Costar Group, Inc. v. Leon Capital Group, LLC

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

COSTAR GROUP, INC., and COSTAR REALTY INFORMATION, INC.,

Plaintiffs,

v. Case No. 21-cv-2227 (CRC)

LEON CAPITAL GROUP, LLC,

Defendant.

MEMORANDUM OPINION

Plaintiffs CoStar Group, Inc. and CoStar Realty Information, Inc. (collectively, “CoStar”) operate a commercial real estate database. CoStar here sues a former licensee of its database, Leon Capital Group, LLC (“Leon Capital”), over claims that Leon Capital is too closely tied to one of CoStar’s competitors—the Commercial Real Estate Exchange, Inc. (“CREXi”). CoStar’s complaint raises five claims, all of which Leon Capital has moved to dismiss. As explained below, the Court will dismiss Claim One, for breach of contract, because Leon Capital’s payment of the amount due under the contract has mooted the claim. But the Court finds that CoStar has at least plausibly stated the other four claims for relief. The Court will, accordingly, grant the motion to dismiss in part and deny it in part. I. Background

CoStar operates “the nation’s most comprehensive commercial real estate information database,” which it licenses to users for a monthly fee.1 Compl. ¶¶ 1, 19. Until May 2021, one

1 The Court draws the following facts from the allegations in the complaint, which the Court must accept as true at the motion to dismiss stage. See Sparrow v. United Air Lines, Inc., 216 F.3d 1111, 1113 (D.C. Cir. 2000).

of those licensees was Leon Capital, a Texas-based real estate investment and development firm. Id. ¶¶ 3, 11; Mem. in Supp. of Mot. Dismiss (“MTD”) at 2. Leon Capital’s use of CoStar’s database was governed by two sets of terms. Compl. ¶ 25.

First, by virtue of its License Agreement, Leon Capital agreed to abide by CoStar’s Terms and Conditions. Id. ¶ 26; see generally Compl. Ex. A. Among those terms was a limitation on “access or use” of the database by any “direct or indirect competitor of CoStar.” Compl. ¶ 35; see Compl. Ex. A ¶ 2(c)(3). The Terms and Conditions also authorized CoStar, upon a “good faith determination” that a licensee had violated certain provisions—including the bar on competitor access—to terminate the license immediately. Compl. ¶ 37; Compl. Ex. A ¶ 6(b)(1). Such a termination would accelerate all fees due on the remainder of the license. Compl. ¶ 37; Compl. Ex. A ¶ 6(d).

Second, when Leon Capital employees logged on to CoStar’s database, their conduct was governed by that product’s Terms of Use. See Compl. ¶¶ 27–28, 30; see generally Compl. Ex. B. Like the Terms and Conditions, the Terms of Use forbade access to the database by “direct or indirect competitor[s] of CoStar.” Compl. ¶ 35; Compl. Ex. B at 6. The Terms of Use offered examples of what Costar considered to be its competitors, including “Internet listing services or other real estate information services.” Compl. ¶ 35; Compl. Ex. B at 6. In addition, the Terms of Use provided that only “Authorized User[s]” could access CoStar’s password-protected services. Compl. ¶ 38; Compl. Ex. B at 6. The Terms of Use defined “Authorized User” as “an individual (a) employed by a CoStar Client or an Exclusive Contractor . . . of a CoStar Client at a site identified in the License Agreement, and (b) who is specified in the License Agreement as a user of a specific Passcode Protected Product and represented by the Client to be an employee or Exclusive Contractor of the Client.” Compl. Ex. B at 3.

CoStar alleges that Leon Capital violated both sets of terms. The first set of allegations relates to the Terms and Conditions’ prohibition on the use of CoStar products by any direct or indirect competitor. Compl. ¶ 42. In the spring of 2021, CoStar determined Leon Capital to be a competitor, based on the relationship of Leon Capital and its CEO with CREXi. Id. ¶¶ 42–52. At that point, CoStar had been embroiled in copyright litigation with CREXi for more than six months. See Compl., CoStar Grp., Inc. v. Com. Real Est. Exch., Inc., No. 20-cv-8819 (C.D. Cal. Sept. 25, 2020). After inquiring about Leon Capital’s relationship to CREXi and receiving no substantive response, on May 24, 2021, CoStar exercised its right to terminate the contract. Compl. ¶¶ 45, 51–52. It requested $47,081.28 in remaining annual fees under the acceleration clause. Id. ¶ 53. As of the filing of the complaint, Leon Capital had not paid that balance. Id.

CoStar also alleges that, notwithstanding the termination of its License Agreement, Leon Capital continued to access its database in May and June of 2021, in violation of the product’s Terms of Use. Id. ¶ 54. Here, CoStar focuses on the actions of Leon Capital’s Managing Director Sean Wood, who joined Leon Capital in May 2021. Id. ¶¶ 55, 57, 59. CoStar alleges that, beginning on May 25, 2021—the day after the termination of the License Agreement— Wood began logging on to CoStar’s database with credentials issued to his previous employer, Dalfen Industrial. Id. ¶¶ 56–65. Acting on behalf of and in the course of his employment with Leon Capital, and using a Leon Capital device, Wood allegedly “mined the CoStar database for data”—ultimately exporting several hundred records. Id. ¶¶ 58, 61. On August 12, 2021, CoStar terminated Wood’s Dalfen username. Id. ¶ 65. At the same time, it terminated the access of another Leon Capital employee who had similarly employed a username connected with an old employer. See id. ¶¶ 66–70.

A week later, CoStar filed suit. The complaint raises five claims. CoStar first seeks payment of the amount due under the Terms and Conditions’ termination clause, which CoStar triggered based on Leon Capital’s alleged violation of the non-competition provision. Id. ¶¶ 78– 86. The remaining claims all relate to Wood’s continued use of CoStar’s database after May 24, 2021, in his capacity as Leon Capital’s Managing Director. These include a second breach of contract claim, this time for alleged violations of the Terms of Use. Id. ¶¶ 87–98. Two more claims—one for fraud and one for unjust enrichment—are pled in the alternative to Claim Two, in the event the Court finds the Terms of Use did not constitute a binding contract between Leon Capital and CoStar. Id. ¶¶ 107–15, 116–23. Finally, CoStar alleges in Claim Three that Wood’s access to and downloading of data from CoStar’s servers violated the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030. Id. ¶¶ 99–106. Leon Capital has moved to dismiss all five claims under Federal Rule of Civil Procedure 12(b)(6). II. Legal Standards

Rule 12(b)(6) requires dismissal of a complaint that fails “to state a claim upon which relief can be granted.” When evaluating a 12(b)(6) motion, the court must determine whether the complaint “contain[s] sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id.

A court “must treat the complaint’s factual allegations as true and must grant plaintiff the benefit of all inferences that can be derived from the facts alleged.” Sparrow v. United Air Lines, Inc., 216 F.3d 1111, 1113 (D.C. Cir. 2000) (internal citation and quotation marks *5 omitted). Although a complaint need not provide “detailed factual allegations” to withstand a 12(b)(6) motion, it must offer “more than labels and conclusions.” Twombly, 550 U.S. at 555. “In determining whether a complaint states a claim, the court may consider the facts alleged in the complaint, documents attached thereto or incorporated therein, and matters of which it may take judicial notice.” Stewart v. Nat’l Educ. Ass’n, 471 F.3d 169, 173 (D.C. Cir. 2006). III. Analysis

The Court organizes its discussion of each claim based on the relevant allegations—first taking up CoStar’s breach of contract claim relating to non-payment of the accelerated license fees; then considering its breach of contract claim relating to Wood’s unauthorized access, as well as the fraud and unjust enrichment claims pled in the alternative to this claim; and finally turning to the CFAA claim. As explained below, the Court will dismiss only CoStar’s first claim, and will otherwise deny Leon Capital’s motion to dismiss.

A. Breach of Subscription License Agreement and Terms and Conditions (Claim One)

With its first breach of contract claim, CoStar relies on several provisions of its standard Terms and Conditions, which was incorporated by reference in the parties’ License Agreement. Compl. ¶ 26. CoStar alleges that it validly terminated Leon Capital’s License Agreement upon its good faith determination that Leon Capital had violated the Terms and Conditions’ non-competition provision. Id. ¶ 84. CoStar then claims that Leon Capital improperly withheld the payment due under a term accelerating the remainder of the license fees. Id. ¶¶ 85–86.

“To prevail on a claim of breach of contract, a party must establish (1) a valid contract between the parties; (2) an obligation or duty arising out of the contract; (3) a breach of that duty; and (4) damages caused by breach.” Tsintolas Realty Co. v. Mendez, 984 A.2d 181, 187 (D.C. 2009). Leon Capital offers two arguments in favor of dismissal: First, it disputes the existence *6 of a breach because, in its view, CoStar has offered “no plausible basis on which the court could determine Leon Capital’s private investment business is an actual competitor” of CoStar. MTD at 4. Second, Leon Capital reports that it has paid the amount due under the acceleration clause—the full damages CoStar seeks with Claim One. See id. at 1. It therefore asks the Court to find the claim moot. See Reply at 4. The Court only needs to reach this second argument, as it agrees that there is nothing left of CoStar’s contract claim as currently pled.

A claim becomes moot “when, among other things, the court can provide no effective remedy because a party has already obtained all the relief that [it has] sought.” Conservation Force, Inc. v. Jewell, 733 F.3d 1200, 1204 (D.C. Cir. 2013) (alteration in original) (internal quotation marks omitted). In its complaint, CoStar specifically alleges that it “has been damaged by the amount due under the contract, totaling $47,081.28.” Compl. ¶ 86. Leon Capital represents that it has now paid the accelerated fees due on the contract—a fact CoStar implicitly concedes. See Opp’n at 2 (accusing Leon Capital of “conveniently omitting when it made this overdue payment” but noting only that it was “unpaid as of the filing of the complaint”). Because CoStar has received all the relief it seeks in Claim One of the complaint, the claim is moot.

CoStar’s efforts to avoid this conclusion are unavailing. It first argues that the Court may not consider the fact of Leon Capital’s belated payment on a 12(b)(6) motion because it is “outside the ‘four corners of the complaint.’” Id. at 13 (quoting Brown v. Gov’t of D.C., 390 F. Supp. 3d 114, 122 (D.D.C. 2019)). Whether Leon Capital has already provided the relief requested in Claim One, however, does not go to failure to state a claim under 12(b)(6). Mundo Verde Pub. Charter Sch. v. Sokolov, 315 F. Supp. 3d 374, 380 n.2 (D.D.C. 2018). It goes instead to mootness, which is properly raised in a motion to dismiss for lack of jurisdiction under Rule *7 12(b)(1). Id. And when evaluating 12(b)(1) motions, courts are not limited to the allegations in the complaint. See Herbert v. Nat’l Acad. of Scis., 974 F.2d 192, 197 (D.C. Cir. 1992). “[W]here necessary,” they may consider, among other things, “undisputed facts evidenced in the record.” Id. Because CoStar has conceded that the payment was made, the Court may consider that undisputed fact and find the breach of contract claim moot.

CoStar next claims that it “seeks far more than $47,081.28—explicitly pleading ‘at least hundreds of thousands of dollars” in damages and seeking injunctive relief as well. Opp’n at 13– 14 (citing Compl. ¶ 77). But that is simply not how CoStar pled this first contract claim. In the complaint, CoStar framed it as one for “Non Payment” based on a breach of the “Subscription License Agreement.” See Compl. at 18. Although CoStar sought injunctive relief and additional damages when laying out other claims in the complaint, see, e.g., id. ¶ 98, it did not do so here. Rather, in the relevant paragraphs in Claim One, CoStar only alleges that it has been “damaged by the amount due under the contract, totaling $47,081.28.” Id. ¶ 86. Because CoStar has been paid those alleged damages, Claim One is moot.

B. Breach of Terms of Use (Claim Two)

The Court turns next to CoStar’s second breach of contract claim, which focuses on Wood’s access of its platform without authorization after the termination of Leon Capital’s License Agreement in May 2021. CoStar alleges that Wood’s use of the platform can be attributed to Leon Capital, and that it violated two provisions in the Terms of Use: (1) the prohibition on competitors’ access to CoStar’s content; and (2) the requirement that those who access the platform be Authorized Users “employed by the subscriber.” Compl. ¶¶ 93–94. Leon Capital mounts two attacks on this claim, neither of which succeed.

First, Leon Capital contends that CoStar has not properly alleged a breach of the relevant contract—between it and Leon Capital. In Leon Capital’s telling, to the extent Wood violated any contract at all, it was the one between CoStar and his former employer, Dalfen Industrial, which never terminated his username when he left the company. See MTD at 7–8. There are several problems with this argument. Initially, it touches only on CoStar’s Authorized User theory of breach, and ignores the allegation that Wood accessed the database despite working for a competitor. See Compl. ¶ 93. The Court will discuss that alternate breach theory at the close of this section. More fundamentally, it is beside the point whether Wood’s actions also violated some agreement between Dalfen and CoStar, or whether they, too, could have prevented his misconduct by terminating his username sooner. Here, CoStar has plausibly alleged facts that would support each element of a breach of contract by Wood: a valid contract in the Terms of Use; an obligation to refrain from accessing the platform unless authorized; a breach of that duty when Wood used his old employer’s username; and damages from that breach. See id. ¶¶ 88, 91, 94, 97.

Contrary to Leon Capital’s suggestion, see Reply at 3–4, CoStar has also plausibly alleged that any violation by Wood can be attributed to Leon Capital. “Under the doctrine of respondeat superior, an employer may be held liable for the acts of his employees committed within the scope of their employment.” Brown v. Argenbright Sec., Inc., 782 A.2d 752, 757 (D.C. 2001). Leon Capital does not dispute that Wood was its employee at the time of the alleged breach. And CoStar plausibly alleges that Wood accessed the database “within the scope of his employment” with Leon Capital and “in furtherance of its ends.” District of Columbia v. Coron, 515 A.2d 435, 437 (D.C. 1986). The complaint notes that Wood used a Leon Capitalassociated device, and that the data he accessed concerned industrial properties in Phoenix and *9 Dallas—areas where Leon Capital “is involved in real estate projects.” Compl. ¶¶ 58, 61. That is sufficient at the motion to dismiss stage to support CoStar’s claim that Wood violated CoStar’s Terms of Use in order “to obtain information about industrial properties” on “behalf of, and for the benefit of Leon Capital.” Id. ¶ 73.

Second, Leon Capital argues that the doctrine of double recovery bars this contract claim. See MTD at 8–9. This doctrine provides that “[d]amages for the same injury may be recovered only once even though they are recoverable under two or more legal theories for two or more wrongs.” Rice v. District of Columbia, 818 F. Supp. 2d 47, 57 (D.D.C. 2011) (citing Franklin Inv. Co., Inc. v. Smith, 383 A.2d 355, 358 (D.C. 1978)). But the appropriate way for courts to handle this risk is to reduce a final award, not to dismiss one of those theories at the outset. Id.; Cobb v. Wash. Metro. Area Transit Auth., No. 20-cv-3522, 2021 WL 2935891, at *4 (D.D.C. July 13, 2021). Besides, neither of the other sources of recovery Leon Capital identifies—from Dalfen’s license fees or Leon Capital’s termination penalty—would compensate CoStar for Wood’s conduct in May through August of 2021. As to the former, assuming Dalfen’s license is subject to the same Terms and Conditions discussed above, access by a former employee would not be an authorized use. Dalfen’s license fees thus would not compensate CoStar for Wood’s continued access after he left his position there. As to the latter, the Court reads the termination clause in the Terms and Conditions to accelerate payment as a remedy for past violations. See Compl. Ex. A ¶ 6(d) (accelerating payment of all fees “[u]pon Licensee’s breach of any terms of this Agreement that leads to a termination” (emphasis added)). Payment of such a penalty would not absolve now-former licensees for future misconduct. That being said, the Court is skeptical that the actual value of the damages here—arising out of extracontractual use of CoStar’s database by a single individual—really amounts to the hundreds of thousands of dollars of *10 damage CoStar claims it suffered. See Compl. ¶ 77. But because CoStar has not yet been compensated for the alleged breach of the Terms of Use, no rule against double recovery mandates this claim’s dismissal.

Finally, the Court returns to CoStar’s alternate theory of liability on this claim—that Leon Capital (via Wood) also breached the Terms of Use in the summer of 2021 by accessing the database even though it was CoStar’s competitor. The parties do not mention this theory in their briefing on Claim Two, perhaps because they had already covered that ground when discussing CoStar’s first breach claim. But the Court finds it useful to explain the principles that govern this alternate theory of liability, as the Court will also allow it to survive the motion to dismiss. This discussion may also streamline litigation going forward, should CoStar seek to amend its complaint to resuscitate any breach of contract claim arising out of Leon Capital’s conduct before May 2021.2

In its briefing, Leon Capital suggests that none of the competitor allegations provide Costar an avenue for relief because it has offered “no plausible basis on which the court could determine Leon Capital’s private investment business is an actual competitor of CoStar’s database business.” MTD at 4. CoStar counters that Leon Capital is “at least an indirect competitor,” pointing to allegations that (1) CREXi is a direct competitor of CoStar; (2) Leon Capital’s CEO was closely involved in founding, managing, and promoting CREXi; and (3) Leon Capital invested in CREXi. See Opp’n at 9; Compl. ¶¶ 3, 24, 42. While something of a

2 These principles largely would have governed the merits of Claim One, had the Court not dismissed it as moot. The Court sees only one difference: evaluating any alleged violation of the Terms and Conditions’ termination clause would require deciding whether CoStar believed in good faith that Leon Capital was a competitor—not whether it in fact competed.

close call, the Court ultimately concludes CoStar has at least plausibly alleged some sort of indirect competitor relationship.

Crucially, neither party has provided the Court with a particularly usable definition of “indirect competitor.” The parties’ agreements never define the term: The Terms and Conditions define neither direct nor indirect competitor. And the Terms of Use only provide examples of direct competitors—“Internet listing services or other real estate information services.” Compl. Ex. B at 6. CREXi appears to be an Internet listing service, but Leon Capital does not.

The parties also have not pointed to any applicable law that encompasses and fully ties together the conduct of Leon Capital, its CEO, and CREXi. They cite no standard definition of “indirect competition” under District of Columbia law. CoStar has gathered cases from a range of other jurisdictions suggesting that “guiding, promoting, assisting, advising, and investing in CREXi”—as De Leon allegedly did—is sufficient to constitute indirect competition. See Opp’n at 10; see also, e.g., United HealthCare Servs., Inc. v. Corzine, No. 2:21-cv-319, 2021 WL 961217, at *16 (S.D. Ohio Mar. 15, 2021) (finding former employee violated prohibition on indirectly competing with insurance company by “participating in” meetings with competitor’s “business development team”); Kan-Di-Ki, LLC v. Suer, No. 7937-VCP, 2015 WL 4503210, at *21 (Del. Ch. July 22, 2015) (unpublished) (crediting evidence that defendant engaged “indirectly in competitive” behavior “by assisting competitors” of a company). But this case law does not establish that Leon Capital—as opposed to its CEO—indirectly competes with CREXi. Neither the cited law nor the allegations in the complaint clarify whether any acts De Leon may have taken to benefit CREXi can and should be attributed to Leon Capital, or whether De Leon, instead, was acting in his personal capacity, without any benefit flowing to or from Leon Capital.

But the Court finds it at least plausible that Leon Capital is sufficiently tied to CREXi, and thus an indirect competitor of CoStar, by virtue of its alleged direct investment in that firm. Compl. ¶ 24. Contrary to Leon Capital’s suggestion, this is not the kind of “mere conclusory statement[]” that courts must reject at the motion to dismiss stage. Iqbal, 556 U.S. at 678. To be clear, questions remain. The Court doubts that any investment—no matter how small or passive—would sufficiently align the interests of two firms such that competition by one would render the other an indirect competitor. And CoStar has not provided the Court with either details of the alleged investor relationship or any relevant case law to help substantiate this theory. Nevertheless, the Court concludes that, taken together, the allegations in the complaint suggest a close enough financial and operational relationship between Leon Capital, De Leon, and CREXi to plausibly allege indirect competition at this early stage of the litigation. The Court will therefore allow the competitor theory of breach to survive the motion to dismiss, even if additional legal and factual underpinnings may be required at subsequent stages of the case.3

C. Alternatives to Claim Two

The Court next addresses objections to the claims CoStar brought in the alternative to Claim Two: one for fraud, and one for unjust enrichment. Both may proceed.

1. Fraud (Claim Four)

CoStar claims that, even if the Court finds that no binding contract governed Leon Capital’s interactions with CoStar’s database after termination of its license in May 2021, Leon

3 The Court is not convinced by any of Leon Capital’s other arguments in its briefing— about, for example, whether Leon Capital is an alter ego of CREXi or shares some other parent, sister, or subsidiary relationship. See MTD at 6. These claims ignore the framing of the complaint, which does not rely on any potential direct corporate relationship.

Capital may still be liable for fraud. “[U]nder District of Columbia law, a plaintiff claiming fraud must prove (1) the defendant made a false representation; (2) in reference to material fact; (3) with knowledge of its falsity; (4) with the intent to deceive the plaintiff; (5) the plaintiff acted in reasonable reliance on that representation; (6) which consequently resulted in provable damages.” Cordoba Initiative Corp. v. Deak, 900 F. Supp. 2d 42, 47 (D.D.C. 2012) (internal quotation marks omitted). CoStar maintains that, each time Wood logged on to its database in his capacity as Leon Capital’s Managing Director, he fraudulently asserted that he was an Authorized User when in fact he was not, leading CoStar to grant him access it otherwise would not give. See Compl. ¶¶ 110–13.

Leon Capital first argues that this fraud claim is not sufficiently independent of CoStar’s breach of contract claim. It is true that “[c]ourts tend not to allow plaintiffs to allege fraudulent inducement alongside claims for breach because ‘[t]here is a risk of turning every breach of contract suit into a fraud suit[.]’” Butler v. Enter. Integration Corp., 459 F. Supp. 3d 78, 96 (D.D.C. 2020) (quoting Desnick v. Am. Broad. Cos., Inc., 44 F.3d 1345, 1354 (7th Cir. 1995) (Posner, J.)). But under District of Columbia law, “the claims may stand side-by-side” when, among other things, (1) the “tort ‘exist[s] in its own right independent of the contract, and any duty upon which the tort is based . . . flow[s] from considerations other than the contractual relationship,” id. (quoting Choharis v. State Farm Fire & Cas. Co., 961 A.2d 1080, 1089 (D.C. 2008)), or (2) “when the defendant makes some statement ‘prior to and ‘independent of the contract’ that deceives the plaintiff into agreeing to be bound by the contract,” id. (quoting Ludwig & Robinson, PLLC v. BiotechPharma, LLC, 186 A.3d 105, 111 (D.C. 2018)). Either of those exceptions could plausibly cover the allegations here. CoStar has alleged that Wood violated an independent duty: the obligation to make truthful statements in business transactions *14 and not “suppress or conceal any facts within his knowledge which would materially qualify those stated.” Ludwig, 186 A.3d at 110. In addition, CoStar has alleged that Wood misrepresented himself as an Authorized User before accepting the Terms of Use, and that—had he properly identified himself beforehand—CoStar would not have allowed him to complete the transaction. See Compl. ¶¶ 110–13.

Leon Capital also asks the Court to dismiss the fraud claim for failure to “allege an injury distinct from a breach of contract claim.” See MTD at 12. Again, it misses the mark. Leon Capital correctly recites the relevant law: To state a viable claim for fraud, “the injury to the plaintiff must be an independent injury over and above the mere disappointment of plaintiff’s hope to receive his contracted-for benefit.” Choharis, 961 A.2d at 1089 (internal quotation marks omitted). But CoStar has alleged such an injury here. Wood’s purported misrepresentations did not just allow him to access the database without compensating CoStar or complying with its rules; rather, because Wood said he was an Authorized User when in fact he was not, CoStar granted him access it very well might not have offered at all. See Jacobson v. Hofgard, 168 F. Supp. 3d 187, 200 (D.D.C. 2016) (“Plaintiffs did not face mere contractual disappointment—they entered into a contract . . . that they would not have otherwise.”). As with CoStar’s second breach of contract claim, the Court is skeptical that the damages from this conduct is of nearly the magnitude claimed. To the extent Wood used CoStar’s database that summer to gather information for Leon Capital’s core real estate investment business, and not to steal proprietary information or funnel it directly to CREXi, it seems unlikely that this conduct would cause hundreds of thousands of dollars of injury, even if it did constitute fraud. Still, because there is some distinct injury alleged, the Court will not dismiss Claim Four.

2. Unjust Enrichment (Claim Five)

Leon Capital next seeks dismissal of CoStar’s unjust enrichment claim, which it again has pled in the alternative to its second contract claim. “The elements of an unjust enrichment claim are that (1) the plaintiff conferred a benefit on the defendant; (2) the defendant retains the benefit; and (3) under the circumstances, the defendant’s retention of the benefit is unjust.” Glasgow v. Camanne Mgmt. Inc., 261 A.3d 208, 219 (D.C. 2021) (internal quotation marks omitted). “Nothing precludes a plaintiff from pleading an unjust enrichment claim as an alternative to a breach of contract claim even when seeking the same amount[.]” Id. at 217.

In its motion to dismiss, Leon Capital suggests that CoStar’s unjust enrichment claim fails because it has not alleged that “Leon Capital retains any benefit that belongs to CoStar.” MTD at 13. The complaint, however, clearly alleges that Leon Capital “received and retained” benefits—conducting searches for information and exporting several hundred records—through Wood’s unauthorized use of its database. Compl. ¶¶ 55, 61, 120. CoStar indicates that Leon Capital may still have access to this material, and seeks to prevent it from using that information going forward. See Compl. Prayer for Relief ¶ D.

When CoStar pointed out this problem in its opposition, Leon Capital changed tack. In its reply, Leon Capital seeks dismissal on the ground that CoStar has not alleged “it was deprived of its property, or that it no longer possesses the information as a result of Defendant’s actions.” Reply at 6. This reframed argument does not work, either. “Where there has been an unjust enrichment, the plaintiff’s remedy is restitution, which is typically measured by reference to the defendant’s gain rather than the plaintiff’s loss.” Peart v. D.C. Hous. Auth., 972 A.2d 810, 820 (D.C. 2009) (emphasis in original). As a result, CoStar can seek a remedy for the benefit Leon *16 Capital gained by virtue of its unauthorized access—regardless of CoStar’s continued access to the same information.

D. Computer Fraud and Abuse Act (Claim Three)

Finally, the Court turns to CoStar’s statutory claim under the Computer Fraud and Abuse Act. The CFAA prohibits “intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected computer.” 18 U.S.C. § 1030(a)(2). The statute authorizes a civil suit if a plaintiff can show that the defendant: “(1) intentionally accessed a computer, (2) without authorization or exceeding authorized access, and that he (3) thereby obtained information (4) from any protected computer (if the conduct involved an interstate or foreign communication), and that (5) there was loss to one or more persons during any one-year period aggregating at least $5,000 in value.” LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009); see 18 U.S.C. § 1030(g). CoStar claims that Leon Capital, via the acts of its managing director, violated the CFAA when Wood “improperly accessed CoStar’s servers without authorization” using his former employer’s credentials, and thereby accessed and obtained “protected information” from CoStar’s computers and servers. Compl. ¶¶ 102–04.

Leon Capital urges dismissal of the CFAA claim primarily on the ground that Wood’s conduct did not exceed authorized access and was thus insufficient for liability under the CFAA. See MTD at 10 (“Wood’s alleged access never went beyond what his valid login credentials were authorized to access.”). In defense of its claim, CoStar posits that Leon Capital focuses on the wrong portion of § 1030(a)(2)—which prohibits accessing a protected computer without authorization, as well as exceeding authorized access. See Opp’n at 17–19. CoStar has the better of this argument. As it notes, § 1030(a)(2) prohibits both access without authorization and *17 exceeding authorized access. CoStar’s complaint expressly pleads the former theory, so the Supreme Court’s discussion of the latter in Van Buren v. United States, 141 S. Ct. 1648 (2021) is largely inapposite.

When properly construed, CoStar’s complaint adequately pleads that Wood’s conduct, on behalf of Leon Capital, violated § 1030’s prohibition on access without authorization. Although the CFAA does not define “without authorization,” several courts—including in this district—have held that it is the system owner’s “decision to allow or terminate [a user’s] authorization to access a computer that determines whether [he] is with or ‘without authorization.’” Brekka, 581 F.3d at 1132–33; see also Lewis-Burke Assocs., LLC v. Widder, 725 F. Supp. 2d 187, 193 (D.D.C. 2010) (adopting definition from Brekka that an employee’s “authorization” to access a computer “depends on actions taken by the employer”). Here, CoStar alleges that it expressly terminated Leon Capital’s access to its database, and that, the very next day, Wood used credentials from his former employer to access it anyway. Compl. ¶¶ 54, 58. The Court is unconvinced by Leon Capital’s theory that Wood’s access was authorized because he had “valid credentials.” MTD at 11. What makes the credentials valid for the purposes of the CFAA is not whether they worked, but whether Wood—and Leon Capital—was authorized to use them at all.

In its reply brief, Leon Capital suggests that CoStar’s—and now the Court’s—reading of § 1030(a)(2) is improperly broad, and that Wood’s conduct does not amount to “covertly access[ing] ‘protected computers,’” as defined by the CFAA. Reply at 5. But the only statutory term at the center of this argument is “protected computers,” and there is no dispute that CoStar’s proprietary and password-protected database qualifies. See 18 U.S.C. § 1030(e)(2)(B) (defining protected computer, as relevant here, as one “used in or affecting interstate or foreign commerce *18 or communication”). Covert access is not a defined term. Regardless, CoStar has plausibly alleged that Wood did covertly access CoStar’s database, when he relied on out-of-date login credentials that the Terms of Use expressly precluded him from using.

Before closing, the Court takes a moment to discuss a related issue with CoStar’s CFAA claim that Leon Capital does not raise, but that may be dispositive at summary judgment: the statute’s loss requirement. To bring a CFAA suit, a plaintiff must have suffered “damage or loss by reason of” the alleged violation. 18 U.S.C. § 1030(g). As relevant here, the amount lost must also total at least $5,000 in “aggregat[e]” value. Id. § 1030(g), (c)(4)(a)(i)(I); Compl. ¶ 105. The statute also defines both loss and damage. Loss includes “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). Damage is defined as “any impairment to the integrity or availability of data, a program, a system, or information.” Id. § 1030(e)(8). As the Supreme Court has noted, both definitions “focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data.”4 Van Buren, 141 S. Ct. at 1660.

Here, the purported damages and losses seem to stem more from the value Leon Capital derived from CoStar’s database—the “resources utilized” and “data downloaded”—than the “damage done to CoStar’s computer systems.” Compl. ¶ 105. Only the latter would appear to

4 This loss requirement also reduces the likelihood, contrary to Leon Capital’s suggestion, that the approach to unauthorized use claims detailed above would leave courts “inundated” with cases against “Netflix users and the like.” Reply at 5. The statute’s focus on “technological harms,” as well as the $5,000 minimum loss standard, will necessarily limit claims to large-scale business misconduct affecting a victim’s computer systems or data.

count toward the CFAA’s minimum loss requirement. That being said, the Court does find sufficient allegations in the complaint of the right kind of damages. CoStar claims that Leon Capital’s unauthorized access “impaired and corrupted CoStar’s efforts to measure and analyze legitimate subscriber traffic.” Id. CoStar doesn’t provide much detail on what those efforts are, and it is very much an open question how much of the alleged remedial effort expended in the wake of Wood’s unauthorized use really focused on this kind of harm. But the allegation is made and is plausible, and Leon Capital does not address this potential deficiency in its motion. So the Court will leave CoStar to its proof at summary judgment, with these principles in mind. IV. Conclusion

For the foregoing reasons, the Court will grant Defendant’s Motion to Dismiss in part and deny it in part. A separate Order shall accompany this memorandum opinion.

CHRISTOPHER R. COOPER United States District Judge

Date: June 7, 2022