Carfax, Inc. v. Accu-Trade, LLC

           IN THE UNITED STATES DISTRICT COURT                       
           FOR THE EASTERN DISTRICT OF VIRGINIA                      
                    Alexandria Division                              

CARFAX, INC.,                 )                                           
                         )                                           
Plaintiff,               )                                           
                         )                                           
v.                       )  Civil Action No. 1:21-cv-00361 (RDA/TCB)  
                         )                                           
ACCU-TRADE, LLC, et al.,      )                                           
                         )                                           
Defendants.              )                                           

            MEMORANDUM OPINION AND ORDER                             

This matter comes before this Court on Accu-Trade, LLC and R. Hollenshead Auto Sales 
& Leasing, Inc.’s (“Defendants”) Motion to Dismiss for lack of subject matter jurisdiction and 
failure to state a claim (“Motion”).  Dkt. Nos. 13; 23.  This Court has dispensed with oral argument 
as it would not aid in the decisional process.  Fed. R. Civ. P. 78(b); Local Civil Rule 7(J).  This 
matter  has  been  fully  briefed  and  is  now  ripe  for  disposition.    Considering  Defendants’ 
Memorandum in Support of its Motion (Dkt. 14), Plaintiff Carfax, Inc.’s (“Plaintiff”) Opposition 
(Dkt. 16), Defendants’ Reply (Dkt. 17), Defendants Supplemental Memorandum in Support of its 
Motion (Dkt. 23); Plaintiff’s Supplemental Opposition (Dkt. 26), and Defendants’ Supplemental 
Reply (Dkt. 27), this Court DENIES the Motion to Dismiss for Lack of Jurisdiction and GRANTS 
IN PART and DENIES IN PART the Motion to Dismiss for Failure to State a Claim for the reasons 
that follow.                                                              
                    I.  BACKGROUND                                   
                   A.  Factual Background                            
This matter arises from the Complaint Plaintiff filed before this Court alleging six counts 
against  Defendants:  (1)  infringing  the  Computer  Fraud  and  Abuse  Act,  

18 U.S.C. § 1030

 
(“CFAA”); (2) infringing the Virginia Computer Crimes Act, 

Va. Code Ann. § 18.2

 – 152.1, et 
seq. (“VCCA”); (3) fraud; (4) unjust enrichment; (5) conversion; and (6) trespass to chattels.  
Plaintiff seeks equitable relief and damages, as well as punitive damages.  
Plaintiff is a data company, incorporated under the laws of Pennsylvania and headquartered 
with its principal place of business in Centreville, Virginia.  Defendant Accu-Trade, LLC (“Accu-

Trade”), which is a valuation platform for auto dealers in calculating offers for potential trade-in 
vehicles, is part of Defendant R. Hollenshead Auto Sales & Leasing, Inc. (“Hollenshead”), which 
characterizes itself as a major automobile wholesaler in North America.  Accu-Trade is organized 
under  the  laws  of  Delaware,  with  its  principal  place  of  business  in  Pennsylvania,  while 
Hollenshead is incorporated under the laws of Florida, with its principal place of business in 
Pennsylvania.                                                             
Plaintiff manages vehicle history information for participants in the used car and light truck 
markets.  As part of its information sharing technology, Plaintiff owns the QuickVIN® tool (“QV”) 
to allow its users to search Vehicle Identification Numbers (“VINs”) in Plaintiff’s database and 

the associated vehicle’s year, make, and model by simply searching a license plate state and 
number.  As a result, the QV tool allows its users to efficiently identify VINs in connection with 
used car transactions at less cost.                                       
The declaration of Donald Elliott, Director of Data Acquisition for Plaintiff, maintains that 
on August 5, 2016, Bob Hollenshead, founder and Manager of Accu-Trade and President of 
Hollenshead, and Jeff Zamora of Accu-Trade, visited Plaintiff’s offices in Centreville, Virginia 
“to discuss a potential data sharing agreement between the parties.”  Dkt. 16-1 ¶ 5.  During that 
visit, Mr. Elliott submits that the parties “discussed the data that Accu-Trade and Hollenshead 
might be able to provide to [Plaintiff] in exchange for access to various [] tools [from Plaintiff] 
that might be of interest to Accu-Trade and Hollenshead, including the [QV] tool.”  Id.1  The QV 
tool had the potential to allow Accu-Trade’s users, such as dealers, to assess valuations of vehicles 
using license plate numbers rather than the VIN, “saving them time, money, and reducing data 
entry errors associated with entering a 17-character VIN.”  Dkt. 1 ¶ 6.  Nearly two years later, 
Plaintiff and Accu-Trade discussed a potential agreement whereby Plaintiff would provide Accu-

Trade with access to the QV tool and its associated data in exchange for Accu-Trade’s vehicle 
data.  In May of 2018, Plaintiff provided Accu-Trade with access to a “QV test account for the 
limited purpose of testing the QV tool to ensure it could be integrated into [Accu-Trade’s] 
valuation platform.”  

Id. ¶ 22

.  Later that month, Accu-Trade provided a “test set of data” to 
Plaintiff containing  561 records  “for the limited purpose of  allowing  [Plaintiff] to  test the 
usefulness of the data” for its systems.  

Id. ¶ 23

.                       
Mr. Elliott, on behalf of Plaintiff, communicated frequently with Mr. Zamora and Mr. 
Hollenshead as part of the negotiations between the parties.  Dkt. 16-1 ¶ 8.  After several months 
of the test run and negotiations, Plaintiff sent a “standard, unexecuted Data Transfer and License 

Agreement” subject to “the laws of the Commonwealth of Virginia,” to Accu-Trade in the event 
the parties arrived at an agreement.  Dkt. 1 ¶ 24; Dkt. 16-1 ¶ 10.  Approximately three months 
later, on November 3, 2018, Mr. Zamora of Accu-Trade informed Plaintiff that Accu-Trade 
“would not be using the QV tool and no longer wished to enter into an agreement with [Plaintiff] 
to provide data to [Plaintiff] in exchange for access to and use of the QV tool.”  Dkt. 1 ¶ 25.  
“Despite these representations, [Plaintiff] subsequently learned that Accu-Trade (and possibly 


1  The declaration of James Sibel, the Chief Financial Officer of Accu-Trade, submits that 
Accu-Trade “never visited to negotiate the QV tool contract” and that Accu-Trade and Plaintiff 
only communicated via email and telephone.  Dkt. 14-1 ¶ 12.  However, as required by the Fourth 
Circuit, the Court construes this fact in favor of the plaintiff for purposes of evaluating the Motion.  
Hollenshead or other entities) continued to access and use [QV] and its associated data without 
authorization.”  Dkt. 16-1 ¶ 13.  When Plaintiff confronted Accu-Trade’s Chief Financial Officer 
about the alleged fraud, he “immediately signed and returned to [Plaintiff]” the contract Plaintiff 
had initially sent to Accu-Trade, which Plaintiff never executed previously or thereafter.  Dkt. 1 ¶ 
28.  On March 24, 2019, Mr. Zamora confirmed to Plaintiff that Accu-Trade had been continuing 

to access and use the QV tool while also reselling the tool and its associated data to at least one 
third party, “who then allowed access to approximately 100 of its own customers.”  

Id. ¶ 29

.  In 
total, Plaintiff alleges that Accu-Trade “engaged in or facilitated the unauthorized access and use 
of the QV tool and its associated data approximately 112,534 times.”  

Id. ¶ 27

; Dkt. 16-1 ¶ 13.   
Plaintiff’s claims turn on the allegation that Defendants knowingly and intentionally 
accessed Plaintiff’s computer systems and server without authorization or in excess of any 
authorization during the time of the test run of the QV tool integration—between May of 2018 and 
November 3, 2018—and continued to use the QV tool even after notifying Plaintiff they would 
not use the QV tool and no longer wished to continue negotiations.        

                  B.  Procedural Background                          
On March 24, 2021, Plaintiff filed the instant Complaint against Defendants.  Dkt. 1.  On 
April 8, 2021, Defendants filed a motion to extend the time to file an answer to the Complaint to 
May 14, 2021, which the Court granted the same day.  Dkt. Nos. 7; 10.  On May 14, 2021, 
Defendants filed the Rule 12(b)(2) Motion to Dismiss for lack of personal jurisdiction as to both 
Defendants as well as an accompanying supporting memorandum.  Dkt. Nos. 13; 14.  On May 28, 
2021, Plaintiff filed its Opposition to the Motion and Defendants filed their Reply on June 3, 2021.  
Dkt. Nos. 16; 17.  On July 8, 2021, Defendants filed a motion for leave to file a supplemental 
memorandum in support of the Motion to Dismiss after the United States Supreme Court issued 
its decision in Van Buren v. United States, 

141 S. Ct. 1648

 (2021) on June 3, 2021.  And the Court 
granted that motion after the parties submitted separate briefs on the matter.  See Dkt. Nos. 20-22.  
On July 28, 2021, Defendants filed a supplemental brief in support of the Motion, seeking to 
dismiss two counts of the Complaint in light of the Van Buren decision for failure to state a claim 
under Rule 12(b)(6).  Dkt. 23.  The Court then approved the parties’ briefing schedule on August 

23, 2021.  Plaintiff timely filed its Opposition on September 15, 2021 and Defendants filed their 
Reply on September 30, 2021.  Dkt. Nos. 25-27.                            
                 II.  STANDARD OF REVIEW                             
                  A.  Rule 12(b)(2) Standard                         
Federal Rule of Civil Procedure 12(b)(2) provides that a court may dismiss a case for lack 
of personal jurisdiction.  Fed. R. Civ. P. 12(b)(2).  When resolving a Rule 12(b)(2) motion, a court 
undertakes a two-step analysis.  First, a court looks to whether personal jurisdiction is authorized 
by state law.  Mitrano v. Hawes, 

377 F.3d 402, 406

 (4th Cir. 2004).  Second, a court must find that 
the exercise of personal jurisdiction comports with the constitutional requirements of due process.  

Id.

  Virginia’s long-arm statute extends personal jurisdiction to the constitutionally permissible 
limits of the Due Process Clause of the Fourteenth Amendment.  ePlus Tech., Inc. v. Aboud, 

313 F.3d 166, 176

 (4th Cir. 2002).  Accordingly, “[b]ecause Virginia’s long-arm statute is intended to 
extend personal jurisdiction to the extent permissible under the due process clause, the statutory 
inquiry merges with the constitutional inquiry.”  Consulting Eng’rs Corp. v. Geometric Ltd., 

561 F.3d 273, 277

 (4th Cir. 2009).  At that point, as to each defendant, a court must find sufficient 
“minimum contacts [with the state] . . . such that the maintenance of the suit does not offend 
traditional notions of fair play and substantial justice.”  Int’l Shoe Co. v. Washington, 

326 U.S. 310, 316

 (1945); see also Walden v. Fiore, 

571 U.S. 277, 286

 (2014) (“The requirements of 
International Shoe, however, must be met as to each defendant over whom a state court exercises 
jurisdiction.”).  That inquiry involves exploring whether general or specific personal jurisdiction 
exists over any nonresident defendant.  See Helicopteros Nacionales de Colombia, S.A. v. Hall, 

466 U.S. 408, 414-16

 (1984).  “If the defendant’s contacts with the [s]tate are also the basis for the 
suit,  those  contacts  may  establish  specific  jurisdiction.”    ALS  Scan,  Inc.  v.  Digital  Serv. 

Consultants, Inc., 

293 F.3d 707

, 712 (4th Cir. 2002).  But “if the defendant’s contacts with the 
[s]tate are not also the basis for suit, then jurisdiction over the defendant must arise from the 
defendant’s general, more persistent, but unrelated contacts with the [s]tate.”  Id. 
In making a personal jurisdiction determination, a district court “must accept as true the 
uncontroverted factual allegations in the plaintiff’s complaint.”  Companion Prop. & Cas. Ins. Co. 
v. Palermo, 

723 F.3d 557, 559

 (5th Cir. 2013).  When a court does not conduct an evidentiary 
hearing on personal jurisdiction, a case may be dismissed for lack of personal jurisdiction if the 
plaintiff has failed to make a prima facie showing.  See Grayson v. Anderson, 

816 F.3d 262, 268

 
(4th Cir. 2016).  If such a showing is made, the defendant must “present a compelling case that the 

presence of some other considerations would render jurisdiction [so] unreasonable,” Burger King 
Corp. v. Rudzewicz, 

471 U.S. 462, 477

 (1985) as to “offend traditional notions of fair play and 
substantial justice,” Int’l Shoe, 

326 U.S. at 316

.  In evaluating the parties’ requisite burdens, a 
court  may  rely  on  “motion  papers,  supporting  legal  memoranda,  []  the  allegations  in  the 
complaint,” Consulting Eng’rs, 

561 F.3d at 276

, and “the contents of affidavits and any other 
relevant matter submitted by the parties to assist it in determining the jurisdictional facts,” 5B Alan 
Wright & Arthur Miller, Fed. P. & Proc. § 1351, at 305 (3d ed. 2004).     
                  B.  Rule 12(b)(6) Standard                         
Additionally, in order to survive a motion to dismiss brought under Federal Rule of Civil 
Procedure 12(b)(6), a complaint must set forth “a claim to relief that is plausible on its face.”  Bell 
Atl. Corp. v. Twombly, 

550 U.S. 544, 570

 (2007).  A claim is facially plausible “when the plaintiff 
pleaded factual content that allows the court to draw the reasonable inference that the defendant is 
liable for the misconduct alleged.”  Ashcroft v. Iqbal, 

556 U.S. 662, 678

 (2009) (citing Twombly, 

550 U.S. at 556

).  When reviewing a motion brought under Rule 12(b)(6), the Court “must accept 

as  true  all  of  the  factual  allegations  contained  in  the  complaint,”  drawing  “all  reasonable 
inferences” in the plaintiff's favor.  E.I. du Pont de Nemours & Co. v. Kolon Indus., Inc., 

637 F.3d 435, 440

 (4th Cir. 2011) (citations omitted).  “[T]he court ‘need not accept the [plaintiff’s] legal 
conclusions drawn from the facts,’ nor need it ‘accept as true unwarranted inferences, unreasonable 
conclusions, or arguments.’”  Wahi v. Charleston Area Med. Ctr., Inc., 

562 F.3d 599

, 616 n.26 
(4th  Cir.  2009)  (quoting  Kloth  v.  Microsoft  Corp.,  

444 F.3d 312, 319

  (4th  Cir.  2006)).  
Additionally, “[t]hreadbare recitals of the elements of a cause of action, supported by mere 
conclusory statements, do not suffice.”  Iqbal, 

556 U.S. at 678

.  Generally, courts may not look 
beyond the four corners of the complaint in evaluating a Rule 12(b)(6) motion.  See Goldfarb v. 

Mayor & City Council of Baltimore, 

791 F.3d 500, 508

 (4th Cir. 2015).     
                      III.  ANALYSIS                                 
The Court first assesses the personal jurisdiction issue and holds that exercising specific 
jurisdiction over each of the Defendants is proper.  The Court then evaluates the sufficiency of the 
Complaint solely as to Counts I and II and holds that Plaintiff has, as a matter of law, sufficiently 
pleaded facts to state a plausible claim as to Count II, but not as to Count I.  
                    A.  Personal Jurisdiction                        
Plaintiff argues that this Court has specific personal jurisdiction over Defendants because 
the cause of action arises from tortious conduct occurring in Virginia.2  However, Defendants 
argue first that Plaintiff has not sufficiently alleged specific jurisdiction over Hollenshead “because 
it makes no factual allegations regarding Hollenshead, let alone allegations of contacts with 
Virginia connected with this dispute.”  Dkt. 14 at 1.  Defendants also argue that exercising specific 
jurisdiction  over  them  would  not  comport  with  the  Due  Process  Clause  of  the  Fourteenth 

Amendment because they have not purposefully availed themselves of the privilege of conducting 
activities within Virginia; that the cause of action more likely arose outside the forum; and that 
exercising personal jurisdiction over Defendants would be unreasonable.    
                  1.  Virginia’s Long-Arm Statute                    
Courts resolve a challenge to personal jurisdiction involving non-resident defendants by 
engaging in a two-step inquiry: (1) “ascertaining whether the forum state’s long-arm statute 
authorizes personal jurisdiction” and if so (2) “determining whether the reach of the statute” 
“comports with the Due Process Clause of the Fourteenth Amendment of the United States 
Constitution.”  Aitken v. Comms. Workers of Am., 

496 F. Supp. 2d 653, 658-59

 (E.D. Va. 2007); 

Verizon Online Servs., Inc. v. Ralsky, 

203 F. Supp. 2d 601, 609

 (E.D. Va. 2003); see also Christian 
Sci. Bd. of Directors of First Church of Christ, Sci. v. Nolan, 

259 F.3d 209, 215

 (4th Cir. 2001).   
Pursuant to Virginia law, “a court may exercise personal jurisdiction under Virginia’s long-
arm statute ‘over a [party], who acts directly or by an agent, as to a cause of action arising from . 
. . causing tortious injury by an act or omission in this Commonwealth.’”  Verizon, 

203 F. Supp. 2d at 610

 (quoting 

Va. Code Ann. § 8.01-328.1

(A)(3)).  Virginia’s long-arm statute further 


2  Plaintiff does not argue that this Court has general jurisdiction over Defendants as 
Defendants’ contacts  with  Virginia are not  “so constant  and pervasive as to  render [them] 
essentially at home” in Virginia.  Daimler AG v. Bauman, 

571 U.S. 117, 122

 (2014) (internal 
quotation and citation omitted).  This Court solely assesses whether Defendants have subjected 
themselves to specific jurisdiction.                                      
provides that personal jurisdiction over a party is proper if that party (a) transacts in any business 
in Virginia, (b) causes tortious injury by “an act or omission in Virginia,” or (c) causes tortious 
injury in Virginia by “an act or omission outside Virginia” when that party regularly conducts 
businesses or “derives substantial revenue” in connection with business it provides to Virginia.  

Va. Code Ann. § 8.01-328.1

.    Virginia’s  long-arm  statute  defines  an  “act  .  .  .  in  this 

Commonwealth”  to  include  “using  a  computer  or  computer  network  located  in  the 
Commonwealth.”  

Va. Code Ann. § 8.01-328.1

(B).  Here, Plaintiff’s Complaint alleges that Accu-
Trade obtained information from Plaintiff’s “protected computer systems and server through the 
QV tool without authorization or in excess of authorization.”  Dkt. 1 ¶¶ 39-40.  Further, Plaintiff 
maintains that the affected server which hosts the QV tool data is physically located in Virginia 
and constitutes “property” within the meaning of Virginia Code § 18.2-152.2.  Id. ¶ 45.  As such, 
according to Plaintiff, Accu-Trade’s alleged use of that server places it within the reaches of 
Virginia’s long-arm statute.                                              
Because Plaintiff alleges that Hollenshead provided its consent to Accu-Trade to engage 

in the alleged wrongful conduct in the Complaint, and is thus allegedly complicit in the conduct, 
the Virginia long-arm statute’s reach also encompasses Hollenshead.  Additionally, Accu-Trade’s 
CFO,  who  also  used  a  Hollenshead  email  address,  signed  the  proposed  agreement  “which 
contemplated that Accu-Trade  and Hollenshead  would send Hollenshead data to  Carfax in 
Virginia.”  Dkt. 16-1 ¶¶ 11, 14.3  Lastly, construing the facts pleaded by Plaintiff in the light most 


3  This Court does not address Defendants’ discussion of whether Hollenshead is an alter 
ego of Accu-Trade.  The facts of the case make clear that Hollenshead provided value separate and 
apart from Accu-Trade in a potential agreement with Plaintiff.  That engagement by Hollenshead 
in negotiations with Plaintiff regarding the QV tool, including affirmatively consenting to Accu-
Trade’s allegedly improper use of the QV tool, provides sufficient grounds for this Court to 
exercise personal jurisdiction over Hollenshead pursuant to the Virginia long-arm statute.  The 
facts  alleged  by  Plaintiff  provide  a  plausible  basis  to  believe  that  Accu-Trade  needed 
favorable to Plaintiff, the founder of Hollenshead himself, met with Plaintiff’s representatives in 
Virginia to kickstart talks between Plaintiff and Defendants regarding potential business synergies, 
including the QV tool that is the basis of this Complaint.  Dkt. 16-1 ¶ 5.  That the parties did not 
accelerate their negotiations until nearly two years later does not ipso facto make their initial 
interactions irrelevant for purposes of this Court’s jurisdictional analysis.  Ultimately, Plaintiff’s 

pleadings paint a clear picture that Accu-Trade and Hollenshead worked in concert during their 
business dealings with Plaintiff.  Together, these facts amount to a sufficient jurisdictional basis 
for exercising personal jurisdiction over Hollenshead pursuant to Virginia’s long-arm statute.   
                      2.  Due Process                                
Pivoting to the second step of the personal jurisdiction inquiry, the courts find that 
sufficient minimum contacts exist with the forum state if a federal court may exercise general or 
specific personal jurisdiction over the nonresident defendants.  Helicopteros, 

466 U.S. at 414-16

.  
It is well-settled within the Fourth Circuit that courts apply a three-pronged test to evaluate whether 
specific personal jurisdiction is proper: (1) “did the defendants ‘purposefully avail’ themselves of 

the privileges of conducting activities in the forum”; (2) “does the claim arise out of these 
activities”; and (3) “is the exercise of jurisdiction reasonable?”  Aitken, 

496 F. Supp. 2d at 659

 
(citing Christian Science, 

259 F.3d at 216

); see also Verizon, 

203 F. Supp. 2d at 611

.  
                   i.  Purposeful Availment                          
Jurisdictional cases involving the Internet involve two strands of potential purposeful 
availment analysis.  The first adopts a “sliding-scale test” enunciated in Zippo Mfg. Co. v. Zippo 
Dot Com, Inc., 

952 F. Supp. 1119, 1124

 (W.D. Pa. 1997), which is meant to assess the active 


Hollenshead’s consent by virtue of Hollenshead’s prior involvement in the negotiations and the 
fact that Accu-Trade is a subsidiary of Hollenshead.  That allegation is not conclusory.   
versus passive nature of a defendant’s access on a particular website.  That heuristic tool allows 
courts to link the propriety of personal jurisdiction over a defendant with the “nature and qualify 
of commercial activity that [the defendant] conducts over the Internet.”  Atlantech Distribution, 
Inc. v. Credit Gen. Ins. Co., 

30 F. Supp. 2d 534, 536-37

 (D. Md. 1998) (citing Zippo Mfg., 

952 F. Supp. at 1124

).  The second framework, termed the “effects test,” is born of the United States 

Supreme Court’s decision in Calder v. Jones, 

465 U.S. 783

 (1984).  Courts in this Circuit have 
traditionally applied the “effects test” in tort cases involving internet activity.  A plaintiff makes 
the requisite showing of the tort’s sufficient effect in the forum to establish jurisdiction if: “(1) the 
defendant committed an intentional tort; (2) the plaintiff felt the brunt of the harm in the forum, 
such that the forum can be said to be the focal point of the harm; and (3) the defendant expressly 
aimed [the] tortious conduct at the forum, such that the forum can be said to be the focal point of 
the tortious activity.”  Carefirst, 334 F.3d at 398 n.7; StratusLive, 

2020 WL 6305875

, at *3; 
Verizon, 

203 F. Supp. 2d at 614

.  Whether the defendant “expressly aimed” the tortious conduct at 
the forum depends on whether the defendant “knew or reasonably should have known” such 

conduct would occur in the forum.  Aitken, 

496 F. Supp. 2d at 660

; see also StratusLive, 

2020 WL 6305875

, at *4 (noting that courts do not require a defendant has actual knowledge of a server’s 
location in order to be “construed as aiming its conduct at a specific forum”).  The Supreme Court 
further refined the “effects test” in Walden to require that the necessary “minimum contacts” to 
establish jurisdiction over a non-resident defendant turns on the defendant’s “contacts with the 
forum state itself, not . . . with the persons who reside there.”  571 U.S. at 285.  Those contacts 
must also convey a rhyme and reason such that the “defendant’s conduct connects [it] to the forum 
in a meaningful way” rather than be “random, fortuitous, or attenuated.”  Id. at 285, 290.   
Plaintiff argues that Defendants purposefully availed themselves of the laws of Virginia 
because they “were aware at the time of the [alleged] scheme that [Plaintiff] was located in Virginia 
and would feel the effects of their tortious conduct in Virginia” as a result of their alleged improper 
use of Plaintiff’s QV tool and its associated data.  Dkt. 1 ¶ 31; 33; see also Dkt. 16 at 14.  Moreover, 
Plaintiff maintains, it was reasonable for Defendants to expect that their use of the QV tool 
involved making contacts with Plaintiff’s servers in Virginia.  Dkt. 16 at 13-14.  From Plaintiff’s 

vantage  point,  specific  personal  jurisdiction  derives  from  the  alleged  tortious  conduct  of 
Defendants that “create[d] a substantial connection with the forum state.”  Id. at 7 (citing Burger 
King, 

471 U.S. at 475

).  In support of its position, Plaintiff cites this Court’s reasoning in Verizon 
and Aitken to demonstrate that the presence of a server in the forum which constitutes the location 
of the tort is a sufficient minimum contact to exercise personal jurisdiction over a nonresident 
defendant.                                                                
Defendants  contend  that  the  only  way  this  Court  can  arrive  at  exercising  personal 
jurisdiction is by finding that Defendants “transacted business” in the forum.  On that basis, 
Defendants submit that they never consummated the proposed contract, despite having executed 

it, and that Plaintiff initiated the discussions surrounding the contract.  Defendants also note that 
the Fourth Circuit has described non-resident defendant contact with a web server within the forum 
as “de minimis” for purposes of establishing personal jurisdiction.  Dkt. 14 at 14 (citing Carefirst 
of Md., Inc. v. Carefirst Pregnancy Ctrs., Inc., 

334 F.3d 390, 402

 (4th Cir. 2003)).  Relying also 
on the recent decision in StratusLive, LLC v. Wimr Grp., LLC, No. 2:19-cv-623, 

2020 WL 6305875

, at *4 (E.D. Va. Oct. 14, 2020), Defendants highlight that Plaintiff did not allege Accu-
Trade “knew” Plaintiff’s servers managing the online traffic for the QV tool were located in 
Virginia.  

Id.

  Without that allegation, Defendants maintain that this Court has no specific personal 
jurisdiction over Defendants.  Lastly, Defendants argue that Verizon and Aitken are inapposite 
because those cases involved actual damage to servers as a result of clogging server bandwidth 
with spam and that Verizon and Aitken both predated the United States Supreme Court decision in 
Walden, which emphasized that personal jurisdiction over a defendant requires that the “suit-
related conduct . . . create a substantial connection with the forum state.”  Dkt. 17 at 7-10 (citing 
Walden, 

571 U.S. at 284

).                                                 

Here, Defendants, are alleged to have acted in concert by virtue of their prior dealings 
together with Plaintiff and their organizational relationship, allegedly committed an intentional 
tort against Plaintiff by misappropriating the QV tool for pecuniary gain.  According to Plaintiff’s 
allegations,  Accu-Trade  “purposefully  and  deliberately,”  Verizon,  

203 F. Supp. 2d at 612

, 
committed the intentional tort 112,534 times with the consent of Hollenshead.  Dkt. 1 ¶ 27; Dkt. 
16-1 ¶ 13.                                                                
Second, Plaintiff argues that the brunt of that tortious conduct was felt by Plaintiff in 
Virginia, where both the QV tool server and Plaintiff’s principal place of business were physically 
located.                                                                  

After having met with Plaintiff’s representatives in Virginia at Plaintiff’s headquarters to 
explore potential business synergies between the parties, Defendants “knew or should have 
known” that Plaintiff “would likely suffer harm” in Virginia by committing the alleged tort.  
Verizon, 

203 F. Supp. 2d at 614

.  Additionally, Plaintiff’s principal place of business, and the fact 
that it maintained its nerve center of operations in Virginia, are indicia of reliability to demonstrate 
that Defendants, at minimum, “should have known” their tortious conduct would cause harm to a 
plaintiff in the forum.  

Id.

 (citing Panavision Int’l, L.P. v. Toeppen, 

141 F.3d 1316, 1321

 (9th Cir. 
1998)); see also Walden, 

571 U.S. at 285

 (“And although physical presence in the forum is not a 
prerequisite to jurisdiction, physical entry into the State—either by the defendant in person or 
through an agent . . .—is certainly a relevant contact.”) (internal citation omitted).  Notably, when 
Defendants’ representative unilaterally executed the proposed contract containing a Virginia 
choice-of-law provision, Defendants affirmed their comfort with the proposed contract’s Virginia 
choice-of-law provision which would call them into the forum with respect to litigation arising 
from Plaintiff’s QV tool.  Dkt. 1 ¶ 28; Dkt. 16-1 ¶ 10; see also CompuServe v. Patterson, 

89 F.3d 1257, 1262-63

 (6th Cir. 1996) (finding that the defendant had purposefully availed himself of the 
forum state by entering into a contract governed by the law of the forum regarding the advertising 
and distribution of the plaintiff’s software).  At each stage of communication between the parties, 
Plaintiff headlined Virginia within the negotiations as “the focal point both of the story and of the 
harm suffered.”  Calder, 

465 U.S. at 789

.  Therefore, Defendants’ “conduct and connection with 
[Virginia] are such that [they] should reasonably anticipate being haled into court there.”  Verizon, 

203 F. Supp. 2d at 612

.                                                   
Third, the location of the server used to commit the alleged tort is also probative of whether 
Defendants have purposefully availed themselves of personal jurisdiction because it speaks to 

Defendants directing their conduct at the forum.  To be sure, the injury does not mirror the injury 
in a spammer case; but the reasoning in Verizon and Aitken remain instructive to this Court.4  While 
Defendants attempt to weaken the significance of this Court’s prior decisions in Verizon and Aitken 
involving spam-related injuries on servers, this Court notes that these cases prove relevant not 
because of an alleged injury to a server but because the tort itself occurred by way of a server.  See 
Aitken, 

496 F. Supp. 2d at 659-60

 (“Those who commit torts via computer and the Internet know, 
or reasonably should know, that servers are either targets of their conduct or the means by which 


4  Spammer cases are especially helpful in this Court’s analysis because they involve 
making contact with servers.  The “nature and quality” of those contacts determine a court’s 
jurisdictional analysis.  Verizon, 

203 F. Supp. 2d at 616

.                
their tortious conduct is given effect.”) (emphasis added).  Unlike the defendant in StratusLive, 
Defendants here had reason to know that the QV tool server would be located in Virginia, where 
Plaintiff was headquartered.  StratusLive, 

2020 WL 6305875

, at *4 (“Here, [the defendant] did not 
know and had no reason to know the servers were in Virginia, demonstrating that he did not aim 
his conduct at Virginia.”); see also Fireclean LLC v. Tuohy, No. 1:16-cv-294, 

2016 WL 4414845

, 

at *7 (E.D. Va. Jun. 14, 2016) (“Plaintiff has no basis for believing the servers hosting Defendants’ 
blog posts are located in Virginia, as opposed to California, Amsterdam, or elsewhere.”).  That 
Defendants “did not know the precise location of [the] server is of no constitutional moment.”  
Aitken, 

496 F. Supp. 2d at 660

.                                           
Defendants argue that the Fourth Circuit considers the location of the server as “de 
minimis” in analyzing the “minimum contacts” of a case.  However, Defendants mischaracterize 
the Fourth Circuit’s opinion in Carefirst.  For one, the “de minimis” language is at best  dicta.  As 
the Fourth Circuit identified in United States v. Batato, 

833 F.3d 413, 424-25

 (4th Cir. 2016), the 
“de minimis” language is “an unfortunate paraphrasing in our Carefirst opinion of a discussion 

contained in a footnote of [Christian Science] . . . [and] does not purport to state a rule of general 
application, nor could it given that the reference is contained in dicta.”  Instead, while the Fourth 
Circuit has not addressed purposeful availment within the context of a “single server that happened 
to reside in the forum state,” it has found purposeful availment where a collection of servers are 
“the central conduit by which the conspiracy was conducted.”  Batato, 

833 F.3d at 425

.  Here, 
without having accessed the QV tool server in Virginia, Defendants would not have been able to 
carry out the alleged misuse of Plaintiff’s proprietary platform and data.  
While the “effects test” places a burden on Plaintiff to demonstrate Defendants at least 
should have known the alleged tort would be felt in the forum when accessing the QV tool, courts 
are also sensitive to applying the test in such a way that does not create perverse incentives.  For 
instance, this Court has repeatedly recognized that “simply pleading ignorance of where the[] 
servers were physically located” cannot empower a nonresident defendant to avoid personal 
jurisdiction and thus “constitute a manifest injustice to [the plaintiff] and Virginia.”  Aitken, 

496 F. Supp. 2d at 660

; Verizon, 

203 F. Supp. 2d at 620

.  Rather, courts look to the nature of the 

interaction by a nonresident defendant with the server.  Verizon, 

203 F. Supp. 2d at 615

 (discussing, 
in the context of e-mails, “the active as opposed to passive nature” of the internet communication 
as “weigh[ing] in favor of finding personal  jurisdiction in the forum  where the [electronic 
communication] was received”).  When the defendant engages in the alleged tort for pecuniary 
gain, courts are especially exacting in their analysis.  See 

id. at 616

 (“One of the key factors courts 
have focused on in finding purposeful availment of a forum state concerning conduct over the 
Internet is whether the activity was driven by pecuniary gain rather than personal purposes.”); 
Internet Doorway, Inc. v. Parks, 

138 F. Supp. 2d 773, 779-80

 (S.D. Miss. 2000) (“By sending an 
e-mail solicitation to the far reaches of the earth for pecuniary gain, one does so at her own peril, 

and cannot then claim that it is not reasonably foreseeable that she will be haled into court in a 
distant jurisdiction to answer for the ramifications of that solicitation.”); Zippo Mfg., 

952 F. Supp at 1124

 (noting the commercial nature of the exchange of data between the parties as a possible 
basis for exercising personal jurisdiction).                              
Here, in each of the alleged 112,534 instances in which Plaintiff alleges Accu-Trade 
improperly accessed the QV tool, Accu-Trade actively retrieved Plaintiff’s proprietary data by 
knocking and then opening the door of the server in an entirely non-“random, fortuitous, or 
attenuated” manner.5  Simply put, Accu-Trade’s conduct “was not a ‘one-shot affair.’”  Verizon, 

203 F. Supp. 2d at 617

 (quoting CompuServe, 

89 F.3d at 1265

).  Unlike in the case of spamming, 
where this Court has still found grounds to exercise personal jurisdiction in Verizon and Aitken, 
Plaintiff has alleged that Accu-Trade targeted the QV tool portal repeatedly to draw information 
from Plaintiff’s server into Accu-Trade’s platform rather than simply transmit information to the 

server.  See, e.g., Amberson Holdings LLC v. Westside Story Newspaper, 

110 F. Supp. 2d 332, 336

 
(D.N.J. 2000) (refusing to find personal jurisdiction over a defendant involving an inter-computer 
transfer  of  information  akin  to  “forwarding  calls  to  a  desired  phone  number  through  a 
switchboard.”).    Moreover,  Defendants’  alleged  misappropriation  of  the  QV  tool  and  the 
associated data by marketing it under their own platform and selling it to at least one third-party 
foreclosed Plaintiff from making additional transactions with other customers.  Dkt. 1 ¶¶ 69, 74. 
This alleged harm to Plaintiff’s business further accentuates the importance of preventing parties 
from improperly utilizing another party’s server for pecuniary gain with impunity.  Verizon, 

203 F. Supp. 2d at 620

.  In this case, Defendants are alleged to have “know[n] full well that their 

conduct harmed . . . [Plaintiff’s] business.”  Id.; see also Dkt. 1 ¶¶ 52, 61, 69.   
Lastly, while Defendants argue that Walden recharacterizes the “effects test” so as to 
nullify this Court’s reasoning in Verizon and Aitken, the Supreme Court made absolutely clear that 
its decision did not address “the very different questions whether and how a defendant’s virtual 
‘presence’ and conduct translate into ‘contacts’ with a particular state.”  571 U.S. at 290 n.9 


5  Defendants highlight that Verizon and Aitken dealt with spammer cases where the harm 
was overloading the server and clogging the servers ability to function properly.  However, this 
Court finds Defendants’ argument unavailing considering that the injury in this matter is not to the 
server itself but rather to Plaintiff’s business as a result of Defendants having repeatedly penetrated 
their server within the forum.  The server in the forum acted as a conduit and not the target of the 
alleged injury.                                                           
(emphasis  added).  Thus, the emphasis on connection to the forum and not the plaintiff in Walden 
proves uninstructive for purposes of the jurisdictional question before this Court.  
    ii.  Cause of Action’s Relationship to Defendants’ Activities in Virginia 
As  to  the  second  step  in  establishing  specific  personal  jurisdiction,  a  nonresident 
defendant’s relationship to the forum “must arise out of contacts that ‘the defendant himself’ 

creates with the forum.”  Walden, 

571 U.S. at 284

 (quoting Burger King, 

471 U.S. at 475

).  The 
“minimum contacts” analysis is defendant-centric in that “however significant the plaintiff’s 
contacts with the forum may be, those contacts cannot be ‘decisive in determining whether the 
defendant’s due process rights are violated.’” 

Id.

 at 285 (quoting Rush v. Savchuk, 

444 U.S. 320, 332

 (1980)).  “If a defendant’s contacts with the forum state are related to the operative facts of 
the controversy, then an action will be deemed to have arisen from those contacts.”  Verizon, 

203 F. Supp. 2d at 620

 (quoting CompuServe, 

89 F.3d at 1267

).                 
Plaintiff contends that, as in Verizon, “the connection to Virginia is the claim itself.”  Dkt. 
16 at 15 (quoting Verizon, 

203 F. Supp. 2d at 620

).  Plaintiff also disputes Defendants’ claim that 

the Complaint did not allege that Accu-Trade acted with sufficient knowledge.     
Defendants  counter  that  the  mere  allegation  of  intentional  harm  against  Plaintiff  is 
insufficient because that would “impermissibly allow[] [P]laintiff’s contacts with the defendant 
and forum to drive the jurisdictional analysis.”  Dkt. 14 at 15 (citing Walden, 

571 U.S. at 289

).  
Furthermore, Defendants argue that they never entered into an enforceable contract with Plaintiff 
and that their contact with the forum solely related to those negotiations.  Because Plaintiff did not 
allege that Accu-Trade “knowingly accessed Virginia-based web servers,” Defendants maintain 
that the cause of action bears no significant relationship to Defendants’ activities in Virginia.  

Id.

  
Here, for the same reasons described above, Defendants’ alleged repeated and deliberate 
access of Plaintiff’s QV tool server 112,534 times in Virginia constituted much of the tortious 
conduct alleged by Plaintiff.  But for Defendants’ alleged improper access of Plaintiff’s server, 
Plaintiff would not have suffered the alleged harm.6  See Panavision, 

141 F.3d at 1321

; Verizon, 

203 F. Supp. 2d at 621

.  As in Verizon and Aitken, Defendants had every reason to know that their 
access of the QV tool directly impacted Plaintiff’s principal business in Virginia.  And unlike in 

Verizon and Aitken, Defendants actively and intentionally drew from the proprietary data well that 
was Plaintiff’s server physically located in Virginia to effect the tortious injury on Plaintiff.  While 
Walden prohibits a court from resting personal jurisdiction predominantly on a plaintiff’s contacts 
with the forum, the facts of this case do not trip the Walden wire.  Defendants’ actions in the forum 
drive  the  jurisdictional  analysis  and  therefore,  the  second  requirement  of  personal  specific 
jurisdiction is satisfied.                                                
   iii.  Reasonableness of Exercising Personal Jurisdiction Over Defendants 
The  final  prong  of  the  due  process  analysis  requires  courts  to  evaluate  whether  a 
defendant’s actions have a “substantial enough connection” with the plaintiff and the forum “to 

make the exercise of personal jurisdiction over [the defendants] constitutionally reasonable.”  

6  To be clear, Plaintiff alleges that harm to have been the fact that: 

Defendants wrongfully exercised dominion or control over the QV tool and its data 
by not only continuing to use it, but by reselling the QV tool and its associated data 
to at least one third party without Carfax’s knowledge or consent, resulting in 
illicitly gained revenue and profits to Defendants . . . particularly insofar as it was 
sold to third parties without Carfax’s knowledge or consent, and deprived Carfax 
of the ability to sell the tool and its associated data to those third parties itself.  
Dkt. 1 ¶¶ 67, 74.                                                         

Defendants also used Carfax’s name and reputation to resell the QV tool and its 
associated data to third parties, thereby depriving Carfax of its property interest in 
its own name and reputation.                                         
Id. ¶ 69.                                                                 
Verizon, 

203 F. Supp. 2d at 621

 (citing Christian Science, 

259 F.3d at 216

).  In determining 
whether exercising personal jurisdiction over a foreign defendant is constitutionally reasonable, 
courts in the Fourth Circuit consider “the burden on the defendant, the forum State’s interest in 
adjudicating the dispute, the plaintiff’s interest in obtaining convenient and effective relief, the 
interstate judicial system’s interest in obtaining the most efficient resolution of controversies, and 

the  shared  interest  of  several  States  in  furthering  fundamental  substantive  social  policies.”  
Christian Science, 

259 F.3d at 217

 (quoting Burger King, 

471 U.S. at 477

).  Ultimately, the 
reasonableness analysis asks whether exercising jurisdiction over a defendant “make[s] litigation 
‘so gravely difficult and inconvenient’ that a party unfairly is at a ‘severe disadvantage’ in 
comparison to his opponent.”  

Id.

 (quoting Burger King, 

471 U.S. at 478

).   
Plaintiff argues that exercising personal jurisdiction over Defendants is constitutionally 
reasonable because Virginia has a “strong interest” in resolving the dispute that includes Virginia 
law claims that arise from the use of a server located in Virginia and involve a Virginia- 
headquartered business.  Dkt. 16 at 18-19.  Additionally, Plaintiff asserts that to expect Defendants 

to defend the suit in Virginia does not impose an unreasonable burden on Defendants.   
Defendants submit that Accu-Trade is a small twelve-employee company in Pennsylvania 
with “[a]ll possible witnesses and documentary evidence” in Pennsylvania.  Dkt. 14 at 16.  
Moreover, Defendants argue that Plaintiff’s VCCA claim is “largely derivative” of its federal 
CFAA claim.  Lastly, Defendants argue that Plaintiff’s interest in obtaining “convenient and 
effective relief” is counterbalanced by Accu-Trade’s equivalent interest and that the judicial 
system’s interstate interest in efficiently resolving the dispute would not be furthered to a greater 
extent in Virginia than in Pennsylvania or elsewhere.  Dkt. 14 at 17.     
While Defendants note that “the ‘reasonableness’ specific personal jurisdiction factors 
weigh  slightly more in favor of Pennsylvania than Virginia,”  Dkt.  14 at  17, they do not 
demonstrate that exercising jurisdiction over them would be “extraordinary []or of constitutional 
magnitude.”  Aitken, 

496 F. Supp. 2d at 661

.  First, Defendants’ places of business are located in 
Manheim, Pennsylvania, approximately 130 miles from this Court.  That distance is nearly half 
the distance spanning the Eastern District of Virginia.  Second, this Court considers a number of 

factors  that  give  Virginia  a  legitimate  interest  in  adjudicating  the  dispute:  (1)  Plaintiff  is 
headquartered and principally operating in Virginia; (2) the tort occurred via a server physically 
located in Virginia; (3) the contract negotiations related to this dispute began when Defendants 
physically traveled to Virginia to meet with Plaintiff; (4) the contract Defendants unilaterally 
signed contemplated a Virginia forum selection clause; and (5) five of the six claims alleged 
against Defendants arise or could arise under Virginia law.  Third, as Defendants admit, while 
there are reasons why Defendants would prefer to litigate in another forum such as Pennsylvania, 
exercising personal jurisdiction over Defendants would not impede convenient and effective relief 
nor would it frustrate the interstate judicial system’s interest in obtaining the most efficient 

resolution of controversies.  In all, exercising specific personal jurisdiction over Defendants would 
not make this litigation “so gravely difficult and inconvenient” that Defendants are at a “severe 
disadvantage” in comparison to Plaintiff.  Burger King, 

471 U.S. at 478

.   
Lastly, the Fourth Circuit has advised that “‘where the jurisdictional facts are intertwined 
with the facts central to the merits of the dispute’ deferring resolution of that factual dispute to a 
proceeding on the merits ‘is the better view.’”  Grayson v. Anderson, 

816 F.3d 262, 268

 (4th Cir. 
2016) (quoting Adams v. Bain, 

697 F.2d 1213, 1219

 (4th Cir. 1982)).  Because Defendants’ 
interaction  with  the  forum  via  Plaintiff’s  server  underlies  the  entire  dispute  as  to  whether 
Defendants acted unlawfully in the use of the QV tool and Plaintiff’s associated data, the 
jurisdictional facts are “intertwined” with the merits of the dispute.  As a result, it is reasonable for 
this Court to not put the cart before the horse since the factual dispute regarding the nature of 
Defendants’ use of Plaintiff’s Virginia servers undergirds the merits, and not just the jurisdiction, 
of the matter.                                                            
      iv.  Due Process Considerations of Hollenshead as a Defendant  

As to due process concerns related to Hollenshead’s ability to mount a defense, the Court 
has recognized that “personal jurisdiction can be imputed against a foreign co-conspirator when 
one co-conspirator has sufficient contacts with the forum such that due process would not be 
violated.”  Knight v. Doe, No. 1:10-cv-887, 

2011 WL 2471543

, at *2 n.2 (E.D. Va. Jun 21, 2011) 
(citing Verizon, 

203 F. Supp. 2d at 622

).  Hollenshead’s role in the alleged tort features the same 
role of a co-conspirator.  Hollenshead not only allegedly provided Accu-Trade with informed 
consent to use the QV tool and associated data in the alleged improper manner, but it also played 
a prominent role in the negotiations with Plaintiff that gave rise to the alleged tortious conduct.7  
Importantly, Hollenshead stood to benefit from the tortious conduct as it could leverage the data 

acquired by Accu-Trade to improve its function as an automobile wholesaler.  This Court applies 
the same reasoning in Knight here and finds that, even if Hollenshead could not be brought into 
the forum based on its own contacts with the forum, its relationship with Accu-Trade makes 
exercising personal jurisdiction over it proper.                          
For these reasons, this Court holds that there are sufficient minimum contacts with the 
forum to exercise personal jurisdiction over Defendants so as not to offend “traditional notions of 
fair play and substantial justice.”  Int’l Shoe, 

326 U.S. at 316

 (quoting Milliken v. Meyer, 

311 U.S. 7

  Hollenshead was to provide Plaintiff with auction data in return for Accu-Trade’s access 
to the QV tool.  Dkt. 16-1 ¶ 6.                                           
457, 463 (1940)).                                                         
         B.  Sufficiency of the Complaint as to Counts I and II      
Relying on the United States Supreme Court’s recent opinion in Van Buren, Defendants 
also move this Court to dismiss Count I and Count II of the Complaint.  For the reasons to follow, 
this Court finds that Plaintiff has pled a sufficient factual basis to consider the claims as to both 

Count I and Count II facially plausible.                                  
                     1.  Count I – CFAA                              
In 1984, Congress passed the Counterfeit Access Device and Computer Fraud and Abuse 
Act of 1984 (“Act”) in its campaign against computer crime.  

Pub. L. No. 98-473, 98

 Stat. 2190.  
Two years later, it expanded the reach of the Act with the CFAA, which the Fourth Circuit has 
characterizes as “primarily a criminal statute designed to combat hacking.”  WEC Carolina Energy 
Solutions LLC v. Miller, 

687 F.3d 199, 201

 (4th Cir. 2012) (citing A.V. ex rel. Vanderhye v. 
iParadigms, LLC, 

562 F.3d 630, 645

 (4th Cir. 2009)).  However the CFAA still provides private 
plaintiffs with a private right of action for any “damage or loss” suffered “by reason of a violation 

of [the statute].”  

18 U.S.C. § 1030

(g).  The CFAA provides a number of grounds for civil liability, 
which include instances in which an actor:                                
[I]ntentionally accesses a computer without authorization or exceeds authorized 
access, and thereby obtains ... information from any protected computer; . . . 
knowingly and with intent to defraud, accesses a protected computer without 
authorization, or exceeds authorized access, and by means of such conduct furthers 
the intended fraud and obtains anything of value; [or] . . . intentionally accesses a 
protected  computer  without  authorization,  and  as  a  result  of  such  conduct, 
recklessly causes damage[,] or ... causes damage and loss.           
§§ 1030(a)(2)(C), (4), (5)(B)-(C).                                        
On June 3, 2021, the Supreme Court published its opinion in Van Buren v. United States, 

141 S. Ct. 1648

 (2021) addressing a split among a number of circuit’s interpretations of the CFAA, 
including the Fourth Circuit’s decision in WEC.  Van Buren, a police officer, was charged with 
having violated the CFAA after accepting a bribe to run a license plate search in a law enforcement 
computer  database  to  which  he  was  already  authorized  to  use.    As  such,  while  the  Court 
acknowledged Van Buren acted with an improper purpose, the Court ultimately held that Van 
Buren had not violated the CFAA because he did not “exceed[] authorized access” under § 1030 
of the statute.  The CFAA subjects to criminal or civil liability anyone who “intentionally accesses 

a computer without authorization or exceeds authorized access” for the purpose of “obtain[ing] or 
alter[ing] information in the computer that the accesser is not entitled so to obtain or alter.”  

18 U.S.C. § 1030

(a)(2), (e)(6).  Because Van Buren had already been granted access to the law 
enforcement computer database, the Court limited its ruling to whether Van Buren “exceed[ed] 
[his] authorized access.”                                                 
The Court adopted Van Buren’s position stating that, on the one hand, the “without 
authorization” clause of the CFAA works to defend computers against “outside hackers—those 
who ‘acces[s] a computer without any permission at all.’”  Van Buren, 

141 S. Ct. at 1658

 (quoting 
LVRC Holdings LLC v. Brekka, 

581 F.3d 1127, 1133

 (9th Cir. 2009)).  On the other hand, the 

“exceeds authorized access” clause works to defend computers against “inside hackers—those 
who access a computer with permission, but then ‘exceed the parameters of authorized access by 
entering an area of the computer to which that authorization does not extend.’”  

Id.

 (quoting United 
States v. Valle, 

807 F.3d 508, 524

 (2d Cir. 2015).  “Liability under both clauses stems from a gates-
up-or-down inquiry—one either can or cannot access a computer system, and one either can or 
cannot access certain areas within that system.”  Id. at 1658-59.  Ultimately, the Court held that 
one “exceeds authorized access” “when he accesses a computer with authorization but then obtains 
information located in particular areas of the computer—such as files, folders, or databases—that 
are off limits to him.”  Van Buren, 

141 S. Ct. at 1662

.  That holding and the Court’s reasoning 
align with the Fourth Circuit’s view.  See 

id.

 at 1653 n.2 (collecting cases in accordance with the 
view adopted by the Court); WEC, 

687 F.3d at 204

 (concluding that “an employee ‘exceeds 
authorized access’ when he has approval to access a computer, but uses his access to obtain or 
alter information that falls outside the bounds of his approved access”).  In WEC, the Fourth Circuit 
observed that the CFAA does not define “without authorization” and thus interpreted that term to 

describe when a person “accesses a computer without permission.”  

Id. at 206

.  
Defendants  argue  that  Van  Buren’s  bright-line  “gates-up-or-gates-down”  view  of 
authorization under the CFAA makes Plaintiff’s allegations as to Count I of no moment.  To that 
end, Defendants contend that Plaintiff’s allegation that Accu-Trade was not permitted to use the 
QV tool after allegedly rejecting Plaintiff’s contract is “not enough.”  Dkt. 23 at 10.  As such 
Defendants contend that because Plaintiff did not allege it attempted to disable Accu-Trade’s 
ability to access the QV tool or issue some clear message to Accu-Trade that their access to the 
QV tool was no more, the Complaint fails to assert that Accu-Trade accessed the QV tool without 
authorization.  See Dkt. 27 at 8.                                         

Plaintiff argues that Van Buren merely addressed the definition of “exceeds authorized 
access” under 

18 U.S.C. § 1030

(e)(6) of the CFAA.  In doing so, according to Plaintiff, the Van 
Buren Court did not change the law in the Fourth Circuit surrounding the CFAA’s bar on accessing 
a computer without authorization.  Plaintiff does admit that it cannot state a claim on an “exceeds 
authorized access” theory pursuant to the CFAA after having made such an allegation in the 
Complaint as a basis for its CFAA claim.  See Dkt. 1 ¶ 26.  But that admission leads Plaintiff to 
emphasize that it has nonetheless stated a claim for access “without authorization” under the 
CFAA by alleging that “[a]ny authorization to access and use the QV tool ended [on November 3, 
2018].”  

Id. ¶ 25

; see also 

id. ¶¶ 26, 46

.  Additionally, Plaintiff highlights several of its allegations 
which it argues supports the view that Accu-Trade was well aware it no longer had access to the 
QV tool at the point of ending contract negotiations.  Notwithstanding Plaintiff’s arguments in 
favor of its CFAA claim, Plaintiff also contends that the question of whether the gates were up or 
down after November 3, 2018 is a factual dispute unresolvable at the motion to dismiss stage.  
Defendants respond by noting that Van Buren also makes the “without authorization” claim 

unpalatable based on Plaintiff’s  allegations.  For one, Defendants  submit that the “without 
authorization” liability under the CFAA is meant to target hackers and the “technological harms” 
they cause, which Defendants assert is not at issue here.  Second, Defendants argue that although 
Van Buren did not abrogate the Fourth Circuit’s reasoning in WEC, the Fourth Circuit still requires 
a showing that Accu-Trade was accessing the QV tool without permission.8  Third, Defendants 
maintain that the rule of lenity requires that CFAA claims be construed narrowly as an anti-hacking 
statute rather than an “expansive misappropriation statute” and that while Plaintiff “may have valid 
state law remedies against Accu-Trade[,] . . . the CFAA does not supply those remedies.”  Dkt. 27 
at 5 (quoting United States v. Nosal, 

676 F.3d 854, 856-57

 (9th Cir. 2012) and KBS Pharm., Inc. 

v. Patel, No. 21-1339, 

2021 WL 2351961

, at *3 (E.D. Pa. Jun. 9, 2021)).   
This Court begins by noting, as do both parties, that Plaintiff’s claims that Defendants 
“exceeded any authorization” provided by Plaintiff prior to November 3, 2018 cannot survive the 
holdings in WEC and now in Van Buren.  See Dkt. Nos. 23 at 9-11; 26 at 3 n.1 (“[Plaintiff] 
acknowledges that pursuant to Van Buren, it cannot state a claim for “exceeds authorized access” 
pursuant to the CFAA.”).  Van Buren makes clear that improper purpose alone is insufficient to 
bring an “exceeds authorized access” claim  under the CFAA and instead requires that the 


8  The fact that Van Buren buttresses the nearly decade-old holding in WEC and yet 
Defendants did not seek to dismiss Plaintiff’s CFAA claim until after the Van Buren decision 
puzzles this Court.                                                       
information obtained via computer constitute information for which the user has not been granted 
access.  See Van Buren, 

141 S. Ct. at 1653

 (holding that the “‘exceeds authorized access’ clause 
applies only to those who obtain information to which their computer access does not extend, not 
to those who misuse access that they otherwise have”); see also 

id. at 1654-55

 (rejecting the 
Government’s interpretation of “exceeds authorized access” to include obtaining information in a 

particular improper manner or in improper circumstances).  Here, prior to November 3, 2018, it is 
undisputed that Defendants are alleged solely to have misused the information to which Plaintiff 
granted them access.  Plaintiff does not allege that Defendants improperly accessed an entirely 
different set of data not contemplated in the negotiations.               
That leaves the Court with the question: Were the gates to the QV tool ever re-erected 
following Accu-Trade’s representations to Plaintiff on November 3, 2018 so as to provide a 
plausible basis for Plaintiff’s claim that Defendants continued to access the QV tool “without 
authorization”?  Framed differently, the Court must determine, as a matter of law, whether an 
affirmative act by Plaintiff to re-raise the gates around the QV tool server is required to establish 

that Defendants had acted “without authorization.”  Because this Court construes the issue as a 
question of law and not a disputed fact, resolution of this issue is required in making a plausibility 
assessment of Count I and is therefore a proper exercise at the motion to dismiss stage.  See, e.g., 
WEC, 

687 F.3d at 203

 (affirming the district court’s consideration of how to interpret “without 
authorization” at the motion to dismiss stage).                           
It is without question that Van Buren expressly did not consider the question of whether 
the “gates-up-or-gates-down” analysis “turns only on technological (or ‘code-based’) limitations 
on access, or instead also looks to limits contained in contracts or policies.”  

141 S. Ct. at 1659

 
n.8.  Thus, this Court looks to controlling precedent in this circuit.  In WEC, the Fourth Circuit 
ruled  that  an  employee  who  allegedly  downloaded  his  employer’s  proprietary  information, 
resigned, and then used that information on behalf of a competitor did not access his employer’s 
computer “without authorization” and thus found no liability under the CFAA.  

687 F.3d at 207

.  
In United States v. Steele, the Fourth Circuit did uphold a conviction of a defendant who 
surreptitiously and repeatedly accessed the email server of his former employer to filch proprietary 

information after having resigned.  595 F. App’x at 211.  Notwithstanding the “common sense,” 
id., in holding a former employee liable for such conduct, the Fourth Circuit relied chiefly on three 
factors that supported the view that the gates were up at the time the information was accessed: (1) 
the former employee had accessed the information after having left the company;  (2) the company 
“took steps to revoke [the defendant’s] access to company information, including collecting [his] 
company-issued laptop, denying him physical access to the company’s offices, and generally 
terminating his main system access;” and (3) the defendant “recognized that his resignation 
effectively terminated any authority he had to access the [plaintiff’s] system thereafter,” id.; see 
also United States v. Eddings, 

2021 WL 2527966

, at *5 (E.D. Pa. Jun. 21, 2021) (deciding “that 

mere possession of the means of access of a computer system in the form of a password necessarily 
equates to authorization to access that computer system is incompatible with common sense . . . 
.”).                                                                      
Accepting each of Plaintiff’s allegations as true and drawing “all reasonable inferences” in 
Plaintiff’s favor, E.I. du Pont de Nemours & Co., 

637 F.3d at 440

, the factual conduct Plaintiff 
pleads does not “allow the court to draw the reasonable inference that the [Defendants] [are] liable 
for the misconduct alleged” under § 1030(a) of the CFAA.  Iqbal, 

556 U.S. at 678

.  Unlike the 
plaintiff in WEC, Plaintiff does include the requisite elements of a CFAA claim in the Complaint 
and alleges that those elements have been met, including the fact that Defendants acted “without 
authorization” and knew as much when they indicated to Plaintiff they would not be continuing 
negotiations around use of the QV tool.  Compare Dkt. 1 ¶¶ 25, 26, 46-49 (explicitly alleging that 
Defendants acted “without authorization” or “without authority”) with WEC, 

687 F.3d at 207

 
(“Notably, however, [plaintiff] fails to allege that [defendants] accessed a computer or information 
on a computer without authorization.) and with Federated It, Inc. v. Anthony, No. 1:18-cv-1484, 

2020 WL 4747784

, at *6 (E.D. Va. May 12, 2020) (dismissing a CFAA claim because there was 
“no specific allegation in the complaint that defendant [] did not have authorization to access th[e] 
information, only that she then misused certain information that she had access”).  However, 
Plaintiff’s allegations do not contain sufficient factual grounds to assert a plausible claim under 
the CFAA that comports with the Fourth Circuit’s interpretation of “without authorization.”   
Truth be told, because the CFAA does not define “without authorization,” the concept of 
whether a defendant acted “without authorization” remains a matter of debate.  In WEC, the Fourth 
Circuit considered two ways of viewing the “without authorization” language in the CFAA.  

687 F.3d at 203, 206-07

.  The expansive view of the CFAA, adopted by the Seventh Circuit, holds that 

bad  faith  dealings  alone  may  raise  the  gates  and  make  any  subsequent  access  “without 
authorization.”  See Int’l Airport Ctrs., LLC v. Citrin, 

440 F.3d 418, 420-21

 (7th Cir. 2006) 
(reasoning that an employee’s “breach of his duty of loyalty terminated his agency relationship . . 
. and with it his authority to access the laptop, because the only basis of his authority had been that 
relationship”).  Rather conversely the Ninth Circuit interprets “without authorization” “literally 
and narrowly,” reasoning that “the CFAA fails to provide a remedy for misappropriation of trade 
secrets or violation of a use policy where authorization has not been rescinded.”  Nosal, 

676 F.3d at 863-64

.  Ultimately, the WEC court adopted the Ninth Circuit’s “narrow reading of the term[] 
‘without authorization.’”  

687 F.3d at 206

.  In its analysis, the Fourth Circuit noted that the 
defendants retained access to the plaintiff’s “intranet and computer servers and to numerous 
confidential and trade secret documents stored on these computer servers.”  

Id. at 207

.  As a result, 
the court determined that the plaintiff failed to allege that the defendants accessed a computer or 
information on a computer “without authorization.”  

Id.

  Despite the fact that the plaintiff in WEC 
alleged a CFAA claim under the statute’s civil provision, the Fourth Circuit applied the rule of 

lenity to comply with the Supreme Court’s counsel to construe criminal statutes strictly.  

Id.

 (citing 
United States v. Lanier, 

520 U.S. 259, 266

 (1997)).   In doing so, the Court expressed its 
unwillingness to “contravene Congress’ intent by transforming a statute meant to target hackers 
into a vehicle for imputing liability to workers who access computers or information in bad faith, 
or who disregard a use policy.”  

Id.

                                      
The Ninth Circuit’s Facebook decision continued to build off of Nosal, which further 
clarifies the view embraced by the Fourth Circuit in WEC.  In Facebook, the Ninth Circuit held 
that “without authorization” under the CFAA occurs only “when the employer has rescinded 
permission to access the computer and the defendant uses the computer anyway.” 9  Facebook, Inc. 

v. Power Ventures, Inc., 

844 F.3d 1058, 1066

 (9th Cir. 2016); see also Domain Name Comm’n 
Ltd. v. DomainTools, LLC, 

449 F. Supp. 3d 1024

, 1029 (W.D. Wash. 2020) (“Permission or 


9  Following Nosal, but prior to Facebook, two district court opinions in the Ninth Circuit 
held that “[p]revious Ninth Circuit authority (un-altered by Nosal) indicates that if a former 
employee accesses information without permission, even if his prior log-in information is still 
operative as a technical matter, such access would violate the CFAA.”  See, e.g., Weingand v. 
Harland Fin. Solutions, Inc., No. C-11-3109 EMC, 

2012 WL 2327660

, at *9.  At least one district 
court in this circuit has relied on that holding.  GSP Fin. Servs., LLC v. Harrison, No. GJH-18-
2307, 

2021 WL 288172

, at *4 (D. Md. Jan. 28, 2021) (upholding a CFAA claim involving a former 
employee who had been terminated and days later received a cease-and desist letter from their 
employer to end their continued access of the plaintiff’s data).  However, the court’s opinion 
neglected to consider the Ninth Circuit’s more recent Facebook authority, which does not support 
the rule in Weingand.  That the GSP court, sitting outside the Ninth Circuit, is the only court to 
have cited that rule in the six years since Facebook is telling.          
authorization to access a computer does not evaporate simply because the user has violated a duty 
owed to the owner of the computer.”).  The Ninth Circuit dismissed the CFAA claim because the 
plaintiff had sent the defendant a cease and desist letter.  

844 F.3d at 1067-68

.  Moreover, the 
Facebook court found the cease and desist letter issued by the plaintiff sufficient reason to dismiss 
the CFAA claim because it put the defendant on unequivocal notice that they were no longer 

authorized to access the plaintiff’s computers.  See 

id. at 1067

.  Another district court applied  
Facebook  to  hold  that  the  CFAA  “requires  express  revocation  of  previously  granted 
authorization.”  NW Monitoring LLC v. Hollander, No. C20-5572 RSM, 

2021 WL 1424690

, at *5 
(W.D. Wash. Apr. 15, 2021) (emphasis in original) (citing Facebook, Inc., 

844 F.3d at 1066

).  
Defendants’  relationship  with  Plaintiff  arose  from  the  negotiations  and  unwritten 
agreements related to the testing of Plaintiff’s QV tool with Accu-Trade’s platform and the testing 
of Accu-Trade’s data with Plaintiff’s platform.  Focusing solely on Accu-Trade’s use of the QV 
tool  during  the  period prior  to  November  3,  2018,  Accu-Trade’s  information  access  rights 
surrounding Plaintiff’s proprietary QV data appear similar to those of an employee of Plaintiff 

who worked on the QV tool.  Plaintiff had effectively provided actual authority to Accu-Trade as 
an agent of Plaintiff in licensing the use of its QV tool—at least on a temporary basis.   
Because the Fourth Circuit adopted the reasoning of the Ninth Circuit, this Court interprets 
“without authorization” narrowly to mean that a party has accessed information that, although 
previously made available to that party, has since been rescinded by the information provider.  
Comparing the facts in Steele, where the Fourth Circuit upheld a CFAA claim involving a former 
employee, to those alleged in this case proves instructive.  First, Plaintiff does allege that Accu-
Trade admitted to accessing the QV tool repeatedly after November 3, 2018.  Dkt. 1 ¶ 29.  Second, 
Plaintiff does allege that Accu-Trade immediately signed the proposed contract when confronted 
by Plaintiff about its alleged behavior.  Id. ¶ 28 (“When confronted by [Plaintiff] about its fraud, 
Accu-Trade . . . immediately signed and returned to Plaintiff the previously rejected and unsigned 
[proposed contract] in an attempt to cover up the company’s illegal conduct.”).  However third, 
and fatal to Plaintiff’s claim, Plaintiff does not allege that it rescinded or even sought to rescind 
Accu-Trade’s access to the QV tool during the time that Accu-Trade is alleged to have improperly 

accessed Plaintiff’s QV tool.  See id. ¶ 26 (acknowledging that Plaintiff did not inform Accu-Trade 
that it was not allowed to continue to use the QV until after it became aware of the alleged 
misappropriation through one of its data providers—at which point the alleged harm had already 
occurred).                                                                
Plaintiff fails to allege that it took any affirmative act to revoke that access until after the 
alleged harm had been caused.  And according to the Fourth Circuit, that is a critical component 
of determining whether an actor accessed information with or without authorization.  To be sure, 
the Steele court did in fact reason that “[j]ust because [the plaintiff] neglected to change a password 
on [the defendant’s] backdoor account does not mean [the plaintiff] intended for [the defendant] 

to have continued access to its information.”  Id.  However, the court also emphasized that the 
plaintiff  “took  steps  to  revoke  [the  defendant’s]  access  to  company  information,  including 
collecting [his] company-issued laptop, denying him physical access to the company’s offices, and 
generally terminating his main system access.”  595 F. App’x at 211.  Because of that affirmative 
notice,  the  Fourth  Circuit  found  grounds  to  uphold  the  CFAA  claim.    But  such  notice  is 
conspicuously absent from Plaintiff’s allegations.                        
This Court notes that although applying the Fourth Circuit’s narrow construction of 
“without authorization” reveals Plaintiff has not met the requisite pleading standard, Plaintiff 
nonetheless “may have valid state law remedies against [Accu-Trade] . . . but the CFAA does not 
supply those remedies.” See KBS Pharm., Inc. v. Patel, No. 21-1339, 

2021 WL 2351961

, at *3 
(E.D. Pa. June 9, 2021) (dismissing CFAA claim based on violation of a signed confidentiality 
agreement  as  well  as  an  acknowledged  set  of  policy  guidelines  contained  in  an  employee 
handbook).                                                                
Therefore, this Court holds that Plaintiff has not sufficiently pleaded a facially plausible 

claim under the CFAA.                                                     
            2.  Count II – Virginia Computer Crimes Act              
In Count II, Plaintiff alleges that Defendants violated the VCCA.  To sufficiently plead a 
facially plausible claim under the VCCA, a plaintiff must demonstrate that the defendant “used a 
computer or computer network without authority . . . with the intent to obtain property or services 
by false pretenses, embezzle or commit larceny, or convert the property of another.”  Space 
Systems/Loral, LLC v. Orbital ATK, Inc., 

306 F. Supp. 3d 845, 855

 (E.D. Va. 2018) (citing Ford 
v. Torres, No. 1:08-cv-1153, 

2009 WL 537563

, at *7 (E.D. Va. Mar. 3, 2009).  Under the VCCA, 
a person acts “without authority” when “he knows or reasonably should know that he has no right, 

agreement, or permission or acts in a manner knowingly exceeding such right, agreement, or 
permission.”  

Va. Code Ann. § 18.2-152.2

.                                 
Plaintiff argues that the VCCA stands on its own and therefore the Van Buren decision 
does not implicate the statute.  For example, Plaintiff notes that the VCCA does not use the 
“entitled so to obtain” language that drove the Van Buren court’s interpretative analysis of the 
CFAA.  Instead, Plaintiff submits that the VCCA’s “without authority” language is clearly defined 
and that the Complaint adequately pleads factual grounds to assert a cognizable claim under that 
statute.                                                                  
Defendants rely on Shelton v. Commonwealth, 

645 S.E.2d 914, 917-18

 (Va. 2007) for the 
proposition that this Court must apply the rule of lenity to the VCCA in like manner as the Fourth 
Circuit has done in interpreting the CFAA.  Defendants also cite Lester v. Allied Concrete Co., 

80 Va. Cir. 454, 461

 (2010), for the proposition that the interpretation of “without authority” under 
the VCCA is derivative of the CFAA.  And because Defendants argue that there is no merit to the 
CFAA claim, they contend the VCCA claim should sink with it.              

The terms of the VCCA make crystal clear that if an actor at least “reasonably should know 
that he has no right” to certain information, that actor may be subject to liability.  Following Van 
Buren’s lead, “[b]ecause the text . . . support[s] [this Court’s] reading,” the rule of lenity “is not in 
play.”  

141 S. Ct. at 1661

.  Furthermore, the VCCA is not derivative of the CFAA.  It predated the 
CFAA by two years.  Nothing in Lester or any other case interpreting the VCCA suggests that 
“without authority” under the VCCA is interpreted in the same manner as “without authorization” 
under the CFAA.  Cf., e.g., Vanderhye, 

562 F.3d at 646-47

 (Fourth Circuit overruling a district 
court’s rejection of both a CFAA and a VCCA claim because the district court attempted to 
construe “any damages” under the VCCA in the same light as the CFAA).  Here, the Complaint 

provides sufficient allegations for this Court to reasonably infer that Defendants, at minimum, 
should have known that they forfeited the right to continue to use the QV tool at the time they 
actively ended negotiations.  Dkt. 1 ¶¶ 25, 28.  That allegation meets the definition of “without 
authority” under the VCCA, which is separate and apart from the “without authorization” language 
used in the CFAA.  It follows that Plaintiff has met the pleading standard and the VCCA claim 
thus survives Defendants’ motion to dismiss.                              
                    IV.  CONCLUSION                                  
For the reasons articulated in this opinion, it is hereby ORDERED that Defendants’ Motion 
to Dismiss for Lack of Jurisdiction (Dkt. 13) is DENIED; and it is        
 FURTHER ORDERED that Defendants’ Motion to Dismiss for Failure to State a Claim 
(Dkt. 23) is GRANTED IN PART and DENIED IN PART.  Count I of the Complaint is dismissed 
and Count II of the Complaint may proceed. 
 The Clerk is directed to forward copies of this Order to counsel of record. 
 It is SO ORDERED. 
Alexandria, Virginia 
March 4, 2022 

                                        Rossie D, Alston, Jr. 
                                        United States District Judge 

                                 35