byrd, 521 U.S. 811 (1997) ........................................................................................................ 8 Roe v. Bernabei & Wachtel PLLC, 85 F. Supp. 3d 89 (D.D.C. 2015) .................................................................................... 5 Rosenberger v. Rector & Visitors of Univ. of Virginia, 515 U.S. 819 (1995) ...................................................................................................... 23 Seegars v. Gonzales, 396 F.3d 1248 (D.C. Cir. 2005) .............................................................................. 13, 16 SEIU, Local 82 v. D.C., 608 F. Supp. 1434 (D.D.C. 1985) ................................................................................. 29 Skilling v. United States, 561 U.S. 358 (2010) ................................................................................................ 29, 31 Smith v. Ark. State Highway Emps., Local, 1315, 441 U.S. 463 (1979) ............................................................................................ 27 Sons of Confederate Veterans, Inc. ex rel. Griffin v. Comm'r of Virginia Dep’t of Motor Vehicles, 288 F.3d 610 (4th Cir. 2002) .................................................................................. 21, 22 Spence v. Washington, 418 U.S. 405 (1974) ........................................................................................................ 9 Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83 (1998) .......................................................................................................... 6 Sunshine Anthracite Coal Co. v. Adkins, 310 U.S. 381 (1940) ...................................................................................................... 31 Texas v. Johnson, 491 U.S. 397 (1989) ........................................................................................................ 9 U.S. Ecology, Inc. v. U.S. Dep’t of Interior, 231 F.3d 20 (D.C. Cir. 2000) .......................................................................................... 6 United States v. Auernheimer, No. 11-CR-470-SDW, 2012 WL 5389142 (D.N.J. Oct. 26, 2012) .............................. 30 United States v. Bronstein, 151 F. Supp. 3d 31 (D.D.C. 2015) ................................................................................ 29 *United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009) ............................................................................ 14, 15 United States v. Eichman, 731 F. Supp. 1123 (D.D.C. 1990) ................................................................................. 21 United States v. John, 597 F.3d 263 (5th Cir. 2010) .................................................................................... 4, 25 iv Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 6 of 41 *United States v. Lowson, Crim. No. 10-114 KSH, 2010 WL 9552416 (D.N.J. Oct. 12, 2010) ............................ 14 United States v. Mazurie, 419 U.S. 544 (1975) ...................................................................................................... 29 *United States v. Nosal, 676 F.3d 854 (9th Cir. 2012) ........................................................................ 4, 15, 25, 30 United States v. O'Brien, 391 U.S. 367 (1968) ...................................................................................................... 21 United States v. Williams, 553 U.S. 285 (2008) ................................................................................................ 25, 27 Valley Forge Christian Coll. v. Ams. United for Separation of Church & State, Inc., 454 U.S. 464 (1982) ........................................................................................................ 7 Virginia v. Hicks, 539 U.S. 113 (2003) .......................................................................................... 24, 25, 26 Warth v. Seldin, 422 U.S. 490 (1975) ........................................................................................................ 7 Wayte v. United States, 470 U.S. 598 (1985) .................................................................................................. 8, 27 Whitmore v. Arkansas, 495 U.S. 149 (1990) ........................................................................................................ 8 *Zemel v. Rusk, 381 U.S. 1 (1965) .............................................................................................. 10, 11, 21 FEDERAL STATUTES 17 U.S.C. § 106 ................................................................................................................. 32 17 U.S.C. § 506 ................................................................................................................. 32 18 U.S.C. § 1029 ............................................................................................................... 33 18 U.S.C. § 1030 ....................................................................................................... 1, 4, 30 18 U.S.C. § 1831 ............................................................................................................... 32 42 U.S.C. § 3604 ............................................................................................................... 18 STATE STATUTES D.C. Code § 22-3302 (2013)............................................................................................. 32 REGULATIONS 25 C.F.R. § 11.411 ............................................................................................................ 32 RULES Fed. R. Civ. P. 12 ........................................................................................................ 1, 3, 7 CONSTITUTION U.S. Const. amend. I ......................................................................................................... 27 U.S. Const. Art. I .............................................................................................................. 31 OTHER AUTHORITIES Cyber Crime: Modernizing Our Legal Framework for the Information Age, Before the Subcomm. On Crime and Terrorism of the Senate Comm. On the Judiciary, 114th Cong. (2015) ....................................................................................................... 17 H.R. Rep. No. 98-894, reprinted in 1984 U.S.C.C.A.N. 3689............................................ 3 Pub. L. No. 110-326, 122 Stat. 3561 (2008) ....................................................................... 3 v Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 7 of 41 Pub. L. No. 98-473, 98 Stat. 1837 (1984) ........................................................................... 3 S. Rep. No. 104-357 (1996) .......................................................................................... 3, 26 vi Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 8 of 41 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA CHRISTIAN W. SANDVIG et al., Plaintiffs, v. Case No. 1:16-cv-1368 (JDB) LORETTA LYNCH, in her official capacity as Attorney General of the United States, Defendant. MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF DEFENDANT’S MOTION TO DISMISS Plaintiffs are four university professors and one media organization that allege a desire to engage in the systemic collection of information from the websites of nonconsenting private entities through the deployment of certain computer programs. Plaintiffs aver that their proposed activities would violate the terms of use of the targeted websites. Although no adverse action has been taken against any of the plaintiffs, even though some have already engaged in the proposed information-gathering activity, they seek to raise a preenforcement challenge to the constitutionality of a provision of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030(a)(2)(C), under the theory that the provision runs afoul of the First and Fifth Amendments to the United States Constitution. The provision in question provides penalties for obtaining information by intentionally accessing a protected computer without authorization or in a manner that exceeds authorized access. Plaintiffs, however, fail to allege any constitutionally cognizable injury in fact; accordingly, they lack standing to sue, and the Court should dismiss the complaint pursuant to Federal Rule of Civil Procedure 12(b)(1). Moreover, Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 9 of 41 assuming plaintiffs could make the threshold showing of standing, their First and Fifth Amendment claims and should be dismissed pursuant to Rule 12(b)(6) for failure to state a claim upon which relief can be granted. Plaintiffs fail to allege an injury in fact sufficient to meet the constitutional minimum of standing. Standing to assert preenforcement statutory challenges under the First and Fifth Amendments may exist where the statute in question regulates constitutionally protected conduct and a credible fear of prosecution exists. The challenged provision of the CFAA, however, does not facially regulate protected conduct, and the conduct in which plaintiffs intend to engage—deploying information-gathering software on the websites of non-consenting private entities—is not activity that the First Amendment protects. Moreover, plaintiffs fail to provide any facts indicating a credible threat that the challenged provision will be enforced against them: plaintiffs do not allege to have been investigated by law enforcement or threatened with an enforcement action; plaintiffs do not identify any cases in which the government has sought to enforce the CFAA for harmless terms of use violations that were not in furtherance another crime or tort; and the government has affirmatively stated that it has no intention to enforce the CFAA under the circumstances alleged here. Accordingly, plaintiffs are unable to assert an objectively credible threat of prosecution and, as a result, their complaint must be dismissed on standing grounds. Moreover, plaintiffs’ preenforcement First and Fifth Amendment claims fail on their merits. Plaintiffs’ First Amendment claims fail for the threshold reason that plaintiffs do not allege that they have been prohibited from engaging in any activity that has been recognized as protected under the First Amendment. Plaintiffs’ free speech 2 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 10 of 41 claims also fail because plaintiffs do not allege that their purportedly protected speech is being regulated in a constitutionally recognized free speech forum; no court has held that the website of a private corporation constitutes such a forum. Their First Amendment overbreadth challenge also fails because the challenged provision of the CFAA is not specifically addressed to speech or to conduct necessarily intertwined with speech, such as picketing or demonstrating. Plaintiffs’ Petition Clause claim also fails because the challenged provision of the CFAA does not prohibit petitions to the government, nor does it provide a sanction against individuals who submit a petition. Plaintiffs’ Fifth Amendment claims are also subject to Rule 12(b)(6) dismissal. Their vagueness claim fails because the challenged provision does not prohibit constitutionally protected conduct and contains a mens rea requirement. Moreover, courts across the country have fashioned constitutionally permissible constructions of the challenged provision in a variety of as-applied contexts. Lastly, plaintiffs’ nondelegation claim fails because the challenged provision of the CFAA does not contain the type of legislative or executive delegation that is prohibited under Supreme Court jurisprudence. Accordingly, because plaintiffs cannot identify an injury sufficient to confer standing to sue and because plaintiffs fails to state a claim upon which relief can be granted, defendant respectfully requests the Court dismiss the complaint pursuant to Rule 12(b)(1) or 12(b)(6). 3 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 11 of 41 STATUTORY OVERVIEW Congress enacted the Computer Fraud and Abuse Act (“CFAA”) in 1984 in an attempt to address the emergence of computer crimes. See Pub. L. No. 98-473, 98 Stat. 1837, 2190 (1984); H.R. Rep. No. 98-894, at 6 (1984), reprinted in 1984 U.S.C.C.A.N. 3689, 3692. Prior to the CFAA’s enactment, law enforcement had been forced to bootstrap enforcement efforts against computer crime by relying on statutory restrictions designed for other offenses. See S. Rep. No. 104-357, at 11 (1996) (accompanying the 1996 amendments to the CFAA). Congress has modified the CFAA multiple times, most recently in 2008, as it continues to address the changing climate of computer crime. See Pub. L. No. 110-326, 122 Stat. 3561, 3563 (2008). One provision of the CFAA prohibits “intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected computer.” 18 U.S.C. § 1030(a)(2)(C) (the “challenged provision”). The statute defines the term “protected computer” to mean a computer “exclusively for the use of a financial institution or the United States Government . . . or . . . [a computer] which is used in or affecting interstate or foreign commerce or communication . . . .” 18 U.S.C. § 1030(e)(2). The term “exceeds authorized access” means “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6). The scope of the terms “without authorization” and “exceeds authorized access” has been the subject of extensive litigation. Circuits have differed on the appropriate interpretation of those terms, with the analysis of the proper interpretation depending 4 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 12 of 41 heavily on the factual circumstances present in each case. See, e.g., Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418, 420 (7th Cir. 2006) (an employee exceeds authorized access to information on his employer’s computer where he uses that information in a manner that violates “the duty of loyalty” to his employer); United States v. John, 597 F.3d 263, 272 (5th Cir. 2010) (“[T]he concept of ‘exceeds authorized access’ may include exceeding the purposes for which access is ‘authorized’” in a case where the information was used in furtherance of the commission of a separate crime.); United States v. Nosal, 676 F.3d 854, 863-64 (9th Cir. 2012) (“[W]e hold that the phrase ‘exceeds authorized access’ in the CFAA does not extend to violations of use restrictions[;]” the term is “limited to violations of restrictions on access to information, and not restrictions on its use.”) (emphasis in original). The D.C. Circuit has not ruled on the issue; the district courts in this circuit that have addressed the matter have followed the narrower interpretation adopted by the Ninth Circuit. See, e.g., Roe v. Bernabei & Wachtel PLLC, 85 F. Supp. 3d 89, 103 (D.D.C. 2015) (“[T]he plain meaning of the statute . . . speaks only of authorized ‘access’ to data and not of use.”); Lewis–Burke Assocs. LLC v. Widder, 725 F. Supp. 2d 187, 194 (D.D.C. 2010) (“‘Exceeds authorized access’ should not be confused with exceeds authorized use.”). FACTUAL BACKGROUND Plaintiffs are four individuals who are professors at institutions of higher learning and one non-profit media organization. Compl. ¶¶ 13-21. Plaintiffs allege an intent to engage in certain research activities for the purposes of publishing scholarly articles, journalism pieces, and engaging in a variety of communications about their findings with the public or with government officials. Id. ¶ 134. 5 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 13 of 41 With respect to their specific intentions, Plaintiffs Sandvig and Karahalios allege that they intend to deploy on certain unspecified corporate websites a computer program designed to mimic the on-line presence of real individuals. Id. ¶¶ 88-92. These artificial on-line presences, referred to as “bots,” would visit certain websites and collect (or “scrape”) and store information from those websites. Id. Plaintiffs Mislove and Wilson intend to deploy a similar bot-creating computer program that would gather information from websites of certain companies in the jobseeking industry. Compl. ¶¶ 100-128. Plaintiffs Mislove and Wilson also intend to scrape data from corporate websites that return results to certain job-seeking queries and to deploy a computer program that would systematically browse (or “crawl”) the personal profiles of individual job-seeking candidates to gather information about those individuals. Id. Plaintiffs Mislove and Wilson aver to have already started engaging in these activities. Id. ¶ 126. Plaintiff First Look Media Works (“Media Works”) provides only a broad description of the information-gathering activity in which it intends to engage. It alleges that it generally “wish[es] to violate certain website terms of service . . . including by scraping data” of unspecified business websites in an effort to conduct investigations concerning unspecified “online business practices.” Id. at ¶¶ 130-32. All of the plaintiffs allege that their activities will not harm the target websites, and plaintiffs allege to be conducting their actives for academic and public interest purposes. The complaint contains no allegations that the government has investigated plaintiffs’ activities, threatened plaintiffs with the possibility of an enforcement action 6 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 14 of 41 under the CFAA or any other statute, or taken any other action whatsoever against any of the plaintiffs. LEGAL STANDARD A motion to dismiss under Rule 12(b)(1) of the Federal Rules of Civil Procedure requires the party seeking to invoke the jurisdiction of a federal court to establish that the court has jurisdiction. See U.S. Ecology, Inc. v. U.S. Dep’t of Interior, 231 F.3d 20, 24 (D.C. Cir. 2000) (citing Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 103–04 (1998)); see also Grand Lodge of the Fraternal Order of Police v. Ashcroft, 185 F. Supp. 2d 9, 13 (D.D.C. 2001) (“[A] Rule 12(b)(1) motion imposes on the court an affirmative obligation to ensure that it is acting within the scope of its jurisdictional authority.”). In resolving a Rule 12(b)(1) motion, the court will accept as true the factual allegations contained in the complaint, but those allegations “will bear closer scrutiny in resolving a 12(b)(1) motion than in resolving a 12(b)(6) motion for failure to state a claim.” Grand Lodge, 185 F. Supp. 2d at 13–14 (internal quotations omitted). A court may consider material other than the allegations of the complaint in determining jurisdiction, as long as it continues to accept the factual allegations in the complaint as true. See Jerome Stevens Pharms., Inc. v. FDA, 402 F.3d 1249, 1253–54 (D.C. Cir. 2005). A Rule 12(b)(6) motion tests the legal sufficiency of the complaint. Browning v. Clinton, 292 F.3d 235, 242 (D.C. Cir. 2002). Although a plaintiff need not set forth “detailed factual allegations” to withstand a Rule 12(b)(6) motion, to establish the “grounds” of “entitlement to relief,” a plaintiff must furnish “more than labels and conclusions” or “a formulaic recitation of the elements of a cause of action.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555-56 (2007) (internal quotation marks and brackets 7 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 15 of 41 omitted). To survive a Rule 12(b)(6) motion, the complaint must contain sufficient factual matter to state a claim to relief that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). ARGUMENT I. Plaintiffs Fail to Allege Facts Sufficient to Establish Standing to Sue. Standing is a “threshold question in every federal case.” Warth v. Seldin, 422 U.S. 490, 498 (1975). Article III of the U.S. Constitution “limits the ‘judicial power’ of the United States to the resolution of ‘cases’ and ‘controversies.’” Valley Forge Christian Coll. v. Ams. United for Separation of Church & State, Inc., 454 U.S. 464, 471 (1982). The standing doctrine ensures that only those cases and controversies “that are of the justiciable sort referred to in Article III” are “resolved through the judicial process.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (quoting Whitmore v. Arkansas, 495 U.S. 149, 155 (1990)). To establish the “irreducible constitutional minimum of standing,” a plaintiff must establish three elements: (1) an “injury in fact,” which is “(a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical;” (2) “a causal connection between the injury and the conduct complained of;” and (3) a likelihood “that the injury will be redressed by a favorable decision.” Lujan, 504 U.S. at 560–61 (internal quotation marks and citations omitted). The burden of establishing each of these elements lies with the party invoking federal jurisdiction. Id. at 561. The Supreme Court has recently stated that the “standing inquiry has been especially rigorous when reaching the merits of the dispute would force [the Court] to decide whether an action taken by one of the other two branches of the Federal Government was 8 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 16 of 41 unconstitutional.” Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138, 1147, (2013) (quoting Raines v. Byrd, 521 U.S. 811, 819-20 (1997)). To establish standing to assert a preenforcement challenge under the First Amendment to a statute’s constitutionality, a plaintiff must show that “First Amendment rights are arguably chilled,” and that “there is a credible threat of prosecution.” Chamber of Commerce of U.S. v. Fed. Election Comm’n, 69 F.3d 600, 603 (D.C. Cir. 1995); see also Wayte v. United States, 470 U.S. 598, 610 n.11 (1985) (where a plaintiff alleges that certain conduct violates both his right to free speech and his right to petition in a similar manner, “we view these claims as essentially the same” because although the First Amendment rights “are separate guarantees, they are related and generally subject to the same constitutional analysis”); Borough of Duryea v. Guarnieri, 564 U.S. 379, 382 (2011). Courts more rarely entertain non-First Amendment preenforcement statutory challenges, but where such cases have survived, the party invoking jurisdiction has been required to show a “credible threat of prosecution,” just as he or she would in the First Amendment context. See, e.g., Holder v. Humanitarian Law Project, 561 U.S. 1, 15 (2010) (addressing preenforcement challenge raising First and Fifth Amendment claims). Plaintiffs’ stated intention to deploy computer programs that would gather data from the websites of various private corporations is not conduct that is protected under the First Amendment, and plaintiffs fail to allege a reasonable fear of future prosecution for the actions they wish to undertake. Thus, because the government has taken no action against plaintiffs in any form, and because plaintiffs are not facing a credible threat of imminent prosecution for their actions, plaintiffs lack standing to assert their First and Fifth Amendment claims. 9 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 17 of 41 A. Plaintiffs Fail to Allege that the Challenged Provision of the CFAA Chills Conduct Protected Under the First Amendment. For First Amendment protections to trigger, a plaintiff must be engaging in protected activity. See Cornelius v. NAACP Legal Def. & Educ. Fund, Inc., 473 U.S. 788, 797 (1985) (holding that if the allegedly restricted conduct is not protected speech activity, “[the court] need go no further.”). The Freedom of Speech Clause of the First Amendment protects both expressive conduct and pure speech, although “expressive conduct receives significantly less protection than pure speech.” Chai v. Dep’t of State, 466 F.3d 125, 133 (D.C. Cir. 2006) (citing Humanitarian Law Project v. Reno, 205 F.3d 1130, 1134-35 (9th Cir. 2000)). To constitute expressive conduct protected by the First Amendment, an act must be made with an “intent to convey a particularized message” that is likely to “be understood by those who viewed it.” Texas v. Johnson, 491 U.S. 397, 404 (1989) (quoting Spence v. Washington, 418 U.S. 405, 410–11 (1974)). While the message conveyed by the conduct need not be “narrow” or “succinctly articulable,” Hurley v. Irish-Am. Gay, Lesbian, and Bisexual Grp. of Bos., 515 U.S. 557, 569 (1995), some expression by the plaintiff is required. See Hodge v. Talkin, 799 F.3d 1145, 1168 (D.C. Cir. 2015), cert. denied, 136 S. Ct. 2009 (2016) (finding that regulation of “nonexpressive conduct . . . raise[s] no First Amendment concern in the first place”). Here, plaintiffs allege that the challenged provision of the CFAA has chilled their desire to deploy software technology designed to gather information from the websites of private corporations without the permission of those corporations and in a manner that the relevant website terms of use expressly prohibit. The systemic collection of information from the websites of non-consenting private entities is not conduct the First 10 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 18 of 41 Amendment protects, and thus plaintiffs are unable to assert a reasonable First Amendment chill with respect to that conduct. The Supreme Court has made clear that the First Amendment does not create an unrestrained right to acquire information for the purpose of subsequently conveying it, even where the information sought relates to a matter of public concern. See Zemel v. Rusk, 381 U.S. 1, 16-17 (1965). The plaintiff in Zemel argued that the Secretary of State’s decision to refuse to validate his passport for travel to Cuba violated his First Amendment rights under the theory that the Secretary’s decision impaired the plaintiff’s ability to acquire and subsequently convey information regarding the impact of the federal government’s Cuban policies. Id. at 3, 16. While the Court acknowledged that the Secretary’s action may have restricted “the flow of information concerning [Cuba],” it nevertheless rejected the contention that such a restriction implicated First Amendment protections: [T]o the extent that the Secretary’s refusal to validate passports for Cuba acts as an inhibition . . ., it is an inhibition of action. There are few restrictions on action which could not be clothed by ingenious argument in the garb of decreased data flow. For example, the prohibition of unauthorized entry into the White House diminishes the citizen’s opportunities to gather information he might find relevant to his opinion of the way the country is being run, but that does not make entry into the White House a First Amendment right. The right to speak and publish does not carry with it the unrestrained right to gather information. Id. at 16–17 (emphasis added). The Court subsequently reaffirmed that, while the First Amendment may protect certain aspects of news gathering in specific situations, there is no “constitutional right of access to news sources.” Houchins v. KQED, Inc., 438 U.S. 1, 10–11 (1978) (finding no constitutional violation in the denial of access to a jail for the purposes of investigating 11 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 19 of 41 jail conditions) (distinguishing Branzburg v. Hayes, 408 U.S. 665, 728 (1972)). There is thus “no basis for the claim that the First Amendment compels others—private persons or governments—to supply information.” Id. at 11; see also Putnam Pit, Inc. v. City of Cookeville, 221 F.3d 834, 840 (6th Cir. 2000) (holding that the First Amendment does not require the disclosure of parking ticket records in electronic form, as opposed to hard copy, even when information in that medium is sought by members of the press). The logic of Zemel, Houchins, and their progeny applies with equal force here. Plaintiffs admit that they are attempting to gather information from private parties without the consent of those parties and through methods that those private parties expressly prohibit. Plaintiffs Sandvig and Karahalios’ acknowledge that deployment of their data-scraping program would be prohibited by the terms of service of “virtually all real estate websites” that they intend to target. Compl. at ¶ 95. Plaintiffs Mislove and Wilson similarly acknowledge that their proposed information gathering activity violates the terms of service of the relevant websites implicated by their plan, and Plaintiff Media Works likewise avers that it intends “to violate certain website terms of service” in conducting its investigations. Id. at ¶ 131. But the First Amendment does not entitle members of the public to unfettered access to information held by private corporations, nor does it create a right to gather information from non-consenting private entities through any means that the information-gatherer deems most expedient. See Houchins, 438 U.S. at 10–11; Putnam Pit, Inc., 221 F.3d at 840. Thus, just as there is no First Amendment right to gather information by personally travelling to a sanctioned country, and no First Amendment right to gather information by visiting a jail without the permission of the warden, and no First Amendment right to access information in 12 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 20 of 41 electronic form rather than paper form, there is likewise no First Amendment right to gather information controlled by private entities by deploying a data-scraping computer program on the websites of those entities without their permission and in a manner that the entities explicitly prohibit. Because plaintiffs’ proposed data-gathering conduct is not protected under the First Amendment, they cannot establish a First Amendment chill with respect to that conduct. Accordingly, plaintiffs fail to meet the first requirement of establishing standing to allege a preenforcement First Amendment statutory challenge. See Chamber of Commerce, 69 F.3d at 603. B. Plaintiffs Fail to Assert a Credible Threat of Prosecution. Plaintiffs additionally lack standing for the independent reason that they have not alleged that a credible injury is imminent. When expressive activity is at issue, a “party has standing to challenge, pre-enforcement, even the constitutionality of a statute if First Amendment rights are arguably chilled, so long as there is a credible threat of prosecution.” Chamber of Commerce, 69 F.3d at 603–04 (former emphasis in original, latter emphasis added). The assertion of a “subjective chill alone will not suffice to confer standing on a litigant bringing a pre-enforcement facial challenge to a statute allegedly infringing on the freedom of speech . . . .” A.N.S.W.E.R. v. D.C., 589 F.3d 433, 435 (D.C. Cir. 2009) (quotations omitted). A plaintiff’s ability to claim a credible threat of prosecution “depends on how likely it is that the government will attempt to use [the challenged] provisions against them—that is, on the threat of enforcement—and not on how much the prospect of enforcement worries them.” Am. Library Ass’n v. Barr, 956 F.2d 1178, 1193 (D.C. Cir. 13 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 21 of 41 1992). In cases “[w]here there is no expectation of enforcement, there is unlikely to be a credible threat of prosecution.” Johnson v. D.C., 71 F. Supp. 3d 155, 160 (D.D.C. 2014) (internal quotation marks omitted). The likelihood of enforcement depends on the “full panoply of circumstances” present in each case. Id. Factors that a court may consider include “the history of enforcement of the challenged statute to like facts, any threats of enforcement, and a government’s disavowal of any intention to prosecute on the basis of the Government’s own interpretation of the statute and its rejection of the plaintiff's interpretation as unreasonable.” Id. (citing Blum v. Holder, 744 F.3d 790, 798 (1st Cir. 2014) and Hill v. City of Houston, 789 F.2d 1103, 1107 (5th Cir. 1986)). “[C]ourts often find the absence of a specific threat [of enforcement] fatal.” Id. (citing Seegars v. Gonzales, 396 F.3d 1248, 1252 (D.C. Cir. 2005)). Plaintiffs here make no allegation that they have received any threat of enforcement; they cite only two cases as evidence that the government might enforce the challenged provision of the CFAA in this context, but one of those cases did not involve terms of service violations at all, and both cases involved conduct that occurred in furtherance of a separate crime or tortious act or that resulted in substantial harm to the target, which is a context substantively dissimilar to the allegations in the instant matter; and the Department of Justice has publically stated to Congress that it has no intention of prosecuting harmless terms of service violations that are not in furtherance of other criminal activity. Accordingly, plaintiffs are incapable of stating a credible threat of imminent prosecution for the activity alleged in their Complaint. Plaintiffs cite two cases for the proposition that the government will criminally prosecute individuals who access a website in a manner that violates the website’s terms 14 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 22 of 41 of service, both of which are readily distinguishable from the allegations contained in the complaint. Compl. at ¶ 31 (citing United States v. Drew, 259 F.R.D. 449, 452 (C.D. Cal. 2009) and United States v. Lowson, Crim. No. 10-114 KSH, 2010 WL 9552416, at *1 (D.N.J. Oct. 12, 2010) (unreported)). The indictment in Drew charged the defendant with one count of conspiracy and three counts of violating the felony portion of the CFAA, which prohibits certain types of access to a computer in furtherance of a crime of tortious act. Drew, 259 F.R.D. at 452. The government accused the defendant of creating a fake social media account in violation of the terms of service of the social media website for the purposes of committing the tort of intentional infliction of emotional distress. Id. The defendant in that matter had used the fake account to torment a classmate of her daughter’s, and the classmate ultimately committed suicide as a result of defendant’s harassment. Id. The jury acquitted the defendant under the felony provision of the CFAA—which required the showing of that the violation occurred in furtherance of a tortious act—but issued a conviction for under the challenged provision, which was deemed to be a “lesser included” offense. Id. The trial court set aside the conviction under the lesser included offense reasoning that a conviction based solely on a website term of use violation “runs afoul of the void-for-vagueness doctrine.” Id. at 468. The government did not appeal that holding; it has not subsequently pursued charges in any matter under the challenged provision based solely on website terms of use violations; and the Ninth Circuit subsequently interpreted the “exceeds authorized access” language of the CFAA as not extending to terms of use restrictions. See Nosal, 676 F.3d at 863. Thus, contrary to plaintiffs’ contention, the holdings Drew and Nosal do not enhance the likelihood that the government will pursue criminal charges under the challenged 15 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 23 of 41 provision for website terms of use violations, rather, those holdings diminish that prospect. Lowson involved a nation-wide scheme of fraudulent misrepresentation and computer hacking to purchase event tickets surreptitiously over the internet for subsequent resale. See Superseding Indictment at 1-2, Lowson, Crim. No. 10-114 KSH, 2010 WL 9552416 (attached hereto as Exhibit 1). The Lowson defendants impersonated thousands of tickets buyers while purchasing more than one million tickets to events across the nation. Id. The defendants ignored cease and desist letters from ticket vendors, adapted their technology to defeat specific steps taken to block their activities, and ultimately received more than $25 million dollars in illegitimate profit from their scheme. Id. at 1-2. Importantly, the government and the Court stressed in that case that proof of the unauthorized access element of the charges did not rely simply on website terms of use violations: “as the government goes to pains to stress, and as the indictment makes clear, the unauthorized access charges at the heart of this indictment involve allegations of breaches of both contract and code-based restrictions.” Lowson, 2010 WL 9552416, at *6 (expressly distinguishing the allegations from those at issue in Drew) (emphasis added); see also Superseding Indictment ¶ 9 (Ex. 1) (describing some of defendants efforts to defeat code-based encryption access restrictions). Thus, Lowson is distinguishable not only because the defendants there were not engaged in harmless terms of service violations akin to the activity plaintiffs here allege, but also because the government used code-based access breaches to establish unauthorized access in that matter, and plaintiffs do not allege an intent to engage in such breaches here. 16 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 24 of 41 Unlike the conduct at issue in Lowson and Drew, plaintiffs here do not aver that their proposed activities are in furtherance of any crime or tort, that the activities would result in any substantial harm to the targeted entities, or that they intend to engage in code-based encryption breaches to access targeted websites. Plaintiffs have not been threatened with any enforcement action, and they point to no instances of CFAA enforcement concerning the type of activity in which they intend to engage. Courts in this circuit have found that a history of non-enforcement in similar circumstances and the lack of the government’s expressed intent to prosecute a given plaintiff make it highly unlikely that a plaintiff can allege a credible threat of prosecution. See, e.g., Seegars, 396 F.3d at 1252; Johnson, 71 F. Supp. 3d at 161. In Johnson, an animal rights activist who espoused the theory that no animal was capable of being “owned,” brought a First Amendment preenforcement challenge to a D.C. statute making it illegal to “falsely deny ownership of any animal.” Id. at 157. The court held that the plaintiff’s fears of prosecution under the statute were not objectively reasonable because “the government has never threatened [the plaintiff] with prosecution,” and “there is no evidence that the government has ever enforced the statute on these facts.” Id. at 161-62. Like the Johnson plaintiff, the plaintiffs here cannot establish a credible fear of imminent harm in the absence of any threated enforcement against them or any enforcement of the statute in similar circumstances. See also Navegar, Inc. v. United States, 103 F.3d 994, 998, 1000– 01 (D.C. Cir. 1997) (holding that certain plaintiffs who the government singled out by name for a potential enforcement action could establish standing, but other plaintiffs who asserted only a generalized fear of potential future enforcement failed to meet the standing requirements). 17 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 25 of 41 The credibility of plaintiffs’ alleged fear of prosecution is even further diminished given that the Department of Justice has publically stated that it “has no interest in prosecuting harmless violations of use restrictions” under the CFAA. See “Cyber Crime: Modernizing Our Legal Framework for the Information Age,” Before the Subcomm. On Crime and Terrorism of the Senate Comm. On the Judiciary, 114th Cong., at 6 (2015) (statement of David M. Bitkower, Deputy Assistant Attorney General, Criminal Division, Department of Justice) (attached hereto as Exhibit 2). Indeed, the Department has advocated that Congress amend the CFAA to clarify that “to constitute a crime . . . not only must an offender access a protected computer in excess of authorization and obtain information, but the information must be worth $5,000 or more, the access must be in furtherance of a separate felony offense, or the information must be stored on a Government computer.” Id. at 7. None of those circumstances applies to the conduct in which plaintiffs allege a desire to engage. Accordingly, because plaintiffs fail to allege any facts suggesting it is likely that the government will attempt to enforce the challenged provision of the CFAA against them, their purported fears of potential enforcement amount to little more than a subjective chill, which is insufficient to confer preenforcement standing to assert a First or Fifth Amendment challenge to a federal statute. See Am. Library Ass’n, 956 F.2d at 1193; A.N.S.W.E.R., 589 F.3d at 435; Firearms Imp./Exp. Roundtable Trade Grp. v. Jones, 854 F. Supp. 2d 1, 19–20 (D.D.C. 2012), aff’d sub nom. Firearms Imp./Exp. Roundtable Trade Grp. v. ATFE, 498 F. App’x 50 (D.C. Cir. 2013) (plaintiffs lack standing to assert a Fifth Amendment vagueness claims where “the record contains no evidence of even an intent to investigate plaintiffs” and plaintiffs’ only assertion of injury 18 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 26 of 41 consists of a fear of “possible criminal prosecution” and a claim that they “cannot determine what is illegal and what is legal”). C. The Doctrine of “Tester Standing” Is Inapplicable in this Context. Plaintiffs refer in their complaint to the Supreme Court’s decision in Havens Realty Corp. v. Coleman, 455 U.S. 363, 373 (1982), for the proposition that “housing testers have standing to sue for [Federal Housing Act] violations.” Compl. at ¶ 44. There, the Court recognized that the injury in fact element of traditional Article III standing “may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing.” Havens Realty Corp., 455 U.S. at 373 (internal quotation marks and citations omitted). The FHA created an enforceable right to receive truthful information about available housing, see 42 U.S.C. § 3604(d), thus, the Court held that individuals testing the real estate market who had received misrepresentations made unlawful by the FHA had suffered a statutorily cognizable injury. Havens Realty Corp., 455 U.S. at 373-74. Conversely, individuals testing the market who received accurate information could not claim the same statutory injury; rather, those individuals were required to identify a separate, traditional injury in fact to satisfy the requirements of Article III. Id. at 374-75. Here, while plaintiffs allege an intention to engage in the testing of certain corporate websites involved in the real estate industry as well as other industries, see, e.g., Compl. at ¶ 71, they do not allege that that they have received misrepresentations in violation of the enforceable provisions of the FHA or in violation of any other federal statute. Accordingly, they are unable to establish tester standing based on a statutory injury akin to the one recognized in Havens Realty Corp. 19 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 27 of 41 II. Plaintiffs Fail to State a Claim Upon Which Relief Can Be Granted. Plaintiffs’ failure to assert an injury sufficient to establish Article III standing strips this Court of jurisdiction, rendering their First and Fifth Amendment claims subject to dismissal pursuant to Rule 12(b)(1). Assuming, arguendo, that plaintiffs could satisfy the standing requirements of Article III, the Court should nevertheless dismiss the complaint for failure to state a claim upon which relief can be granted pursuant to Rule 12(b)(6). Because plaintiffs fail to allege that they have been prohibited from engaging in any First Amendment protected activity—under either the Freedom of Speech, Press, or Petition Clauses—their First Amendment claims fail as a matter of law. Moreover, plaintiffs’ Free Speech Clause claim fails for the additional reason that plaintiffs are unable to identify a free speech forum in which their allegedly protected conduct is proscribed; their overbreadth challenge cannot survive against a law that is not specifically addressed to speech or to conduct necessarily intertwined with speech, such as picketing or demonstrating; and their Petition Clause claim fails for the additional reason that the challenged provision of the CFAA does not prohibit petitions to the government, nor does it sanction individuals who submit a petition. Plaintiffs’ Fifth Amendment claims are also subject to Rule 12(b)(6) dismissal. Plaintiffs fail to state a vagueness claim because the challenged provision does not prohibit constitutionally protected activity, contains a mens rea element, and has been permissibly applied in a variety of contexts. Their claim under the non-delegation doctrine fails because the challenged provision of the CFAA does not contain the type of legislative or executive delegation that the Supreme Court has declared constitutionally impermissible. At bottom, plaintiffs cannot state any claim sanctioning the facial 20 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 28 of 41 invalidation of a federal criminal statute that has never been applied to their conduct. Accordingly, the Court should dismiss their complaint. A. Plaintiffs Fail to State a Freedom of Speech Claim. As mentioned above, the first step a court must take in addressing the merits of a First Amendment claim is to determine whether allegedly restricted conduct is protected speech activity, “for, if it is not, [the court] need go no further.” Cornelius v. NAACP Legal Def. & Educ. Fund, Inc., 473 U.S. 788, 797 (1985). If it determines the conduct at issue is protected, the court will then engage in a two-step inquiry: (1) it will examine nature of forum where the speech was made and, (2) it will then assess whether the government’s action in restricting the speech was legitimate in light of the applicable standard of review. Id. Where no free speech forum is implicated by the proposed conduct, regulation of speech or conduct based on the content of the message is nonetheless presumed impermissible. See Sons of Confederate Veterans, Inc. ex rel. Griffin v. Comm'r of Virginia Dep’t of Motor Vehicles, 288 F.3d 610, 622 (4th Cir. 2002). Moreover, government restrictions on expressive conduct generally “are not subject to the exacting scrutiny which restrictions on pure speech are subject to under the First Amendment.” United States v. Eichman, 731 F. Supp. 1123, 1128 (D.D.C. 1990). Thus, “when ‘speech’ and ‘nonspeech’ elements are combined in the same course of conduct, a sufficiently important governmental interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms.” United States v. O'Brien, 391 U.S. 367, 376 (1968). Here, plaintiffs fail to meet the first step of the relevant First Amendment analysis because the conduct they allege as subject to potential regulation is not conduct that is 21 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 29 of 41 protected under the First Amendment. As detailed above, plaintiffs cannot assert a right under any clause of the First Amendment to the systemic collection of information from the websites of non-consenting private entities through a means that those entities expressly prohibit. See infra Part I.A. The Supreme Court has rejected analogous attempts to dress up the regulation of non-speech activity in “the garb of decreased data flow” in an attempt to invoke First Amendment protections. Zemel, 381 U.S. at 16-17. The “right to speak and publish does not carry with it the unrestrained right to gather information,” and no court has even remotely held that the First Amendment provides individuals the right to deploy unwanted computer programs on the websites of private entities in an effort to collect corporate data from those entities. Id. Thus, as plaintiffs’ proposed conducted is not protected speech activity, the court “need go no further” in addressing their First Amendment claims. Cornelius, 473 U.S. at 797. But even assuming plaintiffs’ proposed activity could fall within the First Amendment’s protections, which it does not, their claims would nevertheless fail at the next step of the First Amendment analysis because plaintiffs do not contend that the challenged provision of the CFAA regulates their activities in a free speech forum. See Hudgens v. NLRB, 424 U.S. 507, 519-21 (1976) (holding that, absent a scenario involving a company-owned town, private property does not constitute a free speech forum); Lloyd Corp. v. Tanner, 407 U.S. 551, 567 (1972) (the First Amendment does not protect the distribution of handbills on private property contrary to the wishes of the property owner and contrary to a policy enforced against all hand-billing). Under the Supreme Court’s forum analysis, regulations of speech are subject to varying levels of scrutiny depending on the forum in which the speech occurs. The Supreme Court has 22 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 30 of 41 recognized three categories of free speech fora: (1) a traditional public forum such as streets, parks, and sidewalks; (2) a designated public forum, which the government creates by intentionally opening a non-traditional forum for public discourse; and (3) a nonpublic forum, which the government creates when it grants access to its property or resources to private speakers. See Sons of Confederate Veterans, Inc. ex rel. Griffin, 288 F.3d at 622 n.10. The forum analysis applied in First Amendment cases “has traditionally applied to . . . property owned by the government,” not property controlled by a private corporation. Putnam Pit, Inc., 221 F. 3d at 842. Where no free speech forum is involved, the government is nevertheless prohibited from regulating speech “based on . . . the message it conveys . . . [s]uch viewpoint discrimination presumptively is impermissible whether it occurs within or outside a private speech forum.” Sons of Confederate Veterans, Inc. ex rel. Griffin, 288 F.3d at 622 (citing Rosenberger v. Rector & Visitors of Univ. of Virginia, 515 U.S. 819, 829-30 (1995) and Ark. Educ. Television Com’n v. Forbes, 523 U.S. 666, 676 (1998)). The website of a private entity does not constitute a free speech forum. In Cyber Promotions, Inc. v. American Online, Inc., 948 F. Supp. 436, 442-45 (E.D. Pa. 1996), the court rejected a First Amendment challenge to a separate provision of the CFAA in holding that the First Amendment does protect a private company’s (Cyber Promotions) attempts to send unsolicited e–mail advertisements to subscribers of another private company (America Online (“AOL”)) through AOL’s website. The court rejected Cyber Promotions’ argument that AOL’s decision to open its website “to the public, free of charge to any user, where public discourse, conversations and commercial transactions can and do take place” was sufficient to render the website a public forum. Id. at 442. 23 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 31 of 41 Rather, the Court adopted the analysis of Hudgens and Lloyd Corp., Ltd. to hold that, because AOL did not serve municipal functions equivalent to those exercised in a company-town, AOL’s website was not the equivalent of state-run property. Id. Accordingly, Cyber Promotions had “no right under the First Amendment” to use AOL’s website to send unsolicited e-mail. Id. at 445. Like the facts of Cyber Promotions, the conduct at issue in this case takes place not on government-run property, but rather on websites owned and controlled by private corporations. Because no free speech forum is implicated, the challenged provision would be constitutionally impermissible only if it authorized the government to engage in viewpoint discrimination in a private forum. It does not, and plaintiffs have made no allegations to the contrary. Accordingly, because plaintiffs’ proposed activity does not implicate a free speech forum, their First Amendment claims lack merit. See Hudgens, 424 U.S. at 519-21. B. Plaintiffs Fail to State a Claim Under the Overbreadth Doctrine. Plaintiffs also allege that the challenged provision of the CFAA is constitutionally invalid under the First Amendment because it is facially overbroad. See Compl. at ¶ 183. Under the overbreadth doctrine “[a] defendant being prosecuted for speech or expressive conduct may challenge the law on its face if it reaches protected expression, even when that person’s activities are not protected by the First Amendment.” R.A.V. v. City of St. Paul, 505 U.S. 377, 411–12 (1992). The doctrine is grounded in the idea that “the possible harm to society in permitting some unprotected speech to go unpunished is outweighed by the possibility that protected speech of others may be muted.” Broadrick v. Oklahoma, 413 U.S. 601, 612 (1973). The Supreme Court has admonished, however, 24 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 32 of 41 that the overbreadth doctrine is “strong medicine” that should be administered “only as a last resort.” L.A. Police Dep’t v. United Reporting Publ’g Corp., 528 U.S. 32, 39 (1999). “Rarely, if ever, will an overbreadth challenge succeed against a law or regulation that is not specifically addressed to speech or to conduct necessarily associated with speech (such as picketing or demonstrating).” Virginia v. Hicks, 539 U.S. 113, 124 (2003). To assert a facial overbreadth claim, plaintiffs must demonstrate that the challenged provision of the CFAA (1) “could never be applied in a valid manner,” or (2) that even though it may be validly applied to some, “it nevertheless is so broad that it ‘may inhibit constitutionally protected speech of third parties.’” 1 New York State Club Ass’n, Inc. v. City of New York, 487 U.S. 1, 11 (1988). “[T]he first kind of facial challenge will not succeed unless the court finds that every application of the statute created an impermissible risk of suppression of ideas.” Id. “[T]he second kind of facial challenge will not succeed unless the statute is ‘substantially’ overbroad, which requires the court to find a realistic danger that the statute itself will significantly compromise recognized First Amendment protections of parties not before the Court.” Id. Plaintiffs are incapable of stating a claim under the first style of facial overbreadth challenge because they do not contend that the challenged provision could never be validly applied. To the contrary, multiple courts have reached an interpretation of the provision that survives constitutional scrutiny in the face of challenges similar to the ones plaintiffs present here. See, e.g., Citrin, 440 F.3d at 420; John, 597 F.3d at 272; Nosal, 676 F.3d at 863. Thus, because a facial overbreadth challenge cannot be “invoked when a limiting construction has been or could be placed on the challenged statute,” any 1 The Supreme Court has noted that this latter kind of facial challenge is properly thought of as “an exception to ordinary standing requirements.” New York State Club Ass’n, Inc., 487 U.S. at 11. 25 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 33 of 41 attempt to assert a facial overbreadth challenge here on the grounds that the provision can never be validly applied must fail. Broadrick, 413 U.S. at 613. Plaintiffs are also incapable of asserting the second type of overbreadth challenge, which requires them to show that the statute is “substantially” overbroad. See Virginia, 539 U.S. at 122 (“The overbreadth claimant bears the burden of demonstrating, from the text of [the law] and from actual fact, that substantial overbreadth exists.”). “The ‘mere fact that one can conceive of some impermissible applications of a statute is not sufficient to render it susceptible to an overbreadth challenge.’” United States v. Williams, 553 U.S. 285, 303 (2008) (quoting Members of City Council of Los Angeles v. Taxpayers for Vincent, 466 U.S. 789, 800 (1984)). Moreover, the concerns that animate the overbreadth doctrine “attenuate[] as the otherwise unprotected behavior that it forbids the State to sanction moves from ‘pure speech’ toward conduct and that conduct—even if expressive—falls within the scope of otherwise valid criminal laws that reflect legitimate state interests in maintaining comprehensive controls over harmful, constitutionally unprotected conduct.” Broadrick, 413 U.S. at 615–16. “Although such laws, if too broadly worded, may deter protected speech to some unknown extent, there comes a point where that effect . . . cannot . . . justify invalidating a statute on its face[.]” Id. In such instances, “whatever overbreadth may exist should be cured through case-by-case analysis of the fact situations to which its sanctions . . . may not be applied.” Id.; see also Hicks, 539 U.S. at 118–19 (A “showing that a law punishes a substantial amount of protected free speech” must be “judged in relation to the statutes plainly legitimate sweep,” and invalidates the law “unless a limiting construction or partial invalidation” 26 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 34 of 41 suffices to eliminate the constitutional concerns.) (internal quotation marks and citations omitted). Here, the challenged provision of the CFAA regulates conduct, not pure speech, and the conduct subject to its regulation is not the type that is “necessarily associated with speech (such as picketing or demonstrating).” Hicks, 539 U.S. at 124. The “plainly legitimate sweep” of the CFAA is evident—the statute regulates computer crimes, which is a clearly legitimate state interest. Broadrick, 413 U.S. at 615–16; S. Rep. 104-357 at 5 (“As computers continue to proliferate in businesses and homes, and new forms of computer crimes emerge, Congress must remain vigilant to ensure that the (CFAA) . . . provides law enforcement with the necessary legal framework to fight computer crime.”). Thus, regardless of whether “one can conceive of some impermissible application[]” of the challenged provision, the provision is not “susceptible to an overbreadth challenge,” Williams, 553 U.S. at 303, and any First Amendment deficiencies that may spring from the breadth of the statute must be cured not by facial invalidation, but “through case-by-case analysis.” Broadrick, 413 U.S. at 622. C. Plaintiffs Fail to State a Claim Under the Petition Clause. The First Amendment guarantees “the right of the people . . . to petition the Government for a redress of grievances.” U.S. Const. amend. I. Generally speaking, although the right to petition and the right to free speech are separate guarantees, they are related and generally subject to the same constitutional analysis. Wayte, 470 U.S. at 610 n.11; Borough of Duryea, 564 U.S. at 382. A claim under the Petition Clause arises where the government infringes upon the right to petition either by a general prohibition against certain forms of advocacy or by imposing sanctions for the expression of 27 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 35 of 41 particular views the government opposes. See Smith v. Ark. State Highway Emps., Local 1315, 441 U.S. 463, 464 (1979) (per curiam). The First Amendment guarantees only that an individual may “speak freely and petition openly” and be free from retaliation for doing so; but there is no affirmative obligation on the government to listen or respond. Id. at 465. The challenged provision of the CFAA does not prohibit petitions to the government, nor does it impose sanctions for the expression of particular views that the government opposes. Moreover, plaintiffs do not allege that they have been denied in any specific attempt to petition the government or that they have been sanctioned as a result of submitting a petition. Accordingly, plaintiffs’ Petition Clause claim must be dismissed. See Smith, 441 U.S. at 464; Nat'l Ass'n for the Advancement of MultiJurisdiction Practice v. Roberts, Civ. Action No. 13-01963-NMG, 2015 WL 10459071, at *11 (D.D.C. Dec. 31, 2015) (rejecting a Petition Clause claim where the regulation at issue did not facially “restrict [an individual’s] ability . . . to file petitions,” and where there was no allegation that enforcement of the regulation had “anything to do with the filing of petitions”). Plaintiffs’ claim appears to be premised on the theory that the challenged provision of the CFAA violates the Petition Clause because it might restrict plaintiffs’ ability to gather information from corporate websites in the manner they desire, thereby hampering their ability to raise a successful claim of discrimination at some later proceeding before a court or other administrative body. See Compl. ¶ 187-193. But the Petition Clause does not create a right to gather information through means that a potential petitioner deems most likely to be helpful in redressing a potential grievance. 28 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 36 of 41 Indeed, the guarantees of the Petition Clause are limited in scope; the D.C. Circuit has held that the Petition Clause does not guarantee a right to “the possibility of a remedy” or even the “right to receive a government response to or official consideration of a petition.” Am. Bus Ass’n v. Rogoff, 649 F.3d 734, 739 (D.C. Cir. 2011) (emphasis in original); see also Minn. State Bd. for Cmty. Colleges v. Knight, 465 U.S. 271, 285 (1984) (“Nothing in the First Amendment . . . suggests that the rights to speak, associate, and petition require government policymakers to listen or respond to individuals’ communications on public issues.”). Thus, any claim plaintiffs attempt to state that is premised on the theory that the Petition Clause protects their ability to remedy a potential grievance must fail. D. Plaintiffs Fail to State a Claim Under the Fifth Amendment Vagueness Doctrine. Plaintiffs allege generally that the term “exceeds authorized access” as it appears in the CFAA is “on its face” unconstitutionally vague. Compl. ¶¶ 170-171. The voidfor-vagueness doctrine requires that a criminal statute must contain “relatively clear guidelines as to prohibited conduct” and provide “objective criteria” to evaluate whether a crime has been committed. Gonzales v. Carhart, 550 U.S. 124, 149 (2007). The Supreme Court has cautioned that “difficulty in determining whether certain marginal offenses are within the meaning of the language under attack as vague does not automatically render a statute unconstitutional . . . [i]mpossible standards of specificity are not required.” Jordan v. De George, 341 U.S. 223, 231 (1951). “It is well established that vagueness challenges to statutes which do not involve First Amendment freedoms must be examined in the light of the facts of the case at hand.” United States v. Mazurie, 419 U.S. 544, 550 (1975). Moreover, “courts must consider whether a 29 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 37 of 41 provision is fairly ‘amenable to a limiting construction’ before striking it down as vague.” United States v. Bronstein, 151 F. Supp. 3d 31, 38 (D.D.C. 2015) (quoting Skilling v. United States, 561 U.S. 358, 405 (2010)). A plaintiff bringing a preenforcement facial vagueness challenge “bears a heavy burden.” SEIU, Local 82 v. D.C., 608 F. Supp. 1434, 1446–47 (D.D.C. 1985). The Supreme Court has found that a facial vagueness challenge may be appropriate where “vagueness permeates the text” of “a criminal law that contains no mens rea requirement . . . and infringes on constitutionally protected rights.” City of Chicago v. Morales, 527 U.S. 41, 55 (1999). But plaintiffs here are incapable of stating a facial vagueness claim under the City of Chicago standard because, unlike the ordinance at issue in that case, which expressly regulated a recognized liberty interest protected by the Due Process Clause and which contained no mens rea requirement, the challenged provision of the CFAA does not criminalize constitutionally protected conduct, see infra at Pt. I.A, and it contains the mens rea of intentionality. 18 U.S.C. § 1030(a)(2). Accordingly, the concerns animating the holding in City of Chicago are not present here. See Gonzales, 550 U.S. at 149 (“[S]cienter requirements alleviate vagueness concerns.”); Colautti v. Franklin, 439 U.S. 379, 395 (1979) (“This Court has long recognized that the constitutionality of a vague statutory standard is closely related to whether that standard incorporates a requirement of mens rea.”). Moreover, multiple courts have overcome vagueness challenges to the challenged provision in light of the particular facts at issue, while others have interpreted the provision in a manner that allows it to be permissibly applied in a variety of settings. See, e.g., Nosal, 676 F.3d at 859-63 (alleviating constitutional concerns by interpreting 30 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 38 of 41 the term “exceeds authorized access” as not “extend[ing] to violations of use restrictions”); United States v. Auernheimer, No. 11-CR-470 SDW, 2012 WL 5389142, at *3 (D.N.J. Oct. 26, 2012), rev’d on other grounds, 748 F.3d 525 (3d Cir. 2014) (holding that “a reasonable person would know” that hacking into AT&T servers and stealing information concerning thousands of e-mail addresses “puts [them] at risk of punishment under the statue”); see also Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178, 1187 (N.D. Cal. 2013) (provision barring unauthorized access to publicly available websites was not unconstitutionally vague as applied to user that continued to pull data from a publicly accessible classified ad website after the site operator sent it a cease and desist letter and took steps to block access to the site from devices associated with the user). Thus, because the challenged provision may be “amenable to a limiting construction” that alleviates potential constitutional concerns, plaintiffs’ preenforcement facial vagueness challenge, which seeks an order enjoining enforcement of the provision in all instances, cannot survive. See Skilling, 561 U.S. at 405. E. Plaintiffs Fail to State a Claim Under the Non-Delegation Doctrine. Article I of the Constitution provides that “All legislative Powers . . . shall be vested in a Congress of the United States.” U.S. Const. Art. I, § 1. The Supreme Court has interpreted that provision to permit Congress to delegate legislative power to both public and private entities, subject to certain constraints. See, e.g., Mistretta v. United States, 488 U.S. 361, 372 (1989); Sunshine Anthracite Coal Co. v. Adkins, 310 U.S. 381, 398 (1940). The Supreme Court has not invalidated a law on the grounds of an unconstitutional delegation to a private entity since 1936. See generally Carter v. Carter Coal Co., 298 U.S. 238 (1936). Plaintiffs contend that Congress violated the non- 31 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 39 of 41 delegation doctrine in enacting the CFAA because the statute allows private entities to define the terms of service that govern their websites, and those terms of service might later be used to determine whether the government can meet one of the multiple showings needed to establish a CFAA violation. Compl. ¶¶ 199-202. As an initial matter, the challenged provision of the CFAA does not contain an express delegation of legislative authority, and it does not provide individual website operators the power to make law, adjudicate liability, or exercise executive powers. Thus, the challenged provision is readily distinct from every case in which a federal statute has suffered from a deficiency under the non-delegation doctrine. For example, in Carter, Congress delegated to a private commission the authority to set maximum hours and minimum wages in the coal mining industry and to enforce those rules against dissenting coal producers. 298 U.S. at 310-11. The Supreme Court rejected the delegation because the power conferred on the commission was “in effect, the power to regulate the affairs of an unwilling minority” with little or no federal oversight. Id. Unlike Carter, the CFAA does not delegate to every individual who operates a website the power to create and enforce regulations that are binding on third parties. Accordingly, the challenged provision does not run afoul of the Court’s limited private non-delegation doctrine jurisprudence. Moreover, the Supreme Court has held that a generally applicable statute does not violate the non-delegation doctrine simply because its application depends on the actions of private citizens. See New Motor Vehicle Bd. of Cal. v. Orrin W. Fox Co., 439 U.S. 96, 109 (1978). Under plaintiffs’ theory, an entire universe of criminal laws that rely in part on the authorization of private individuals would be rendered unconstitutional. Federal 32 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 40 of 41 and state trespass laws, for example, criminalize conduct where there trespasser lacks authorization from the property owner to access the property in question. See, e.g., D.C. Code § 22-3302 (2013) (“Any person who, without lawful authority, shall enter . . . any private dwelling . . . or other property . . . against the will of the lawful occupant . . . shall be deemed guilty of a misdemeanor.”); 25 C.F.R. § 11.411 (criminalizing trespass on federal property). Similarly, federal criminal laws regulating trade secrets, copyrights, identity theft, embezzlement, and many other areas are dependent on whether private individuals or corporations provide authorization for the conduct in question. See, e.g., 18 U.S.C. § 1831 (providing criminal penalties for the receipt, appropriation, or conveyance of trade secrets without authorization of the trade secret holder); 17 U.S.C. §§ 106, 506 (providing copyright owners the exclusive right to authorize reproduction of copyrighted work and creating a criminal offense for copyright infringement); 18 U.S.C. § 1029 (providing criminal penalties for unauthorized use of “access devices,” such as an individual’s bank account number or credit card to obtain a thing of value). Under plaintiffs’ interpretation of the non-delegation doctrine, these statutes and potentially large swaths of the federal criminal code would be deemed invalid. Such an outcome is not supported by any controlling law or precedent. CONCLUSION For the foregoing reasons, defendant respectfully request that the Court dismiss the Complaint pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure. A proposed order is attached. 33 Case 1:16-cv-01368-JDB Document 10-1 Filed 09/09/16 Page 41 of 41 September 9, 2016 Respectfully Submitted, BENJAMIN C. MIZER Principal Deputy Assistant Attorney General JOHN R. TYLER Assistant Branch Director /s/ Stephen J. Buckingham STEPHEN J. BUCKINGHAM (MD Bar) Trial Attorney U.S. Department of Justice, Civil Division Tel: (202) 514-3330 Fax: (202) 616-8470 Email: stephen.buckingham@usdoj.gov P.O. Box 883 Ben Franklin Station Washington, DC 20530 Attorneys for Defendant 34