Costar Group, Inc. v. Leon Capital Group, LLC ( 2022 )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
COSTAR GROUP, INC., and COSTAR
REALTY INFORMATION, INC.,
Plaintiffs,
v. Case No. 21-cv-2227 (CRC)
LEON CAPITAL GROUP, LLC,
Defendant.
MEMORANDUM OPINION
Plaintiffs CoStar Group, Inc. and CoStar Realty Information, Inc. (collectively, “CoStar”)
operate a commercial real estate database. CoStar here sues a former licensee of its database,
Leon Capital Group, LLC (“Leon Capital”), over claims that Leon Capital is too closely tied to
one of CoStar’s competitors—the Commercial Real Estate Exchange, Inc. (“CREXi”). CoStar’s
complaint raises five claims, all of which Leon Capital has moved to dismiss. As explained
below, the Court will dismiss Claim One, for breach of contract, because Leon Capital’s
payment of the amount due under the contract has mooted the claim. But the Court finds that
CoStar has at least plausibly stated the other four claims for relief. The Court will, accordingly,
grant the motion to dismiss in part and deny it in part.
I. Background
CoStar operates “the nation’s most comprehensive commercial real estate information
database,” which it licenses to users for a monthly fee.1 Compl. ¶¶ 1, 19. Until May 2021, one
1
The Court draws the following facts from the allegations in the complaint, which the
Court must accept as true at the motion to dismiss stage. See Sparrow v. United Air Lines, Inc.,
216 F.3d 1111, 1113 (D.C. Cir. 2000).
of those licensees was Leon Capital, a Texas-based real estate investment and development firm.
Id. ¶¶ 3, 11; Mem. in Supp. of Mot. Dismiss (“MTD”) at 2. Leon Capital’s use of CoStar’s
database was governed by two sets of terms. Compl. ¶ 25.
First, by virtue of its License Agreement, Leon Capital agreed to abide by CoStar’s
Terms and Conditions. Id. ¶ 26; see generally Compl. Ex. A. Among those terms was a
limitation on “access or use” of the database by any “direct or indirect competitor of CoStar.”
Compl. ¶ 35; see Compl. Ex. A ¶ 2(c)(3). The Terms and Conditions also authorized CoStar,
upon a “good faith determination” that a licensee had violated certain provisions—including the
bar on competitor access—to terminate the license immediately. Compl. ¶ 37; Compl. Ex. A ¶
6(b)(1). Such a termination would accelerate all fees due on the remainder of the license.
Compl. ¶ 37; Compl. Ex. A ¶ 6(d).
Second, when Leon Capital employees logged on to CoStar’s database, their conduct was
governed by that product’s Terms of Use. See Compl. ¶¶ 27–28, 30; see generally Compl. Ex.
B. Like the Terms and Conditions, the Terms of Use forbade access to the database by “direct or
indirect competitor[s] of CoStar.” Compl. ¶ 35; Compl. Ex. B at 6. The Terms of Use offered
examples of what Costar considered to be its competitors, including “Internet listing services or
other real estate information services.” Compl. ¶ 35; Compl. Ex. B at 6. In addition, the Terms
of Use provided that only “Authorized User[s]” could access CoStar’s password-protected
services. Compl. ¶ 38; Compl. Ex. B at 6. The Terms of Use defined “Authorized User” as “an
individual (a) employed by a CoStar Client or an Exclusive Contractor . . . of a CoStar Client at a
site identified in the License Agreement, and (b) who is specified in the License Agreement as a
user of a specific Passcode Protected Product and represented by the Client to be an employee or
Exclusive Contractor of the Client.” Compl. Ex. B at 3.
2
CoStar alleges that Leon Capital violated both sets of terms. The first set of allegations
relates to the Terms and Conditions’ prohibition on the use of CoStar products by any direct or
indirect competitor. Compl. ¶ 42. In the spring of 2021, CoStar determined Leon Capital to be a
competitor, based on the relationship of Leon Capital and its CEO with CREXi. Id. ¶¶ 42–52.
At that point, CoStar had been embroiled in copyright litigation with CREXi for more than six
months. See Compl., CoStar Grp., Inc. v. Com. Real Est. Exch., Inc., No. 20-cv-8819 (C.D. Cal.
Sept. 25, 2020). After inquiring about Leon Capital’s relationship to CREXi and receiving no
substantive response, on May 24, 2021, CoStar exercised its right to terminate the contract.
Compl. ¶¶ 45, 51–52. It requested $47,081.28 in remaining annual fees under the acceleration
clause. Id. ¶ 53. As of the filing of the complaint, Leon Capital had not paid that balance. Id.
CoStar also alleges that, notwithstanding the termination of its License Agreement, Leon
Capital continued to access its database in May and June of 2021, in violation of the product’s
Terms of Use. Id. ¶ 54. Here, CoStar focuses on the actions of Leon Capital’s Managing
Director Sean Wood, who joined Leon Capital in May 2021. Id. ¶¶ 55, 57, 59. CoStar alleges
that, beginning on May 25, 2021—the day after the termination of the License Agreement—
Wood began logging on to CoStar’s database with credentials issued to his previous employer,
Dalfen Industrial. Id. ¶¶ 56–65. Acting on behalf of and in the course of his employment with
Leon Capital, and using a Leon Capital device, Wood allegedly “mined the CoStar database for
data”—ultimately exporting several hundred records. Id. ¶¶ 58, 61. On August 12, 2021, CoStar
terminated Wood’s Dalfen username. Id. ¶ 65. At the same time, it terminated the access of
another Leon Capital employee who had similarly employed a username connected with an old
employer. See id. ¶¶ 66–70.
3
A week later, CoStar filed suit. The complaint raises five claims. CoStar first seeks
payment of the amount due under the Terms and Conditions’ termination clause, which CoStar
triggered based on Leon Capital’s alleged violation of the non-competition provision. Id. ¶¶ 78–
86. The remaining claims all relate to Wood’s continued use of CoStar’s database after May 24,
2021, in his capacity as Leon Capital’s Managing Director. These include a second breach of
contract claim, this time for alleged violations of the Terms of Use. Id. ¶¶ 87–98. Two more
claims—one for fraud and one for unjust enrichment—are pled in the alternative to Claim Two,
in the event the Court finds the Terms of Use did not constitute a binding contract between Leon
Capital and CoStar. Id. ¶¶ 107–15, 116–23. Finally, CoStar alleges in Claim Three that Wood’s
access to and downloading of data from CoStar’s servers violated the Computer Fraud and
Abuse Act (“CFAA”), 18 U.S.C. § 1030. Id. ¶¶ 99–106. Leon Capital has moved to dismiss all
five claims under Federal Rule of Civil Procedure 12(b)(6).
II. Legal Standards
Rule 12(b)(6) requires dismissal of a complaint that fails “to state a claim upon which
relief can be granted.” When evaluating a 12(b)(6) motion, the court must determine whether the
complaint “contain[s] sufficient factual matter, accepted as true, to ‘state a claim to relief that is
plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007)). A claim is plausible “when the plaintiff pleads factual
content that allows the court to draw the reasonable inference that the defendant is liable for the
misconduct alleged.” Id.A court “must treat the complaint’s factual allegations as true and must grant plaintiff the
benefit of all inferences that can be derived from the facts alleged.” Sparrow v. United Air
Lines, Inc., 216 F.3d 1111, 1113 (D.C. Cir. 2000) (internal citation and quotation marks
4
omitted). Although a complaint need not provide “detailed factual allegations” to withstand a
12(b)(6) motion, it must offer “more than labels and conclusions.” Twombly, 550 U.S. at 555.
“In determining whether a complaint states a claim, the court may consider the facts alleged in
the complaint, documents attached thereto or incorporated therein, and matters of which it may
take judicial notice.” Stewart v. Nat’l Educ. Ass’n, 471 F.3d 169, 173 (D.C. Cir. 2006).
III. Analysis
The Court organizes its discussion of each claim based on the relevant allegations—first
taking up CoStar’s breach of contract claim relating to non-payment of the accelerated license
fees; then considering its breach of contract claim relating to Wood’s unauthorized access, as
well as the fraud and unjust enrichment claims pled in the alternative to this claim; and finally
turning to the CFAA claim. As explained below, the Court will dismiss only CoStar’s first
claim, and will otherwise deny Leon Capital’s motion to dismiss.
A. Breach of Subscription License Agreement and Terms and Conditions (Claim One)
With its first breach of contract claim, CoStar relies on several provisions of its standard
Terms and Conditions, which was incorporated by reference in the parties’ License Agreement.
Compl. ¶ 26. CoStar alleges that it validly terminated Leon Capital’s License Agreement upon
its good faith determination that Leon Capital had violated the Terms and Conditions’ non-
competition provision. Id. ¶ 84. CoStar then claims that Leon Capital improperly withheld the
payment due under a term accelerating the remainder of the license fees. Id. ¶¶ 85–86.
“To prevail on a claim of breach of contract, a party must establish (1) a valid contract
between the parties; (2) an obligation or duty arising out of the contract; (3) a breach of that duty;
and (4) damages caused by breach.” Tsintolas Realty Co. v. Mendez, 984 A.2d 181, 187 (D.C.
2009). Leon Capital offers two arguments in favor of dismissal: First, it disputes the existence
5
of a breach because, in its view, CoStar has offered “no plausible basis on which the court could
determine Leon Capital’s private investment business is an actual competitor” of CoStar. MTD
at 4. Second, Leon Capital reports that it has paid the amount due under the acceleration
clause—the full damages CoStar seeks with Claim One. See id. at 1. It therefore asks the Court
to find the claim moot. See Reply at 4. The Court only needs to reach this second argument, as
it agrees that there is nothing left of CoStar’s contract claim as currently pled.
A claim becomes moot “when, among other things, the court can provide no effective
remedy because a party has already obtained all the relief that [it has] sought.” Conservation
Force, Inc. v. Jewell, 733 F.3d 1200, 1204 (D.C. Cir. 2013) (alteration in original) (internal
quotation marks omitted). In its complaint, CoStar specifically alleges that it “has been damaged
by the amount due under the contract, totaling $47,081.28.” Compl. ¶ 86. Leon Capital
represents that it has now paid the accelerated fees due on the contract—a fact CoStar implicitly
concedes. See Opp’n at 2 (accusing Leon Capital of “conveniently omitting when it made this
overdue payment” but noting only that it was “unpaid as of the filing of the complaint”).
Because CoStar has received all the relief it seeks in Claim One of the complaint, the claim is
moot.
CoStar’s efforts to avoid this conclusion are unavailing. It first argues that the Court may
not consider the fact of Leon Capital’s belated payment on a 12(b)(6) motion because it is
“outside the ‘four corners of the complaint.’” Id. at 13 (quoting Brown v. Gov’t of D.C., 390 F.
Supp. 3d 114, 122 (D.D.C. 2019)). Whether Leon Capital has already provided the relief
requested in Claim One, however, does not go to failure to state a claim under 12(b)(6). Mundo
Verde Pub. Charter Sch. v. Sokolov, 315 F. Supp. 3d 374, 380 n.2 (D.D.C. 2018). It goes instead
to mootness, which is properly raised in a motion to dismiss for lack of jurisdiction under Rule
6
12(b)(1). Id. And when evaluating 12(b)(1) motions, courts are not limited to the allegations in
the complaint. See Herbert v. Nat’l Acad. of Scis., 974 F.2d 192, 197 (D.C. Cir. 1992).
“[W]here necessary,” they may consider, among other things, “undisputed facts evidenced in the
record.” Id. Because CoStar has conceded that the payment was made, the Court may consider
that undisputed fact and find the breach of contract claim moot.
CoStar next claims that it “seeks far more than $47,081.28—explicitly pleading ‘at least
hundreds of thousands of dollars” in damages and seeking injunctive relief as well. Opp’n at 13–
14 (citing Compl. ¶ 77). But that is simply not how CoStar pled this first contract claim. In the
complaint, CoStar framed it as one for “Non Payment” based on a breach of the “Subscription
License Agreement.” See Compl. at 18. Although CoStar sought injunctive relief and additional
damages when laying out other claims in the complaint, see, e.g., id. ¶ 98, it did not do so here.
Rather, in the relevant paragraphs in Claim One, CoStar only alleges that it has been “damaged
by the amount due under the contract, totaling $47,081.28.” Id. ¶ 86. Because CoStar has been
paid those alleged damages, Claim One is moot.
B. Breach of Terms of Use (Claim Two)
The Court turns next to CoStar’s second breach of contract claim, which focuses on
Wood’s access of its platform without authorization after the termination of Leon Capital’s
License Agreement in May 2021. CoStar alleges that Wood’s use of the platform can be
attributed to Leon Capital, and that it violated two provisions in the Terms of Use: (1) the
prohibition on competitors’ access to CoStar’s content; and (2) the requirement that those who
access the platform be Authorized Users “employed by the subscriber.” Compl. ¶¶ 93–94. Leon
Capital mounts two attacks on this claim, neither of which succeed.
7
First, Leon Capital contends that CoStar has not properly alleged a breach of the relevant
contract—between it and Leon Capital. In Leon Capital’s telling, to the extent Wood violated
any contract at all, it was the one between CoStar and his former employer, Dalfen Industrial,
which never terminated his username when he left the company. See MTD at 7–8. There are
several problems with this argument. Initially, it touches only on CoStar’s Authorized User
theory of breach, and ignores the allegation that Wood accessed the database despite working for
a competitor. See Compl. ¶ 93. The Court will discuss that alternate breach theory at the close
of this section. More fundamentally, it is beside the point whether Wood’s actions also violated
some agreement between Dalfen and CoStar, or whether they, too, could have prevented his
misconduct by terminating his username sooner. Here, CoStar has plausibly alleged facts that
would support each element of a breach of contract by Wood: a valid contract in the Terms of
Use; an obligation to refrain from accessing the platform unless authorized; a breach of that duty
when Wood used his old employer’s username; and damages from that breach. See id. ¶¶ 88, 91,
94, 97.
Contrary to Leon Capital’s suggestion, see Reply at 3–4, CoStar has also plausibly
alleged that any violation by Wood can be attributed to Leon Capital. “Under the doctrine of
respondeat superior, an employer may be held liable for the acts of his employees committed
within the scope of their employment.” Brown v. Argenbright Sec., Inc., 782 A.2d 752, 757
(D.C. 2001). Leon Capital does not dispute that Wood was its employee at the time of the
alleged breach. And CoStar plausibly alleges that Wood accessed the database “within the scope
of his employment” with Leon Capital and “in furtherance of its ends.” District of Columbia v.
Coron, 515 A.2d 435, 437 (D.C. 1986). The complaint notes that Wood used a Leon Capital-
associated device, and that the data he accessed concerned industrial properties in Phoenix and
8
Dallas—areas where Leon Capital “is involved in real estate projects.” Compl. ¶¶ 58, 61. That
is sufficient at the motion to dismiss stage to support CoStar’s claim that Wood violated CoStar’s
Terms of Use in order “to obtain information about industrial properties” on “behalf of, and for
the benefit of Leon Capital.” Id. ¶ 73.
Second, Leon Capital argues that the doctrine of double recovery bars this contract claim.
See MTD at 8–9. This doctrine provides that “[d]amages for the same injury may be recovered
only once even though they are recoverable under two or more legal theories for two or more
wrongs.” Rice v. District of Columbia, 818 F. Supp. 2d 47, 57 (D.D.C. 2011) (citing Franklin
Inv. Co., Inc. v. Smith, 383 A.2d 355, 358 (D.C. 1978)). But the appropriate way for courts to
handle this risk is to reduce a final award, not to dismiss one of those theories at the outset. Id.;
Cobb v. Wash. Metro. Area Transit Auth., No. 20-cv-3522, 2021 WL 2935891, at *4 (D.D.C.
July 13, 2021). Besides, neither of the other sources of recovery Leon Capital identifies—from
Dalfen’s license fees or Leon Capital’s termination penalty—would compensate CoStar for
Wood’s conduct in May through August of 2021. As to the former, assuming Dalfen’s license is
subject to the same Terms and Conditions discussed above, access by a former employee would
not be an authorized use. Dalfen’s license fees thus would not compensate CoStar for Wood’s
continued access after he left his position there. As to the latter, the Court reads the termination
clause in the Terms and Conditions to accelerate payment as a remedy for past violations. See
Compl. Ex. A ¶ 6(d) (accelerating payment of all fees “[u]pon Licensee’s breach of any terms of
this Agreement that leads to a termination” (emphasis added)). Payment of such a penalty would
not absolve now-former licensees for future misconduct. That being said, the Court is skeptical
that the actual value of the damages here—arising out of extracontractual use of CoStar’s
database by a single individual—really amounts to the hundreds of thousands of dollars of
9
damage CoStar claims it suffered. See Compl. ¶ 77. But because CoStar has not yet been
compensated for the alleged breach of the Terms of Use, no rule against double recovery
mandates this claim’s dismissal.
Finally, the Court returns to CoStar’s alternate theory of liability on this claim—that
Leon Capital (via Wood) also breached the Terms of Use in the summer of 2021 by accessing
the database even though it was CoStar’s competitor. The parties do not mention this theory in
their briefing on Claim Two, perhaps because they had already covered that ground when
discussing CoStar’s first breach claim. But the Court finds it useful to explain the principles that
govern this alternate theory of liability, as the Court will also allow it to survive the motion to
dismiss. This discussion may also streamline litigation going forward, should CoStar seek to
amend its complaint to resuscitate any breach of contract claim arising out of Leon Capital’s
conduct before May 2021.2
In its briefing, Leon Capital suggests that none of the competitor allegations provide
Costar an avenue for relief because it has offered “no plausible basis on which the court could
determine Leon Capital’s private investment business is an actual competitor of CoStar’s
database business.” MTD at 4. CoStar counters that Leon Capital is “at least an indirect
competitor,” pointing to allegations that (1) CREXi is a direct competitor of CoStar; (2) Leon
Capital’s CEO was closely involved in founding, managing, and promoting CREXi; and (3)
Leon Capital invested in CREXi. See Opp’n at 9; Compl. ¶¶ 3, 24, 42. While something of a
2
These principles largely would have governed the merits of Claim One, had the Court
not dismissed it as moot. The Court sees only one difference: evaluating any alleged violation
of the Terms and Conditions’ termination clause would require deciding whether CoStar
believed in good faith that Leon Capital was a competitor—not whether it in fact competed.
10
close call, the Court ultimately concludes CoStar has at least plausibly alleged some sort of
indirect competitor relationship.
Crucially, neither party has provided the Court with a particularly usable definition of
“indirect competitor.” The parties’ agreements never define the term: The Terms and
Conditions define neither direct nor indirect competitor. And the Terms of Use only provide
examples of direct competitors—“Internet listing services or other real estate information
services.” Compl. Ex. B at 6. CREXi appears to be an Internet listing service, but Leon Capital
does not.
The parties also have not pointed to any applicable law that encompasses and fully ties
together the conduct of Leon Capital, its CEO, and CREXi. They cite no standard definition of
“indirect competition” under District of Columbia law. CoStar has gathered cases from a range
of other jurisdictions suggesting that “guiding, promoting, assisting, advising, and investing in
CREXi”—as De Leon allegedly did—is sufficient to constitute indirect competition. See Opp’n
at 10; see also, e.g., United HealthCare Servs., Inc. v. Corzine, No. 2:21-cv-319, 2021 WL
961217, at *16 (S.D. Ohio Mar. 15, 2021) (finding former employee violated prohibition on
indirectly competing with insurance company by “participating in” meetings with competitor’s
“business development team”); Kan-Di-Ki, LLC v. Suer, No. 7937-VCP, 2015 WL 4503210, at
*21 (Del. Ch. July 22, 2015) (unpublished) (crediting evidence that defendant engaged
“indirectly in competitive” behavior “by assisting competitors” of a company). But this case law
does not establish that Leon Capital—as opposed to its CEO—indirectly competes with CREXi.
Neither the cited law nor the allegations in the complaint clarify whether any acts De Leon may
have taken to benefit CREXi can and should be attributed to Leon Capital, or whether De Leon,
instead, was acting in his personal capacity, without any benefit flowing to or from Leon Capital.
11
But the Court finds it at least plausible that Leon Capital is sufficiently tied to CREXi,
and thus an indirect competitor of CoStar, by virtue of its alleged direct investment in that firm.
Compl. ¶ 24. Contrary to Leon Capital’s suggestion, this is not the kind of “mere conclusory
statement[]” that courts must reject at the motion to dismiss stage. Iqbal, 556 U.S. at 678. To be
clear, questions remain. The Court doubts that any investment—no matter how small or
passive—would sufficiently align the interests of two firms such that competition by one would
render the other an indirect competitor. And CoStar has not provided the Court with either
details of the alleged investor relationship or any relevant case law to help substantiate this
theory. Nevertheless, the Court concludes that, taken together, the allegations in the complaint
suggest a close enough financial and operational relationship between Leon Capital, De Leon,
and CREXi to plausibly allege indirect competition at this early stage of the litigation. The
Court will therefore allow the competitor theory of breach to survive the motion to dismiss, even
if additional legal and factual underpinnings may be required at subsequent stages of the case.3
C. Alternatives to Claim Two
The Court next addresses objections to the claims CoStar brought in the alternative to
Claim Two: one for fraud, and one for unjust enrichment. Both may proceed.
1. Fraud (Claim Four)
CoStar claims that, even if the Court finds that no binding contract governed Leon
Capital’s interactions with CoStar’s database after termination of its license in May 2021, Leon
3
The Court is not convinced by any of Leon Capital’s other arguments in its briefing—
about, for example, whether Leon Capital is an alter ego of CREXi or shares some other parent,
sister, or subsidiary relationship. See MTD at 6. These claims ignore the framing of the
complaint, which does not rely on any potential direct corporate relationship.
12
Capital may still be liable for fraud. “[U]nder District of Columbia law, a plaintiff claiming
fraud must prove (1) the defendant made a false representation; (2) in reference to material fact;
(3) with knowledge of its falsity; (4) with the intent to deceive the plaintiff; (5) the plaintiff acted
in reasonable reliance on that representation; (6) which consequently resulted in provable
damages.” Cordoba Initiative Corp. v. Deak, 900 F. Supp. 2d 42, 47 (D.D.C. 2012) (internal
quotation marks omitted). CoStar maintains that, each time Wood logged on to its database in
his capacity as Leon Capital’s Managing Director, he fraudulently asserted that he was an
Authorized User when in fact he was not, leading CoStar to grant him access it otherwise would
not give. See Compl. ¶¶ 110–13.
Leon Capital first argues that this fraud claim is not sufficiently independent of CoStar’s
breach of contract claim. It is true that “[c]ourts tend not to allow plaintiffs to allege fraudulent
inducement alongside claims for breach because ‘[t]here is a risk of turning every breach of
contract suit into a fraud suit[.]’” Butler v. Enter. Integration Corp., 459 F. Supp. 3d 78, 96
(D.D.C. 2020) (quoting Desnick v. Am. Broad. Cos., Inc., 44 F.3d 1345, 1354 (7th Cir. 1995)
(Posner, J.)). But under District of Columbia law, “the claims may stand side-by-side” when,
among other things, (1) the “tort ‘exist[s] in its own right independent of the contract, and any
duty upon which the tort is based . . . flow[s] from considerations other than the contractual
relationship,” id. (quoting Choharis v. State Farm Fire & Cas. Co., 961 A.2d 1080, 1089 (D.C.
2008)), or (2) “when the defendant makes some statement ‘prior to and ‘independent of the
contract’ that deceives the plaintiff into agreeing to be bound by the contract,” id. (quoting
Ludwig & Robinson, PLLC v. BiotechPharma, LLC, 186 A.3d 105, 111 (D.C. 2018)). Either of
those exceptions could plausibly cover the allegations here. CoStar has alleged that Wood
violated an independent duty: the obligation to make truthful statements in business transactions
13
and not “suppress or conceal any facts within his knowledge which would materially qualify
those stated.” Ludwig, 186 A.3d at 110. In addition, CoStar has alleged that Wood
misrepresented himself as an Authorized User before accepting the Terms of Use, and that—had
he properly identified himself beforehand—CoStar would not have allowed him to complete the
transaction. See Compl. ¶¶ 110–13.
Leon Capital also asks the Court to dismiss the fraud claim for failure to “allege an injury
distinct from a breach of contract claim.” See MTD at 12. Again, it misses the mark. Leon
Capital correctly recites the relevant law: To state a viable claim for fraud, “the injury to the
plaintiff must be an independent injury over and above the mere disappointment of plaintiff’s
hope to receive his contracted-for benefit.” Choharis, 961 A.2d at 1089 (internal quotation
marks omitted). But CoStar has alleged such an injury here. Wood’s purported
misrepresentations did not just allow him to access the database without compensating CoStar or
complying with its rules; rather, because Wood said he was an Authorized User when in fact he
was not, CoStar granted him access it very well might not have offered at all. See Jacobson v.
Hofgard, 168 F. Supp. 3d 187, 200 (D.D.C. 2016) (“Plaintiffs did not face mere contractual
disappointment—they entered into a contract . . . that they would not have otherwise.”). As with
CoStar’s second breach of contract claim, the Court is skeptical that the damages from this
conduct is of nearly the magnitude claimed. To the extent Wood used CoStar’s database that
summer to gather information for Leon Capital’s core real estate investment business, and not to
steal proprietary information or funnel it directly to CREXi, it seems unlikely that this conduct
would cause hundreds of thousands of dollars of injury, even if it did constitute fraud. Still,
because there is some distinct injury alleged, the Court will not dismiss Claim Four.
14
2. Unjust Enrichment (Claim Five)
Leon Capital next seeks dismissal of CoStar’s unjust enrichment claim, which it again
has pled in the alternative to its second contract claim. “The elements of an unjust enrichment
claim are that (1) the plaintiff conferred a benefit on the defendant; (2) the defendant retains the
benefit; and (3) under the circumstances, the defendant’s retention of the benefit is unjust.”
Glasgow v. Camanne Mgmt. Inc., 261 A.3d 208, 219 (D.C. 2021) (internal quotation marks
omitted). “Nothing precludes a plaintiff from pleading an unjust enrichment claim as an
alternative to a breach of contract claim even when seeking the same amount[.]” Id. at 217.
In its motion to dismiss, Leon Capital suggests that CoStar’s unjust enrichment claim
fails because it has not alleged that “Leon Capital retains any benefit that belongs to CoStar.”
MTD at 13. The complaint, however, clearly alleges that Leon Capital “received and retained”
benefits—conducting searches for information and exporting several hundred records—through
Wood’s unauthorized use of its database. Compl. ¶¶ 55, 61, 120. CoStar indicates that Leon
Capital may still have access to this material, and seeks to prevent it from using that information
going forward. See Compl. Prayer for Relief ¶ D.
When CoStar pointed out this problem in its opposition, Leon Capital changed tack. In
its reply, Leon Capital seeks dismissal on the ground that CoStar has not alleged “it was deprived
of its property, or that it no longer possesses the information as a result of Defendant’s actions.”
Reply at 6. This reframed argument does not work, either. “Where there has been an unjust
enrichment, the plaintiff’s remedy is restitution, which is typically measured by reference to the
defendant’s gain rather than the plaintiff’s loss.” Peart v. D.C. Hous. Auth., 972 A.2d 810, 820
(D.C. 2009) (emphasis in original). As a result, CoStar can seek a remedy for the benefit Leon
15
Capital gained by virtue of its unauthorized access—regardless of CoStar’s continued access to
the same information.
D. Computer Fraud and Abuse Act (Claim Three)
Finally, the Court turns to CoStar’s statutory claim under the Computer Fraud and Abuse
Act. The CFAA prohibits “intentionally access[ing] a computer without authorization or
exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected
computer.” 18 U.S.C. § 1030(a)(2). The statute authorizes a civil suit if a plaintiff can show that
the defendant: “(1) intentionally accessed a computer, (2) without authorization or exceeding
authorized access, and that he (3) thereby obtained information (4) from any protected computer
(if the conduct involved an interstate or foreign communication), and that (5) there was loss to
one or more persons during any one-year period aggregating at least $5,000 in value.” LVRC
Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009); see 18 U.S.C. § 1030(g). CoStar
claims that Leon Capital, via the acts of its managing director, violated the CFAA when Wood
“improperly accessed CoStar’s servers without authorization” using his former employer’s
credentials, and thereby accessed and obtained “protected information” from CoStar’s computers
and servers. Compl. ¶¶ 102–04.
Leon Capital urges dismissal of the CFAA claim primarily on the ground that Wood’s
conduct did not exceed authorized access and was thus insufficient for liability under the CFAA.
See MTD at 10 (“Wood’s alleged access never went beyond what his valid login credentials
were authorized to access.”). In defense of its claim, CoStar posits that Leon Capital focuses on
the wrong portion of § 1030(a)(2)—which prohibits accessing a protected computer without
authorization, as well as exceeding authorized access. See Opp’n at 17–19. CoStar has the
better of this argument. As it notes, § 1030(a)(2) prohibits both access without authorization and
16
exceeding authorized access. CoStar’s complaint expressly pleads the former theory, so the
Supreme Court’s discussion of the latter in Van Buren v. United States, 141 S. Ct. 1648 (2021) is
largely inapposite.
When properly construed, CoStar’s complaint adequately pleads that Wood’s conduct,
on behalf of Leon Capital, violated § 1030’s prohibition on access without authorization.
Although the CFAA does not define “without authorization,” several courts—including in this
district—have held that it is the system owner’s “decision to allow or terminate [a user’s]
authorization to access a computer that determines whether [he] is with or ‘without
authorization.’” Brekka, 581 F.3d at 1132–33; see also Lewis-Burke Assocs., LLC v. Widder,
725 F. Supp. 2d 187, 193 (D.D.C. 2010) (adopting definition from Brekka that an employee’s
“authorization” to access a computer “depends on actions taken by the employer”). Here, CoStar
alleges that it expressly terminated Leon Capital’s access to its database, and that, the very next
day, Wood used credentials from his former employer to access it anyway. Compl. ¶¶ 54, 58.
The Court is unconvinced by Leon Capital’s theory that Wood’s access was authorized because
he had “valid credentials.” MTD at 11. What makes the credentials valid for the purposes of the
CFAA is not whether they worked, but whether Wood—and Leon Capital—was authorized to
use them at all.
In its reply brief, Leon Capital suggests that CoStar’s—and now the Court’s—reading of
§ 1030(a)(2) is improperly broad, and that Wood’s conduct does not amount to “covertly
access[ing] ‘protected computers,’” as defined by the CFAA. Reply at 5. But the only statutory
term at the center of this argument is “protected computers,” and there is no dispute that CoStar’s
proprietary and password-protected database qualifies. See 18 U.S.C. § 1030(e)(2)(B) (defining
protected computer, as relevant here, as one “used in or affecting interstate or foreign commerce
17
or communication”). Covert access is not a defined term. Regardless, CoStar has plausibly
alleged that Wood did covertly access CoStar’s database, when he relied on out-of-date login
credentials that the Terms of Use expressly precluded him from using.
Before closing, the Court takes a moment to discuss a related issue with CoStar’s CFAA
claim that Leon Capital does not raise, but that may be dispositive at summary judgment: the
statute’s loss requirement. To bring a CFAA suit, a plaintiff must have suffered “damage or loss
by reason of” the alleged violation. 18 U.S.C. § 1030(g). As relevant here, the amount lost must
also total at least $5,000 in “aggregat[e]” value. Id. § 1030(g), (c)(4)(a)(i)(I); Compl. ¶ 105. The
statute also defines both loss and damage. Loss includes “any reasonable cost to any victim,
including the cost of responding to an offense, conducting a damage assessment, and restoring
the data, program, system, or information to its condition prior to the offense, and any revenue
lost, cost incurred, or other consequential damages incurred because of interruption of service.”
18 U.S.C. § 1030(e)(11). Damage is defined as “any impairment to the integrity or availability
of data, a program, a system, or information.” Id. § 1030(e)(8). As the Supreme Court has
noted, both definitions “focus on technological harms—such as the corruption of files—of the
type unauthorized users cause to computer systems and data.”4 Van Buren, 141 S. Ct. at 1660.
Here, the purported damages and losses seem to stem more from the value Leon Capital
derived from CoStar’s database—the “resources utilized” and “data downloaded”—than the
“damage done to CoStar’s computer systems.” Compl. ¶ 105. Only the latter would appear to
4
This loss requirement also reduces the likelihood, contrary to Leon Capital’s suggestion,
that the approach to unauthorized use claims detailed above would leave courts “inundated” with
cases against “Netflix users and the like.” Reply at 5. The statute’s focus on “technological
harms,” as well as the $5,000 minimum loss standard, will necessarily limit claims to large-scale
business misconduct affecting a victim’s computer systems or data.
18
count toward the CFAA’s minimum loss requirement. That being said, the Court does find
sufficient allegations in the complaint of the right kind of damages. CoStar claims that Leon
Capital’s unauthorized access “impaired and corrupted CoStar’s efforts to measure and analyze
legitimate subscriber traffic.” Id. CoStar doesn’t provide much detail on what those efforts are,
and it is very much an open question how much of the alleged remedial effort expended in the
wake of Wood’s unauthorized use really focused on this kind of harm. But the allegation is
made and is plausible, and Leon Capital does not address this potential deficiency in its motion.
So the Court will leave CoStar to its proof at summary judgment, with these principles in mind.
IV. Conclusion
For the foregoing reasons, the Court will grant Defendant’s Motion to Dismiss in part and
deny it in part. A separate Order shall accompany this memorandum opinion.
CHRISTOPHER R. COOPER
United States District Judge
Date: June 7, 2022
19