Sandvig v. Sessions (315 F. Supp. 3d 1, 2018)

JOHN D. BATES, United States District Judge

It's a dangerous business, reading the fine print. Nearly every website we visit features Terms of Service ("ToS"), those endless lists of dos and don'ts conjured up by lawyers to govern our conduct in cyberspace. They normally remain a perpetual click away at the bottom of every web page, or quickly scrolled past as we check the box stating that we agree to them. But to knowingly violate some of those terms, the Department of Justice tells us, could get one thrown in jail. This reading of federal law is a boon to prosecutors hoping to deter cybercrime. Yet it also creates a dilemma for those with more benign intentions. Plaintiffs in this case, for instance, are researchers who wish to find out whether websites engage in discrimination, but who have to violate certain ToS to do so. They have challenged the statute that they allege criminalizes their conduct, saying that it violates their free speech, petition, and due process rights. First, however, they must show that they have a sufficient injury to make it through the courthouse door, and that their suit is plausible enough to continue. For the following reasons, the Court finds that plaintiffs have standing, and that they can bring one (but not the rest) of their claims.

I. BACKGROUND

This case centers on a few sections of the Computer Fraud and Abuse Act (CFAA), a law dedicated to "deterring the criminal element from abusing computer technology." H.R. Rep. No. 98-894, at 4 (1984). Plaintiffs directly challenge one section, referred to here as the Access Provision, which sweeps in the greatest amount of conduct. The Access Provision states that "[w]hoever ... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer ... shall be punished as provided in subsection (c) of this section." 18 U.S.C. § 1030(a)(2)(C). The CFAA defines "protected computer" to mean, among other things, "a computer ...which is used in or affecting interstate or foreign commerce or communication." Id. § 1030(e)(2)(B). This definition encompasses just about all computers hooked up to the Internet-including computers that house website servers. See, e.g., United States v. Nosal, 676 F.3d 854, 859 (9th Cir. 2012). The statute also defines "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). Thus, the Access Provision applies to anyone who purposely accesses an Internet-connected computer without authorization, or uses a legitimate authorization to receive or change information that they are not supposed to, and thereby obtains information from the computer.

The CFAA provides for a fine and/or imprisonment for up to one year upon a first violation of the Access Provision, or up to ten years for any further offenses. Id. § 1030(c)(2)(A), (C). However, the punishment for an initial violation rises to a sentence of up to five years' imprisonment if the offense (1) "was committed for purposes of commercial advantage or private financial gain," (2) was "in furtherance of any criminal or tortious act in violation of the Constitution" or state or federal law, or (3) involved obtaining information valued at more than $5,000. Id. § 1030(c)(2)(B). Thus, meeting one of these three conditions makes a first violation a felony; if none are met, the first violation is a misdemeanor.

Plaintiffs in this case are four professors and a media organization: Christian W. Sandvig of the University of Michigan; Kyratso "Karrie" Karahalios of the University of Illinois; Alan Mislove of Northeastern University; Christopher "Christo" Wilson of Northeastern University; and First Look Media Works, Inc. ("Media Works"), which publishes the online news platform The Intercept. Compl. [ECF No. 1] ¶¶ 13-14, 16-17, 19. Plaintiffs are conducting studies to respond to new trends in real estate, finance, and employment transactions, which increasingly have been initiated on the Internet. Id. ¶¶ 15, 18, 55. Data brokers assemble consumers' information from myriad sources and place consumers into models that include racial, ethnic, socioeconomic, gender, and religious inferences about them. Id. ¶¶ 56-57. After brokers create consumer profiles, those profiles follow consumers around online through tracking technologies such as cookies. Id. ¶¶ 58-59. Tracking allows websites and advertisers to display content targeted at particular groups, based on consumers' inferred characteristics or the sorts of websites they visit. Id. ¶¶ 59-60. But plaintiffs are concerned, "[g]iven the ... history of racial discrimination in housing and employment," that this technology may be "harnessed for discriminatory purposes." Id. ¶ 61. They are also concerned that, "when algorithms automate decisions, there is a very real risk that those decisions will unintentionally have a prohibited discriminatory effect." Id. ¶ 62.

One way to determine whether members of protected classes are being discriminated against is to engage in "outcomes-based audit testing." Id. ¶ 67. Such testing commonly involves accessing a website or other network service repeatedly, generally by creating false or artificial user profiles, to see how websites respond to users who display characteristics attributed to certain races, genders, or other classes. Id. ¶ 70. This method is similar to classical paired testing procedures, in which multiple people-identical but for one legally protected trait-apply for the same house or job. Such procedures are often used to uncover violations of housing and employment discrimination laws in the physical world. Id. ¶¶ 41, 50, 52.

Plaintiffs plan to engage, and are engaging, in such audit testing. Sandvig and Karahalios are investigating whether computer programs that decide what to display on real estate websites discriminate against users based on race or other factors. Id. ¶ 82. They are writing a computer program that will create bots-automated agents that will each browse the Internet and interact with websites as a human user might. Id. ¶ 88. Each bot will create a number of distinct user profiles, each of which is called a "sock puppet." Id. ¶ 89. Sandvig and Karahalios will program the bots to visit real estate websites and search for properties, while also engaging in behaviors correlated with members of a particular race. Id. ¶¶ 90-91. Sandvig and Karahalios will use an automatic data recording technique known as scraping to record the properties that each bot sees on the real estate sites. Id. ¶¶ 90, 92. They can then examine their data to determine whether race-associated behaviors caused the sock puppets to see different sets of properties. Id. ¶ 93.

Similarly, Mislove and Wilson plan to conduct a study to see whether hiring websites' algorithms end up discriminating against job seekers based on protected statuses like race or gender. Id. ¶ 107. They will first use bots to crawl the profiles of a random selection of job-seekers to obtain baseline demographic data, then create fake employer profiles so that they can search for candidates and record how the algorithms rank those candidates. Id. ¶¶ 114-17. They will also create fictitious sock-puppet job seeker profiles, and have the fictitious seekers-who will vary along different demographic axes-apply for fictitious jobs, to examine how the algorithms rank the candidates. Id. ¶¶ 118-19, 121-22. Mislove and Wilson will prevent real people from applying for the false jobs by giving them titles that say "[t]his is not a real job, do not apply," and will delete the fictitious accounts and jobs when they finish. Id. ¶ 120.

Media Works and its journalists seek to investigate online companies, websites, and platforms, including by examining any discriminatory effects of their use of algorithms. Id. ¶ 130.

Mislove and Wilson plan to publish their findings in academic papers, and to bring the results of their research to the public. Id. ¶ 123. Media Works intends to use the results of its journalistic investigations to inform the public about online business practices. Id. ¶ 132. Sandvig and Karahalios do not explicitly claim that they will publish their work, but state that their findings "would produce important new scientific knowledge about the operation of computer systems, discrimination, and cumulative disadvantage." Id. ¶ 94.

Plaintiffs are all aware that their activities will violate certain website ToS. Id. ¶¶ 95, 124, 131. All intend to use scraping to record data, which is banned by many of the websites plaintiffs seek to study. Id.; see id. ¶¶ 70-71. Many of the housing websites that Sandvig and Karahalios will study prohibit the use of bots. Id. ¶¶ 71, 95. All of the hiring websites that Mislove and Wilson will study prohibit the use of sock puppets, and most prohibit crawling. Id. ¶¶ 71, 124. Additionally, some websites control when and how visitors may speak about any information gained through the site-even in other forums-by including non-disparagement clauses in their ToS. Id. ¶ 72. Some sites also have ToS that require advance permission before using the sites for research purposes, which, plaintiffs allege, creates the possibility of viewpoint-discriminatory permission schemes. Id. ¶ 73. Aside from their ToS violations, plaintiffs' experiments will have at most a minimal impact on the operations of the target websites. Id. ¶¶ 96, 125. All plaintiffs but Media Works have already begun some of the activities involved in their research plans, including activities that require violating websites' TOS. Id. ¶¶ 98, 126.

Plaintiffs claim that they must either refrain from conducting research, testing, and investigations that (they argue) constitute protected speech or expressive activity, or else expose themselves to the risk of prosecution under the Access Provision of the CFAA. Id. ¶ 137. Plaintiffs therefore filed this suit against the Attorney General, raising four causes of action: (1) a facial overbreadth and as-applied challenge under the Free Speech and Free Press Clauses of the First Amendment, id. ¶¶ 180-86; (2) a First Amendment Petition Clause challenge, ¶¶ 187-93; (3) a vagueness claim under the Fifth Amendment's Due Process Clause, id. ¶¶ 194-98; and (4) a claim of unconstitutional delegation to private parties under the Fifth Amendment, id. ¶¶ 199-202. The government has moved to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) for lack of standing and failure to state a claim. See Mot. to Dismiss [ECF No. 10].

II. DISCUSSION

We begin with the familiar standards that govern Rule 12(b) analysis. When facing a Rule 12(b)(1) motion to dismiss for lack of subject-matter jurisdiction, a plaintiff "bears the burden of showing that he has standing." Summers v. Earth Island Inst., 555 U.S. 488, 493, 129 S.Ct. 1142, 173 L.Ed.2d 1 (2009). Just because a plaintiff makes it through the courthouse doors on one claim does not mean that other claims can tag along; rather, a plaintiff "must demonstrate standing for each claim he seeks to press and for each form of relief that is sought." Town of Chester v. Laroe Estates, Inc., --- U.S. ----, 137 S.Ct. 1645, 1650, 198 L.Ed.2d 64 (2017) (citation omitted). On a motion to dismiss, plaintiffs must plead facts that, taken as true, raise a plausible standing claim. See Humane Soc'y of the U.S. v. Vilsack, 797 F.3d 4, 8 (D.C. Cir. 2015). The Court must take all facts alleged in the complaint as true and make all reasonable inferences in plaintiffs' favor. See Gulf Coast Mar. Supply, Inc. v. United States, 867 F.3d 123, 128 (D.C. Cir. 2017). However, the Court "may consider materials outside the pleadings in deciding whether to grant a motion to dismiss for lack of jurisdiction." Id.

To survive a motion to dismiss for failure to state a claim under Rule 12(b)(6), a complaint must "contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.' " Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). Plausibility does not mean certainty, or that a claim is more likely to succeed than not, but rather that the claim at issue rises "above the speculative level." Twombly, 550 U.S. at 555, 127 S.Ct. 1955. In other words: if what plaintiffs lay out in the complaint actually happened, is it more than merely possible that the law has been violated? Plaintiffs cannot meet this standard through "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements." Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. Likewise, a court need not accept a plaintiff's legal conclusions, even if they are dressed up as factual allegations. See Sickle v. Torres Advanced Enter. Sols., LLC, 884 F.3d 338, 345 (D.C. Cir. 2018). However, courts must accept as true all facts stated in the complaint, making all reasonable inferences in plaintiffs' favor. Id.

A. THE INTERNET AS PUBLIC FORUM

At the outset, it is necessary to answer a question that affects both the standing and the merits inquiries in this case: what is the First Amendment status of the Internet? And, more particularly, what powers does the government possess to regulate activity on individual websites?

The government bases much of its argument that plaintiffs do not have standing, and that they have not alleged a First Amendment violation, on the premise that this case is about "a private actor's abridgment of free expression in a private forum." Reply in Supp. of Def.'s Mot. to Dismiss ("Def.'s Reply") [ECF No. 15] at 2; see Mem. of P. & A. in Supp. of Def.'s Mot. to Dismiss ("Def.'s Mem.") [ECF No. 10-1] at 10-13, 22-24. This argument finds some support in Supreme Court case law, which has rejected the First Amendment claims of individuals who wished to distribute handbills or advertise a strike in shopping centers against the wishes of the property owners. See Hudgens v. NLRB, 424 U.S. 507, 520, 96 S.Ct. 1029, 47 L.Ed.2d 196 (1976) ; Lloyd Corp. v. Tanner, 407 U.S. 551, 567-68, 92 S.Ct. 2219, 33 L.Ed.2d 131 (1972). Private property, the Court determined, does not "lose its private character merely because the public is generally invited to use it for designated purposes." Lloyd, 407 U.S. at 569, 92 S.Ct. 2219. Why, then, would it violate the First Amendment to arrest those who engage in expressive activity on a privately owned website against the owner's wishes?

The answer is that, quite simply, the Internet is different. The Internet is a "dynamic, multifaceted category of communication"

that "includes not only traditional print and news services, but also audio, video, and still images, as well as interactive, real-time dialogue." Reno v. Am. Civil Liberties Union, 521 U.S. 844, 870, 117 S.Ct. 2329, 138 L.Ed.2d 874 (1997). Indeed, "the content on the Internet is as diverse as human thought." Id. (citation omitted). Only last Term, the Supreme Court emphatically declared the Internet a primary location for First Amendment activity: "While in the past there may have been difficulty in identifying the most important places (in a spatial sense) for the exchange of views, today the answer is clear. It is cyberspace ...." Packingham v. North Carolina, --- U.S. ----, 137 S.Ct. 1730, 1735, 198 L.Ed.2d 273 (2017) (citation omitted).

With this special status comes special First Amendment protection. The Packingham Court applied public forum analysis to a North Carolina law that banned former sex offenders from using social media websites, employing intermediate scrutiny because the law was content-neutral. See id. at 1736. The fact that the statute restricted access to particular websites, run by private companies, did not change the calculus. Consider: on one of the sites the Court treated as an exemplar of social media, LinkedIn, "users can look for work, advertise for employees, or review tips on entrepreneurship," id. at 1735 -the same activities in which Mislove and Wilson wish to engage for their research. As the Court warned, the judiciary "must exercise extreme caution before suggesting that the First Amendment provides scant protection for access to vast networks in [the modern Internet]." Id. at 1736. The government's proposed public/private ownership distinction cannot account for the Court's determination in Packingham that privately-owned sites like Facebook, LinkedIn, and Twitter are part of a public forum, government regulation of which is subject to heightened First Amendment scrutiny. The Internet "is a forum more in a metaphysical than in a spatial or geographic sense, but the same principles are applicable." Rosenberger v. Rector & Visitors of Univ. of Virginia, 515 U.S. 819, 830, 115 S.Ct. 2510, 132 L.Ed.2d 700 (1995).

An analogy to the real world, while necessarily imperfect, may help illustrate the point. Stroll out onto the National Mall on any day with decent weather and you will discover a phalanx of food trucks lining the streets. Those food trucks are privately owned businesses. Customers interact with them for the private purpose of buying a meal. If they were a brick-and-mortar store on private property, they would encounter no First Amendment barrier to removing a patron who created a ruckus. Yet if a customer standing on a public sidewalk tastes her food and then yells at those in line behind her that they should avail themselves of the myriad other culinary options nearby, the truck could not call the police to arrest her for her comments. She is in a public forum, and her speech remains protected even when she interacts with a private business located within that forum.

It makes good sense to treat the Internet in this manner. "Each medium of expression ... must be assessed for First Amendment purposes by standards suited to it, for each may present its own problems." Se. Promotions, Ltd. v. Conrad, 420 U.S. 546, 557, 95 S.Ct. 1239, 43 L.Ed.2d 448 (1975). Regulation of the Internet presents serious line-drawing problems that the public/private distinction in physical space does not. The decisions in Lloyd and Hudgens concerned "property privately owned and used nondiscriminatorily for private purposes only." Lloyd, 407 U.S. at 568, 92 S.Ct. 2219. It is difficult to argue that most websites readily meet this description. As the Supreme Court has recognized, the Internet "provides relatively unlimited, low-cost capacity for communication of all kinds." Reno, 521 U.S. at 870, 117 S.Ct. 2329. Much of this communication takes place on websites that, in the physical world, would be seen solely as private, commercial spaces. Take Amazon.com. As a "popular retail website," Amazon undoubtedly has a private use "as a seller of products." Packingham, 137 S.Ct. at 1741 (Alito, J., concurring in the judgment). Yet the site also "facilitates the social introduction of people for the purpose of information exchanges," since it "allows a user to create a personal profile" and, "[w]hen someone purchases a product on Amazon, the purchaser can review the product and upload photographs, and other buyers can then respond to the review." Id. Conversely, Facebook-to which the Court pointed in Packingham as a quintessential site for protected First Amendment activity-allows users to buy and sell products in its Marketplace, and, like many social media sites, sells ads to make revenue. Simply put: the public Internet is too heavily suffused with First Amendment activity, and what might otherwise be deemed private spaces are too blurred with expressive spaces, to sustain a direct parallel to the physical world.

At the same time, however, it would be ill-advised to "equate the entirety of the [I]nternet with public streets and parks." Id. at 1738 (emphasis added). To do so would "gloss[ ] over the dual public and private nature of digital arenas," and subject to heightened scrutiny regulations on even the Internet's most secluded nooks and crannies. Note, First Amendment-Freedom of Speech-Public Forum Doctrine- Packingham v. North Carolina, 131 Harv. L. Rev. 233, 238 (2017). Rifling through a business's confidential files is no less a trespass merely because those files are located in the cloud. A hacker cannot legally break into a Gmail account and copy the account-holder's emails, just as a busybody cannot legally reach into someone else's mailbox and open her mail. The First Amendment does not give someone the right to breach a paywall on a news website any more than it gives someone the right to steal a newspaper.

What separates these examples from the social media sites in Packingham is that the owners of the information at issue have taken real steps to limit who can access it. But simply placing contractual conditions on accounts that anyone can create, as social media and many other sites do, does not remove a website from the First Amendment protections of the public Internet. If it did, then Packingham-which examined a law that limited access to websites that require user accounts for full functionality-would have come out the other way. 137 S.Ct. at 1737 ; see also Orin S. Kerr, Cybercrime's Scope: Interpreting "Access" and "Authorization" in Computer Misuse Statutes, 78 N.Y.U. L. Rev. 1596, 1658 (2003) ("Applying a contract-based theory of authorization in a criminal context ... may be constitutionally overbroad, criminalizing a great deal beyond core criminal conduct, including acts protected by the First Amendment."). Rather, only code-based restrictions, which "carve[ ] out a virtual private space within the website or service that requires proper authentication to gain access," remove those protected portions of a site from the public forum. Orin S. Kerr, Essay, Norms of Computer Trespass, 116 Colum. L. Rev. 1143, 1171 (2016). Stealing another's credentials, or breaching a site's security to evade a code-based restriction, therefore remains unprotected by the First Amendment.

To return to the National Mall example, suppose that a food truck remains stationed on the Mall but boards up for the night, and the owner returns home. By shutting the food in a truck, perhaps along with her cooking instructions, the owner has placed a barrier between that property and the public forum outside. Thus, while the police could not arrest a customer for telling others in line that the food tastes terrible, or for reading the menu on the truck's exterior, they could arrest that customer for breaking into the boarded-up truck seeking confidential culinary information. This is true even if the customer claimed she was doing so in order to broadcast to the world the truck's substandard ingredients and ill-conceived recipes. While the First Amendment has free rein on the Mall generally, it does not protect those who circumvent barriers that demarcate private areas, even if those private areas are surrounded by an otherwise public forum. This distinction guides the Court's analysis here.

B. STANDING

Before reaching the merits of plaintiffs' claims, the Court must assure itself that they have standing-a sufficient stake to transform this dispute into one of the "Cases" or "Controversies" on which federal courts may pass judgment. U.S. Const. art. III, § 2. "The 'irreducible constitutional minimum of standing contains three elements': (1) injury-in-fact, (2) causation, and (3) redressability." Rainbow/PUSH Coal. v. FCC, 330 F.3d 539, 542 (D.C. Cir. 2003) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). Plaintiffs must plead or prove each element of standing "with the manner and degree of evidence required at the successive stages of the litigation." Lujan, 504 U.S. at 561, 112 S.Ct. 2130. Here, therefore, "general factual allegations of injury resulting from the defendant's conduct may suffice" to allege standing, "for on a motion to dismiss we 'presum[e] that general allegations embrace those specific facts that are necessary to support the claim.' " Id. (alteration in original) (citation omitted). For any given claim or form of relief, "the presence of one party with standing is sufficient" to reach the issue. Rumsfeld v. Forum for Acad. & Institutional Rights, Inc., 547 U.S. 47, 53 n.2, 126 S.Ct. 1297, 164 L.Ed.2d 156 (2006).

Because this is a pre-enforcement challenge, plaintiffs must meet more specific conditions to satisfy the injury-in-fact requirement. They must plausibly allege "an intention to engage in a course of conduct [1] arguably affected with a constitutional interest, but [2] proscribed by a statute, and [3] [that] there exists a credible threat of prosecution thereunder." Susan B. Anthony List v. Driehaus, --- U.S. ----, 134 S.Ct. 2334, 2342, 189 L.Ed.2d 246 (2014) (quoting Babbitt v. United Farm Workers Nat'l Union, 442 U.S. 289, 298, 99 S.Ct. 2301, 60 L.Ed.2d 895 (1979) ). The government argues that plaintiffs cannot meet this test. See Def.'s Mem. at 8-19. Plaintiffs contend that they do intend to engage in constitutionally protected speech, and that they have pled a credible threat of prosecution. See Pls.' Mem. of P. & A. in Opp'n to Def.'s Mot. to Dismiss ("Pls.' Mem.") [ECF No. 13] at 18-30. It is clear that any injury to plaintiffs is caused by the government's criminalization of websites' ToS, and that the declaratory and injunctive relief plaintiffs seek, see Compl. at 46-47, would redress the injury. Therefore, the question is whether plaintiffs allege a sufficient injury in the first place.

Generally speaking, a court's standing analysis must be "especially rigorous when reaching the merits of the dispute would force us to decide whether an action taken by one of the other two branches of the Federal Government was unconstitutional." Raines v. Byrd, 521 U.S. 811, 819-20, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997). However, the D.C. Circuit has interpreted the Supreme Court's pre-enforcement standing doctrine broadly in the First Amendment sphere. Indeed, "the courts have shown special solicitude to pre-enforcement challenges brought under the First Amendment." N.Y. Republican State Comm. v. SEC, 799 F.3d 1126, 1135 (D.C. Cir. 2015). Therefore, the Circuit has found, "the courts' willingness to permit pre-enforcement review is 'at its peak' when claims are rooted in the First Amendment." Id. at 1135 (citation omitted). "Pre-enforcement review, particularly in the First Amendment context, does not require plaintiffs to allege that they 'will in fact' violate the regulation in order to demonstrate an injury." U.S. Telecom Ass'n v. FCC, 825 F.3d 674, 739 (D.C. Cir. 2016) (quoting Driehaus, 134 S.Ct. at 2345 ), reh'g en banc denied, 855 F.3d 381 (D.C. Cir.), cert. docketed, No. 17-504 (U.S. Oct. 3, 2017). Nor need they show that they are likely to be prosecuted. Rather, "[s]tanding 'to challenge laws burdening expressive rights requires only a credible statement by the plaintiff of intent to commit violative acts and a conventional background expectation that the government will enforce the law.' " Id. (quoting Act Now to Stop War & End Racism Coal. v. District of Columbia (ANSWER I ), 589 F.3d 433, 435 (D.C. Cir. 2009) ).

1. "Arguably Affected With a Constitutional Interest"

Plaintiffs assert that their conduct falls within three categories of First Amendment-protected activity. Scraping data from their target websites, they allege, is subject to the First Amendment right to record or preserve information. Pls.' Mem. at 10-14. Moreover, employing bots and sock puppets and creating false user accounts constitute harmless false speech. Id. at 14-17. And their planned post-research activities are protected by the right to publish. Id. at 17-18. All of these claims are sufficiently plausible to conclude that plaintiffs' proposed conduct is "arguably affected with a constitutional interest." Driehaus, 134 S.Ct. at 2342.

First, scraping plausibly falls within the ambit of the First Amendment. "[T]he First Amendment goes beyond protection of the press and the self-expression of individuals to prohibit government from limiting the stock of information from which members of the public may draw." First Nat. Bank of Boston v. Bellotti, 435 U.S. 765, 783, 98 S.Ct. 1407, 55 L.Ed.2d 707 (1978). The Supreme Court has made a number of recent statements that give full First Amendment application to the gathering and creation of information. Additionally, six courts of appeals have found that individuals have a First Amendment right to record at least some matters of public interest, in order to preserve and disseminate ideas. That plaintiffs wish to scrape data from websites rather than manually record information does not change the analysis. Scraping is merely a technological advance that makes information collection easier; it is not meaningfully different from using a tape recorder instead of taking written notes, or using the panorama function on a smartphone instead of taking a series of photos from different positions. And, as already discussed, the information plaintiffs seek is located in a public forum. Hence, plaintiffs' attempts to record the contents of public websites for research purposes are arguably affected with a First Amendment interest.

Second, plaintiffs have a First Amendment interest in harmlessly misrepresenting their identities to target websites. The complaint alleges that plaintiffs' research requires them to create false employer and job-seeker profiles on employment websites, and to use sock puppets to make it appear to a number of housing and employment sites that multiple people are accessing the information they have made available. Compl. ¶¶ 88-93, 114-21. Because "some false statements are inevitable if there is to be an open and vigorous expression of views in public and private conversation," and because "[t]he Government has not demonstrated that false statements generally should constitute a new category of unprotected speech," false claims that are not "made to effect a fraud or secure moneys or other valuable considerations" fall within First Amendment protection. United States v. Alvarez, 567 U.S. 709, 718, 722-23, 132 S.Ct. 2537, 183 L.Ed.2d 574 (2012). Plaintiffs allege that their conduct will cause minimal, if any, harm to the targeted websites, and that they will take steps to avoid affecting third-party users of the website (such as informing job seekers that their fake positions are fake). Compl. ¶¶ 96, 120, 125. Thus, plaintiffs' harmless false or misleading speech to website owners is arguably affected with a constitutional interest.

Third, plaintiffs contend that they have the right, and the desire, to publish the results of their research, and that some sites' ToS prohibit them from doing so without prior permission or else employ anti-disparagement clauses. Pls.' Mem. at 17. The Supreme Court has made very clear that the right to publish falls within the core of the First Amendment's protections. See, e.g., Bartnicki v. Vopper, 532 U.S. 514, 527, 121 S.Ct. 1753, 149 L.Ed.2d 787 (2001) ("As a general matter, 'state action to punish the publication of truthful information seldom can satisfy constitutional standards.' " (quoting Smith v. Daily Mail Publishing Co., 443 U.S. 97, 102, 99 S.Ct. 2667, 61 L.Ed.2d 399 (1979) ). Applying criminal sanctions for publishing original material that uses publicly available information, or for making negative statements about a website, triggers First Amendment scrutiny.

The government raises two overarching objections to all of these alleged rights. It initially claims that the First Amendment does not regulate the decisions that private entities make about how to control access to their private websites-in other words, that there is no state action here. See Def.'s Mem. at 21-24; Def.'s Reply at 6-12; see also Columbia Broad. Sys., Inc. v. Democratic Nat. Comm., 412 U.S. 94, 114, 93 S.Ct. 2080, 36 L.Ed.2d 772 (1973) ("[The First Amendment] is a restraint on government action, not that of private persons."). However, private speech prohibitions can still implicate the First Amendment when given the imprimatur of state protection through civil or criminal law. See, e.g., New York Times Co. v. Sullivan, 376 U.S. 254, 265, 84 S.Ct. 710, 11 L.Ed.2d 686 (1964). Moreover, plaintiffs claim injury from a potential criminal action against them-and "a criminal prosecution under the CFAA would undoubtedly constitute state action" because the government itself is policing website ToS violations. hiQ Labs, Inc. v. LinkedIn Corp., 273 F.Supp.3d 1099, 1114 n.12 (N.D. Cal. Aug. 14, 2017), appeal docketed, No. 17-16783 (9th Cir. Sept. 6, 2017).

The government also claims that the First Amendment does not protect plaintiffs' conduct because, under Zemel v. Rusk, 381 U.S. 1, 16-17, 85 S.Ct. 1271, 14 L.Ed.2d 179 (1965), and Houchins v. KQED, Inc., 438 U.S. 1, 10-11, 98 S.Ct. 2588, 57 L.Ed.2d 553 (1978) (plurality opinion), the First Amendment does not create a right to acquire information in whatever manner one desires. Def.'s Mem. at 10-12. In Zemel, the Court held that the government did not implicate any First Amendment rights by refusing to issue the plaintiff a passport to visit Cuba, which the plaintiff claimed interfered with his ability to acquaint himself with the effects of the government's policies in relation to Cuba. 381 U.S. at 16, 85 S.Ct. 1271. The Court rejected the claim, stating that "[t]he right to speak and publish does not carry with it the unrestrained right to gather information." Id. at 17, 85 S.Ct. 1271. Then, in Houchins, the Court held that journalists had no special First Amendment right to access inmates in a jail just because they sought to write stories about the jail; the Court rejected the "notion that the First Amendment confers a right of access to news sources." 438 U.S. at 11, 98 S.Ct. 2588. However, the Court did note that "[t]he right to receive ideas and information is not the issue in this case," and that "[t]he issue is a claimed special privilege of access." Id. at 12, 98 S.Ct. 2588. Thus, "[t]here is an undoubted right to gather news 'from any source by means within the law,' " but the First Amendment does not "compel[ ] others-private persons or governments-to supply information." Id. at 11, 98 S.Ct. 2588.

Here, plaintiffs are not asking the Court to force private websites to provide them with information that others cannot get. Instead, they seek only to prevent the government from prosecuting them for obtaining or using information that the general public can access-though they wish to do so in a manner that could have private consequences, such as a website banning them or deleting their accounts. See Compl. ¶ 4 ("[Plaintiffs] have no intent ... to access any data or information that is not made available to the public."). Because plaintiffs neither want a special privilege of access nor seek to force websites to give them otherwise unobtainable information, the Zemel and Houchins line of cases is inapposite here. Plaintiffs therefore plausibly allege that their conduct is arguably affected with a constitutional interest.

2. "Proscribed by a Statute"

Under D.C. Circuit precedent, "at the motion to dismiss stage, a plaintiff's non-frivolous contention regarding the meaning of a statute must be taken as correct for purposes of standing." Info. Handling Servs., Inc. v. Def. Automated Printing Servs., 338 F.3d 1024, 1030 (D.C. Cir. 2003). Because plaintiffs' reading of the statute to encompass all ToS violations is not frivolous, and because plaintiffs allege that their conduct would violate websites' ToS, it is clear for standing purposes that their intended actions would violate the statute.

The government contests this conclusion in only one instance. In two sentences in its reply brief, the government claims that plaintiffs lack standing for any injuries relating to their ability to publish. As the government sees it, "[t]he Complaint contains no allegation that any website on which plaintiffs intend to conduct their activity contains" a restriction on future publication, "and plaintiffs lack standing to assert claims based on hypothetical circumstances." Def.'s Reply at 12.

This argument is unavailing. True, plaintiffs do not explicitly allege that their target websites restrict subsequent publication. But the complaint does allege that "[p]laintiffs wish to ... report on their findings to the public," and that "[t]he research, testing, and investigative methods they have designed would, if carried out, violate the [Access] Provision, because they all require violating the [ToS] of the targeted website." Compl. ¶¶ 134-35 (emphasis added); see also id. ¶ 160 ("Plaintiffs wish to have the option of publishing the results of their research, including any findings of discrimination, even if a target website's ToS prohibit doing so."). "[O]n a motion to dismiss we presum[e] that general allegations embrace those specific facts that are necessary to support the claim." Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C. Cir. 2015) (second alteration in original) (citation omitted). Plaintiffs' allegations allow for the presumption that reporting on their research findings would violate some targeted websites' ToS. While far from the degree of proof necessary for summary judgment, see Lujan, 504 U.S. at 561, 112 S.Ct. 2130, at this early stage plaintiffs have plausibly alleged that the CFAA prevents all of their conduct.

3. "Credible Threat of Prosecution"

Even if plaintiffs' intended conduct is arguably affected with a constitutional interest, and is prohibited by the CFAA, plaintiffs still must show that there is a credible threat of prosecution for that conduct under the statute. See Driehaus, 134 S.Ct. at 2342. The government asserts that plaintiffs cannot meet this test, because "plaintiffs make no allegation that the government has threatened them with CFAA enforcement," plaintiffs "cite no instances in which the government has enforced the challenged provision for harmless [ToS] violations," and DOJ "has expressly stated that it has no intention of prosecuting harmless [ToS] violations that are not in furtherance of other criminal activity or tortious conduct." Def.'s Reply at 13. The government is, for the most part, correct on the facts. The complaint does not allege that plaintiffs have actually been threatened with prosecution. The two cases plaintiffs cite to show that prosecutors have used the Access Provision to punish ToS violations did, in fact, involve harmful conduct. And DOJ's guidance to federal prosecutors does discourage them-though somewhat tepidly-from bringing CFAA cases based solely on harmless ToS violations. See U.S. Att'y Gen., Intake and Charging Policy for Computer Crimes Matters ("Charging Policy") (Sept. 11, 2014) [ECF No. 15-1] at 5.

However, both Supreme Court and D.C. Circuit precedent create a low standing bar in cases like this one. Because plaintiffs "challenge [a] law[ ] burdening expressive rights," and because their complaint provides "a credible statement ... of intent to commit violative acts," plaintiffs may rely on the "conventional background expectation that the government will enforce the law." U.S. Telecom Ass'n, 825 F.3d at 739 (citation omitted); accord Act Now to Stop War & End Racism Coal. v. District of Columbia (ANSWER II ), 846 F.3d 391, 401-02 (D.C. Cir. 2017), cert. denied, --- U.S. ----, 138 S.Ct. 334, 199 L.Ed.2d 213 (2017) (mem.). Indeed, the D.C. Circuit has occasionally found standing without inquiring into whether the government has actually enforced the challenged restriction. See U.S. Telecom Ass'n, 825 F.3d at 739-40.

Here, there are sufficient indications of a credible threat to enforce the Access Provision, both in general and as applied to plaintiffs' activities. To begin with, the parties have sparred over whether DOJ has enforced the Access Provision specifically against harmless ToS violations. See Compl. ¶ 31; Def.'s Mem. at 14-17; Pls.' Mem. at 3-4, 25. Yet a number of cases have looked to whether the statutory provision as a whole-or at least the particular term being challenged-has been enforced through prosecutions, without asking whether the facts were similar to those the plaintiffs alleged. See, e.g., Holder v. Humanitarian Law Project, 561 U.S. 1, 16, 130 S.Ct. 2705, 177 L.Ed.2d 355 (2010) ; Babbitt, 442 U.S. at 302, 99 S.Ct. 2301 ; N. Carolina Right to Life, Inc. v. Bartlett, 168 F.3d 705, 710 (4th Cir. 1999). If one need only find a history of enforcement of the Access Provision generally, or enforcement of the "exceeds authorized access" language in particular, plaintiffs would have no trouble showing that there is a significant history. Indeed, the Supreme Court decided a case just two years ago that involved a prosecution under the Access Provision, in part for exceeding authorized access. Musacchio v. United States, --- U.S. ----, 136 S.Ct. 709, 713 & n.1, 193 L.Ed.2d 639 (2016).

Even looking more closely at similar factual scenarios, plaintiffs have shown that prosecutions have stemmed from close enough facts that it would be credible to fear a future prosecution for their own activities. Plaintiffs cite two cases in which individuals were prosecuted under the Access Provision for violating ToS agreements: United States v. Lowson, No. 10-cr-114 (KSH), 2010 WL 9552416 (D.N.J. Oct. 12, 2010), and United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009). Compl. ¶ 31. Lowson, as the government points out, did not solely involve violations of website ToS; it also involved ticket scalpers' attempts "to defeat code-based security restrictions" on Ticketmaster's website. 2010 WL 9552416, at *5. However, the indictment alleged "both contract- and code-based violations," id. at *6, and laid out the websites' prohibitions that the defendants allegedly violated, see Superseding Indictment at 5-9, Lowson, 2010 WL 9552416 (No. 10-cr-114), ECF No. 10-2. More directly on point is Drew, in which the government prosecuted a woman for lying about her age and creating a false account on Myspace in order to cyberbully her daughter's teenage classmate-thus violating Myspace's ToS in order to commit the tort of intentional infliction of emotional distress. 259 F.R.D. at 452. Prosecutors included both a felony count under the Access Provision-because the violation was in furtherance of a tortious act-and a misdemeanor count for the standalone ToS violations. Id. at 451. The jury acquitted Drew on the felony count, id.; the court then dismissed the misdemeanor conviction, as coverage of ToS violations rendered the Access Provision unconstitutionally vague, id. at 467.

That the government brought the Drew case without enough evidence to ultimately prove the added harm required for a felony conviction, and chose to include a misdemeanor count for harmless ToS violations, lends some credibility to plaintiffs' fears of prosecution. The government also does not know whether prosecutors may have employed the Access Provision to obtain plea agreements in which defendants admitted to harmless ToS violations. See Tr. of Mot. Hr'g [ECF No. 20] at 17:15-18:13. These prior prosecutions, whether under the Access Provision generally or under related factual circumstances, provide "somewhat more than the 'conventional background expectation that the government will enforce the law.' " ANSWER I, 589 F.3d at 435 (citation omitted). Thus, even if more were necessary, plaintiffs have provided it.

Finally, the government has not expressly disavowed any intent to prosecute plaintiffs, which would defeat the normal expectation of enforcement. The government points to a 2014 memorandum that the Attorney General sent to United States Attorneys regarding charging policy under the CFAA, which the government claims is the current "binding guidance" on this issue. Def.'s Reply at 14. According to the government, plaintiffs' fear of prosecution is "implausible" because (1) the charging policy focuses on several factors that would not apply to harmless ToS violations, (2) prosecutions based solely on such violations are discouraged, and (3) attorneys must consult with the Criminal Division of DOJ before making CFAA charging decisions. Id. However, to disprove an otherwise credible threat of prosecution, courts have normally required an explicit statement "that plaintiffs will not be prosecuted if they do what they say they wish to do." Humanitarian Law Project, 561 U.S. at 16, 130 S.Ct. 2705. The government has not made such a declaration. DOJ's charging policy states that, "if the defendant exceeded authorized access solely by violating an access restriction contained in a contractual agreement or [ToS] with an Internet service provider or website, federal prosecution may not be warranted." Charging Policy at 5 (emphasis added). This is a far cry from the sort of disavowal required by case law.

In an attempt to provide such a disavowal, and at the Court's suggestion, the government filed an affidavit from John T. Lynch, Jr., Chief of the Computer Crime and Intellectual Property Section of the Criminal Division of DOJ. Aff. of John T. Lynch, Jr. [ECF No. 21-1]. He points to the charging factors mentioned above, id. at 2-3, and states that he "do[es] not expect that the Department would bring a CFAA prosecution based on such facts and de minimis harm," id. at 3. But many things that we do not expect in fact come to pass. An official's prognostication does not substitute for a declaration of non-prosecution. Moreover, even explicit disavowals are most valuable when they are made "on the basis of the Government's own interpretation of the statute and its rejection of plaintiffs' interpretation as unreasonable." Blum v. Holder, 744 F.3d 790, 798 (1st Cir. 2014). Here, the government has implicitly-and in past prosecutions, explicitly-read the Access Provision to include ToS violations. See Charging Policy at 4-5. "[T]o rely upon prosecutorial discretion to narrow the otherwise wide-ranging scope of a criminal statute's highly abstract general statutory language places great power in the hands of the prosecutor." Marinello v. United States, No. 16-1144, --- U.S. ----, 138 S.Ct. 1101, 200 L.Ed.2d 356, 2018 WL 1402426, at *6 (Mar. 21, 2018). The Constitution "does not leave us at the mercy of noblesse oblige," United States v. Stevens, 559 U.S. 460, 480, 130 S.Ct. 1577, 176 L.Ed.2d 435 (2010), which is all the government ultimately offers.

One final point. Until now, this standing analysis has focused on plaintiffs' First Amendment challenge. But plaintiffs also bring due process claims. In Seegars v. Gonzales, 396 F.3d 1248 (D.C. Cir. 2005), the D.C. Circuit applied a more rigorous "imminence" standard for non-First-Amendment constitutional claims. But the court took pains to point out that it was forced to follow circuit precedent that conflicted with the Supreme Court's and the D.C. Circuit's own laxer standing test for First Amendment pre-enforcement challenges. See id. at 1252-54. Subsequent cases have confirmed that the "more demanding standard" required by Seegars does not apply when challenging "laws burdening expressive rights." ANSWER I, 589 F.3d at 435. Here, plaintiffs' Fifth Amendment claims allege an injury-in-fact essentially identical to that alleged for their First Amendment claims. Pls.' Mem. at 23 n.2. Both the Supreme Court and the D.C. Circuit have upheld standing for dual First- and Fifth-Amendment pre-enforcement challenges, under a less rigorous imminence standard, without distinguishing between the two amendments for standing purposes. See Humanitarian Law Project, 561 U.S. at 11-12, 15-16, 130 S.Ct. 2705 ; ANSWER II, 846 F.3d at 396, 401-02 ; ANSWER I, 589 F.3d at 434-35. Plaintiffs therefore have standing to bring their Fifth Amendment claims along with their First Amendment ones.

For the foregoing reasons, plaintiffs have plausibly pled standing at the motion to dismiss stage, and the government's Rule 12(b)(1) motion will be denied.

C. INTERPRETING THE STATUTE

Plaintiffs allege only constitutional claims in this case. Likely because they are bringing a pre-enforcement challenge, they are not claiming that the statute, properly read, does not apply to them. However, nearly all of their claims require the Court to determine the reach of the Access Provision before deciding the constitutional question. Since the Court does not accept plaintiffs' legal conclusions as true for purposes of a motion to dismiss under Rule 12(b)(6), see Doe v. Rumsfeld, 683 F.3d 390, 391 (D.C. Cir. 2012), plaintiffs' reading of the statute to cover their conduct does not control. Instead, the Court must interpret the law.

Courts are split as to how to read the relevant provisions. The CFAA defines the phrase "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). The Second, Fourth, and Ninth Circuits have held that this language prohibits only unauthorized access to information. See United States v. Valle, 807 F.3d 508, 523-28 (2d Cir. 2015) ; WEC Carolina Ener. Solutions LLC v. Miller, 687 F.3d 199, 206 (4th Cir. 2012) ; Nosal, 676 F.3d at 863 ; see also Pulte Homes, Inc. v. Laborers' Int'l Union of N. Am., 648 F.3d 295, 304 (6th Cir. 2011) (stating, based on Ninth Circuit precedent, that "an individual who is authorized to use a computer for certain purposes but goes beyond those limitations... has 'exceed[ed] authorized access' " (citation omitted) (alteration in original) ). Meanwhile, the First, Fifth, and Eleventh Circuits have held that it also covers (at least in some instances) unauthorized use of information that a defendant was authorized to access only for specific purposes. See EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 583 (1st Cir. 2001) ; United States v. John, 597 F.3d 263, 271 (5th Cir. 2010) ; United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010) ; see also Int'l Airport Centers, LLC v. Citrin, 440 F.3d 418, 420-21 (7th Cir. 2006) (holding that an employee who deleted his employer's files in violation of his employment contract had terminated the agency relationship that authorized him to access the information). Courts have also split over whether violating a website's ToS exceeds authorized access for purposes of the CFAA. The D.C. Circuit has never opined on either question. Several district judges in this Circuit, however, have held that the provision only applies to unauthorized access to information, not to unauthorized use of properly accessed material. See Hedgeye Risk Mgmt., LLC v. Heldman, 271 F.Supp.3d 181, 194-95 (D.D.C. 2017) (collecting cases).

At one point in their briefing, plaintiffs suggest a different dividing line: a limiting construction that carves out harmless ToS violations from the statute. Pls.' Mem. at 31-33, 35. However, "[t]he text will not bear such a reading." INS v. Yueh-Shaio Yang, 519 U.S. 26, 30, 117 S.Ct. 350, 136 L.Ed.2d 288 (1996). It is one thing to carve out such violations by determining that the statute is unconstitutional as applied, but the text of the statute itself-"exceeds authorized access"-and its statutory definition do not appear to allow for such a surgical slicing off of conduct. How does the text differentiate between ToS violations and violations of employers' computer use policies, for instance? And how does the text distinguish between "[ToS] violations alone," Pls.' Mem. at 35, and ToS violations that cause damage or involve fraud, which plaintiffs admit are covered by §§ 1030(a)(4) and (a)(5), id. at 31-32? One can just as easily "use [authorized] access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter," § 1030(e)(6), whether it is a website or some other entity that is doing the authorizing, and whether the violation is harmful or harmless.

The question thus remains whether "exceeds authorized access" refers to access alone or to access, use, and other violations. The Court finds the narrow interpretation adopted by the Second, Fourth, and Ninth Circuits-and by numerous other district judges in this Circuit-to be the best reading of the statute. First, the text itself more naturally reads as limited to violations of the spatial scope of one's permitted access. To "exceed[ ] authorized access," one must have permission to access the computer at issue, and must "use such access"-i.e., one's authorized presence on the computer-"to obtain or alter information in the computer." Id. Thus, unlike the phrase "unauthorized access" used alongside it in several CFAA provisions, the phrase "exceeds authorized access" refers not to an outside attack but rather to an inside job. See, e.g., Nosal, 676 F.3d at 858. The rest of the definition requires that the information at issue be information "that the accesser is not entitled so to obtain or alter." Id. The key word here is "entitled." "And, in context, the most 'sensible reading of "entitled" is as a synonym for "authorized.' " " Hedgeye, 271 F.Supp.3d at 194 (quoting Nosal, 676 F.3d at 857 ). The focus is thus on whether someone is allowed to access a computer at all, in the case of "unauthorized access," or on whether someone is authorized to obtain or alter particular information, in the case of "exceeds authorized access." In neither instance does the statute focus on how the accesser plans to use the information.

The statutory context buttresses this narrower reading of the text. Reading "exceeds authorized access" to turn on the accesser's purpose in seeking out the information would eliminate a major difference between the Access Provision-which has no purpose requirement-and other provisions that require intent to defraud. E.g., 18 U.S.C. § 1030(a)(4). It would also water down the difference between the misdemeanor penalty provisions and the felony provisions that enhance sentences for violations committed for fraud or financial gain. Id. § 1030(c)(2) ; see also S. Rep. No. 104-357, at 8 (1996) ("[T]he statutory penalties are structured to provide that obtaining information of minimal value is only a misdemeanor, but obtaining valuable information, or misusing information in other more serious ways, is a felony." (emphasis added) ). After all, just about any attempt to use proprietary information to defraud or for personal or commercial gain would likely violate a computer use policy or website ToS. See Nosal, 676 F.3d at 858 n.4. Congress knew how to draft a specific intent requirement, and did so in these other sections of the CFAA. It would be rather odd, then, for Congress to also smuggle a specific intent factor into its definition of the actus reus of the offense. While this context is certainly not dispositive-Congress often drafts overlapping or even redundant provisions-it is best to avoid readings that "would render superfluous another part of the same statutory scheme." Marx v. Gen. Revenue Corp., 568 U.S. 371, 386, 133 S.Ct. 1166, 185 L.Ed.2d 242 (2013).

Legislative history also points to an access-based, rather than an intended-use-based, reading of "exceeds authorized access." The Second Circuit has already canvassed in great detail the congressional intent and history behind the definition of "exceeds authorized access," see Valle, 807 F.3d at 525-26, and this Court will not repeat it here. This Court agrees with the Second Circuit, however, that "the legislative history consistently characterizes the evil to be remedied-computer crime-as 'trespass' into computer systems or data, and correspondingly describes 'authorization' in terms of the portion of the computer's data to which one's access rights extend." Id. at 525. Congress thus viewed exceeding authorized access as the digital equivalent of being allowed into a house but entering a room within it that the owner has declared to be off-limits. A sensible conception, particularly considering that the language at issue was written in 1986-before the World Wide Web or websites existed. See Kerr, Norms of Computer Trespass, supra, at 1161.

The amendment history of the definition supports this reading. The initial language of the CFAA applied to anyone who, knowingly "having accessed a computer with authorization, uses the opportunity such access provides for purposes to which such authorization does not extend, and thereby obtains information." Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub. L. No. 98-473, tit. II, ch. 21, § 2102(a), 98 Stat. 1837, 2190-91 (emphasis added). In 1986, however, in a section entitled "Modification of Authorized Access Aspect of Offenses," Congress replaced this language with the phrase "exceeds authorized access," and, in a section entitled "Conforming Amendments to Definitions Provision," added the current definition of that phrase. See Computer Fraud and Abuse Act of 1986, Pub. L. No. 99-474, § 2(c), (g)(4), 100 Stat. 1213, 1215. It is not clear that Congress intended this language change to be substantive. See S. Rep. No. 99-432, at 9 (1986) ("The Committee intends this change to simplify the language in 18 U.S.C. 1030(a)(1) and (2), and the phrase 'exceeds authorized access' is defined separately in Section (2)(g) of the bill."); 132 Cong. Rec. 28,821 (1986) (statement of Rep. Hughes) (stating, as the chairman of the drafting subcommittee just before final passage, that "the basic thrust of this bill remains its three new offenses with some minor changes in the existing law"). Yet it is notable that Congress did not simply transpose the existing, purpose-oriented language into the definition section-which still would have simplified the language of § 1030(a), as desired-but instead replaced it with new language that focuses on authorization to access particular information. Indeed, if Congress did not think it was making a substantive change, the legislative history suggests that this was because Congress thought the initial language also was limited to access, since "when Congress referenced the user's 'purposes,' it spoke in terms of the particular computer files or data to which the user's access rights extended." Valle, 807 F.3d at 526.

Finally, plaintiffs raise numerous First and Fifth Amendment concerns with the Access Provision that would arise out of reading "exceeds authorized access" to include the purpose or use restrictions that appear in many ToS. When a court is "deciding which of two plausible statutory constructions to adopt," and when "one of them would raise a multitude of constitutional problems, the other should prevail." Clark v. Martinez, 543 U.S. 371, 380-81, 125 S.Ct. 716, 160 L.Ed.2d 734 (2005). This maxim holds doubly true for criminal statutes. See Marinello, 2018 WL 1402426, at *4, 138 S.Ct. at 1106 ("[Courts] have traditionally exercised restraint in assessing the reach of a federal criminal statute, both out of deference to the prerogatives of Congress and out of concern that 'a fair warning should be given to the world in language that the common world will understand, of what the law intends to do if a certain line is passed.' " (citation omitted) ). While the CFAA's text and legislative history point strongly toward an access-only interpretation of "exceeds authorized access," a broader reading is not entirely implausible; therefore, constitutional avoidance applies. Cf. Jennings v. Rodriguez, --- U.S. ----, 138 S.Ct. 830, 842, 200 L.Ed.2d 122 (2018). In interpreting the statutory text, the Court need not determine whether plaintiffs' constitutional arguments would actually win the day. Rather, the Court undertakes "a narrow inquiry" into whether one reading "presents a significant risk that [c