In Re: Dealer Management Systems Antitrust Litigation

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

IN RE DEALER MANAGEMENT SYSTEMS )

ANTITRUST LITIGATION, MDL 2817 ) Case No. 18-cv-864

)

__________________________________________) Judge Robert M. Dow, Jr.

)

This document relates to: )

)

THE DEALERSHIP CLASS ACTION )

)

MEMORANDUM OPINION AND ORDER

Before the Court is the motion to dismiss the counterclaims of Defendant/Counter-Plaintiff

CDK Global, LLC (“Counter-Plaintiff” or “CDK”) [593] filed by Plaintiffs/Counter-Defendants

ACA Motors, Inc.; Continental Classic Motors, Inc.; 5800 Countryside, LLC; HDA Motors, Inc.;

H & H Continental Motors, Inc.; Continental Autos, Inc.; Naperville Zoom Cars, Inc.; NV Autos,

Inc.; Baystate Ford Inc.; Cliff Harris Ford, LLC; Marshall Chrysler Jeep Dodge, L.L.C.;

Warrensburg Chrysler Dodge Jeep, L.L.C.; Cherry Hill Jaguar; JCF Autos LLC; Jericho Turnpike

Sales LLC; Patchogue 112 Motors LLC; and Waconia Dodge, Inc. (collectively, “Counter-

Defendants”). For the reasons set forth below, the motion to dismiss [593] CDK’s counterclaims

is granted in part and denied in part. CDK is given until September 30, 2019 to file amended

counterclaims consistent with this opinion.

I. Background1

Given that this case already has been extensively litigated before multiple courts, the Court

assumes some familiarity with the background of this case and thus will limit its recitation of the

1 For purposes of the motions to dismiss, the Court accepts as true all of Counter-Plaintiff’s well-pleaded

factual allegations and draws all reasonable inferences in Counter-Plaintiff’s favor. Killingsworth v. HSBC

Bank Nev., N.A., 507 F.3d 614, 618 (7th Cir. 2007).

facts essential to the motion now before it. CDK brings counterclaims against the Counter-

Defendants under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, and

for breach of contract. The counterclaims focus on Counter-Defendants’ purported unauthorized

access—along with data integrator Authenticom, Inc.—of CDK’s enterprise software and

computing platform for automotive dealerships and dealership groups known as its Dealer

Management System or, more commonly, its DMS.

The automotive data system that CDK supports is massive—with tens of thousands of

installations of approved vendor applications and millions of transactions every day—supporting

hundreds of billions of dollars in commerce each year. [522 (Counterclaims), at ¶ 5.] CDK has

made tremendous investments to build out and support its network of product and service

offerings. [Id.] Over the last four years alone, CDK has spent more than $480 million researching,

developing, and deploying new and enhanced product solutions for its customers. [Id.] CDK’s

DMS includes (and is largely comprised of) valuable pieces of intellectual property, including

patented technologies, proprietary software elements and programs that it has created (including

software programs protected by the copyright laws), and proprietary data collections, which are

accessible through the DMS. [Id. at ¶ 32.] Dealers that purchase DMS services from CDK are

granted a personal, non-transferable license to use CDK’s DMS in accordance with the terms and

conditions of their agreements. [Id.]

CDK’s DMS offering consists of software and hardware components residing at both the

dealership and at CDK’s data centers (“CDK’s network”). [Id. at ¶ 33.] CDK uses state-of-the-

art technology to secure the connections between the dealerships and CDK’s network, including

through specialized hardware at each dealership site. [Id.] That hardware creates a “virtual private

network” or “Leased-Line Multiprotocol Label Switching network” between the dealership and

CDK’s network, which accepts direct communications only from computers on the corresponding

dealership’s network. [Id.]

CDK’s DMS is password protected. [Id. at ¶ 37.] To access the DMS, each dealership

employee must use his or her individual login credentials. [Id.] CDK has implemented security

features in addition to password protection. [Id. at ¶ 40.] In early 2016, CDK created a login

prompt requiring users to certify that they were an “authorized dealer employee” before they could

access CDK’s DMS. [Id.] Further, in November 2017, CDK began introducing a CAPTCHA2

control for particular login credentials that it suspected were being used to facilitate unauthorized

access to its DMS by third parties. [Id. at ¶ 41.] Humans can easily pass CAPTCHA tests, but

automated scripts—like those used by Authenticom and other third-party data extractors—often

encounter difficulty. [Id.] The CAPTCHA controls are specifically designed to prevent access to

computers through automated means. [Id.]

CDK has entered into a Master Service Agreement (“MSA”) with each Counter-Defendant

(collectively, the “MSAs”). [Id. at ¶ 43.] The MSAs expressly prohibit Counter-Defendants from

supplying DMS login credentials to third parties or otherwise granting third parties access to

CDK’s DMS. [Id.] Specifically, Section 6(D) of the MSAs provides that the “Client shall not

allow access to [CDK’s DMS] by any third parties except as otherwise permitted by this

agreement.” [Id. at ¶ 44.] In addition, each Counter-Defendant expressly agrees that it will only

use CDK’s software “for its own internal business purposes and will not sell or otherwise provide,

directly or indirectly, any of the Services or Software, or any portion thereof, to any third party”

and that it will “treat as confidential and will not disclose or otherwise make available any of the

2 “CAPTCHA” is an acronym for “Completely Automated Public Turing Test to tell Computers and

Humans Apart.” Tel. Sci. Corp. v. Asset Recovery Sols., LLC, 2016 WL 4179150, at *1 (N.D. Ill. Aug. 8,

2016).

[CDK’s] Products (including, without limitation, screen displays or user documentation) or any

* * * proprietary data, information, or documentation related thereto * * * in any form, to any

person other than employees and agents of [the dealer.]” [Id. at ¶ 45.] Each dealer acknowledges

that—notwithstanding its license to use CDK’s DMS—the DMS remains at all times “the

exclusive and confidential property of [CDK].” [Id.] Additionally, the MSAs independently

prohibit “ANY THIRD PARTY SOFTWARE TO ACCESS [CDK’S] DEALER

MANAGEMENT SYSTEM EXCEPT AS OTHERWISE PERMITTED BY THIS

AGREEMENT.” [Id. at ¶ 46.]

CDK contends that third party hostile data extractors like Authenticom are not “agents” of

the Counter-Defendants. [Id. at ¶ 49.] Authenticom’s own contract with dealers makes clear that

Authenticom is not the dealer’s “agent,” and in fact refers to “agents” of the dealer repeatedly as

third parties to the agreement. [Id.] Similarly, the standard End-User License Agreement

(“EULA”) offered by Superior Integrated Solutions (“SIS”), another third party data extractor,

states that “[t]he parties shall be independent contractors under this Agreement, and nothing herein

will constitute either party as the employer, employee, agent or representative of the other party,

or both parties as joint ventures or partners for any purpose.” [Id.]

CDK submits that Counter-Defendants have repeatedly breached their contracts with CDK

by handing out their DMS login credentials (directly or through their software vendors) to third

party data extractors for the express purpose of enabling those third parties to use those credentials

to repeatedly and relentlessly access CDK’s DMS using sophisticated computer software that

extracts (or scrapes) large volumes of data from the system. [Id. at ¶ 2.] Many of these data

extractors—including Authenticom—then resell that data to other third-party application

providers, paying nothing to CDK. [Id.] According to CDK, this unauthorized access not only

threatens the security of the data in CDK’s DMS, but also threatens the integrity of that data

because ungoverned extraction and insertion of data into the DMS may corrupt the DMS databases.

[Id.] Moreover, the thousands of unauthorized extractions and the high volume of data in many

of those extractions degrade the performance of the DMS, impairing its value for all of CDK’s

DMS customers. [Id.]

CDK brings counterclaims against Counter-Defendants based on this alleged unauthorized

access. Before the Court is Counter-Defendants’ motion to dismiss the breach of contract,

Computer Fraud and Abase Act, and Digital Millennium Copyright Act counterclaims brought

against them.

II. Legal Standard

To survive a Federal Rule of Civil Procedure (“Rule”) 12(b)(6) motion to dismiss for

failure to state a claim upon which relief can be granted, the complaint first must comply with

Rule 8(a) by providing “a short and plain statement of the claim showing that the pleader is entitled

to relief,” Fed. R. Civ. P. 8(a)(2), such that the defendant is given “fair notice of what the * * *

claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555

(2007) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957)) (alteration in original). Second, the

factual allegations in the complaint must be sufficient to raise the possibility of relief above the

“speculative level.” E.E.O.C. v. Concentra Health Servs., Inc., 496 F.3d 773, 776 (7th Cir. 2007)

(quoting Twombly, 550 U.S. at 555). “A pleading that offers ‘labels and conclusions’ or a

‘formulaic recitation of the elements of a cause of action will not do.’” Ashcroft v. Iqbal, 556 U.S.

662, 678 (2009) (quoting Twombly, 550 U.S. at 555). Dismissal for failure to state a claim under

Rule 12(b)(6) is proper “when the allegations in a complaint, however true, could not raise a claim

of entitlement to relief.” Twombly, 550 U.S. at 558. In reviewing a motion to dismiss pursuant to

Rule 12(b)(6), the Court accepts as true all of Counter-Plaintiff’s well-pleaded factual allegations

and draws all reasonable inferences in Counter-Plaintiff’s favor. Killingsworth v. HSBC Bank

Nev., N.A., 507 F.3d 614, 618 (7th Cir. 2007).

III. Analysis

A. Breach of Contract (First Counterclaim)

CDK’s first cause of action alleges that the Counter-Defendants violated the terms of their

respective MSAs by sharing login credentials with Authenticom and other third parties. CDK

further contends that Counter-Defendants have “repeatedly violated the express contractual

prohibitions” in their respective MSAs by “actively facilitating hostile, unauthorized access to

CDK’s DMS.” [522 (Counterclaims), at ¶ 103, 104-32.] The MSAs “expressly prohibit the

Counter-Defendants from allowing third-parties to access CDK’s DMS.” [Id. at ¶ 43.] There is a

limited exception to this prohibition in some MSAs that allows access by “employees and agents

of [the dealer] with a need-to-know.” [Id. at ¶ 49.] Counter-Defendants argue that CDK’s breach

of contract counterclaim fails because Counter-Defendants authorized data extractors to extract

data from the DMS, which—according to Counter-Defendants—is all that is necessary under the

MSAs. Specifically, CDK alleges:

In knowingly providing login credentials to these data extractors and, actively or

passively, “authorizing” them to access CDK’s DMS to extract or insert data—

including data that does not belong to the Dealership Counter-Defendants—the

Dealership Counter-Defendants have breached their contracts with CDK. This

conduct also violates the CFAA, which prohibits unauthorized access to protected

computer systems. In addition, certain Dealership Counter-Defendants—and

numerous members of the putative class—have engaged in further unlawful

conduct that violates the DMCA. CDK requests that the Court enjoin the Dealership

Counter-Defendants’ illegal conduct and award CDK damages.

[Id. at ¶ 3.] According to Counter-Defendants, this allegation establishes that Authenticom and

other third-party integrators were authorized to access CDK’s data and therefore were acting as

the agents of Counter-Defendants. CDK responds that the word “authorizing” is in quotation

marks because CDK is alleging that third-party access to its data was not authorized. Stone v.

Wright, 734 F. App’x 989 (7th Cir. 2018) (using scare quotes around claim brought by plaintiff to

express doubts regarding viability of such a claim under the Constitution). The Court agrees that

the use of the term “authorizing” in scare quotes does not amount to a concession that

Counter-Defendants’ access to CDK’s data was authorized.

That leaves the question of whether Authenticom and other third-party data integrators

were the employees and/or agents of Counter-Defendants such that they were authorized to access

CDK’s DMSs under the terms of the relevant MSAs. Because Counter-Defendants do not contend

that Authenticom and other third-party data integrators were their employees, the Court need only

consider whether the third-party data integrators were the agents of Counter-Defendants. To the

extent that Counter-Defendants contend that all that is needed to circumvent the MSAs’ prohibition

on allowing parties to access CDK’s DMS was Counter-Defendants’ authorization, the prohibition

on third-party access would be pointless, as Counter-Defendants simply could authorize any

third-party to access CDK’s DMS. Thus, something more than authorization by

Counter-Defendants’ must be necessary to establish agency under the MSAs. Cress v. Recreation

Servs., Inc., 795 N.E.2d 817, 852 (Ill. App. Ct. 2003) (“[A] court must give meaning and effect to

every part of the contract.”).

Counter-Defendants argue that—to the extent that the term “agents” is ambiguous—the

term should be construed against CDK, as the drafter of the MSAs. Bourke v. Dun & Bradstreet

Corp., 159 F.3d 1032, 1036 (7th Cir. 1998) (Under Illinois law, “any ambiguity in the terms of a

contract must be resolved against the drafter of the disputed provision.” (quoting Dowd & Dowd,

Ltd. v. Gleason, 693 N.E.2d 358, 368 (Ill. App. Ct. 1998) (internal quotation marks omitted)). But

agency is a concept well-defined and understood under the law and by businesses of even modest

sophistication—a threshold that all of the parties to this motion easily clear. Hernandez ex rel.

Gonzalez v. Tapia, 2010 WL 5232942, at *7 (N.D. Ill. Dec. 15, 2010) (“The phrase ‘agents and

employees’ is not ambiguous and therefore the court will apply the plain meaning of these terms.”).

Moreover, agency is an issue of fact generally not susceptible to resolution at the motion

to dismiss stage. Restoration Specialists, LLC v. Hartford Fire Ins. Co., 2009 WL 3147481, at *3

(N.D. Ill. Sept. 29, 2009) (“[T]he question of agency typically presents an issue of fact that seldom

can be resolved at the summary judgment stage, much less on a motion to dismiss.”); Semitekol v.

Monaco Coach Corp., 582 F. Supp. 2d 1009, 1024 (N.D. Ill. 2008) (“[W]hether an agency

relationship has been established between the parties is [an issue] of fact which is not properly

resolved on a motion to dismiss.” (citation omitted)). Under Illinois law—on which Counter-

Defendants rely in their reply brief—“[t]he analysis turns primarily on the level of control that the

alleged agent retains over the performance of its assigned work”. Jackson v. Bank of New York,

62 F. Supp. 3d 802, 814 (N.D. Ill. 2014) (citing Horwitz v. Holabird & Root, 816 N.E.2d 272, 279

(2004)). “In a principal-agent relationship, the principal retains the right to control the manner and

method in which the work is carried out by the agent.” Id. (citing Uesco Indus., Inc. v. Poolman

of Wis., Inc., 993 N.E.2d 97, 112 (Ill. App. Ct. 2013)). “By contrast, ‘[a]n independent contractor

is one who undertakes to produce a given result but in the actual execution of the work is not under

the orders or control of the person for whom he does the work but may use his own discretion in

things not specified * * * [and] without his being subject to the orders [of the person for whom the

work is done] in respect to the details of the work.” Id. (quoting Horwitz, 816 N.E.2d at 279).

Other factors that bear on the question of whether one is properly considered an agent or an

independent contractor include “(1) the question of hiring; (2) the right to discharge; (3) the manner

of direction of the servant; (4) the right to terminate the relationship; and (5) the character of the

supervision of the work done.” Lawlor v. N. Am. Corp. of Ill., 983 N.E.2d 414, 427 (Ill. 2012).

Counter-Defendants fail to explain how this analysis can be resolved as a matter of law based on

the allegations in the breach of contract counterclaim.

In fact, CDK identifies allegations suggesting that there is no such agency relationship.

CDK alleges that Authenticom’s own contract with dealers makes clear that Authenticom is not

the dealer’s “agent,” and in fact refers to “agents” of the dealer repeatedly as third parties to the

agreement. [522 (Counterclaims), at ¶ 49.] Similarly, SIS’s EULA states that “[t]he parties shall

be independent contractors under this Agreement, and nothing herein will constitute either party

as the employer, employee, agent or representative of the other party, or both parties as joint

ventures or partners for any purpose.” [Id.]

Counter-Defendants counter that the contracts do not undermine their contention that data

integrators are their agents. Specifically, Counter-Defendants note that an agent may be both an

independent contractor in one relationship and an agent in another. Signs & Blanks, Ltd. v. Lanan

Prod., Inc., 2009 WL 10695777, at *5 n.4 (N.D. Ill. Jan. 20, 2009) (“[A] person may be both an

independent contractor and an agent with the authority both to control the details of the work and

also the power to act for and to bind the principal in business negotiations within the scope of [the]

agency.” (internal quotation marks and citation omitted)). Although Counter-Defendants do not

identify what law applies to this analysis in their opening brief, Counter-Defendants assert in their

reply brief that Illinois law applies to the issue of whether data extractors were agents of

Counter-Defendants.3 Illinois courts have indicated that an independent contractor may be

3 The Court questions whether Illinois law applies, as the contract between dealers and Authenticom is

governed by Wisconsin law. [See 506.] Because the parties have not presented any argument to that effect,

the Court proceeds on the assumption that Illinois law applies. In any event, the result likely would be the

same under Wisconsin law. As the Court previously has noted, the distinction under Wisconsin law

considered an agent for certain purposes when they have “the authority both to control the details

of the work and also ‘the power to act for and to bind the principal in business negotiations within

the scope of [the] agency.’” Horwitz, 816 N.E.2d at 279 (citing Hoffman & Morton Co. v.

American Insurance Co., 181 N.E.2d 821 (Ill. App. Ct. 1962)). Counter-Defendants do not

contend that such circumstances are present here.

Lastly, Counter-Defendants argue that the merger clause in the MSAs precludes

interpreting the MSAs in light of Counter-Defendants’ contracts with other entities. [595, at 13.]

Specifically, the MSAs provide:

This Agreement contains the entire agreement of the parties with respect to their

subject matter and supersedes all existing agreements and all other oral, written or

other communications between them concerning their subject matter[.]

[595-1, at ¶ 18.A.] However, the merger clause addresses agreements between the parties to the

contract, not agreements with third parties. Furthermore, it cannot be the case that

Counter-Defendants’ contracts with data integrators are irrelevant to determining whether the data

integrators can be characterized as agents of Counter-Defendants. While Counter-Defendants’

own characterization of their relationships with data integrators is not dispositive of the issue of

agency, it certainly is relevant. K.C. 1986 Ltd. P’ship v. Reade Mfg., 33 F.Supp.2d 820, 828 (W.D.

Mo. 1998) (“While [the parties’] characterization of their relationship as an employer/independent

contractor is not dispositive of the issue before the Court, it is probative of the intended nature of

the relationship.” (citations omitted)); Bartolotta v. Dunkin’ Brands Grp., Inc., 2016 WL 7104290,

between “an employee or agent and an independent contractor is the degree of retention by the employer

or principal of the right to control the manner in which the details of the work are to be performed.” Jahns

v. Milwaukee Mut. Ins. Co., 155 N.W.2d 674, 676 (Wis. 1968) (citations omitted). An independent

contractor may be considered an agent for certain purposes—where the “fiduciary relationship has formed

and the principal has control over certain activities.” Romero v. W. Bend Mut. Ins. Co., 885 N.W.2d 591,

601 (Wis. Ct. App. 2016) (citation omitted). Counter-Defendants have not identified any allegations

indicating that such circumstances are present here.

at *5 (N.D. Ill. Dec. 6, 2016) (“In short, while the nature and extent of control as defined in the

franchise agreement is relevant, so too is the parties’ actual conduct and practice.” (citations

omitted)); Ziehlsdorf v. Am. Family Ins. Grp., 461 N.W.2d 448 (Wis. Ct. App. 1990) (“A written

agreement defining the relationship as an independent contractor is also a significant factor.”).

Indeed, even if the contracts between Counter-Defendants and data integrators did not characterize

their relationship, looking at the terms of the contract likely would be relevant to engaging in the

fact intensive agency analysis discussed above.

Based on the foregoing analysis, the Court denies Counter-Defendants’ motion to dismiss

CDK’s breach of contract counterclaim.

B. Computer Fraud and Abuse Act (Second Counterclaim)

Counter-Defendants move for dismissal of CDK’s counterclaim under the Computer Fraud

and Abuse Act (“CFAA”) because the counterclaim (1) is untimely, (2) fails to allege “accessor”

liability against Counter-Defendants, and (3) CDK has not alleged the requisite loss or damage.

The Court addresses each of these arguments in turn.

i. Time-Barred

Counter-Defendants move for dismissal of CDK’s CFAA counterclaim as time-barred.

Dismissal based on a statute of limitations is an affirmative defense. See Fed. R. Civ. P. 8(c)(1).

Nevertheless, “dismissal is appropriate when the plaintiff pleads [herself] out of court by alleging

facts sufficient to establish the complaint’s tardiness.” Cancer Found., Inc. v. Cerberus Capital

Mgmt., LP, 559 F.3d 671, 674-75 (7th Cir. 2009); see also United States v. Lewis, 411 F.3d 838,

842 (7th Cir. 2005) (explaining that dismissal is appropriate “where, as here, the allegations of the

complaint itself set forth everything necessary to satisfy the affirmative defense, such as when a

complaint plainly reveals that an action is untimely under the governing statute of limitations”).

The CFAA has a two-year statute of limitations. See 18 U.S.C. § 1030(g) (“No action may be

brought under this subsection unless such action is begun within 2 years of the date of the act

complained of or the date of the discovery of the damage.”); Meyer Tech. Solutions, LLC v.

Kaegem Corp., 2017 WL 4512918, at *1 (N.D. Ill. Oct. 10, 2017) (concluding that CFAA claims

were barred when counter-plaintiff “discovered the damage flowing from the unauthorized access”

more than two years before it filed its counterclaims).

CDK filed its counterclaims on February 22, 2019. [See 522.] CDK alleges facts

establishing that it became aware of Counter-Defendants’ alleged unauthorized access of CDK’s

DMS no later than June 2015. [522, at ¶ 92 (alleging that Counter-Defendants “became aware that

CDK objected to unauthorized access to the CDK DMS by third parties like Authenticom no later

than when CDK announced SecurityFirst in June 2015 and in all likelihood, much earlier”).]

Counter-Defendants identify additional allegations indicating that CDK learned of the alleged

misconduct more than two years before it filed its counterclaims. [395, at 14.]

CDK argues that its CFAA counterclaim is not time-barred because it is a compulsory

counterclaim. While the Seventh Circuit has held that “[a] counterclaim for affirmative relief may

not be asserted if barred by the statute of limitations,” Chauffeurs, Teamsters, Warehousemen &

Helpers, Local Union No. 135 v. Jefferson Trucking Co., 628 F.2d 1023, 1027 (7th Cir. 1980), the

Seventh Circuit also has recognized in dicta that “[t]here is authority that the filing of a claim tolls

the statute of limitations on any compulsory counterclaim, by analogy to the ‘relation back’

language of Rule 15.” Asset Allocation & Mgmt. Co. v. W. Employers Ins. Co., 892 F.2d 566, 571

(7th Cir. 1989) (citing Burlington Industries, Inc. v. Milliken & Co., 690 F.2d 380, 389 (4th

Cir.1982); 6 Wright & Miller, FEDERAL PRACTICE AND PROCEDURE § 1419 (1971)). Although the

Seventh Circuit has not conclusively addressed that issue, courts in this District have held that the

filing of a claim tolls the statute of limitations on any compulsory counterclaim. Seitz v. Beeter,

2013 WL 409428, at *2 (N.D. Ill. Jan. 31, 2013) (collecting cases).

“Rule 13(a) defines a compulsory counterclaim as one that ‘arises out of the transaction or

occurrence that is the subject matter of the opposing party’s claim.’” Bd. Of Regents of Univ. Of

Wisconsin Sys. v. Phoenix Int’l Software, Inc., 653 F.3d 448, 470 (7th Cir. 2011) (quoting Fed. R.

Civ. P. 13(a)). The Seventh Circuit uses “a ‘logical relationship’ test to decide whether two matters

are the same for purposes of Rule 13(a).” Id. Under this “flexible” approach, the Court must

“consider the totality of the claims, including the nature of the claims, the legal basis for recovery,

the law involved, and the respective factual backgrounds.” Id. (quoting Burlington Northern R.R.

Co. v. Strong, 907 F.2d 707, 711 (1990)) (internal quotation marks omitted). “Even if two claims

are ‘technically related,’ the relationship between the claims may be insufficient to satisfy

Rule 13(a) if the two claims are based on different theories and would raise different legal and

factual issues.” Simon v. Nw. Univ., 2017 WL 25173, at *3 (N.D. Ill. Jan. 3, 2017) (citing

Burlington N. R. Co. v. Strong, 907 F.2d 707, 711 (7th Cir. 1990)).

CDK argues that its CFAA counterclaim is compulsory because it overlaps with several of

CDK’s affirmative defenses. Specifically, one of CDK’s defenses to the Counter-Defendants’

antitrust claims is that CDK legally is entitled to control access to its DMS. Another of CDK’s

defenses is that precluding hostile access is procompetitive because it furthers legitimate security

concerns. However, neither defense establishes that CDK’s CFAA counterclaim is based on the

same theory and implicates the same legal and factual issues as Counter-Defendants’ antitrust

claims. With respect to the first defense, whether CDK is entitled to control access to its DMS

may relate to CDK’s CFAA counterclaim, but it is not central to Counter-Defendants’ antitrust

claims. As prior decisions in this case have noted, even assuming that CDK was entitled to deny

certain parties’ access to its DMS generally, CDK is “not free to withhold such approval pursuant

to illegal arrangements.” In re Dealer Mgmt. Sys. Antitrust Litig., 313 F. Supp. 3d 931, 948 (N.D.

Ill. 2018). With respect to the second defense, whether precluding hostile access is procompetitive

because it furthers legitimate security concerns certainly relates to Counter-Defendants’ antitrust

claims, but it is not central to CDK’s CFAA counterclaim. The Court recognizes that CDK’s

CFAA counterclaim and Counter-Defendants’ antitrust claims have a common-origin—disputes

relating to CDK’s DMS. However, the CFAA counterclaim and the antitrust claims are based on

different legal theories and will present different legal and factual issues.

In support of its argument that its CFAA counterclaim is compulsory, CDK cites Moore v.

New York Cotton Exchange, 270 U.S. 593, 602 (1926). In that case, the plaintiff sued the New

York Cotton Exchange under the antitrust laws, alleging that the Exchange had a monopoly on

price quotations for cotton futures and was illegally precluding the plaintiff from accessing the

quotations via telegraphic ticker service. The Exchange counterclaimed, asserting that the

plaintiff, “though it had been refused permission to use the quotations of the New York exchange,

was purloining them, or receiving them from some person who was purloining them, and giving

them out to its members.” Id. at 603. After the antirust claim was dismissed, the Supreme Court

concluded that it had jurisdiction over the counterclaim because it arose out of the same transaction

as the plaintiff’s antitrust claim. Id. at 610. The Supreme Court stated:

The refusal to furnish the quotations is one of the links in the chain which

constitutes the transaction upon which appellant here bases its cause of action. It

is an important part of the transaction constituting the subject-matter of the

counterclaim. It is the one circumstance without which neither party would have

found it necessary to seek relief. Essential facts alleged by appellant enter into and

constitute in part the cause of action set forth in the counterclaim.

Id.

CDK argues that this case is on all fours with Moore. Specifically, CDK contends that—

like the plaintiff in Moore—it refused to give third-party integrators like Authenticom access to

its DMS and that Counter-Defendants—like the defendant in Moore—“purloined data” from

CDK’s DMS. The Court recognizes that there are similarities between this case and Moore.

However, in Moore, the Supreme Court noted that “so close is the connection between the case

sought to be stated in the bill and that set up in the counterclaim, that it only needs the failure of

the former to establish a foundation for the latter.” Id. As discussed above, the same cannot be

said here. The Court therefore finds Moore to be distinguishable and concludes that CDK’s CFAA

counterclaim is not a compulsory counterclaim.

CDK further argues that even if its CFAA counterclaim is not compulsory, it nonetheless

is timely to the extent that it is based on recent instances of unauthorized access. Counter-

Defendants respond that the continuing violation exception does not apply to the CFAA. “The

continuing violation doctrine allows a plaintiff to get relief for a time-barred act by linking it with

an act that is within the limitations period.” Selan v. Kiley, 969 F.2d 560, 564 (7th Cir. 1992). The

purpose of the continuing violation doctrine “is to allow suit to be delayed until a series of wrongful

acts blossoms into an injury on which suit can be brought.” Limestone Dev. Corp. v. Vill. of

Lemont, Ill., 520 F.3d 797, 801 (7th Cir. 2008) (citations omitted). The doctrine applies when

individual instances of alleged misconduct alone are not actionable, but the cumulative effect of a

series of actions is enough to establish an actionable claim. Id.

“The ‘continuing violation’ exception to federal statutes of limitations only allows suit to

be delayed in cases where the first instance of misconduct may be insufficient—and indeed the

‘cumulative effect’ of a series of acts is necessary—to make out an actionable claim.” Meyer Tech.

Sols., LLC v. Kaegem Corp., 2017 WL 4512918, at *1 (N.D. Ill. Oct. 10, 2017) (citing Limestone

Dev. Corp. v. Village of Lemont, Ill., 520 F.3d 797, 801 (7th Cir. 2008)).4 Here, CDK does not

identify any facts indicating that its CFAA counterclaim is based on the cumulative effect of a

series of acts. Plaintiff therefore has not alleged facts sufficient to invoke the continuing violation

exception. Id. Still, to the extent that CDK seeks to bring a CFAA counterclaim based on recent

instances of unauthorized access, the continuing violation doctrine is not necessary to save CDK’s

CFAA counterclaim.

In sum, to the extent that CDK’s CFAA counterclaim is based on misconduct occurring

more than two years before CDK filed its counterclaims, the counterclaim is time-barred and is

dismissed. However, to the extent that CDK’s CFAA counterclaim is based on more recent

conduct (since February 22, 2017), the claim is timely.

ii. Accessor Liability

Counter-Defendants also move for dismissal of CDK’s CFAA counterclaim on the ground

that CDK fails sufficiently to allege “accessor” liability on the part of Counter-Defendants. The

CFAA provides criminal and civil penalties for anyone who “intentionally accesses a computer

without authorization or exceeds authorized access, and thereby obtains * * * information from

any protected computer.” 18 U.S.C. § 1030(a)(2)(C). Counter-Defendants seek dismissal of the

CFAA counterclaim because “the complained-of computer access was conducted by persons other

4 In Meyer, the court correctly noted that “[t]he ‘continuing violation’ exception to federal statutes of

limitations only allows suit to be delayed in cases where the first instance of misconduct may be

insufficient—and indeed the ‘cumulative effect’ of a series of acts is necessary—to make out an actionable

claim.” 2017 WL 4512918, at *1 (N.D. Ill. Oct. 10, 2017) (citing Limestone Dev. Corp. v. Village of

Lemont, Ill., 520 F.3d 797, 801 (7th Cir. 2008)). CDK indicates that Meyer stands for the proposition that

the continuing violation doctrine does not apply to claims brought under the CFAA. However, the court

did not go so far. Rather, it concluded that the continuing violation doctrine did not apply in that case. Id.

Still, to the extent that the court in Meyer dismissed CFAA claims that were based on conduct occurring

within the statute of limitations period, this Court respectfully disagrees that such claims should be

dismissed as time-barred because misconduct also occurred outside of the limitations period. See Gajewski

v. Ocwen Loan Servicing, 650 F. App’x 283, 287 (7th Cir. 2016) (considering whether the plaintiff

sufficiently stated a claim with respect to alleged misconduct occurring within the statute of limitations

period after rejecting invocation of the continuing violation doctrine).

than the dealerships—namely, ‘Authenticom and other third parties.’” [595, at 15.] In other

words, Counter-Defendants contend that CDK’s CFAA counterclaim fails because CDK does not

allege that Counter-Defendants personally accessed CDK’s DMS.

Counter-Defendants begin by arguing that Court should not impose liability for inducing

misconduct unless the statute expressly establishes inducer liability, which the CFAA does not.

As noted by Counter-Defendants, Congress has imposed inducer liability in other statutes. See,

e.g., 35 U.S.C. § 271(b) (“Whoever actively induces infringement of a patent shall be liable as an

infringer.”). Still, the Court must examine the text of the statute. United States v. Miscellaneous

Firearms, Explosives, Destructive Devices and Ammunitions, 376 F.3d 709, 712 (7th Cir. 2004)

(“The cardinal rule of statutory interpretation is that courts ‘must first look to the language of the

statute and assume that its plain meaning accurately expresses the legislative purpose.’” (quoting

Grzan v. Charter Hosp. of Northwest Ind., 104 F.3d 116, 122 (7th Cir. 1997)). The statute at issue

here—the CFAA—prohibits intentionally accessing a computer without authorization or in excess

of authorized access. The question before the Court therefore is what it means to intentionally

access a computer.

In Synthes, Inc. v. Emerge Med., Inc., the court noted that the “the plain language of the

statute requires only ‘access’—no modifying term suggesting the need for ‘personal access’ is

included.” 2012 WL 4205476, at *17 (E.D. Pa. Sept. 19, 2012). Because the term “access”

generally means “gaining admission to,” id. (collecting authorities on the common meaning of the

term “access”), many courts addressing the issue have concluded that direct personal access is not

required. Id. (collecting cases). Still, courts are divided on the issue. For example, in Power

Equipment Maintenance, Inc. v. AIRCO Power Services, Inc., the court dismissed a CFAA claim

against a defendant who allegedly “accessed files by having an administrative assistant print a

confidential contract for him” after his access had been revoked because he did not personally

access the computer. 953 F. Supp. 2d 1290, 1297 (S.D. Ga. 2013). The defendant just “managed

to convince another with access to provide him with the information.” Id. The Court questions

whether the CFAA should be read so narrowly, as such a reading would allow parties easily to

circumvent the CFAA by enlisting unknowing persons to access computers personally. However,

the Court need not resolve that issue now, as conspiracy is an express basis for liability under the

CFAA. 18 U.S.C. § 1030(b) (“Whoever conspires to commit or attempts to commit an offense

under subsection (a) of this section shall be punished as provided in subsection (c) of this

section.”). Counter-Plaintiff recognizes that it “did not plead a conspiracy claim in its

Counterclaims.” [639, at 15 n.4.] Still, CDK asserts that it has alleged sufficient facts to state a

conspiracy claim under the CFAA. [Id.] Counter-Defendants do not explain why the facts alleged

are insufficient to state a claim under the CFAA. Instead, Counter-Defendants assert that a brief

cannot amend a pleading. Although that is true, the parties are required to plead facts, not causes

of action. Alioto v. Town of Lisbon, 651 F.3d 715, 721 (7th Cir. 2011) (“[W]e have stated

repeatedly (and frequently) that a complaint need not plead legal theories[.]”). Thus, as long as

CDK alleged sufficient facts to bring a conspiracy counterclaim under the CFAA, it may proceed

under that theory. Because Counter-Defendants do not address whether CDK alleged sufficient

facts to bring a conspiracy claim under the CFAA, the Court denies their motion to dismiss the

CFAA counterclaim for failure to allege wrongful conduct by Counter-Defendants.5

5 Counter-Defendants do argue that it would be futile to allow CDK to amend its Counterclaims, citing one

decision questioning whether the CFAA permits a conspiracy claim. [674, at 19.] However, that case cited

did not rule on that issue. Because Counter-Defendants do not otherwise develop the argument, the Court

will not consider it at this time. See Crespo v. Colvin, 824 F.3d 667, 674 (7th Cir. 2016) (“‘[P]erfunctory

and undeveloped arguments, and arguments that are unsupported by pertinent authority, are waived (even

where those arguments raise constitutional issues).”’ (quoting United States v. Berkowitz, 927 F.2d 1376,

1384 (7th Cir. 1991))).

Counter-Defendants further argue that—even if allegations of personal access are not

necessary to state a claim under the CFAA— CDK’s CFAA counterclaim still should be dismissed

because CDK alleges that Counter-Defendants authorized Authenticom and other data integrators

to access the DMS. Specifically, Counter-Defendants argue that the “authorization” required

under the CFAA is that of the computer system’s user, not the owner. [595, at 17.] However,

Counter-Defendants do not cite any authority in support of that interpretation.

In any event, the Court rejects Counter-Defendants’ interpretation of the CFAA. Although

the statute does not specify whose authorization is necessary, it cannot be the case that only the

user’s authorization is necessary. As noted above, anyone who “intentionally accesses a computer

without authorization or exceeds authorized access, and thereby obtains * * * information from

any protected computer” violates the CFAA. 18 U.S.C. § 1030(a)(2)(C). “Under the CFAA, the

phrase ‘“exceeds authorized access” means to access a computer with authorization and to use

such access to obtain or alter information in the computer that the accessor is not entitled to obtain

or alter.’” Motorola, Inc. v. Lemko Corp., 609 F. Supp. 2d 760, 767 (N.D. Ill. 2009) (quoting 18

U.S.C. § 1030(e)(6)). Thus, “[a]llegations that an employee e-mailed and downloaded confidential

information for an improper purpose are sufficient to state a claim that the employee exceeded her

authorization.” Id. (citing Mintel Int’l Group, Ltd. v. Neergheen, 2008 WL 2782818, at *3 (N.D.

Ill. July 16, 2008)). In such cases, the employee would be the user. It would be illogical to say

that the employee needed authorization from herself. Because the CFAA contemplates that users

may exceed authorized access, it cannot be the case that the authorization required by the CFAA

is that of the user. This Court previously concluded the authorization required by the CFAA is

that of the owner of the computer system, not from anyone who happens to use the system. [506,

at 15.] And Counter-Defendant’s have not presented persuasive grounds for reconsidering that

conclusion.6

Finally, Counter-Defendants argue that the CFAA counterclaim fails because CDK alleges

that it actually did authorize Authenticom and other third-party data integrators to access its DMS

by contractually permitting dealerships to provide DMS access to their “agents.” [595, at 17.]

However, as discussed above, whether Authenticom and other third-party data integrators are

agents of Counter-Defendants is an issue of fact not properly resolved on Counter-Defendant’s

motion to dismiss. Furthermore, CDK alleges that Counter-Defendants exceeded any

authorization by—among other conduct—“having new credentials created and/or by restoring

disabled credentials—including on information and belief by automated means.” [Id. at ¶ 152.]

These allegations are sufficient to state a claim under the CFAA. See Tracfone Wireless, Inc. v.

Simply Wireless, Inc., 229 F. Supp. 3d 1284, 1297 (S.D. Fla. 2017) (concluding that “the

unauthorized or in excess of authorization elements” of the CFAA were sufficiently plead where

plaintiff alleged “the sale of the unbundled PINs was not authorized by the agreement between the

parties”). Accordingly, the Court denies Counter-Defendants’ motion to dismiss for failure to

allege accessor liability.

6 Counter-Defendants do note that the CFAA is a penal statute that imposes criminal liability and that any

ambiguities in the language should be resolved in the dealership’s favor under the rule of lenity. However,

“[t]he rule does not apply when a statute is unambiguous or when invoked to engraft an illogical

requirement to its text.” Salinas v. United States, 522 U.S. 52, 66 (1997) (citing United States v. Shabani,

513 U.S. 10, 17 (1994)).

iii. Requisite Losses

Counter-Defendants also argue that CDK fails to allege “loss to 1 or more persons during

any 1-year period * * * aggregating at least $5,000 in value,” as required by 18 U.S.C.

§ 1030(c)(4)(A)(i)(I).7 CDK alleges that:

The Dealership Counter-Defendants’ violations of the CFAA have caused CDK to

suffer damages and losses. These damages and losses include the costs of

investigating and responding to the Dealership Counter-Defendants’ unlawful

actions; the costs of restoring the DMS and the data it contains to their condition

prior to the Dealership Counter-Defendants’ unlawful actions; and all revenue lost,

costs incurred, and other consequential damages incurred because of disruption of

service caused by the unlawful actions of the Dealership Counter-Defendants and

the third parties acting in concert with the Dealership Counter-Defendants. On

information and belief, these losses have exceeded $5,000 within a twelve-month

period.

[522 (Counterclaims), at ¶ 144.] Counter-Defendants argue that this allegation is insufficient to

establish the requisite amount of losses because CDK cannot aggregate the losses allegedly caused

by all Counter-Defendants. Counter-Defendants further note that—based on this allegation—

“each of the dealerships could have caused as little as $294.12 in alleged losses.” [595, at 18 n.7.]

CDK argues that, “even assuming that a plaintiff must identify $5,000 in loss or damage

attributable to each defendant, the defendants’ contention that this standard has not been met was

“simply one inference of many that [may] be drawn from Plaintiff’s complaint.” [638, at 18

(quoting Wolf v. Schadegg, 2016 WL 1117364 (D. Colo. Mar. 21, 2016)).] In other words, CDK

believes that the Court should not infer that each Defendant caused as little as $294.12 in losses

because that is just one possible inference and the Court must draw all reasonable inferences in

Counter-Plaintiff’s favor at the motion to dismiss stage. That argument misses the mark. Although

the Court must draw all reasonable inferences in CDK’s favor, that does not relieve CDK of its

7 Counter Defendants also argue that CDK fails sufficiently to allege damage. However,

Section 1030(c)(4)(A)(i)(I) does not address damage.

obligation to allege sufficient facts to establish the elements of its counterclaims, including that it

satisfied the CFAA losses threshold.

In Wolf, the court concluded that the plaintiff alleged losses sufficient to satisfy the CFAA

losses threshold even though it did not identify what specific loss was caused by each defendant.

2016 WL 1117364, at *4. In reaching that conclusion, however, the court noted that plaintiff’s

allegations permitted “an inference that both [d]efendants were working together to access

[p]laintiffs’ data, particularly given that [d]efendants were working for the same rival company

and undoubtedly were familiar with each other by virtue of their past employment with [p]laintiff.”

Id. Here, on the other hand, CDK does not identify any facts indicating that Counter-Defendants

were acting together.

CDK further argues that “allocation questions are at best fact issues that cannot be resolved

on a motion to dismiss.” [639, at 19 (citations omitted).] Even if that is the case, however, CDK

fails directly to address the threshold issue of whether losses caused by each Defendant can be

aggregated under the CFAA in the first place.8 The Seventh Circuit has not yet addressed whether

losses allegedly caused by multiple defendants can be aggregated for the purposes of satisfying

the CFAA’s loss threshold, and there is little case law on the issue.

In the context of determining whether losses incurred by multiple victims can be

aggregated, however, courts have reached different conclusions. In In re DoubleClick Inc. Privacy

Litigation, the court held “that damages and losses under § 1030(e)(8)(A) may only be aggregated

across victims and over time for a single act.” 154 F. Supp. 2d 497, 523 (S.D.N.Y. 2001). In

reaching that conclusion, the court noted that the CFAA provides that “the term ‘damage’ means

any impairment to the integrity or availability of data, a program, a system, or information that—

8 The issue of how claimed losses should be allocated is different from the issue of whether claimed losses

caused by numerous defendants can be aggregated.

(A) causes loss aggregating at least $5,000 in value during any 1–year period to one or more

individuals.” Because Section 1030(e)(8)(A) “is phrased in the singular (‘any impairment to the

integrity or availability of data, a program, a system, or information that—(a) causes loss’), rather

than the plural (e.g., any impairments to the integrity or availability of data, programs, systems, or

information that—(a) cause loss * * * ),” the court concluded that Section 1030(e)(8)(A) “should

only apply to single acts.” Id. at 523. The court found support for this conclusion in the Senate

Judiciary Committee’s report that accompanied the CFAA, id., which states:

The Committee does not intend that every victim of acts proscribed under

[1030(e)(8)(A)] must individually suffer a loss of [then] $1,000. Certain types of

malicious mischief may cause smaller amounts of damage to numerous individuals,

and thereby collectively create a loss of more than $1,000. By using ‘one of more

others’, the Committee intends to make clear that losses caused by the same act

may be aggregated for the purposes of meeting the [then] $1,000 threshold.

[Sen. R. No. 99-432.] The court in DoubleClick therefore concluded that Section “1030(e)(8)(A)

only allows aggregation of damage over victims and time for a single act.” In re DoubleClick Inc.

Privacy Litig., 154 F. Supp. 2d at 524. The Court noted that “[t]his interpretation is consistent

with Congress’ overall intent to limit the CFAA to major crimes.” Id. at 523-24.

The Ninth Circuit reached the opposite conclusion in Creative Computing v.

Getloaded.com LLC, 386 F.3d 930, 934 (9th Cir. 2004). Specifically, the court held that “[t]he

damage floor in the [CFAA] contains no ‘single act’ requirement.” 386 F.3d 930, 935 (9th Cir.

2004). In reaching that conclusion, the court asserted that “[t]he syntax makes it clear that * * *

the $5,000 floor applies to how much damage or loss there is to the victim over a one-year period,

not from a particular intrusion.” Id. at 934. The court further asserted that even though the term

“impairment” is singular, “impairment” can refer to multiple intrusions. Id. at 934-35 (“Multiple

intrusions can cause a single impairment, and multiple corruptions of data can be described as a

single ‘impairment’ to the data.”).

Here, the Court need not resolve whether aggregation only is appropriate when losses stem

from a single act (i.e., the DoubleClick approach), or, alternatively, from multiple acts that

accurately can be characterized as an impairment (i.e., the Creative Computing approach), as CDK

fails to allege facts indicating that Counter-Defendants were acting together and that their alleged

wrongs can therefore be treated as an impairment. Nothing in either DoubleClick or Creative

Computing indicates that losses caused independent actions of unrelated parties can be aggregated

for the purposes of satisfying the CFAA’s loss threshold. Such an interpretation of the CFAA

would be inconsistent with the text of the statute.

The Court sees no reason to interpret the singular term “impairment” to encompass multiple

unrelated wrongs. And nothing in the language indicates that a single victim can aggregate losses

caused by multiple acts of multiple defendants.9 CDK fails sufficiently to explain why the losses

resulting from the alleged misconduct of separate defendants should be considered an

“impairment” under the CFAA. Accordingly, the Court grants Counter-Defendants’ motion to

dismiss CDK’s CFAA counterclaim for failure to allege sufficient losses. This dismissal is without

prejudice to the filing of amended counterclaims by the date set forth above.

9 As noted by CDK, the court in Wolf stated that “there appear to be no cases determining whether a plaintiff

is required to meet the $5,000 floor with respect to each defendant individually or all defendants

collectively.” 2016 WL 1117364, at *4. The court went on to conclude that “who caused the alleged loss

sustained by [p]laintiffs and to what degree each individual caused this loss” are “questions of fact whose

answers are not necessarily available to [p]laintiffs prior to discovery.” Id. This Court respectfully

disagrees with that position. Even if an issue presents a factual issue, that does not relieve plaintiffs of their

obligation to allege sufficient facts to state a claim. Although CDK asserts that the holding of Wolf is

consistent with Motorola, Inc. v. Lemko Corp., 609 F. Supp. 2d 760 (N.D. Ill. 2009), the Court again

disagrees. In Motorola, the court concluded that the allegation that all defendants “caused [plaintiff] to

incur losses of over $5,000 during a one-year period related to damage and security assessments” was

“sufficient to allege loss for purposes of the CFAA.” Id. at 768. However, in Motorola, the Court did not

specifically address whether plaintiff could aggregate losses allegedly caused by multiple defendants, and

the issue was not raised in the motion to dismiss. [Case No. 08-cv-5427, Dkt. 21.]

C. Digital Millennium Copyright Act (Third Counterclaim)

CDK brings a counterclaim against Counter-Defendants Continental and Warrensburg,

alleging that they violated Section 1201(a)(1)(A) of the Digital Millennium Copyright Act

(“DMCA”). The DMCA provides, in relevant part, that “[n]o person shall circumvent a

technological measure that effectively controls access to a work protected under this title.” 17

U.S.C. § 1201(a)(1)(A). The DMCA defines “circumvent a technological measure” to mean

“descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass,

remove, deactivate, or impair a technological measure, without the authority of the copyright

owner.” Id. at § 1201(a)(3)(A). The DMCA further defines the term to “circumvent protection

afforded by a technological measure” to mean “avoiding, bypassing, removing, deactivating, or

otherwise impairing a technological measure.” Id. at § 1201(b)(2)(A).

CDK alleges that Counter-Defendants Continental and Warrensburg “circumvent[ed] a

technological measure” that controls access to CDK’s DMS by “provid[ing] dealer login

credentials to Authenticom and other third parties in violation of contractual requirements that

such credentials be given to and used only by authorized dealer employees.” [522

(Counterclaims), at ¶ 151.] CDK further alleges that these Counter-Defendants and Authenticom

worked to evade CDK’s efforts to disable the login credentials “by having new credentials created

and/or by restoring disabled credentials—including on information and belief by automated

means.” [Id. at ¶ 152.] Finally, CDK alleges that Counter-Defendants Continental and

Warrensburg “installed Authenticom’s Profile Manager tool in an attempt to re-enable” passwords

that CDK had disabled. [Id. at ¶ 113.]

Counter-Defendants Continental and Warrensburg argue that they cannot be held

secondarily liable under Section 1201(a)(1)(A) of the DMCA. In support of that argument,

Counter-Defendants cite cases holding that there is no secondary liability under various other

statutes in “the absence of the words ‘aid’ or ‘abet’ in the statute indicates a congressional intent

to not provide for aiding and abetting liability.” Wooley v. Jackson Hewitt, Inc., 540 F. Supp. 2d

964, 976 (N.D. Ill. 2008). However, the absence of such language does not establish that imposing

any kind of secondary liability under the DMCA is improper, especially in light of the relationship

between the DMCA and the Copyright Act, which does impose such liability.10 “Congress enacted

the DMCA in 1998 to comply with international copyright treaties and to update domestic

copyright law for the online world.” Ellison v. Robertson, 357 F.3d 1072, 1076 (9th Cir. 2004)

(citations omitted); see also Navistar, Inc. v. New Baltimore Garage, Inc., 2012 WL 4338816, at

*3 (N.D. Ill. Sept. 20, 2012) (“Congress enacted the DMCA * * * to strengthen copyright

protection in the digital age.” (citation and internal quotation marks omitted)). Secondary liability

is “well established” in the copyright context. Metro-Goldwyn-Mayer Studios Inc. v. Grokster,

Ltd., 545 U.S. 913, 930 (2005). Despite the fact that the copyright statute does not include

language expressly addressing secondary liability, “vicarious liability is imposed in virtually all

areas of the law, and the concept of contributory infringement is merely a species of the broader

problem of identifying the circumstances in which it is just to hold one individual accountable for

10 In discussing secondary liability, Counter-Defendants address numerous types of secondary liability (e.g.,

aiding and abetting liability). CDK’s opposition brief makes clear that they are proceeding on vicarious

and contributory liability theories. Specifically, CDK draws comparisons between the DMCA and the

Copyright Act, noting that the latter allows for claims based on vicarious and contributory infringement.

[See 639, at 26.] Counter-Defendants fail to explain why contributory liability would not apply. Although

Counter-Defendants assert that vicarious liability does not apply in a footnote [674, at 19 n.9], they fail

fully to develop the argument. Because Counter-Defendants fail fully to explain why Counter-Plaintiff

may not proceed under vicarious and/or contributory liability theories, the Court addresses Counter-

Defendants’ central argument that there is no secondary liability under the relevant provision of the DMCA.

Counter-Defendants are free to fully develop any arguments with respect to vicarious and/or contributory

liability under the DMCA in any future motion before the Court. Because CDK sufficiently alleges primary

liability under the DMCA, as discussed below, CDK’s DMCA counterclaim would survive regardless of

whether CDK sufficiently alleged vicarious and/or contributory liability.

the actions of another.” Sony Corp. of Am. v. Universal City Studios, Inc., 464 U.S. 417, 435

(1984).11

Courts therefore have applied secondary liability principles drawn from copyright law to

claims brought under the DMCA. See, e.g., Gordon v. Nextel Commc’ns, 345 F.3d 922, 925 &

n.1 (6th Cir. 2003); Microsoft Corp. v. Silver Star Micro, Inc., 2008 WL 115006, at *8 n.8 (N.D.

Ga. Jan. 9, 2008) (citing Ellison); Rosenthal v. MPC Computers, LLC, 493 F. Supp. 2d 182, 190

(D. Mass. 2007) (citing Gordon). Counter-Defendants do not argue that these cases incorrectly

were decided. Rather, Counter-Defendants argue that these cases are distinguishable because they

relate to different provisions of the DMCA.

Although these cases do relate to different provisions of the DMCA, the Court sees no

reason that common law vicarious liability principles would apply to these provisions but not

Section 1205(a)(1). Counter-Defendants argue that the Court should not extend secondary liability

principals to Section 1201(a) because that provision created a distinct anti-circumvention right

under Section 1210(a) without any infringement nexus requirement. Thus, according to

Counter-Defendants, attaching a copyright context to this provision of the statute would be

improper. The Court disagrees. As noted by the Supreme Court in Sony, the secondary liability

principles applied in copyright law stemmed from more generally applicable common law

principles. Counter-Defendants have not identified any basis for concluding that such principles

do not also apply to Section 1201(a).12

11 Although CDK cites Sony and Goldwyn-Mayer, the Supreme Court cases setting forth these principles,

Counter-Defendants fail entirely to address these cases in their reply.

12 Although CDK has not cited any case finding a defendant liable under Section 1201(a)(1)(A) without

personally engaging in such misconduct, Counter-Defendants do not cite any case rejecting such a theory.

Counter-Defendants do cite GC2 Inc. v. Int’l Game Tech., which concluded that the DMCA “imposes

liability for violations by a defendant, not a third party.” 2018 WL 5921315, at *8 (N.D. Ill. Nov. 12, 2018).

However, that decision did not address secondary liability. Furthermore, the cited portion of that decision

In any event, CDK alleges facts sufficient to establish that Counter-Defendants themselves

circumvented a technological measure that effectively controls access to a work protected under

this title. Although it is true—as Counter-Defendants contend—that the use of valid

username/password combinations alone is insufficient to establish liability under

Section 1201(a)(1)(A) of the DMCA, Navistar, Inc, 2012 WL 4338816, at *5 (quoting Egilman v.

Keller & Heckman, LLP, 401 F. Supp. 2d 105, 112 (D.D.C. 2005)); see also Ground Zero Museum

Workshop v. Wilson, 813 F. Supp. 2d 678, 692 (D. Md. 2011) (recognizing same), CDK alleges

that Counter-Defendants Continental and Warrensburg did more than simply provide Authenticom

with valid passwords. Specifically, CDK claims that these Counter-Defendants took affirmative

steps—including the installation of computer programs and/or the use of other automated

programs—to circumvent CDK’s efforts to prevent Authenticom’s alleged unauthorized access of

its DMS. For example, CDK alleges that these Counter-Defendants worked to evade “blocking

by having new credentials created and/or by restoring disabled credentials—including on

information and belief by automated means.” [522 (Counterclaims), at ¶ 152.] These allegations

are sufficient to establish primary liability at the motion to dismiss stage. In re Dealer Mgmt. Sys.

Antitrust Litig., 362 F. Supp. 3d 558, 571 (N.D. Ill. 2019).

Counter-Defendants also argue that CDK conflates Section 1201(a)(1)(A) and

Section 1201(a)(2). As noted above, Section 1201(a)(1)(A) provides, in relevant part, that “[n]o

person shall circumvent a technological measure that effectively controls access to a work

protected under this title.” 17 U.S.C. § 1201(a)(1)(A). Section 1201(a)(2) states, in relevant part,

that “[n]o person shall manufacture, import, offer to the public, provide, or otherwise traffic in any

technology, product, service, device, component, or part thereof, that (A) is primarily designed or

addressed an issue that the court declined to address because the arguments were not sufficiently developed.

Id.

produced for the purpose of circumventing a technological measure that effectively controls access

to a work protected under this title.” Id. at § 1201(a)(2). According to Counter-Defendants,

Section 1201(a)(1)(A) “addresses the ‘conduct’ of actually circumventing a technological

measure, whereas [Section] 1201(a)(2) addresses the underlying process of how the circumvention

occurred.” [674, at 23.] Counter-Defendants therefore contend that Section 1201(a)(1)(A) does

not apply to them “as they did not engage in the actual act of the alleged circumvention.” [Id.]

However, Counter-Defendants misread the statute. Section 1201(a)(2) “prohibits devices

primarily designed to circumvent effective technological measures that limit access to a work.” S.

REP. 105-190, at 12 (emphasis added). Even if CDK cited the incorrect provision of the statute,

that would not mandate dismissal. Suarez v. W.M. Barr & Co., Inc., 842 F.3d 513, 518 (7th Cir.

2016). Regardless, as discussed above, CDK does allege that Continental and Warrensburg

engaged in conduct amounting to a circumvention of a technological measure.13

Finally, Counter-Defendants raise a number of additional arguments in support of the

dismissal of CDK’s DMCA counterclaim that were not raised in their initial motion to dismiss.

Specifically, Counter-Defendants argue that CDK has not sufficiently alleged “access to a work

protected” under 17 U.S.C. § 1201(a)(1)(A). Counter-Defendants also argue that their conduct is

exempted under 17 U.S.C. § 1201(f)(2). Because Counter-Defendants first raised these arguments

in their reply brief, the arguments are waived.14 West, 81 F. App’x 74, 75. Accordingly, the Court

13 Continental and Warrensburg focus on allegations that they improperly provided and/or used valid

username and password combinations. Again, while those allegations do not amount to DMCA violations,

they do not make otherwise prohibited conduct permissible. Furthermore, the fact that Authenticom used

automated programs to re-enable login credentials does not foreclose the possibility that Continental and

Warrensburg also engaged in the misconduct.

14 The Court notes that CDK filed a sur-reply touching on these issues. [691.] In the sur-reply, CDK

identifies reasons why these arguments fail. Although these arguments appear to be meritorious at first

glance, Counter-Defendants have not had the opportunity to respond to the arguments. The Court therefore

denies Counter-Defendants Continental and Warrensburg motion to dismiss CDK’s DMCA

claims.

IV. Conclusion

For the reasons set forth above, the motion to dismiss the counterclaims of

Defendant/Counter-Plaintiff CDK Global, LLC [593] is granted in part and denied in part.

Counter-Plaintiff is given until September 30, 2019 to file amended counterclaims consistent with

this opinion.

Date: September 3, 2019

Robert M. Dow, Jr.

United States District Judge

defers issuing a definitive ruling on these issues until they properly are presented to the Court at a future

stage of the case.

30