## Facts

- State Analysis, Inc., doing business as StateScape, sold subscription access to a proprietary database of state legislative and regulatory information, with unique usernames and passwords for authorized users.
- American Financial Services Association (AFSA) subscribed from about 1998 to 2008 and, under its agreement, could provide access to member businesses through separate user credentials.
- Kimbell Sherman Ellis (KSE), a lobbying firm, bought a StateScape subscription around 1999–2000, later developed a competing tracking service (FOCUS), and hired two former StateScape employees in 2003.
- In 2008, AFSA told StateScape it planned to switch to KSE’s FOCUS product.
- StateScape’s forensic review allegedly showed the StateScape database was accessed 735 times from a Montpelier, Vermont computer using usernames and passwords assigned to three AFSA employees in Washington, D.C.
- KSE was not an AFSA member and allegedly had no entitlement to use AFSA-issued credentials.
- StateScape also alleged KSE produced bill summaries and related materials for AFSA that were markedly similar to StateScape’s materials, supporting an inference of copying of protected content and arrangement.

## Issues

1. Whether the complaint plausibly alleged copyright infringement based on copying protected selection, coordination, arrangement, or original explanatory content from a database containing public legislative materials.
2. Whether the complaint plausibly alleged liability under the Computer Fraud and Abuse Act (CFAA) for access “without authorization” or access that “exceed[ed] authorized access,” and a cognizable statutory “loss.”
3. Whether the complaint sufficiently alleged unauthorized access or use under the Virginia Computer Crimes Act (CCA) based on alleged misuse of AFSA credentials.
4. Whether related state-law theories were preempted by the Copyright Act or otherwise inadequately pleaded.

## Decision

- The court granted defendants’ Rule 12(b)(6) motions in part and denied them in part.
- The court held the complaint plausibly alleged copyright infringement sufficient to proceed past the pleading stage.
- The court held core CFAA claims were plausibly pleaded where a non-subscriber allegedly accessed the database using credentials issued to others, and the plaintiff alleged investigation and response costs constituting statutory “loss.”
- The court held certain Virginia CCA claims were plausibly pleaded based on repeated access by an allegedly unauthorized party using others’ credentials.
- The court dismissed certain state-law claims or theories to the extent they were preempted by federal copyright law or lacked sufficient factual allegations or required elements.

## Legal Principles

- Copyright protection for compilations and databases may extend to original selection, coordination, and arrangement and to original explanatory content, even when underlying source materials are public and unprotected.
- At the pleading stage, allegations of repeated unauthorized access coupled with marked similarity between works can support a reasonable inference of copying.
- Copyright Act preemption bars state-law claims that seek to vindicate rights equivalent to exclusive rights under copyright; claims with an “extra element,” such as breach of a specific contract duty or statutory unauthorized-access elements, may proceed.
- Under the CFAA, alleged use of valid credentials by an unauthorized third party can constitute access “without authorization” or in excess of authorization, depending on the pleaded limits on permission.
- CFAA “loss” can include reasonable costs of responding to the offense, conducting a damage assessment, and investigating unauthorized access.
- Virginia computer-crime claims may be plausibly stated where facts support an inference of knowing, unauthorized computer access or use, including access by a non-entitled party through another user’s credentials.

## Conclusion

The court allowed the case to proceed on the core theories that defendants obtained and used StateScape’s database material through unauthorized credential-based access and copied protectable aspects of the database, while narrowing the suit by dismissing preempted or insufficiently pleaded state-law claims.


State Analysis, Inc. v. Am. Fin. Servs. Ass’n, 621 F. Supp. 2d 309 (E.D. Va. 2009)