## Facts

- America Online, Inc. (AOL) operated nationwide email services through computer systems and personnel located in Virginia and imposed user policies barring unsolicited bulk email and address harvesting.
- National Health Care Discount, Inc. (NHCD), an Iowa company marketing discount health-related plans, obtained customers through mass email advertising conducted by “contract e-mailers” paid per lead.
- The advertising content originated with NHCD and was used by the e-mailers to solicit recipients, including AOL members.
- The e-mailers harvested AOL member email addresses and sent extremely large quantities of unsolicited bulk email through AOL’s systems (estimated tens to hundreds of millions of messages over 1997–1999).
- AOL expended resources to block the emails, handle complaints, and mitigate system and customer impacts, but a substantial volume still reached AOL members.
- AOL sent cease-and-desist letters; NHCD responded that the emails were sent by independent contractors outside NHCD’s control.
- AOL sued on multiple theories, including CFAA, state computer-crime statutes, trespass to chattels/conversion, civil conspiracy, and unjust enrichment; summary judgment was denied due to disputed facts, and the case proceeded to a bench trial.

## Issues

1. Whether NHCD was vicariously liable for unsolicited bulk emails sent by contract e-mailers based on agency/control principles.
2. Whether the spam activity constituted “unauthorized access” and caused qualifying “damage” or “loss” under the Computer Fraud and Abuse Act (18 U.S.C. § 1030).
3. Whether the evidence supported a civil-conspiracy theory tied to the bulk-email campaign.
4. What remedies, including injunctive relief, were warranted to address the harms to AOL’s systems and members.

## Decision

- The court found that the bulk emails were sent “on behalf of” NHCD and analyzed NHCD’s responsibility for the campaign under agency and vicarious-liability principles.
- The court treated the CFAA as a limited fit for spam claims and required proof of statutorily cognizable unauthorized access and specific, measurable damage or loss attributable to the campaign.
- The court addressed AOL’s conspiracy theory on the developed record, focusing on the relationship and coordinated conduct between NHCD and the emailers.
- The court granted a permanent injunction restricting NHCD’s future use of unsolicited email directed at AOL members and addressed monetary relief based on proven operational costs and related harms.

## Legal Principles

- A business may be held liable for mass-email marketing performed by purported independent contractors when the evidence shows knowledge, financial arrangement, and sufficient right of control consistent with agency principles.
- CFAA civil liability requires more than receipt of unwanted messages; plaintiffs must prove access “without authorization” (or exceeding authorization) and qualifying damage or loss that is specifically tied to the defendant’s conduct.
- High-volume unsolicited use of an online service’s computing resources can support property-based theories (such as trespass to chattels) when the use meaningfully impairs system condition/value or forces expenditures to mitigate interference.
- Permanent injunctive relief may be appropriate to prevent recurring interference with network operations and user experience when legal violations and ongoing risk are shown, even if some statutory theories are construed narrowly.

## Conclusion

The court held NHCD accountable for a large-scale spam campaign carried out by contract emailers based on agency-focused facts, applied a restrained CFAA analysis requiring specific unauthorized-access and damage showings, and issued a permanent injunction to curb future unsolicited emails directed at AOL members while recognizing AOL’s proven operational harms.


Am. Online, Inc. v. Nat'l Health Care Disc., Inc., 174 F. Supp. 2d 890 (N.D. Iowa 2001)