## Facts

- Creative Computing (Creative), doing business as InternetTruckstop.com, ran an online freight “load board” that matched shippers’ loads with truckers who had available capacity.
- A key feature of Creative’s site was a “radius search,” allowing users to quickly find loads within a chosen distance from a location.
- Getloaded.com LLC (Getloaded) launched a competing load-matching website.
- To keep competitors from viewing its marketplace data, Creative used a password-based access system and prohibited competing matching services from accessing the site.
- Getloaded sought access to Creative’s site despite that restriction and reasoned that some trucking companies might reuse the same login credentials on both sites.
- Getloaded used the login information of one of its own customers to enter Creative’s website, effectively posing as that customer and viewing the site’s load-matching information.
- Getloaded also obtained access by registering a defunct company as a subscriber to Creative’s site.
- In addition to viewing user-facing information, Getloaded hacked into Creative’s website to examine source code associated with Creative’s radius-search feature.
- Creative sued Getloaded in the District of Idaho, including claims under the Computer Fraud and Abuse Act (CFAA), and sought damages and injunctive relief based on the unauthorized access and related harm.
- The district court entered judgment for Creative on the CFAA claim, awarded damages, and issued a permanent injunction; Getloaded appealed.

## Issues

1. Whether the CFAA’s civil-action threshold of at least $5,000 in “loss” during a one-year period must be satisfied separately for each unauthorized access, or may be satisfied by aggregating losses from related conduct within that year.
2. Whether expenses incurred to investigate and respond to unauthorized access qualify as “loss” recoverable under the CFAA.
3. Whether the district court properly granted injunctive relief based on Getloaded’s unauthorized access and risk of continued misconduct.

## Decision

- The Ninth Circuit affirmed the district court’s judgment for Creative on the CFAA claim.
- The court rejected Getloaded’s argument that Creative had to show $5,000 in loss for each individual act of unauthorized access.
- The court held that the CFAA permits aggregation of qualifying losses over a one-year period to meet the $5,000 threshold.
- The court accepted that reasonable costs of responding to and investigating the intrusions (including damage assessment and related remedial steps) can constitute “loss” under the CFAA.
- The court affirmed the permanent injunction entered against Getloaded.

## Legal Principles

- Under 18 U.S.C. § 1030(g), a civil CFAA claim requires proof of one of the statute’s listed damage or loss factors, including “loss” aggregating at least $5,000 in value during a one-year period.
- The $5,000 CFAA civil threshold may be satisfied by aggregating qualifying losses caused by a course of unauthorized access within a one-year period; it is not limited to a per-access minimum.
- “Loss” under the CFAA includes reasonable costs of responding to an offense, conducting a damage assessment, and restoring data, programs, systems, or information to their prior condition.
- Using another party’s credentials to gain entry and bypass an express competitor restriction can constitute access “without authorization” for CFAA purposes.
- The CFAA authorizes injunctive relief, and a court may enjoin continued or threatened unauthorized access where the record supports ongoing risk and irreparable harm.

## Conclusion

Creative’s competitor restrictions did not stop Getloaded from entering the site through reused customer credentials, registering a defunct entity, and hacking to view radius-search source code. The Ninth Circuit held that the CFAA’s $5,000 civil-loss requirement can be met by aggregating qualifying response and investigation costs over a one-year period, and it affirmed both the damages award and the permanent injunction against Getloaded.


Creative Computing v. Getloaded.com LLC, 386 F.3d 930 (2004)