# In Re: Dealer Management Systems Antitrust Litigation

> District Court, N.D. Illinois · September 3, 2019

URL: https://www.frixlaw.com/law-library/cases/10141309

## Case

- **Court:** District Court, N.D. Illinois
- **Decided:** September 3, 2019
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/10141309

## How later opinions describe it (automated extraction)

- explaining that dismissal is appropriate “where, as here, the allegations of the complaint itself set forth everything necessary to satisfy the affirmative defense, such as when a complaint plainly reveals that an action is untimely under the governing statute of limitations”

## Opinion text

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ILLINOIS
EASTERN DIVISION

IN RE DEALER MANAGEMENT SYSTEMS )
ANTITRUST LITIGATION, MDL 2817 ) Case No. 18-cv-864
)
__________________________________________) Judge Robert M. Dow, Jr.
)
This document relates to: )
)
THE DEALERSHIP CLASS ACTION )
)

MEMORANDUM OPINION AND ORDER
Before the Court is the motion to dismiss the counterclaims of Defendant/Counter-Plaintiff
CDK Global, LLC (“Counter-Plaintiff” or “CDK”) [593] filed by Plaintiffs/Counter-Defendants
ACA Motors, Inc.; Continental Classic Motors, Inc.; 5800 Countryside, LLC; HDA Motors, Inc.;
H & H Continental Motors, Inc.; Continental Autos, Inc.; Naperville Zoom Cars, Inc.; NV Autos,
Inc.; Baystate Ford Inc.; Cliff Harris Ford, LLC; Marshall Chrysler Jeep Dodge, L.L.C.;
Warrensburg Chrysler Dodge Jeep, L.L.C.; Cherry Hill Jaguar; JCF Autos LLC; Jericho Turnpike
Sales LLC; Patchogue 112 Motors LLC; and Waconia Dodge, Inc. (collectively, “Counter-
Defendants”). For the reasons set forth below, the motion to dismiss [593] CDK’s counterclaims
is granted in part and denied in part. CDK is given until September 30, 2019 to file amended
counterclaims consistent with this opinion.
I. Background1
Given that this case already has been extensively litigated before multiple courts, the Court
assumes some familiarity with the background of this case and thus will limit its recitation of the

1 For purposes of the motions to dismiss, the Court accepts as true all of Counter-Plaintiff’s well-pleaded
factual allegations and draws all reasonable inferences in Counter-Plaintiff’s favor. Killingsworth v. HSBC
Bank Nev., N.A., 507 F.3d 614, 618 (7th Cir. 2007).
facts essential to the motion now before it. CDK brings counterclaims against the Counter-
Defendants under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, and
for breach of contract. The counterclaims focus on Counter-Defendants’ purported unauthorized
access—along with data integrator Authenticom, Inc.—of CDK’s enterprise software and
computing platform for automotive dealerships and dealership groups known as its Dealer

Management System or, more commonly, its DMS.
The automotive data system that CDK supports is massive—with tens of thousands of
installations of approved vendor applications and millions of transactions every day—supporting
hundreds of billions of dollars in commerce each year. [522 (Counterclaims), at ¶ 5.] CDK has
made tremendous investments to build out and support its network of product and service
offerings. [Id.] Over the last four years alone, CDK has spent more than $480 million researching,
developing, and deploying new and enhanced product solutions for its customers. [Id.] CDK’s
DMS includes (and is largely comprised of) valuable pieces of intellectual property, including
patented technologies, proprietary software elements and programs that it has created (including

software programs protected by the copyright laws), and proprietary data collections, which are
accessible through the DMS. [Id. at ¶ 32.] Dealers that purchase DMS services from CDK are
granted a personal, non-transferable license to use CDK’s DMS in accordance with the terms and
conditions of their agreements. [Id.]
CDK’s DMS offering consists of software and hardware components residing at both the
dealership and at CDK’s data centers (“CDK’s network”). [Id. at ¶ 33.] CDK uses state-of-the-
art technology to secure the connections between the dealerships and CDK’s network, including
through specialized hardware at each dealership site. [Id.] That hardware creates a “virtual private
network” or “Leased-Line Multiprotocol Label Switching network” between the dealership and
CDK’s network, which accepts direct communications only from computers on the corresponding
dealership’s network. [Id.]
CDK’s DMS is password protected. [Id. at ¶ 37.] To access the DMS, each dealership
employee must use his or her individual login credentials. [Id.] CDK has implemented security
features in addition to password protection. [Id. at ¶ 40.] In early 2016, CDK created a login

prompt requiring users to certify that they were an “authorized dealer employee” before they could
access CDK’s DMS. [Id.] Further, in November 2017, CDK began introducing a CAPTCHA2
control for particular login credentials that it suspected were being used to facilitate unauthorized
access to its DMS by third parties. [Id. at ¶ 41.] Humans can easily pass CAPTCHA tests, but
automated scripts—like those used by Authenticom and other third-party data extractors—often
encounter difficulty. [Id.] The CAPTCHA controls are specifically designed to prevent access to
computers through automated means. [Id.]
CDK has entered into a Master Service Agreement (“MSA”) with each Counter-Defendant
(collectively, the “MSAs”). [Id. at ¶ 43.] The MSAs expressly prohibit Counter-Defendants from

supplying DMS login credentials to third parties or otherwise granting third parties access to
CDK’s DMS. [Id.] Specifically, Section 6(D) of the MSAs provides that the “Client shall not
allow access to [CDK’s DMS] by any third parties except as otherwise permitted by this
agreement.” [Id. at ¶ 44.] In addition, each Counter-Defendant expressly agrees that it will only
use CDK’s software “for its own internal business purposes and will not sell or otherwise provide,
directly or indirectly, any of the Services or Software, or any portion thereof, to any third party”
and that it will “treat as confidential and will not disclose or otherwise make available any of the

2 “CAPTCHA” is an acronym for “Completely Automated Public Turing Test to tell Computers and
Humans Apart.” Tel. Sci. Corp. v. Asset Recovery Sols., LLC, 2016 WL 4179150, at *1 (N.D. Ill. Aug. 8,
2016).
[CDK’s] Products (including, without limitation, screen displays or user documentation) or any
* * * proprietary data, information, or documentation related thereto * * * in any form, to any
person other than employees and agents of [the dealer.]” [Id. at ¶ 45.] Each dealer acknowledges
that—notwithstanding its license to use CDK’s DMS—the DMS remains at all times “the
exclusive and confidential property of [CDK].” [Id.] Additionally, the MSAs independently

prohibit “ANY THIRD PARTY SOFTWARE TO ACCESS [CDK’S] DEALER
MANAGEMENT SYSTEM EXCEPT AS OTHERWISE PERMITTED BY THIS
AGREEMENT.” [Id. at ¶ 46.]
CDK contends that third party hostile data extractors like Authenticom are not “agents” of
the Counter-Defendants. [Id. at ¶ 49.] Authenticom’s own contract with dealers makes clear that
Authenticom is not the dealer’s “agent,” and in fact refers to “agents” of the dealer repeatedly as
third parties to the agreement. [Id.] Similarly, the standard End-User License Agreement
(“EULA”) offered by Superior Integrated Solutions (“SIS”), another third party data extractor,
states that “[t]he parties shall be independent contractors under this Agreement, and nothing herein

will constitute either party as the employer, employee, agent or representative of the other party,
or both parties as joint ventures or partners for any purpose.” [Id.]
CDK submits that Counter-Defendants have repeatedly breached their contracts with CDK
by handing out their DMS login credentials (directly or through their software vendors) to third
party data extractors for the express purpose of enabling those third parties to use those credentials
to repeatedly and relentlessly access CDK’s DMS using sophisticated computer software that
extracts (or scrapes) large volumes of data from the system. [Id. at ¶ 2.] Many of these data
extractors—including Authenticom—then resell that data to other third-party application
providers, paying nothing to CDK. [Id.] According to CDK, this unauthorized access not only
threatens the security of the data in CDK’s DMS, but also threatens the integrity of that data
because ungoverned extraction and insertion of data into the DMS may corrupt the DMS databases.
[Id.] Moreover, the thousands of unauthorized extractions and the high volume of data in many
of those extractions degrade the performance of the DMS, impairing its value for all of CDK’s
DMS customers. [Id.]

CDK brings counterclaims against Counter-Defendants based on this alleged unauthorized
access. Before the Court is Counter-Defendants’ motion to dismiss the breach of contract,
Computer Fraud and Abase Act, and Digital Millennium Copyright Act counterclaims brought
against them.
II. Legal Standard

To survive a Federal Rule of Civil Procedure (“Rule”) 12(b)(6) motion to dismiss for
failure to state a claim upon which relief can be granted, the complaint first must comply with
Rule 8(a) by providing “a short and plain statement of the claim showing that the pleader is entitled
to relief,” Fed. R. Civ. P. 8(a)(2), such that the defendant is given “fair notice of what the * * *
claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555
(2007) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957)) (alteration in original). Second, the
factual allegations in the complaint must be sufficient to raise the possibility of relief above the
“speculative level.” E.E.O.C. v. Concentra Health Servs., Inc., 496 F.3d 773, 776 (7th Cir. 2007)
(quoting Twombly, 550 U.S. at 555). “A pleading that offers ‘labels and conclusions’ or a
‘formulaic recitation of the elements of a cause of action will not do.’” Ashcroft v. Iqbal, 556 U.S.
662, 678 (2009) (quoting Twombly, 550 U.S. at 555). Dismissal for failure to state a claim under
Rule 12(b)(6) is proper “when the allegations in a complaint, however true, could not raise a claim
of entitlement to relief.” Twombly, 550 U.S. at 558. In reviewing a motion to dismiss pursuant to
Rule 12(b)(6), the Court accepts as true all of Counter-Plaintiff’s well-pleaded factual allegations
and draws all reasonable inferences in Counter-Plaintiff’s favor. Killingsworth v. HSBC Bank
Nev., N.A., 507 F.3d 614, 618 (7th Cir. 2007).
III. Analysis

A. Breach of Contract (First Counterclaim)
CDK’s first cause of action alleges that the Counter-Defendants violated the terms of their
respective MSAs by sharing login credentials with Authenticom and other third parties. CDK
further contends that Counter-Defendants have “repeatedly violated the express contractual
prohibitions” in their respective MSAs by “actively facilitating hostile, unauthorized access to
CDK’s DMS.” [522 (Counterclaims), at ¶ 103, 104-32.] The MSAs “expressly prohibit the
Counter-Defendants from allowing third-parties to access CDK’s DMS.” [Id. at ¶ 43.] There is a
limited exception to this prohibition in some MSAs that allows access by “employees and agents
of [the dealer] with a need-to-know.” [Id. at ¶ 49.] Counter-Defendants argue that CDK’s breach
of contract counterclaim fails because Counter-Defendants authorized data extractors to extract

data from the DMS, which—according to Counter-Defendants—is all that is necessary under the
MSAs. Specifically, CDK alleges:
In knowingly providing login credentials to these data extractors and, actively or
passively, “authorizing” them to access CDK’s DMS to extract or insert data—
including data that does not belong to the Dealership Counter-Defendants—the
Dealership Counter-Defendants have breached their contracts with CDK. This
conduct also violates the CFAA, which prohibits unauthorized access to protected
computer systems. In addition, certain Dealership Counter-Defendants—and
numerous members of the putative class—have engaged in further unlawful
conduct that violates the DMCA. CDK requests that the Court enjoin the Dealership
Counter-Defendants’ illegal conduct and award CDK damages.

[Id. at ¶ 3.] According to Counter-Defendants, this allegation establishes that Authenticom and
other third-party integrators were authorized to access CDK’s data and therefore were acting as
the agents of Counter-Defendants. CDK responds that the word “authorizing” is in quotation
marks because CDK is alleging that third-party access to its data was not authorized. Stone v.
Wright, 734 F. App’x 989 (7th Cir. 2018) (using scare quotes around claim brought by plaintiff to
express doubts regarding viability of such a claim under the Constitution). The Court agrees that
the use of the term “authorizing” in scare quotes does not amount to a concession that

Counter-Defendants’ access to CDK’s data was authorized.
That leaves the question of whether Authenticom and other third-party data integrators
were the employees and/or agents of Counter-Defendants such that they were authorized to access
CDK’s DMSs under the terms of the relevant MSAs. Because Counter-Defendants do not contend
that Authenticom and other third-party data integrators were their employees, the Court need only
consider whether the third-party data integrators were the agents of Counter-Defendants. To the
extent that Counter-Defendants contend that all that is needed to circumvent the MSAs’ prohibition
on allowing parties to access CDK’s DMS was Counter-Defendants’ authorization, the prohibition
on third-party access would be pointless, as Counter-Defendants simply could authorize any

third-party to access CDK’s DMS. Thus, something more than authorization by
Counter-Defendants’ must be necessary to establish agency under the MSAs. Cress v. Recreation
Servs., Inc., 795 N.E.2d 817, 852 (Ill. App. Ct. 2003) (“[A] court must give meaning and effect to
every part of the contract.”).
Counter-Defendants argue that—to the extent that the term “agents” is ambiguous—the
term should be construed against CDK, as the drafter of the MSAs. Bourke v. Dun & Bradstreet
Corp., 159 F.3d 1032, 1036 (7th Cir. 1998) (Under Illinois law, “any ambiguity in the terms of a
contract must be resolved against the drafter of the disputed provision.” (quoting Dowd & Dowd,
Ltd. v. Gleason, 693 N.E.2d 358, 368 (Ill. App. Ct. 1998) (internal quotation marks omitted)). But
agency is a concept well-defined and understood under the law and by businesses of even modest
sophistication—a threshold that all of the parties to this motion easily clear. Hernandez ex rel.
Gonzalez v. Tapia, 2010 WL 5232942, at *7 (N.D. Ill. Dec. 15, 2010) (“The phrase ‘agents and
employees’ is not ambiguous and therefore the court will apply the plain meaning of these terms.”).
Moreover, agency is an issue of fact generally not susceptible to resolution at the motion

to dismiss stage. Restoration Specialists, LLC v. Hartford Fire Ins. Co., 2009 WL 3147481, at *3
(N.D. Ill. Sept. 29, 2009) (“[T]he question of agency typically presents an issue of fact that seldom
can be resolved at the summary judgment stage, much less on a motion to dismiss.”); Semitekol v.
Monaco Coach Corp., 582 F. Supp. 2d 1009, 1024 (N.D. Ill. 2008) (“[W]hether an agency
relationship has been established between the parties is [an issue] of fact which is not properly
resolved on a motion to dismiss.” (citation omitted)). Under Illinois law—on which Counter-
Defendants rely in their reply brief—“[t]he analysis turns primarily on the level of control that the
alleged agent retains over the performance of its assigned work”. Jackson v. Bank of New York,
62 F. Supp. 3d 802, 814 (N.D. Ill. 2014) (citing Horwitz v. Holabird & Root, 816 N.E.2d 272, 279

(2004)). “In a principal-agent relationship, the principal retains the right to control the manner and
method in which the work is carried out by the agent.” Id. (citing Uesco Indus., Inc. v. Poolman
of Wis., Inc., 993 N.E.2d 97, 112 (Ill. App. Ct. 2013)). “By contrast, ‘[a]n independent contractor
is one who undertakes to produce a given result but in the actual execution of the work is not under
the orders or control of the person for whom he does the work but may use his own discretion in
things not specified * * * [and] without his being subject to the orders [of the person for whom the
work is done] in respect to the details of the work.” Id. (quoting Horwitz, 816 N.E.2d at 279).
Other factors that bear on the question of whether one is properly considered an agent or an
independent contractor include “(1) the question of hiring; (2) the right to discharge; (3) the manner
of direction of the servant; (4) the right to terminate the relationship; and (5) the character of the
supervision of the work done.” Lawlor v. N. Am. Corp. of Ill., 983 N.E.2d 414, 427 (Ill. 2012).
Counter-Defendants fail to explain how this analysis can be resolved as a matter of law based on
the allegations in the breach of contract counterclaim.
In fact, CDK identifies allegations suggesting that there is no such agency relationship.

CDK alleges that Authenticom’s own contract with dealers makes clear that Authenticom is not
the dealer’s “agent,” and in fact refers to “agents” of the dealer repeatedly as third parties to the
agreement. [522 (Counterclaims), at ¶ 49.] Similarly, SIS’s EULA states that “[t]he parties shall
be independent contractors under this Agreement, and nothing herein will constitute either party
as the employer, employee, agent or representative of the other party, or both parties as joint
ventures or partners for any purpose.” [Id.]
Counter-Defendants counter that the contracts do not undermine their contention that data
integrators are their agents. Specifically, Counter-Defendants note that an agent may be both an
independent contractor in one relationship and an agent in another. Signs & Blanks, Ltd. v. Lanan

Prod., Inc., 2009 WL 10695777, at *5 n.4 (N.D. Ill. Jan. 20, 2009) (“[A] person may be both an
independent contractor and an agent with the authority both to control the details of the work and
also the power to act for and to bind the principal in business negotiations within the scope of [the]
agency.” (internal quotation marks and citation omitted)). Although Counter-Defendants do not
identify what law applies to this analysis in their opening brief, Counter-Defendants assert in their
reply brief that Illinois law applies to the issue of whether data extractors were agents of
Counter-Defendants.3 Illinois courts have indicated that an independent contractor may be

3 The Court questions whether Illinois law applies, as the contract between dealers and Authenticom is
governed by Wisconsin law. [See 506.] Because the parties have not presented any argument to that effect,
the Court proceeds on the assumption that Illinois law applies. In any event, the result likely would be the
same under Wisconsin law. As the Court previously has noted, the distinction under Wisconsin law
considered an agent for certain purposes when they have “the authority both to control the details
of the work and also ‘the power to act for and to bind the principal in business negotiations within
the scope of [the] agency.’” Horwitz, 816 N.E.2d at 279 (citing Hoffman & Morton Co. v.
American Insurance Co., 181 N.E.2d 821 (Ill. App. Ct. 1962)). Counter-Defendants do not
contend that such circumstances are present here.

Lastly, Counter-Defendants argue that the merger clause in the MSAs precludes
interpreting the MSAs in light of Counter-Defendants’ contracts with other entities. [595, at 13.]
Specifically, the MSAs provide:
This Agreement contains the entire agreement of the parties with respect to their
subject matter and supersedes all existing agreements and all other oral, written or
other communications between them concerning their subject matter[.]

[595-1, at ¶ 18.A.] However, the merger clause addresses agreements between the parties to the
contract, not agreements with third parties. Furthermore, it cannot be the case that
Counter-Defendants’ contracts with data integrators are irrelevant to determining whether the data
integrators can be characterized as agents of Counter-Defendants. While Counter-Defendants’
own characterization of their relationships with data integrators is not dispositive of the issue of
agency, it certainly is relevant. K.C. 1986 Ltd. P’ship v. Reade Mfg., 33 F.Supp.2d 820, 828 (W.D.
Mo. 1998) (“While [the parties’] characterization of their relationship as an employer/independent
contractor is not dispositive of the issue before the Court, it is probative of the intended nature of
the relationship.” (citations omitted)); Bartolotta v. Dunkin’ Brands Grp., Inc., 2016 WL 7104290,

between “an employee or agent and an independent contractor is the degree of retention by the employer
or principal of the right to control the manner in which the details of the work are to be performed.” Jahns
v. Milwaukee Mut. Ins. Co., 155 N.W.2d 674, 676 (Wis. 1968) (citations omitted). An independent
contractor may be considered an agent for certain purposes—where the “fiduciary relationship has formed
and the principal has control over certain activities.” Romero v. W. Bend Mut. Ins. Co., 885 N.W.2d 591,
601 (Wis. Ct. App. 2016) (citation omitted). Counter-Defendants have not identified any allegations
indicating that such circumstances are present here.
at *5 (N.D. Ill. Dec. 6, 2016) (“In short, while the nature and extent of control as defined in the
franchise agreement is relevant, so too is the parties’ actual conduct and practice.” (citations
omitted)); Ziehlsdorf v. Am. Family Ins. Grp., 461 N.W.2d 448 (Wis. Ct. App. 1990) (“A written
agreement defining the relationship as an independent contractor is also a significant factor.”).
Indeed, even if the contracts between Counter-Defendants and data integrators did not characterize

their relationship, looking at the terms of the contract likely would be relevant to engaging in the
fact intensive agency analysis discussed above.
Based on the foregoing analysis, the Court denies Counter-Defendants’ motion to dismiss
CDK’s breach of contract counterclaim.
B. Computer Fraud and Abuse Act (Second Counterclaim)
Counter-Defendants move for dismissal of CDK’s counterclaim under the Computer Fraud
and Abuse Act (“CFAA”) because the counterclaim (1) is untimely, (2) fails to allege “accessor”
liability against Counter-Defendants, and (3) CDK has not alleged the requisite loss or damage.
The Court addresses each of these arguments in turn.

i. Time-Barred
Counter-Defendants move for dismissal of CDK’s CFAA counterclaim as time-barred.
Dismissal based on a statute of limitations is an affirmative defense. See Fed. R. Civ. P. 8(c)(1).
Nevertheless, “dismissal is appropriate when the plaintiff pleads [herself] out of court by alleging
facts sufficient to establish the complaint’s tardiness.” Cancer Found., Inc. v. Cerberus Capital
Mgmt., LP, 559 F.3d 671, 674-75 (7th Cir. 2009); see also United States v. Lewis, 411 F.3d 838,
842 (7th Cir. 2005) (explaining that dismissal is appropriate “where, as here, the allegations of the
complaint itself set forth everything necessary to satisfy the affirmative defense, such as when a
complaint plainly reveals that an action is untimely under the governing statute of limitations”).
The CFAA has a two-year statute of limitations. See 18 U.S.C. § 1030(g) (“No action may be
brought under this subsection unless such action is begun within 2 years of the date of the act
complained of or the date of the discovery of the damage.”); Meyer Tech. Solutions, LLC v.
Kaegem Corp., 2017 WL 4512918, at *1 (N.D. Ill. Oct. 10, 2017) (concluding that CFAA claims
were barred when counter-plaintiff “discovered the damage flowing from the unauthorized access”

more than two years before it filed its counterclaims).
CDK filed its counterclaims on February 22, 2019. [See 522.] CDK alleges facts
establishing that it became aware of Counter-Defendants’ alleged unauthorized access of CDK’s
DMS no later than June 2015. [522, at ¶ 92 (alleging that Counter-Defendants “became aware that
CDK objected to unauthorized access to the CDK DMS by third parties like Authenticom no later
than when CDK announced SecurityFirst in June 2015 and in all likelihood, much earlier”).]
Counter-Defendants identify additional allegations indicating that CDK learned of the alleged
misconduct more than two years before it filed its counterclaims. [395, at 14.]
CDK argues that its CFAA counterclaim is not time-barred because it is a compulsory

counterclaim. While the Seventh Circuit has held that “[a] counterclaim for affirmative relief may
not be asserted if barred by the statute of limitations,” Chauffeurs, Teamsters, Warehousemen &
Helpers, Local Union No. 135 v. Jefferson Trucking Co., 628 F.2d 1023, 1027 (7th Cir. 1980), the
Seventh Circuit also has recognized in dicta that “[t]here is authority that the filing of a claim tolls
the statute of limitations on any compulsory counterclaim, by analogy to the ‘relation back’
language of Rule 15.” Asset Allocation & Mgmt. Co. v. W. Employers Ins. Co., 892 F.2d 566, 571
(7th Cir. 1989) (citing Burlington Industries, Inc. v. Milliken & Co., 690 F.2d 380, 389 (4th
Cir.1982); 6 Wright & Miller, FEDERAL PRACTICE AND PROCEDURE § 1419 (1971)). Although the
Seventh Circuit has not conclusively addressed that issue, courts in this District have held that the
filing of a claim tolls the statute of limitations on any compulsory counterclaim. Seitz v. Beeter,
2013 WL 409428, at *2 (N.D. Ill. Jan. 31, 2013) (collecting cases).
“Rule 13(a) defines a compulsory counterclaim as one that ‘arises out of the transaction or
occurrence that is the subject matter of the opposing party’s claim.’” Bd. Of Regents of Univ. Of
Wisconsin Sys. v. Phoenix Int’l Software, Inc., 653 F.3d 448, 470 (7th Cir. 2011) (quoting Fed. R.

Civ. P. 13(a)). The Seventh Circuit uses “a ‘logical relationship’ test to decide whether two matters
are the same for purposes of Rule 13(a).” Id. Under this “flexible” approach, the Court must
“consider the totality of the claims, including the nature of the claims, the legal basis for recovery,
the law involved, and the respective factual backgrounds.” Id. (quoting Burlington Northern R.R.
Co. v. Strong, 907 F.2d 707, 711 (1990)) (internal quotation marks omitted). “Even if two claims
are ‘technically related,’ the relationship between the claims may be insufficient to satisfy
Rule 13(a) if the two claims are based on different theories and would raise different legal and
factual issues.” Simon v. Nw. Univ., 2017 WL 25173, at *3 (N.D. Ill. Jan. 3, 2017) (citing
Burlington N. R. Co. v. Strong, 907 F.2d 707, 711 (7th Cir. 1990)).

CDK argues that its CFAA counterclaim is compulsory because it overlaps with several of
CDK’s affirmative defenses. Specifically, one of CDK’s defenses to the Counter-Defendants’
antitrust claims is that CDK legally is entitled to control access to its DMS. Another of CDK’s
defenses is that precluding hostile access is procompetitive because it furthers legitimate security
concerns. However, neither defense establishes that CDK’s CFAA counterclaim is based on the
same theory and implicates the same legal and factual issues as Counter-Defendants’ antitrust
claims. With respect to the first defense, whether CDK is entitled to control access to its DMS
may relate to CDK’s CFAA counterclaim, but it is not central to Counter-Defendants’ antitrust
claims. As prior decisions in this case have noted, even assuming that CDK was entitled to deny
certain parties’ access to its DMS generally, CDK is “not free to withhold such approval pursuant
to illegal arrangements.” In re Dealer Mgmt. Sys. Antitrust Litig., 313 F. Supp. 3d 931, 948 (N.D.
Ill. 2018). With respect to the second defense, whether precluding hostile access is procompetitive
because it furthers legitimate security concerns certainly relates to Counter-Defendants’ antitrust
claims, but it is not central to CDK’s CFAA counterclaim. The Court recognizes that CDK’s

CFAA counterclaim and Counter-Defendants’ antitrust claims have a common-origin—disputes
relating to CDK’s DMS. However, the CFAA counterclaim and the antitrust claims are based on
different legal theories and will present different legal and factual issues.
In support of its argument that its CFAA counterclaim is compulsory, CDK cites Moore v.
New York Cotton Exchange, 270 U.S. 593, 602 (1926). In that case, the plaintiff sued the New
York Cotton Exchange under the antitrust laws, alleging that the Exchange had a monopoly on
price quotations for cotton futures and was illegally precluding the plaintiff from accessing the
quotations via telegraphic ticker service. The Exchange counterclaimed, asserting that the
plaintiff, “though it had been refused permission to use the quotations of the New York exchange,

was purloining them, or receiving them from some person who was purloining them, and giving
them out to its members.” Id. at 603. After the antirust claim was dismissed, the Supreme Court
concluded that it had jurisdiction over the counterclaim because it arose out of the same transaction
as the plaintiff’s antitrust claim. Id. at 610. The Supreme Court stated:
The refusal to furnish the quotations is one of the links in the chain which
constitutes the transaction upon which appellant here bases its cause of action. It
is an important part of the transaction constituting the subject-matter of the
counterclaim. It is the one circumstance without which neither party would have
found it necessary to seek relief. Essential facts alleged by appellant enter into and
constitute in part the cause of action set forth in the counterclaim.

Id.
CDK argues that this case is on all fours with Moore. Specifically, CDK contends that—
like the plaintiff in Moore—it refused to give third-party integrators like Authenticom access to
its DMS and that Counter-Defendants—like the defendant in Moore—“purloined data” from
CDK’s DMS. The Court recognizes that there are similarities between this case and Moore.
However, in Moore, the Supreme Court noted that “so close is the connection between the case

sought to be stated in the bill and that set up in the counterclaim, that it only needs the failure of
the former to establish a foundation for the latter.” Id. As discussed above, the same cannot be
said here. The Court therefore finds Moore to be distinguishable and concludes that CDK’s CFAA
counterclaim is not a compulsory counterclaim.
CDK further argues that even if its CFAA counterclaim is not compulsory, it nonetheless
is timely to the extent that it is based on recent instances of unauthorized access. Counter-
Defendants respond that the continuing violation exception does not apply to the CFAA. “The
continuing violation doctrine allows a plaintiff to get relief for a time-barred act by linking it with
an act that is within the limitations period.” Selan v. Kiley, 969 F.2d 560, 564 (7th Cir. 1992). The

purpose of the continuing violation doctrine “is to allow suit to be delayed until a series of wrongful
acts blossoms into an injury on which suit can be brought.” Limestone Dev. Corp. v. Vill. of
Lemont, Ill., 520 F.3d 797, 801 (7th Cir. 2008) (citations omitted). The doctrine applies when
individual instances of alleged misconduct alone are not actionable, but the cumulative effect of a
series of actions is enough to establish an actionable claim. Id.
“The ‘continuing violation’ exception to federal statutes of limitations only allows suit to
be delayed in cases where the first instance of misconduct may be insufficient—and indeed the
‘cumulative effect’ of a series of acts is necessary—to make out an actionable claim.” Meyer Tech.
Sols., LLC v. Kaegem Corp., 2017 WL 4512918, at *1 (N.D. Ill. Oct. 10, 2017) (citing Limestone
Dev. Corp. v. Village of Lemont, Ill., 520 F.3d 797, 801 (7th Cir. 2008)).4 Here, CDK does not
identify any facts indicating that its CFAA counterclaim is based on the cumulative effect of a
series of acts. Plaintiff therefore has not alleged facts sufficient to invoke the continuing violation
exception. Id. Still, to the extent that CDK seeks to bring a CFAA counterclaim based on recent
instances of unauthorized access, the continuing violation doctrine is not necessary to save CDK’s

CFAA counterclaim.
In sum, to the extent that CDK’s CFAA counterclaim is based on misconduct occurring
more than two years before CDK filed its counterclaims, the counterclaim is time-barred and is
dismissed. However, to the extent that CDK’s CFAA counterclaim is based on more recent
conduct (since February 22, 2017), the claim is timely.
ii. Accessor Liability
Counter-Defendants also move for dismissal of CDK’s CFAA counterclaim on the ground
that CDK fails sufficiently to allege “accessor” liability on the part of Counter-Defendants. The
CFAA provides criminal and civil penalties for anyone who “intentionally accesses a computer

without authorization or exceeds authorized access, and thereby obtains * * * information from
any protected computer.” 18 U.S.C. § 1030(a)(2)(C). Counter-Defendants seek dismissal of the
CFAA counterclaim because “the complained-of computer access was conducted by persons other

4 In Meyer, the court correctly noted that “[t]he ‘continuing violation’ exception to federal statutes of
limitations only allows suit to be delayed in cases where the first instance of misconduct may be
insufficient—and indeed the ‘cumulative effect’ of a series of acts is necessary—to make out an actionable
claim.” 2017 WL 4512918, at *1 (N.D. Ill. Oct. 10, 2017) (citing Limestone Dev. Corp. v. Village of
Lemont, Ill., 520 F.3d 797, 801 (7th Cir. 2008)). CDK indicates that Meyer stands for the proposition that
the continuing violation doctrine does not apply to claims brought under the CFAA. However, the court
did not go so far. Rather, it concluded that the continuing violation doctrine did not apply in that case. Id.
Still, to the extent that the court in Meyer dismissed CFAA claims that were based on conduct occurring
within the statute of limitations period, this Court respectfully disagrees that such claims should be
dismissed as time-barred because misconduct also occurred outside of the limitations period. See Gajewski
v. Ocwen Loan Servicing, 650 F. App’x 283, 287 (7th Cir. 2016) (considering whether the plaintiff
sufficiently stated a claim with respect to alleged misconduct occurring within the statute of limitations
period after rejecting invocation of the continuing violation doctrine).
than the dealerships—namely, ‘Authenticom and other third parties.’” [595, at 15.] In other
words, Counter-Defendants contend that CDK’s CFAA counterclaim fails because CDK does not
allege that Counter-Defendants personally accessed CDK’s DMS.
Counter-Defendants begin by arguing that Court should not impose liability for inducing
misconduct unless the statute expressly establishes inducer liability, which the CFAA does not.

As noted by Counter-Defendants, Congress has imposed inducer liability in other statutes. See,
e.g., 35 U.S.C. § 271(b) (“Whoever actively induces infringement of a patent shall be liable as an
infringer.”). Still, the Court must examine the text of the statute. United States v. Miscellaneous
Firearms, Explosives, Destructive Devices and Ammunitions, 376 F.3d 709, 712 (7th Cir. 2004)
(“The cardinal rule of statutory interpretation is that courts ‘must first look to the language of the
statute and assume that its plain meaning accurately expresses the legislative purpose.’” (quoting
Grzan v. Charter Hosp. of Northwest Ind., 104 F.3d 116, 122 (7th Cir. 1997)). The statute at issue
here—the CFAA—prohibits intentionally accessing a computer without authorization or in excess
of authorized access. The question before the Court therefore is what it means to intentionally

access a computer.
In Synthes, Inc. v. Emerge Med., Inc., the court noted that the “the plain language of the
statute requires only ‘access’—no modifying term suggesting the need for ‘personal access’ is
included.” 2012 WL 4205476, at *17 (E.D. Pa. Sept. 19, 2012). Because the term “access”
generally means “gaining admission to,” id. (collecting authorities on the common meaning of the
term “access”), many courts addressing the issue have concluded that direct personal access is not
required. Id. (collecting cases). Still, courts are divided on the issue. For example, in Power
Equipment Maintenance, Inc. v. AIRCO Power Services, Inc., the court dismissed a CFAA claim
against a defendant who allegedly “accessed files by having an administrative assistant print a
confidential contract for him” after his access had been revoked because he did not personally
access the computer. 953 F. Supp. 2d 1290, 1297 (S.D. Ga. 2013). The defendant just “managed
to convince another with access to provide him with the information.” Id. The Court questions
whether the CFAA should be read so narrowly, as such a reading would allow parties easily to
circumvent the CFAA by enlisting unknowing persons to access computers personally. However,

the Court need not resolve that issue now, as conspiracy is an express basis for liability under the
CFAA. 18 U.S.C. § 1030(b) (“Whoever conspires to commit or attempts to commit an offense
under subsection (a) of this section shall be punished as provided in subsection (c) of this
section.”). Counter-Plaintiff recognizes that it “did not plead a conspiracy claim in its
Counterclaims.” [639, at 15 n.4.] Still, CDK asserts that it has alleged sufficient facts to state a
conspiracy claim under the CFAA. [Id.] Counter-Defendants do not explain why the facts alleged
are insufficient to state a claim under the CFAA. Instead, Counter-Defendants assert that a brief
cannot amend a pleading. Although that is true, the parties are required to plead facts, not causes
of action. Alioto v. Town of Lisbon, 651 F.3d 715, 721 (7th Cir. 2011) (“[W]e have stated

repeatedly (and frequently) that a complaint need not plead legal theories[.]”). Thus, as long as
CDK alleged sufficient facts to bring a conspiracy counterclaim under the CFAA, it may proceed
under that theory. Because Counter-Defendants do not address whether CDK alleged sufficient
facts to bring a conspiracy claim under the CFAA, the Court denies their motion to dismiss the
CFAA counterclaim for failure to allege wrongful conduct by Counter-Defendants.5

5 Counter-Defendants do argue that it would be futile to allow CDK to amend its Counterclaims, citing one
decision questioning whether the CFAA permits a conspiracy claim. [674, at 19.] However, that case cited
did not rule on that issue. Because Counter-Defendants do not otherwise develop the argument, the Court
will not consider it at this time. See Crespo v. Colvin, 824 F.3d 667, 674 (7th Cir. 2016) (“‘[P]erfunctory
and undeveloped arguments, and arguments that are unsupported by pertinent authority, are waived (even
where those arguments raise constitutional issues).”’ (quoting United States v. Berkowitz, 927 F.2d 1376,
1384 (7th Cir. 1991))).
Counter-Defendants further argue that—even if allegations of personal access are not
necessary to state a claim under the CFAA— CDK’s CFAA counterclaim still should be dismissed
because CDK alleges that Counter-Defendants authorized Authenticom and other data integrators
to access the DMS. Specifically, Counter-Defendants argue that the “authorization” required
under the CFAA is that of the computer system’s user, not the owner. [595, at 17.] However,

Counter-Defendants do not cite any authority in support of that interpretation.
In any event, the Court rejects Counter-Defendants’ interpretation of the CFAA. Although
the statute does not specify whose authorization is necessary, it cannot be the case that only the
user’s authorization is necessary. As noted above, anyone who “intentionally accesses a computer
without authorization or exceeds authorized access, and thereby obtains * * * information from
any protected computer” violates the CFAA. 18 U.S.C. § 1030(a)(2)(C). “Under the CFAA, the
phrase ‘“exceeds authorized access” means to access a computer with authorization and to use
such access to obtain or alter information in the computer that the accessor is not entitled to obtain
or alter.’” Motorola, Inc. v. Lemko Corp., 609 F. Supp. 2d 760, 767 (N.D. Ill. 2009) (quoting 18

U.S.C. § 1030(e)(6)). Thus, “[a]llegations that an employee e-mailed and downloaded confidential
information for an improper purpose are sufficient to state a claim that the employee exceeded her
authorization.” Id. (citing Mintel Int’l Group, Ltd. v. Neergheen, 2008 WL 2782818, at *3 (N.D.
Ill. July 16, 2008)). In such cases, the employee would be the user. It would be illogical to say
that the employee needed authorization from herself. Because the CFAA contemplates that users
may exceed authorized access, it cannot be the case that the authorization required by the CFAA
is that of the user. This Court previously concluded the authorization required by the CFAA is
that of the owner of the computer system, not from anyone who happens to use the system. [506,
at 15.] And Counter-Defendant’s have not presented persuasive grounds for reconsidering that
conclusion.6
Finally, Counter-Defendants argue that the CFAA counterclaim fails because CDK alleges
that it actually did authorize Authenticom and other third-party data integrators to access its DMS
by contractually permitting dealerships to provide DMS access to their “agents.” [595, at 17.]

However, as discussed above, whether Authenticom and other third-party data integrators are
agents of Counter-Defendants is an issue of fact not properly resolved on Counter-Defendant’s
motion to dismiss. Furthermore, CDK alleges that Counter-Defendants exceeded any
authorization by—among other conduct—“having new credentials created and/or by restoring
disabled credentials—including on information and belief by automated means.” [Id. at ¶ 152.]
These allegations are sufficient to state a claim under the CFAA. See Tracfone Wireless, Inc. v.
Simply Wireless, Inc., 229 F. Supp. 3d 1284, 1297 (S.D. Fla. 2017) (concluding that “the
unauthorized or in excess of authorization elements” of the CFAA were sufficiently plead where
plaintiff alleged “the sale of the unbundled PINs was not authorized by the agreement between the

parties”). Accordingly, the Court denies Counter-Defendants’ motion to dismiss for failure to
allege accessor liability.

6 Counter-Defendants do note that the CFAA is a penal statute that imposes criminal liability and that any
ambiguities in the language should be resolved in the dealership’s favor under the rule of lenity. However,
“[t]he rule does not apply when a statute is unambiguous or when invoked to engraft an illogical
requirement to its text.” Salinas v. United States, 522 U.S. 52, 66 (1997) (citing United States v. Shabani,
513 U.S. 10, 17 (1994)).
iii. Requisite Losses
Counter-Defendants also argue that CDK fails to allege “loss to 1 or more persons during
any 1-year period * * * aggregating at least $5,000 in value,” as required by 18 U.S.C.
§ 1030(c)(4)(A)(i)(I).7 CDK alleges that:
The Dealership Counter-Defendants’ violations of the CFAA have caused CDK to
suffer damages and losses. These damages and losses include the costs of
investigating and responding to the Dealership Counter-Defendants’ unlawful
actions; the costs of restoring the DMS and the data it contains to their condition
prior to the Dealership Counter-Defendants’ unlawful actions; and all revenue lost,
costs incurred, and other consequential damages incurred because of disruption of
service caused by the unlawful actions of the Dealership Counter-Defendants and
the third parties acting in concert with the Dealership Counter-Defendants. On
information and belief, these losses have exceeded $5,000 within a twelve-month
period.

[522 (Counterclaims), at ¶ 144.] Counter-Defendants argue that this allegation is insufficient to
establish the requisite amount of losses because CDK cannot aggregate the losses allegedly caused
by all Counter-Defendants. Counter-Defendants further note that—based on this allegation—
“each of the dealerships could have caused as little as $294.12 in alleged losses.” [595, at 18 n.7.]
CDK argues that, “even assuming that a plaintiff must identify $5,000 in loss or damage
attributable to each defendant, the defendants’ contention that this standard has not been met was
“simply one inference of many that [may] be drawn from Plaintiff’s complaint.” [638, at 18
(quoting Wolf v. Schadegg, 2016 WL 1117364 (D. Colo. Mar. 21, 2016)).] In other words, CDK
believes that the Court should not infer that each Defendant caused as little as $294.12 in losses
because that is just one possible inference and the Court must draw all reasonable inferences in
Counter-Plaintiff’s favor at the motion to dismiss stage. That argument misses the mark. Although
the Court must draw all reasonable inferences in CDK’s favor, that does not relieve CDK of its

7 Counter Defendants also argue that CDK fails sufficiently to allege damage. However,
Section 1030(c)(4)(A)(i)(I) does not address damage.
obligation to allege sufficient facts to establish the elements of its counterclaims, including that it
satisfied the CFAA losses threshold.
In Wolf, the court concluded that the plaintiff alleged losses sufficient to satisfy the CFAA
losses threshold even though it did not identify what specific loss was caused by each defendant.
2016 WL 1117364, at *4. In reaching that conclusion, however, the court noted that plaintiff’s

allegations permitted “an inference that both [d]efendants were working together to access
[p]laintiffs’ data, particularly given that [d]efendants were working for the same rival company
and undoubtedly were familiar with each other by virtue of their past employment with [p]laintiff.”
Id. Here, on the other hand, CDK does not identify any facts indicating that Counter-Defendants
were acting together.
CDK further argues that “allocation questions are at best fact issues that cannot be resolved
on a motion to dismiss.” [639, at 19 (citations omitted).] Even if that is the case, however, CDK
fails directly to address the threshold issue of whether losses caused by each Defendant can be
aggregated under the CFAA in the first place.8 The Seventh Circuit has not yet addressed whether

losses allegedly caused by multiple defendants can be aggregated for the purposes of satisfying
the CFAA’s loss threshold, and there is little case law on the issue.
In the context of determining whether losses incurred by multiple victims can be
aggregated, however, courts have reached different conclusions. In In re DoubleClick Inc. Privacy
Litigation, the court held “that damages and losses under § 1030(e)(8)(A) may only be aggregated
across victims and over time for a single act.” 154 F. Supp. 2d 497, 523 (S.D.N.Y. 2001). In
reaching that conclusion, the court noted that the CFAA provides that “the term ‘damage’ means
any impairment to the integrity or availability of data, a program, a system, or information that—

8 The issue of how claimed losses should be allocated is different from the issue of whether claimed losses
caused by numerous defendants can be aggregated.
(A) causes loss aggregating at least $5,000 in value during any 1–year period to one or more
individuals.” Because Section 1030(e)(8)(A) “is phrased in the singular (‘any impairment to the
integrity or availability of data, a program, a system, or information that—(a) causes loss’), rather
than the plural (e.g., any impairments to the integrity or availability of data, programs, systems, or
information that—(a) cause loss * * * ),” the court concluded that Section 1030(e)(8)(A) “should

only apply to single acts.” Id. at 523. The court found support for this conclusion in the Senate
Judiciary Committee’s report that accompanied the CFAA, id., which states:
The Committee does not intend that every victim of acts proscribed under
[1030(e)(8)(A)] must individually suffer a loss of [then] $1,000. Certain types of
malicious mischief may cause smaller amounts of damage to numerous individuals,
and thereby collectively create a loss of more than $1,000. By using ‘one of more
others’, the Committee intends to make clear that losses caused by the same act
may be aggregated for the purposes of meeting the [then] $1,000 threshold.

[Sen. R. No. 99-432.] The court in DoubleClick therefore concluded that Section “1030(e)(8)(A)
only allows aggregation of damage over victims and time for a single act.” In re DoubleClick Inc.
Privacy Litig., 154 F. Supp. 2d at 524. The Court noted that “[t]his interpretation is consistent
with Congress’ overall intent to limit the CFAA to major crimes.” Id. at 523-24.
The Ninth Circuit reached the opposite conclusion in Creative Computing v.
Getloaded.com LLC, 386 F.3d 930, 934 (9th Cir. 2004). Specifically, the court held that “[t]he
damage floor in the [CFAA] contains no ‘single act’ requirement.” 386 F.3d 930, 935 (9th Cir.
2004). In reaching that conclusion, the court asserted that “[t]he syntax makes it clear that * * *
the $5,000 floor applies to how much damage or loss there is to the victim over a one-year period,
not from a particular intrusion.” Id. at 934. The court further asserted that even though the term
“impairment” is singular, “impairment” can refer to multiple intrusions. Id. at 934-35 (“Multiple
intrusions can cause a single impairment, and multiple corruptions of data can be described as a
single ‘impairment’ to the data.”).
Here, the Court need not resolve whether aggregation only is appropriate when losses stem
from a single act (i.e., the DoubleClick approach), or, alternatively, from multiple acts that
accurately can be characterized as an impairment (i.e., the Creative Computing approach), as CDK
fails to allege facts indicating that Counter-Defendants were acting together and that their alleged
wrongs can therefore be treated as an impairment. Nothing in either DoubleClick or Creative

Computing indicates that losses caused independent actions of unrelated parties can be aggregated
for the purposes of satisfying the CFAA’s loss threshold. Such an interpretation of the CFAA
would be inconsistent with the text of the statute.
The Court sees no reason to interpret the singular term “impairment” to encompass multiple
unrelated wrongs. And nothing in the language indicates that a single victim can aggregate losses
caused by multiple acts of multiple defendants.9 CDK fails sufficiently to explain why the losses
resulting from the alleged misconduct of separate defendants should be considered an
“impairment” under the CFAA. Accordingly, the Court grants Counter-Defendants’ motion to
dismiss CDK’s CFAA counterclaim for failure to allege sufficient losses. This dismissal is without

prejudice to the filing of amended counterclaims by the date set forth above.

9 As noted by CDK, the court in Wolf stated that “there appear to be no cases determining whether a plaintiff
is required to meet the $5,000 floor with respect to each defendant individually or all defendants
collectively.” 2016 WL 1117364, at *4. The court went on to conclude that “who caused the alleged loss
sustained by [p]laintiffs and to what degree each individual caused this loss” are “questions of fact whose
answers are not necessarily available to [p]laintiffs prior to discovery.” Id. This Court respectfully
disagrees with that position. Even if an issue presents a factual issue, that does not relieve plaintiffs of their
obligation to allege sufficient facts to state a claim. Although CDK asserts that the holding of Wolf is
consistent with Motorola, Inc. v. Lemko Corp., 609 F. Supp. 2d 760 (N.D. Ill. 2009), the Court again
disagrees. In Motorola, the court concluded that the allegation that all defendants “caused [plaintiff] to
incur losses of over $5,000 during a one-year period related to damage and security assessments” was
“sufficient to allege loss for purposes of the CFAA.” Id. at 768. However, in Motorola, the Court did not
specifically address whether plaintiff could aggregate losses allegedly caused by multiple defendants, and
the issue was not raised in the motion to dismiss. [Case No. 08-cv-5427, Dkt. 21.]
C. Digital Millennium Copyright Act (Third Counterclaim)
CDK brings a counterclaim against Counter-Defendants Continental and Warrensburg,
alleging that they violated Section 1201(a)(1)(A) of the Digital Millennium Copyright Act
(“DMCA”). The DMCA provides, in relevant part, that “[n]o person shall circumvent a
technological measure that effectively controls access to a work protected under this title.” 17

U.S.C. § 1201(a)(1)(A). The DMCA defines “circumvent a technological measure” to mean
“descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass,
remove, deactivate, or impair a technological measure, without the authority of the copyright
owner.” Id. at § 1201(a)(3)(A). The DMCA further defines the term to “circumvent protection
afforded by a technological measure” to mean “avoiding, bypassing, removing, deactivating, or
otherwise impairing a technological measure.” Id. at § 1201(b)(2)(A).
CDK alleges that Counter-Defendants Continental and Warrensburg “circumvent[ed] a
technological measure” that controls access to CDK’s DMS by “provid[ing] dealer login
credentials to Authenticom and other third parties in violation of contractual requirements that

such credentials be given to and used only by authorized dealer employees.” [522
(Counterclaims), at ¶ 151.] CDK further alleges that these Counter-Defendants and Authenticom
worked to evade CDK’s efforts to disable the login credentials “by having new credentials created
and/or by restoring disabled credentials—including on information and belief by automated
means.” [Id. at ¶ 152.] Finally, CDK alleges that Counter-Defendants Continental and
Warrensburg “installed Authenticom’s Profile Manager tool in an attempt to re-enable” passwords
that CDK had disabled. [Id. at ¶ 113.]
Counter-Defendants Continental and Warrensburg argue that they cannot be held
secondarily liable under Section 1201(a)(1)(A) of the DMCA. In support of that argument,
Counter-Defendants cite cases holding that there is no secondary liability under various other
statutes in “the absence of the words ‘aid’ or ‘abet’ in the statute indicates a congressional intent
to not provide for aiding and abetting liability.” Wooley v. Jackson Hewitt, Inc., 540 F. Supp. 2d
964, 976 (N.D. Ill. 2008). However, the absence of such language does not establish that imposing
any kind of secondary liability under the DMCA is improper, especially in light of the relationship

between the DMCA and the Copyright Act, which does impose such liability.10 “Congress enacted
the DMCA in 1998 to comply with international copyright treaties and to update domestic
copyright law for the online world.” Ellison v. Robertson, 357 F.3d 1072, 1076 (9th Cir. 2004)
(citations omitted); see also Navistar, Inc. v. New Baltimore Garage, Inc., 2012 WL 4338816, at
*3 (N.D. Ill. Sept. 20, 2012) (“Congress enacted the DMCA * * * to strengthen copyright
protection in the digital age.” (citation and internal quotation marks omitted)). Secondary liability
is “well established” in the copyright context. Metro-Goldwyn-Mayer Studios Inc. v. Grokster,
Ltd., 545 U.S. 913, 930 (2005). Despite the fact that the copyright statute does not include
language expressly addressing secondary liability, “vicarious liability is imposed in virtually all

areas of the law, and the concept of contributory infringement is merely a species of the broader
problem of identifying the circumstances in which it is just to hold one individual accountable for

10 In discussing secondary liability, Counter-Defendants address numerous types of secondary liability (e.g.,
aiding and abetting liability). CDK’s opposition brief makes clear that they are proceeding on vicarious
and contributory liability theories. Specifically, CDK draws comparisons between the DMCA and the
Copyright Act, noting that the latter allows for claims based on vicarious and contributory infringement.
[See 639, at 26.] Counter-Defendants fail to explain why contributory liability would not apply. Although
Counter-Defendants assert that vicarious liability does not apply in a footnote [674, at 19 n.9], they fail
fully to develop the argument. Because Counter-Defendants fail fully to explain why Counter-Plaintiff
may not proceed under vicarious and/or contributory liability theories, the Court addresses Counter-
Defendants’ central argument that there is no secondary liability under the relevant provision of the DMCA.
Counter-Defendants are free to fully develop any arguments with respect to vicarious and/or contributory
liability under the DMCA in any future motion before the Court. Because CDK sufficiently alleges primary
liability under the DMCA, as discussed below, CDK’s DMCA counterclaim would survive regardless of
whether CDK sufficiently alleged vicarious and/or contributory liability.
the actions of another.” Sony Corp. of Am. v. Universal City Studios, Inc., 464 U.S. 417, 435
(1984).11
Courts therefore have applied secondary liability principles drawn from copyright law to
claims brought under the DMCA. See, e.g., Gordon v. Nextel Commc’ns, 345 F.3d 922, 925 &
n.1 (6th Cir. 2003); Microsoft Corp. v. Silver Star Micro, Inc., 2008 WL 115006, at *8 n.8 (N.D.

Ga. Jan. 9, 2008) (citing Ellison); Rosenthal v. MPC Computers, LLC, 493 F. Supp. 2d 182, 190
(D. Mass. 2007) (citing Gordon). Counter-Defendants do not argue that these cases incorrectly
were decided. Rather, Counter-Defendants argue that these cases are distinguishable because they
relate to different provisions of the DMCA.
Although these cases do relate to different provisions of the DMCA, the Court sees no
reason that common law vicarious liability principles would apply to these provisions but not
Section 1205(a)(1). Counter-Defendants argue that the Court should not extend secondary liability
principals to Section 1201(a) because that provision created a distinct anti-circumvention right
under Section 1210(a) without any infringement nexus requirement. Thus, according to

Counter-Defendants, attaching a copyright context to this provision of the statute would be
improper. The Court disagrees. As noted by the Supreme Court in Sony, the secondary liability
principles applied in copyright law stemmed from more generally applicable common law
principles. Counter-Defendants have not identified any basis for concluding that such principles
do not also apply to Section 1201(a).12

11 Although CDK cites Sony and Goldwyn-Mayer, the Supreme Court cases setting forth these principles,
Counter-Defendants fail entirely to address these cases in their reply.

12 Although CDK has not cited any case finding a defendant liable under Section 1201(a)(1)(A) without
personally engaging in such misconduct, Counter-Defendants do not cite any case rejecting such a theory.
Counter-Defendants do cite GC2 Inc. v. Int’l Game Tech., which concluded that the DMCA “imposes
liability for violations by a defendant, not a third party.” 2018 WL 5921315, at *8 (N.D. Ill. Nov. 12, 2018).
However, that decision did not address secondary liability. Furthermore, the cited portion of that decision
In any event, CDK alleges facts sufficient to establish that Counter-Defendants themselves
circumvented a technological measure that effectively controls access to a work protected under
this title. Although it is true—as Counter-Defendants contend—that the use of valid
username/password combinations alone is insufficient to establish liability under
Section 1201(a)(1)(A) of the DMCA, Navistar, Inc, 2012 WL 4338816, at *5 (quoting Egilman v.

Keller & Heckman, LLP, 401 F. Supp. 2d 105, 112 (D.D.C. 2005)); see also Ground Zero Museum
Workshop v. Wilson, 813 F. Supp. 2d 678, 692 (D. Md. 2011) (recognizing same), CDK alleges
that Counter-Defendants Continental and Warrensburg did more than simply provide Authenticom
with valid passwords. Specifically, CDK claims that these Counter-Defendants took affirmative
steps—including the installation of computer programs and/or the use of other automated
programs—to circumvent CDK’s efforts to prevent Authenticom’s alleged unauthorized access of
its DMS. For example, CDK alleges that these Counter-Defendants worked to evade “blocking
by having new credentials created and/or by restoring disabled credentials—including on
information and belief by automated means.” [522 (Counterclaims), at ¶ 152.] These allegations

are sufficient to establish primary liability at the motion to dismiss stage. In re Dealer Mgmt. Sys.
Antitrust Litig., 362 F. Supp. 3d 558, 571 (N.D. Ill. 2019).
Counter-Defendants also argue that CDK conflates Section 1201(a)(1)(A) and
Section 1201(a)(2). As noted above, Section 1201(a)(1)(A) provides, in relevant part, that “[n]o
person shall circumvent a technological measure that effectively controls access to a work
protected under this title.” 17 U.S.C. § 1201(a)(1)(A). Section 1201(a)(2) states, in relevant part,
that “[n]o person shall manufacture, import, offer to the public, provide, or otherwise traffic in any
technology, product, service, device, component, or part thereof, that (A) is primarily designed or

addressed an issue that the court declined to address because the arguments were not sufficiently developed.
Id.
produced for the purpose of circumventing a technological measure that effectively controls access
to a work protected under this title.” Id. at § 1201(a)(2). According to Counter-Defendants,
Section 1201(a)(1)(A) “addresses the ‘conduct’ of actually circumventing a technological
measure, whereas [Section] 1201(a)(2) addresses the underlying process of how the circumvention
occurred.” [674, at 23.] Counter-Defendants therefore contend that Section 1201(a)(1)(A) does

not apply to them “as they did not engage in the actual act of the alleged circumvention.” [Id.]
However, Counter-Defendants misread the statute. Section 1201(a)(2) “prohibits devices
primarily designed to circumvent effective technological measures that limit access to a work.” S.
REP. 105-190, at 12 (emphasis added). Even if CDK cited the incorrect provision of the statute,
that would not mandate dismissal. Suarez v. W.M. Barr & Co., Inc., 842 F.3d 513, 518 (7th Cir.
2016). Regardless, as discussed above, CDK does allege that Continental and Warrensburg
engaged in conduct amounting to a circumvention of a technological measure.13
Finally, Counter-Defendants raise a number of additional arguments in support of the
dismissal of CDK’s DMCA counterclaim that were not raised in their initial motion to dismiss.

Specifically, Counter-Defendants argue that CDK has not sufficiently alleged “access to a work
protected” under 17 U.S.C. § 1201(a)(1)(A). Counter-Defendants also argue that their conduct is
exempted under 17 U.S.C. § 1201(f)(2). Because Counter-Defendants first raised these arguments
in their reply brief, the arguments are waived.14 West, 81 F. App’x 74, 75. Accordingly, the Court

13 Continental and Warrensburg focus on allegations that they improperly provided and/or used valid
username and password combinations. Again, while those allegations do not amount to DMCA violations,
they do not make otherwise prohibited conduct permissible. Furthermore, the fact that Authenticom used
automated programs to re-enable login credentials does not foreclose the possibility that Continental and
Warrensburg also engaged in the misconduct.

14 The Court notes that CDK filed a sur-reply touching on these issues. [691.] In the sur-reply, CDK
identifies reasons why these arguments fail. Although these arguments appear to be meritorious at first
glance, Counter-Defendants have not had the opportunity to respond to the arguments. The Court therefore
denies Counter-Defendants Continental and Warrensburg motion to dismiss CDK’s DMCA
claims.
IV. Conclusion
For the reasons set forth above, the motion to dismiss the counterclaims of
Defendant/Counter-Plaintiff CDK Global, LLC [593] is granted in part and denied in part.
Counter-Plaintiff is given until September 30, 2019 to file amended counterclaims consistent with
this opinion.

Date: September 3, 2019
Robert M. Dow, Jr.
United States District Judge

defers issuing a definitive ruling on these issues until they properly are presented to the Court at a future
stage of the case.
30

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/10141309. Public record. Not legal advice.