Victory for craigslists in War Against Data Scraping: Circumventing IP Address Blocking May Trigger CFAA Claim

craigslists Wins Again

Classified megasite craiglists won another victory in its fight to block 3Taps from aggregating and republishing craigslist ads.

As set forth in the craiglists complaint, 3Taps

  • copies (or “scrapes”) all content posted to craigslist in real time, directly from the craigslist website;
  • markets a “craigslist API” to allow third parties to access large amounts of content from craigslist; and
  • operates the website, which “essentially replicated the entire craigslist website,” including “all of craigslist’s posts.”

In response, craigslist sent 3Taps a cease and desist letter informing it that they were “no longer authorized to access, and are prohibited from accessing craigslist’s website or services for any reason.” In addition, craigslist configured its website to block access from IP addresses associated with 3Taps. 3Taps bypassed that technological barrier by using different IP addresses and proxy servers to conceal its identity, and continued scraping data.

In its initial ruling denying 3Taps Motion to Dismiss, the Federal District Court for the Northern District of California noted that, with respect to the Computer Fraud and Abuse Act (CFAA)  claim,

although courts in this district have held that the CFAA may apply to unauthorized access to websites, the parties have not cited a case from this district or the Ninth Circuit addressing its application to information that is generally available to the public.

3Taps seized the opportunity and requested to brief the issue. The court reached the same result finding:  The parties agreed that 3Taps had intentionally accessed Craigslists, with the only dispute being whether it was “without authorization” under the CFAA.

Can craigslist revoke access to a public website?

3Taps argued that

By making the classified ads on its website publicly available, craigslist has ‘authorized’ the world, including 3Taps, to access

The court, however, found that craigslist could revoke access to a public website under the CFAA.

Criminalizing Violations of Terms of Use?

3Taps also sought to invoke case law that expresses concern over the CFAA  being used to criminalize violations of private website terms of use policies.  The court, however, found such a circumstance was entirely distinguishable from a case where “a user is altogether banned from accessing a website. The banned user has to follow only one, clear rule: do not access the website.”

The court concluded

Here, Craigslist affirmatively communicated its decisionto revoke 3Taps’ access through its cease-and-desist letter and IP blocking efforts. 3Taps never suggests that those measures did not put 3Taps on notice that Craigslist had banned 3Taps; indeed, 3Taps had to circumvent Craigslist’s IP blocking measures to continue scraping, so it indisputably knew that Craigslist did not want it accessing the website at all.