Opinion

UNITED STATES DISTRICT COURT

MIDDLE DISTRICT OF FLORIDA

TAMPA DIVISION

PROJECT TRAVEL, LLC,

a Delaware Limited Liability Company,

Plaintiff/Counter Defendant,

Lead Case No.:

8:24-cv-02817-WFJ-LSG

v.

Member Case No.:

8:25-cv-02967-WFJ-AAS

TERRA DOTTA, LLC,

A North Carolina Limited Liability Company

Defendant/Counter Claimant.

_____________________________________/

ORDER

Before the Court is Plaintiff/Counter Defendant Project Travel, LLC’s

(“Project Travel”) Motion to Dismiss. Dkt. 34.1 Defendant/Counter Claimant Terra

Dotta, LLC (“Terra Dotta”) has responded in opposition, Dkt. 39, and

Plaintiff/Counter Defendant replied. Dkt. 47. After careful consideration, the Court

grants in part and denies in part Project Travel’s motion to dismiss.

BACKGROUND

This dispute stems from an alleged pattern of misconduct by Defendant Terra

Dotta to undermine Plaintiff Project Travel’s business and steal its confidential and

1 All docket cites in this Order are to the Member Case—8:25-cv-02967-WFJ-AAS.

proprietary information. Dkt. 1 ¶ 1. Terra Dotta and Project Travel are direct

competitors that provide software platforms to universities to help students find

study abroad programs, arrange for travel and lodging, navigate visa requirements,

and enroll in international programs. Dkt. 29 ¶ 1.2 Terra Dotta is a North Carolina

limited liability company with its principal place of business in Chapel Hill, North

Carolina. Id. ¶ 16. Project Travel (d/b/a Via TRM) is a Delaware limited liability

company with its principal place of business in Denver, Colorado. Id. ¶ 17; but see

Dkt. 1 ¶ 11 (“Project Travel is incorporated in Delaware and has its headquarters

and principal place of business in Venice, Florida.”).

Notably, the instant action has been consolidated with Project Travel, LLC v.

Rowe, Case No. 8:24-cv02817-WFJ-LSG (the “Lead Case”), in which Project Travel

is suing a former employee, Jason Rowe, for allegedly misappropriating trade secrets

and sharing them with Terra Dotta. Dkt. 1 ¶¶ 2–4. Following Mr. Rowe’s departure

from Project Travel and subsequent hiring at Terra Dotta, Project Travel learned that

Terra Dotta had undergone a massive overhaul to its competing software. Id. ¶¶ 5,

6. Project Travel alleges these software changes are “plainly intended to mirror the

functions and features of [its own] software.” Id. ¶ 6. After Mr. Rowe joined Terra

Dotta, Project Travel claims that Terra Dotta accelerated the launch of this new

software by several months, and that it is “simply not feasible that Terra Dotta could

2 These paragraph citations refer to Terra Dotta’s counterclaims section of its answer. See Dkt. 29 at 16–42.

have radically changed its software in such a short period of time without the use of

Project Travel’s confidential information[.]” Id. Project Travel believes that Mr.

Rowe communicated confidential information to Terra Dotta while Project Travel

still employed him. Id.

After consolidation with the Lead Case, Dkt. 26, Terra Dotta filed an answer

and brought eight counterclaims against Project Travel, asserting: (1) unfair

competition under the Lanham Act, 15 U.S.C. § 1125; (2) common law unfair

competition; (3) breach of contract; (4) computer trespass under N.C. Gen. Stat. §

14-458; (5) violation of the Digital Millennium Copyright Act, 17 U.S.C. § 1201(a)

(“DMCA”); (6) unfair or deceptive trade practices under N.C. Gen. Stat. § 75-1.1

(“NCUDTPA”); (7) violation of the Computer Fraud and Abuse Act, 18 U.S.C. §

1030(a)(2)(C) (“CFAA”); and (8) abuse of process. Dkt. 29 ¶¶ 118–68.

In its counterclaims, Terra Dotta alleges that Project Travel surreptitiously

posed as a Terra Dotta customer to gain unauthorized access to Terra Dotta’s system

portal. Id. ¶¶ 63–86. Specifically, in early 2024, the University of San Diego

(“USD”) was a Terra Dotta customer, but subsequently switched to Project Travel.

Id. ¶ 63. While its contract with Terra Dotta was still active, USD allegedly added

Project Travel’s Vice-President of Operations, Trevor Stiegelmar, to the permissions

group for USD’s Terra Dotta portal. Id. ¶ 66. Mr. Stiegelmar then registered his own

credentials to access the portal. Id. ¶ 73. Terra Dotta avers it did not authorize Project

Travel’s access to its USD portal, id. ¶ 69, and that all users of Terra Dotta’s portal

agree to be bound by Terra Dotta’s Terms of Use. Id. ¶ 54. Those Terms forbid

unauthorized access to the portal. Id. ¶ 56. The Terms of Use also prohibit obtaining

confidential information from the portal. Id. ¶¶ 57–60. Notwithstanding those

Terms, Mr. Stiegelmar, under the auspices of USD’s account, allegedly accessed the

Terra Dotta portal a dozen times over ten days. Id. ¶ 76. While on the portal, Project

Travel’s executive allegedly obtained Terra Dotta’s confidential information,

including “the platform’s analytics capabilities, flexible brochure-building

capabilities, permissions system, and deployment rules.” Id. ¶¶ 79–81. Project

Travel supposedly used Terra Dotta’s information in furtherance of its own interests

when dealing with USD and other customers. Id. ¶¶ 82, 85.

Next, Terra Dotta claims Project Travel misrepresented its capabilities and

took credit for Terra Dotta’s accolades in the marketplace. Id. ¶ 104. In early 2025,

Project Travel submitted a bid to the University of South Carolina (“USC”). Id. ¶

105. In that bid, Project Travel stated that its International Student & Scholar

Services (“ISSS”) platform had been live for over five years. Id. ¶ 106. That

statement was allegedly false, as Project Travel launched its ISSS platform in late

2024. Id. Project Travel also reportedly provided a customer quote suggesting that

its ISSS platform had received positive feedback, but the customer was using Terra

Dotta’s ISSS platform, not Project Travel’s. Id. ¶ 109. Project Travel further

represented that it had never had a failed project, but it had reportedly previously

failed to complete a project it had with Dartmouth College. Id. ¶ 108. Based on a bid

replete with allegedly false representations, Terra Dotta claims USC decided to

purchase Project Travel’s platform instead of Terra Dotta’s. Id. ¶¶ 110–112.

On January 26, 2026, Plaintiff/Counter Defendant Project Travel filed the

instant motion to dismiss all of Defendant/Counter Claimant Terra Dotta’s

counterclaims under Federal Rule of Civil Procedure 12(b)(6). See Dkt. 34.

LEGAL STANDARD

Federal Rule of Civil Procedure 8(a)(2) requires a short and plain statement

of the claim showing that the plaintiff is entitled to relief to give the defendant fair

notice of the claims and grounds. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555

(2007) (citation omitted). The plaintiff is required to allege “more than labels and

conclusions, and a formulaic recitation of the elements of a cause of action will not

do.” Id. (citation omitted). In considering a Rule 12(b)(6) motion to dismiss, the

court must construe the facts in the light most favorable to the plaintiff. Wiersum v.

U.S. Bank, N.A., 785 F.3d 483, 485 (11th Cir. 2015). A complaint “must contain

sufficient factual matter, accepted as true, to state a claim to relief that is plausible

on its face” to survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 677–78

(2009) (citation modified). However, “[c]onclusory allegations, unwarranted

deductions of facts or legal conclusions masquerading as facts will not prevent

dismissal.” Jackson v. BellSouth Telecomms., 372 F.3d 1250, 1262 (11th Cir. 2004)

(citation omitted).

DISCUSSION

Plaintiff/Counter Defendant Project Travel raises a wide range of arguments

when seeking dismissal of each counterclaim. The Court, however, begins with some

preliminary matters before considering Project Travel’s substantive arguments as to

each counterclaim.

I. Preliminary Matters

a. Choice of law concerning common law claims

Project Travel begins its motion to dismiss by arguing that each of Terra

Dotta’s common law counterclaims—specifically, the unfair competition (Count II),

breach of contract (Count III), and abuse of process (Count VIII)—are governed by

Florida law. Dkt. 34 at 3. Terra Dotta disagrees, arguing that North Carolina law

should govern the disposition of these claims and that any choice-of-law analysis is

premature at the motion-to-dismiss stage. Dkt. 39 at 14, 16, 18. At this stage of the

proceeding, the Court agrees that it would be inappropriate to undergo a choice-of-

law analysis because there are outcome-determinative facts that are not yet before

the Court.

The Supreme Court has long held that a federal court sitting in diversity, as is

the case here for Terra Dotta’s state law claims, will apply the conflict-of-laws rules

of the forum state. Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941);

see also Dkt. 29 ¶ 18 (“This Court has subject matter jurisdiction . . . under 28 U.S.C.

§ 1332 because Terra Dotta and [Project Travel] are citizens of different states and

the amount in controversy exceeds $75,000.”). Applying Florida’s conflict of laws

rules, the State allows the application of another jurisdiction’s laws under the “most

significant relationship” test outlined in the Restatement (Second) of Conflict of

Laws. See Grupo Televisa, S.A. v. Telemundo Comm. Grp., Inc., 485 F.3d 1233,

1240 (11th Cir. 2007) (citing Bishop v. Fla. Specialty Paint Co., 389 So. 2d 999,

1001 (Fla. 1980)). That analysis, in turn, requires a review of a variety of factors

under section 145 of the Restatement, which often entails factual findings. Id. at

1240–41. The factors Florida courts consider are: “(a) the place where the injury

occurred, (b) the place where the conduct causing the injury occurred, (c) the domicil

[sic], residence, nationality, place of incorporation and place of business of the

parties, and (d) the place where the relationship, if any, between the parties is

centered.” Bishop, 389 So. 2d at 1001 (quoting Restatement (Second) of Conflict of

Laws § 145).

However, due to the fact-intensive nature of the most significant relationship

test, some district courts within the Eleventh Circuit have found that

“a choice of law analysis [is] inappropriate at the motion to dismiss stage.” Tufts v.

Hay, No. 6:18-CV-572ORL37DCI, 2018 WL 11249187, at *2 (M.D. Fla. Aug. 10,

2018) (collecting cases); see Onemata Corp. v. Rahman, No. 20-CV-62002, 2025

WL 2696584, at *5 (S.D. Fla. Aug. 13, 2025), report and recommendation

approved, No. 0:20-CV-62002-WPD, 2025 WL 2694794 (S.D. Fla. Sept. 22, 2025)

(collecting cases and finding “[a]t this dismissal stage, the Court need not conduct a

choice of law analysis and the Moving Parties’ request on this issue should be denied

as premature”).

In this case, reserving the choice-of-law analysis for summary judgment

seems the more prudent option, as the Court would have the benefit of a more

thorough record on each common law count. For example, the Court cannot conduct

a full choice-of-law analysis on the common law unfair competition claim in Count

II because there are insufficient facts to decide a basic factor like where the conduct

causing the injury occurred. Terra Dotta specifically alleges that Mr. Stiegelmar

orchestrated the unauthorized incursion into Terra Dotta’s USD platform on Project

Travel’s behalf, Dkt. 29 ¶¶ 66–68, 73–76, but there are no allegations about where

Mr. Stiegelmar was at the time of the alleged intrusions. Project Travel’s motion to

dismiss claims that the alleged conduct happened in Florida since Plaintiff is

headquartered there, Dkt. 34 at 4; see also Dkt. 1 ¶ 11, but Terra Dotta points to

Project Travel’s website, which states that Mr. Stiegelmar is based in Aurora,

Colorado, Dkt. 39 at 16 (citing We Are Via, Via, https://www.viatrm.com/about (last

visited Apr. 1, 2026)). Terra Dotta further argues that Project Travel’s principal

place of business is either in Michigan or Colorado. Dkt. 39 at 16; Dkt. 29 ¶ 17.3

This fundamental disagreement over where Project Travel’s principal place of

business is and where Mr. Stiegelmar is located prevents this Court from resolving

the choice-of-law issue at this time.

Similar issues arise in the breach of contract claim in Count III, as the Court

needs further factual development about Mr. Stiegelmar’s whereabouts when he

allegedly created an account and agreed to Terra Dotta’s Terms of Use. Dkt. 29 ¶¶

72–74. As to the abuse of process claim in Count VIII, Terra Dotta asserts that North

Carolina law applies because the injury occurred there, Dkt. 39 at 19, but the

allegations concern Mr. Rowe being subjected to a deposition by Project Travel, Dkt.

29 ¶ 164, and there are no allegations about where Mr. Rowe’s deposition was taken

or why North Carolina law should apply in an action filed in Florida and being

litigated in Florida. In short, the parties need discovery to explore these discrepancies

and other relevant facts in the choice-of-law determination. Therefore, the Court

defers the choice-of-law analysis on Counts II, III, and VIII to a later stage of the

proceeding. Project Travel’s motion to dismiss is denied as to these counts, but

Plaintiff is free to re-raise any of the substantive arguments made in its motion (as it

relates to these counts) at a later time.

3 Potentially complicating matters further is a previous order from this Court in the Lead Case, which noted that Mr.

Stiegelmar (on behalf of Project Travel) had countersigned a contract in Michigan. See Project Travel, LLC v. Rowe,

No. 8:24-CV-2817-WFJ-LSG, 2025 WL 807460, at *1 (M.D. Fla. Mar. 13, 2025).

b. Count IV—Computer Trespass claim

The other preliminary matter concerns Terra Dotta’s computer trespass claim

under N.C. Gen. Stat. § 14-458. As Project Travel correctly notes, Terra Dotta’s

computer trespass claim under North Carolina law is subject to a one-year statute of

limitations. Dkt. 34 at 19; see N.C. Gen. Stat. § 14-458(c); N.C. Gen. Stat. § 1-

539.2A(b); N.C. Gen. Stat. § 1-54; Glover Constr. Co., Inc. v. Sequoia Servs., LLC,

No. 18 CVS 1900, 2020 WL 3393065, at *8 (N.C. Super. June 18, 2020) (“Plaintiff’s

claim for computer trespass . . . has a limitations period of one year.”). In the

Eleventh Circuit, a “Rule 12(b)(6) dismissal based on a statute of limitations is

appropriate only where it is ‘apparent from the face of the complaint’ that the claim

is time-barred.” United States v. Henco Holding Corp., 985 F.3d 1290, 1296 (11th

Cir. 2021).

Here, Terra Dotta admits it learned of Project Travel’s alleged computer

trespass on March 13, 2024, and that Project Travel’s unauthorized access ended on

March 22, 2024. Dkt. 29 ¶¶ 76, 84 (“[Project Travel] continued to access the

platform until March 22, 2024, when Terra Dotta discovered the unauthorized access

and put a stop to it.”). Terra Dotta’s computer trespass counterclaim, filed on

December 22, 2025, is well past the one-year statute of limitations—a fact that Terra

Dotta concedes in its response. Dkt. 39 at 10 (“Terra Dotta concedes that its

standalone computer trespass claim is time-barred.”). Therefore, the Court grants

Project Travel’s motion to dismiss Count IV with prejudice as time-barred.

II. Count I—Lanham Act claim

Turning now to Project Travel’s substantive arguments for dismissal, Project

Travel contends that the Lanham Act claim in Court I should be dismissed for two

reasons: first, Rule 9(b)’s heightened pleading requirements applies to the Lanham

Act claim, and second, Terra Dotta failed to state a claim because “mere isolated

responses to state-issued requests for proposal (‘RFPs’) are not actionable

‘commercial advertisements’ under the Lanham Act.” Dkt. 34 at 5. The Court will

address both arguments in turn.

a. Application of Rule 9(b) standard

The elements of a false-advertising claim under the Lanham Act are: “(1) the

defendant's statements were false or misleading; (2) the statements deceived, or had

the capacity to deceive, consumers; (3) the deception had a material effect on the

consumers’ purchasing decision; (4) the misrepresented service affects interstate

commerce; and (5) the plaintiff has been, or likely will be, injured as a result of the

false or misleading statement.” Hi-Tech Pharms., Inc. v. HBS Int’l Corp., 910 F.3d

1186, 1196 (11th Cir. 2018) (citation modified). Rule 9(b) adds an additional

requirement to “state with particularity the circumstances constituting fraud or

mistake.” Fed. R. Civ. P. 9(b). If Rule 9(b) does apply, Terra Dotta must also allege:

“(1) the precise statements, documents, or misrepresentations made; (2) the time,

place, and person responsible for the statement; (3) the content and manner in which

these statements misled the Plaintiffs; and (4) what the defendants gained by the

alleged fraud.” Am. Dental Ass’n v. Cigna Corp., 605 F.3d 1283, 1291 (11th Cir.

2010) (citation modified).

As several district courts have noted, the Eleventh Circuit has not yet weighed

in on whether Rule 9(b)’s heightened pleading standard applies to Lanham Act

claims. See Epson Am., Inc. v. Safe Space Scan Tech. LLC, 2024 WL 4555880, at *3

(S.D. Fla. Sept. 13, 2024) (“I recognize that the Eleventh Circuit has not determined

whether Rule 9(b) applies to Lanham Act claims based on fraud.”), report and

recommendation adopted, 2024 WL 4554104 (S.D. Fla. Oct. 23, 2024); Warriors &

Fam. Assistance Ctr. LLC v. Trajector Inc., 2024 WL 4627134, at *2 (N.D. Fla.

Sept. 24, 2024) (“There seems to be no binding precedent on whether Rule 9(b)

necessarily applies to all Lanham Act false advertising claims or all FDUTPA

claims.”).4 In the Middle District of Florida, there is at least one district court that

has found “the weight of authority holds that a Lanham Act claim for false

advertising and a state-law claim for unfair competition need not be pleaded with

4 See also USA Nutraceuticals Grp., Inc. v. BPI Sports, LLC, No. 15-CIV-80352, 2016 WL 4254257, at *2 (S.D. Fla.

Feb. 16, 2016) (“However, BPI provides no cases from within this Circuit indicating that Rule 9(b) should be similarly

applied to claims pursued under the Lanham Act.”); ZAGG Inc. v. Ichilevici, No. 23-CV-20304, 2024 WL 5186468,

at *4 (S.D. Fla. Dec. 20, 2024) (collecting cases on the split in authority between district courts within the Eleventh

Circuit).

specificity.” Incarcerated Ent., LLC v. Warner Bros. Pictures, 261 F. Supp. 3d 1220,

1226–27 (M.D. Fla. May 10, 2017) (collecting cases).

Fortunately, this Court need not wade into the split over which pleading

standard applies, as Terra Dotta satisfies the heightened pleading requirements of

Rule 9(b). First, Terra Dotta has identified the precise misrepresentation it is

complaining about by alleging that Project Travel “submitted a response to a request

for proposal . . . from the University of South Carolina” and that Project Travel

falsely stated that its “ISSS platform had been live for over five years” when the

“ISSS platform had only been active since late 2024, and even then only in pilot

form.” Dkt. 29 ¶¶ 105–06; see also id. ¶ 108 (“[Project Travel] also inaccurately

told the University of South Carolina in its RFP response that Via had no failed

projects. [Project Travel] entered into a contract with Dartmouth College in 2022,

and yet by early 2025, [Project Travel’s] solution with Dartmouth still was not live

and had no go-live plan, despite Dartmouth having hired outside implementation

resources.”). Second, Terra Dotta alleges that Project Travel made these

misrepresentations to USC in early 2025 through an RFP. Id. ¶¶ 105–06. Third, Terra

Dotta explains that Project Travel’s actions confused and misled USC into buying

its platform instead of Terra Dotta’s. Id. ¶ 110; see also id. ¶¶ 111, 113 (“The

University of South Carolina would not have elected to do so if it had known that

the ISSS platform was untested and that [Project Travel] lacked experience in

supporting an ISSS platform. . . . The University of South Carolina also would not

have chosen [Project Travel] if it knew of the failure of [Project Travel’s]

implementation at Dartmouth.”). Fourth, Terra Dotta has alleged that, through its

alleged misrepresentations, Project Travel has suffered financial loss by losing

business from customers in this market. Id. ¶¶ 117, 124. Since Terra Dotta’s

allegations sufficiently alert Project Travel “to the precise misconduct with which

they are charged,” Ziemba v. Cascade Int’l, Inc., 256 F.3d 1194, 1202 (11th Cir.

2001) (citation modified), Count I satisfies Rule 9(b)’s heightened pleading

standard.

b. Failure to state a claim

Because Terra Dotta’s allegations are sufficient even under Rule 9(b), the

Court turns to whether Count I states a viable false-advertising claim under the

Lanham Act. A Lanham Act false advertising claim under 15 U.S.C. § 1125(a) arises

when “any person who, on or in connection with any goods . . . uses in commerce

any . . . false or misleading description of fact, or false or misleading representation

of fact, which . . . in commercial advertising or promotion, misrepresents the nature,

characteristics, qualities, or geographic origin of his or her or another person's

goods.” Suntree Techs., Inc. v. Ecosense Int’l, Inc., 693 F.3d 1338, 1348 (11th Cir.

2012) (citation modified); see 15 U.S.C. § 1125(a)(1)(B). To establish a prima facie

case of false advertising pursuant to 1125(a), the plaintiff must establish that the

alleged infringing conduct constitutes “commercial advertising or promotion.”

Suntree Techs., 693 F.3d at 1349. To make this determination, the representations

must be:

(1) commercial speech; (2) by a defendant who is in commercial

competition with plaintiff; (3) for the purpose of influencing consumers

to buy defendant’s goods or services. While the representations need

not be made in a classic advertising campaign, but may consist instead

of more informal types of promotion, the representations (4) must be

disseminated sufficiently to the relevant purchasing public to constitute

advertising or promotion within that industry.

Id. (citation modified). Project Travel argues that the fourth element has not been

sufficiently alleged. Dkt. 34 at 10. Specifically, Project Travel claims there are no

allegations that any misrepresentations have been disseminated to the relevant

purchasing public; instead, Terra Dotta only describes one RFP to a single customer.

Id.

Here, the Court agrees that a single RFP to a customer does not constitute

sufficient dissemination. To be considered “commercial advertisement or

promotion,” the information must have been disseminated to potential customers.

See Suntree Techs., 693 F.3d at 1349 (affirming summary judgment because

“Suntree also failed to present any evidence that the brochure was actually

disseminated to any potential customers”); Advisors Excel, LLC v. Scranton, 2014

WL 12543802, *6–7 (S.D. Fla. Sep. 15, 2014) (granting the motion to dismiss

because “while Plaintiff does allege dissemination through the internet, Plaintiff fails

to allege how long the video was posted, whether the video was posted on a public

or private website, any estimate of how many people saw the video, or any other

facts that could assist in measuring the breadth of the alleged dissemination”).

Although the Eleventh Circuit has stated that “where the customer market is

particularly small, courts may find a statement to be sufficiently disseminated . . .

even though only distributed to a few customers (or even one),” Suntree Techs, 693

F.3d at 1349 (citation modified), Terra Dotta has not alleged anything about the size

of its particular market of selling software services to higher education institutions

with study abroad programs. See EarthCam, Inc. v. OxBlue Corp., 49 F. Supp. 3d

1210, 1243 (N.D. Ga. 2014), aff’d, 703 F. App’x 803 (11th Cir. 2017) (citation

omitted) (granting summary judgment since “OxBlue has not presented any

evidence regarding the size of the market for high-end, megapixel construction

cameras and webcams,” and a single advertisement to “one customer does not

constitute ‘commercial advertising or promotion’ under the Lanham Act”).5

Therefore, the Court dismisses the Lanham Act counterclaim in Count I.

5 The Court also finds Terra Dotta’s citation to governmental bid cases to be unavailing and easily distinguishable.

See Dkt. 39 at 8–9 (citing Lockheed Martin Corp. v. Boeing Co., No. 6:03-CV-796, 2005 WL 729685, at *3 (M.D.

Fla. Mar. 21, 2005); Analytical Servs. & Materials, 299 F. Supp. 2d 565, 574 (E.D. Va. 2004)). Terra Dotta’s

allegations make it clear that its market is higher education institutions, not the federal government. See Dkt. 29 ¶¶ 1–

2.

III. Count V—DMCA Violation

Next, Project Travel claims that “Terra Dotta cannot state a claim under the

DMCA because the unauthorized use of passwords and user registrations to access

computer software [is] not [an] act[] of ‘circumvention’ of a technological measure

prohibited under the DMCA.” Dkt. 34 at 21. Terra Dotta pushes back, arguing that

Project Travel is attempting to “impose[] an additional and extratextual element onto

a DMCA claim.” Dkt. 39 at 20.

To state a claim under section 1201(a), plaintiff must allege that defendant (1)

circumvented (2) a technological measure that effectively controls access to a

protected work. See Burroughs Payment Sys., Inc. v. Symco Grp., Inc., No. 1:10-

CV-03029-JEC, 2011 WL 13217738, at *4 (N.D. Ga. Dec. 13, 2011) (citing 17

U.S.C. § 1201(a)(1)(A)). To “circumvent a technological measure” means “to

descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid,

bypass, remove, deactivate, or impair a technological measure, without the authority

of the copyright owner.” 17 U.S.C. § 1201(a)(3)(A). Importantly, the DMCA is “not

concerned with people exceeding the alleged limits of their authority once given

valid access.” Aeropost Int’l Servs., Inc. v. Aerocasillas, S.A., No. 09-23437-CIV,

2011 WL 13174672, at *6 (S.D. Fla. Mar. 31, 2011) (citing I.M.S. Inquiry Mgmt.

Sys., Ltd. v. Berkshire Info. Sys., Inc., 307 F. Supp. 2d 521, 531 (S.D.N.Y. 2004);

Egilman v. Keller & Heckman, LLP, 401 F. Supp. 2d 105, 112 (D.D.C. 2005)).

In this case, element two is not at issue, as Terra Dotta has sufficiently alleged

it had a technological measure—i.e., password protection—that controlled access to

its portal. Dkt. 29 ¶ 146; see Burroughs Payment Sys., 2011 WL 13217738, at *4

(quoting Universal City Studios, Inc. v. Corley, 273 F.3d 429, 440 (2d Cir. 2001))

(“[P]assword protection is a recognized ‘technological measure that effectively

controls access’ under the DMCA.”). Instead, the parties’ dispute is the first

element—whether Mr. Stiegelmar’s alleged behavior “circumvented” this

technological measure.

Here, the Court finds that Terra Dotta has failed to allege any “circumvention”

under the DMCA. While Mr. Stiegelmar did not have authorization to access Terra

Dotta’s platform provided to USD, he used his login credentials in the technological

manner authorized by Terra Dotta. See Dkt. 29 ¶¶ 66, 73, 76. On this point, the Court

finds Project Travel’s citation to I.M.S. Inquiry Mgmt. Sys., 307 F. Supp. 2d at 531

to be persuasive.

In I.M.S., the plaintiff was a company that collected advertising tracking

information, primarily for publishers and advertisers. 307 F. Supp. 2d at 523. One

of the services provided by the plaintiff was a web-based service that allowed its

customers to track magazine subscriptions online. Id. This service was available only

to the plaintiff’s clients, who were required to enter an authorized username and

password before accessing the website. Id. The defendant, a competitor that provided

similar advertising-tracking services, allegedly accessed I.M.S.’s website and copied

information for use in its own services. Id. The plaintiff alleged that the defendant

had obtained the username and password from a third party whom the plaintiff had

authorized to access the website. Id. The I.M.S. court found that, while the

defendant’s actions bypassed permission to access I.M.S.’s copyrighted works, the

allegations were insufficient because they were not a circumvention of the

technological means to protect the copyrighted material. Id. at 532. Several district

courts within the Eleventh Circuit have followed I.M.S.’s reasoning that using the

proper channel to access copyrighted work—even if one lacks the authorization to

do so—does not constitute “circumvention” under the DMCA. See Aeropost Int’l

Servs., 2011 WL 13174672, at *6; Flagstone Island Gardens, L.L.C. v. Ser, No. 11-

21865-CIV, 2011 WL 13223685, at *3 (S.D. Fla. Sept. 13, 2011); Burroughs

Payment Sys., 2011 WL 13217738, at *4.

Here, the material facts in I.M.S. are almost on all fours with the allegations

in this case. Terra Dotta alleges that Mr. Stiegelmar obtained administrative access

to its platform from a third party (i.e., USD), who Terra Dotta had previously

authorized to use its platform as a customer. See Dkt. 29 ¶ 66. Mr. Stiegelmar then

proceeded to “register and obtain access credentials” (i.e., create a username and

password), which allowed him to access Terra Dotta’s platform at least twelve times.

Id. ¶¶ 73–76. While Terra Dotta never authorized Project Travel to access its

platform, id. ¶ 69, there are no allegations that Project Travel “avoid[ed],

bypass[ed], remove[d], deactivate[d], or impair[ed]” the password-protection

measure placed on Terra Dotta’s platform. See 17 U.S.C. § 1201(a)(3)(A); see also

Flagstone Island Gardens, 2011 WL 13223685, at *3 (citation modified) (“[W]hile

Plaintiff alleges that Defendant was no longer authorized to use the

username/password combination, other courts have concluded that using a

username/password combination as intended—by entering a valid username and

password, albeit without authorization—does not constitute circumvention under the

DMCA.”); Burroughs Payment Sys., 2011 WL 13217738, at *6 (“[P]laintiff’s

allegations that defendant used a lawful password without authorization are

insufficient to state a claim upon which relief may be granted.”); Aeropost Int’l

Servs., 2011 WL 13174672, at *6 (“Here, the allegations are that Defendants used a

valid login and password to enter the website and to create another login, which they

were freely able to do without any technological impediment. . . . [T]he plaintiffs

allowed the defendants access to their website and left ‘freely’ available the ability

to create additional logins and passwords. The Court cannot say these allegations

sufficiently state a DMCA violation.”); iSpot.tv, Inc. v. Teyfukova, No. 2:21-CV-

06815-MEMF(MARX), 2023 WL 3602806, at *5 (C.D. Cal. May 22, 2023) (“The

[complaint] still only alleges that Teyfukova individually used the credentials in the

technological manner by which she was authorized to do so—albeit without

authorization. Indeed, the SAC still does not allege that Teyfukova took any steps to

avoid, bypass, remove, deactivate, or impair the . . . credentials.”).

Terra Dotta, however, resists this conclusion, arguing that Project Travel

“avoided or bypassed Terra Dotta’s password-protection by using credentials for

which it had no authorization.” Dkt. 39 at 22. True enough, but Mr. Stiegelmar using

credentials that he had no authorization to obtain is not the issue. The central issue

is whether the unauthorized use of an otherwise valid password constitutes

“circumvention” under the DMCA. On this issue, the district court in Burroughs

Payment Sys. explained it best with its “key” analogy:

[A] password issued by the copyright holder is like a key a homeowner

has made for its own lock. If the homeowner loses this key, or even if

it is stolen, one can hardly say that the person using it, while certainly

not authorized to enter, somehow “avoided or bypassed” the doorlock.

They actually used the doorlock in a manner intended by the lock's

technology. Applying this concept to the digital world, “[d]efendant did

not surmount or puncture or evade any technological measure to [access

plaintiff's protected website without plaintiff's authorization] . . . ;

instead, it used a password intentionally issued by plaintiff to another

entity.” [I.M.S., 307 F. Supp. 2d at 532–33].

On the other hand, if the trespasser uses a “skeleton key” which is

ground to fit any lockset, the trespasser has “circumvented” the door

lock by opening the door through a means which the lockset, and its

creator, did not intend. In the digital world, when a defendant uses the

exact password created by a plaintiff for its digital lock, it does not

“avoid” or “bypass” the digital lock. However, when a defendant uses

some technology to open the digital lock, other than the password

specifically made for the digital lock, it is “avoiding” or “bypassing”

the digital lock [in violation of the DMCA].

Burroughs Payment Sys., 2011 WL 13217738, at *5. Therefore, Terra Dotta’s

counterclaim under section 1201(a) of the DMCA is due to be dismissed. Project

Travel’s motion to dismiss Count V is granted.

IV. Count VI—Unfair or Deceptive Trade Practices under N.C. Gen. Stat. §

75-1.1

Turning to the NCUDTPA claim in Count VI, Project Travel argues the claim

should be dismissed because Terra Dotta is merely restating its breach of contract

claim and fails to plead an “aggravating circumstance” that would support a claim

under NCUDTPA. Dkt. 34 at 12–15. In response, Terra Dotta asserts that its

computer trespass claim in Count IV is an alternative predicate for its NCUDTPA

claim, not solely its breach of contract claim in Count III, so the aggravating

circumstances requirement is not applicable. Dkt. 39 at 11–12. To the extent Terra

Dotta’s NCUDTPA claim is predicated on its computer trespass claim, the Court

finds Count VI survives dismissal.

As an initial matter, the Court dismissed Terra Dotta’s computer trespass

counterclaim as time-barred. However, “UDTPA is clearly governed by a four-year

statute of limitations,” and “North Carolina case law indicates that the UDTPA

statute of limitations applies to a UDTPA claim regardless of whether that claim is

predicated on a different substantive claim governed by a different statute of

limitations.” Bland v. Carolina Lease Mgmt. Grp., LLC, No. 23-1367, 2024 WL

2012487, at *2 (4th Cir. May 7, 2024) (citing N.C. Gen. Stat. § 75-16.2; Shepard v.

Ocwen Fed. Bank, FSB, 638 S.E.2d 197, 200 (N.C. 2006)). As such, while Terra

Dotta’s individual computer trespass claim under N.C. Gen. Stat. § 14-458 cannot

move forward; it can still be asserted as the predicate to Terra Ditta’s NCUDTPA

claim.

“In order to state a claim under the UDTPA, a plaintiff must show (1)

defendant committed an unfair or deceptive act or practice; (2) the action in question

was in or affecting commerce; and (3) the act proximately caused injury to the

plaintiff.” Ellis v. La.-Pac. Corp., 699 F.3d 778, 787 (4th Cir. 2012) (citation

modified). The only element at issue is whether Terra Dotta sufficiently alleged an

unfair or deceptive act—that is, whether Terra Dotta stated a claim for computer

trespass. Because Terra Dotta asserts that computer trespass is the predicate unfair

or deceptive act under the NCUDTPA, Terra Dotta must have alleged the following

two elements under N.C. Gen. Stat. § 14-458: “(1) a person must ‘use a computer or

computer network without authority,’ with (2) the intent to engage in one of the

enumerated prohibited actions.” Rel. Ins., Inc. v. Pilot Risk Mgmt. Consulting, LLC,

No. 22 CVS 4285, 2024 WL 3549145, at *44 (N.C. Super. July 12, 2024) (citation

omitted). For purposes of this statute, “a person is ‘without authority’ when . . . the

person has no right or permission of the owner to use a computer, or the person uses

a computer in a manner exceeding the right or permission[.]” N.C. Gen. Stat. § 14-

458(a).

Additionally, North Carolina state courts have ruled that a violation of N.C.

Gen. Stat. § 14-458 “can occur even where the defendant’s initial access to the

computer at issue was authorized.” Miller v. RedGoose, L.L.C., No. 23 CVS 25675,

2024 WL 4892114, at *5 (N.C. Super. Nov. 26, 2024); see also Pilot Risk Mgmt.

Consulting, 2024 WL 3549145, at *45 (finding that “Former Employees ‘used’ [the

plaintiff’s] computers in a manner exceeding their rights or permission” after leaving

the company). Federal district courts in North Carolina interpreting the computer

trespass statute have reached a similar conclusion, finding that “[a]ny greater

utilization of that access would exceed his ‘right or permission,’ thus qualifying as

‘without authority’ for purposes of the North Carolina computer trespass statute.”

CHGYM LLC v. Unify Athletics, LLC, No. 1:21CV911, 2022 WL 112208, at *5

(M.D.N.C. Jan. 12, 2022) (citing N.C. Gen. Stat. § 14-458(a)); see McKeown v.

Tectran Mfg., Inc., No. 5:17-CV-00109, 2018 WL 2207139, at *3 (W.D.N.C. May

14, 2018).

Here, Project Travel contends that there are “no facts showing that Project

Travel accessed Terra Dotta’s platform ‘without authority,’ which is a fundamental

requirement under the statute.” Dkt. 34 at 19. The Court disagrees, as ample

allegations make it clear that USD—not Terra Dotta itself—provided Mr. Stiegelmar

with administrative access to Terra Dotta’s portal. See Dkt. 29 ¶¶ 68, 69, 76, 84. To

the extent Project Travel claims that Mr. Stiegelmar had permission to register and

create an account on Terra Dotta’s portal based on USD’s permission, “unlimited

access did not mean [Mr. Stiegelmar] had unlimited authorization.” CHGYM LLC,

2022 WL 112208, at *5. Mr. Stiegelmar’s twelve unauthorized logins to Terra

Dotta’s portal, which allegedly allowed Project Travel to view and copy Terra

Dotta’s proprietary systems, Dkt. 29 ¶¶ 41, 76–85, undoubtedly “exceed [Mr.

Stiegelmar’s] ‘right or permission,’ thus qualifying as ‘without authority’ for

purposes of the North Carolina computer trespass statute.” CHGYM LLC, 2022 WL

112208, at *5. Thus, the Court finds that Terra Dotta has sufficiently alleged

computer trespass as a predicate act for its NCUDTPA claim. Project Travel’s

motion to dismiss Count VI is denied.

V. Count VII—CFAA Violation

Finally, turning to the CFAA claim in Count VII, Project Travel challenges

the adequacy of Terra Dotta’s allegations. Specifically, Project Travel continues to

assert that “Terra Dotta does not allege facts showing Project Travel lacked

authorization or exceeded its authorization in using Terra Dotta’s platform.” Dkt. 34

at 23. Again, the Court disagrees and finds that Count VII survives dismissal.

Although primarily a criminal statute, the CFAA provides a civil remedy to

any person who suffers damage or loss as a result of a violation of the statute. See

18 U.S.C. § 1030(g). To recover, Terra Dotta must allege that Project Travel “(1)

intentionally ‘accessed’ a computer, (2) lacked authorization or exceeded his

authorized access to the computer, (3) obtained information from the computer, and

(4) caused a loss of at least $ 5,000.00[.]” Clarity Servs., Inc. v. Barney, 698 F. Supp.

2d 1309, 1313 (M.D. Fla. 2010) (citing 18 U.S.C. 1030(a)(2)(C)). The only element

at issue is whether Terra Dotta sufficiently alleged that Project Travel lacked

authorization or exceeded its authorized access. See Dkt. 34 at 23. While the CFAA

does not define “without authorization,” it does state that “exceeds authorized

access” means “to access a computer with authorization and to use such access to

obtain or alter information in the computer that the accesser is not entitled so to

obtain or alter[.]” 18 U.S.C. § 1030(e)(6); see EarthCam, 703 F. App’x at 808

(citation omitted) (“[O]ne of the lessons from [prior precedent] may be that a person

exceeds authorized access if he or she uses the access in a way that contravenes any

policy or term of use governing the computer in question.”); Van Buren v. United

States, 593 U.S. 374, 396 (2021) (“[A]n individual ‘exceeds authorized access’ when

he accesses a computer with authorization but then obtains information located in

particular areas of the computer—such as files, folders, or databases—that are off

limits to him.”).

Here, there are numerous allegations that Project Travel lacked authorization

to access Terra Dotta’s platform, and even if Project Travel did have authorization

via USD, Mr. Stiegelmar allegedly exceeded that authorization by logging in at least

twelve times to view proprietary information about Terra Dotta’s platform and

systems in violation of Terra Dotta’s Terms of Use. Dkt. 29 ¶¶ 54–60, 68–76, 83.

Indeed, to register and obtain access credentials, Mr. Stiegelmar agreed to be bound

by the Terms of Use, id. ¶¶ 54, 74, and while accessing the platform, Project Travel

allegedly “conducted other activities that the Terms of Use explicitly prohibited,

including: a. Harvesting Contact and Personal Information; and b. Accessing Other

Portal Information.” Id. ¶ 83. Accepting the factual allegation as true, as the Court

must at this stage, Terra Dotta has adequately alleged that Project Travel, at a

minimum, exceeded its authorization when it viewed and “obtained confidential and

proprietary information about Terra Dotta and its platform” in violation of its Terms

of Use. Id. ¶¶ 81–85; see Power Equip. Maint., Inc. v. AIRCO Power Servs., Inc.,

953 F. Supp. 2d 1290, 1296 (S.D. Ga. 2013) (“Similarly, exceeds authorized access

simply means that, while an employee’s initial access was permitted, the employee

accessed information for which the employer had not provided permission.”);

Aquent LLC v. Stapleton, 65 F. Supp. 3d 1339, 1346 (M.D. Fla. 2014) (“In the

Amended Complaint, [the plaintiff] alleges that [the defendant] signed an offer letter

from [the plaintiff] that stated she was ‘required to keep such information

confidential during [her] employment and at all times thereafter and may use such

information only within the scope of [her] duties to the company,’ . . . The Amended

Complaint adequately alleges that [the defendant] exceeded her authorization.”).

Therefore, the motion to dismiss is denied as to Count VII since Terra Dotta has

sufficiently stated a claim under the CFAA.

CONCLUSION

Terra Dotta’s response requests that leave to amend be granted. Dkt. 39 at 24.

Because Terra Dotta’s Lanham Act and DMCA counterclaims are premised solely

on grounds unsustainable as a matter of law, any amendment would be futile. As

such, the Court declines to grant leave to amend those counterclaims and dismisses

them with prejudice. See Coventry First, LLC v. McCarty, 605 F.3d 865, 870 (11th

Cir. 2010) (finding leave to amend not required where amendment would be futile).

Accordingly, it is hereby ORDERED and ADJUDGED that:

1. Plaintiff/Counter Defendant Project Travel’s Motion to Dismiss, Dkt. 34, is

GRANTED in part and DENIED in part.

a. The Court DISMISSES with prejudice Counts I, V, and IV.

b. The Motion to Dismiss is DENIED as to all other counts.

2. Defendant/Counter Claimant Terra Dotta’s request for oral argument, Dkt. 40,

is DENIED as moot.

3. Plaintiff/Counter Defendant Project Travel must file a responsive pleading to

the remaining counterclaims within FOURTEEN (14) days of the date of this

Order.

DONE AND ORDERED at Tampa, Florida, on April 1, 2026.

/s/ William F. Jung

WILLIAM F. JUNG

UNITED STATES DISTRICT JUDGE

COPIES FURNISHED TO:

Counsel of Record