## Facts

- EF operated a public website where any visitor could search tours and view tour prices.
- Explorica, a competitor founded by former EF employees, sought to copy EF’s web-posted prices and set its own prices slightly lower.
- Explorica hired Zefer to build an automated “scraper” program that retrieved pricing data from EF’s publicly accessible webpages by reading HTML source code.
- The scraper collected approximately two years of EF pricing data; Explorica used the data to undercut EF’s prices.
- EF sued Explorica, Zefer, and others, and sought a preliminary injunction alleging, among other claims, violations of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030.
- The district court entered a preliminary injunction barring use of the scraper to obtain EF’s prices; a prior appeal upheld the injunction against Explorica based largely on former employees’ misuse of confidential information.
- After Zefer’s bankruptcy stay ended, Zefer appealed the injunction as applied to it.

## Issues

1. Whether using a scraper to collect pricing data from publicly accessible webpages constitutes access “without authorization” or “exceed[ing] authorized access” under 18 U.S.C. § 1030(a)(4).
2. Whether, for preliminary-injunction purposes, EF showed that Zefer violated any explicit access or use restrictions (e.g., posted terms of use or technological barriers) sufficient to limit “authorization” under the CFAA.
3. Whether the injunction against Zefer could be sustained based on Explorica’s enjoined conduct and Zefer’s assistance, without proof that Zefer itself exceeded authorization.

## Decision

- The First Circuit vacated the preliminary injunction as to Zefer.
- EF failed, on the record and theory presented, to show a likelihood of success on its CFAA claim against Zefer.
- The court declined to define “authorization” by generalized “reasonable expectations,” favoring objectively expressed limits such as posted terms of use or technological access controls.
- The court distinguished the earlier decision involving Explorica because that injunction rested heavily on misuse of EF confidential information by former employees bound by confidentiality duties, which was not shown as to Zefer.

## Legal Principles

- Access to a public website is generally authorized unless the owner imposes and relies on specific limitations that clearly restrict access or use.
- Under the CFAA, “authorization” may be limited by objectively manifested restrictions, including passwords or similar access controls, and potentially by explicit prohibitions in posted terms of use.
- CFAA analysis is actor-specific; a contractor is not automatically liable merely because it assisted another party who may have exceeded authorized access.
- At the preliminary injunction stage, the plaintiff must show a sufficient likelihood of success on the pleaded CFAA theory, supported by evidence that the defendant crossed an enforceable authorization boundary.

## Conclusion

The First Circuit vacated the injunction against Zefer because EF did not show that Zefer’s scraping of publicly available webpages violated any explicit contractual or technical limits that would make the access unauthorized under the CFAA, and Zefer’s liability could not be presumed from Explorica’s separate conduct.


EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58 (1st Cir. 2003)