Snap-On v. O’Neill

by Gaurav Shetti and Philip Foeckler

In this case the plaintiff alleges unlawful access in violation of the CFAA. This case provides further insights into different legal arguments and interpretations regarding the CFAA, and best practices for EULA’s, through comparison with the Facebook v. Power Ventures reading, another case addressing allegedly unauthorized scraping of data.

Background

Plaintiff Snap-on provides electronic parts catalogues for clients in the automotive and heavy equipment industries. Customer gives raw data to the Snap-on and they in-turn create a searchable database with linked data and images. In 2007, one of the Snap-on’s clients, Mitsubishi, decided to move on the parts catalogue from Snap-on to O’Neil, a direct competitor of Snap-On and requested a copy of the database content. Snap-On demanded a one-time payment in exchange for the content, which Mitsubishi refused. In 2009 Mitsubishi gave O’Neill access to run a scraper tool on the catalog, causing Snap-On’s web site to crash twice,  despite efforts by Snap-On to block access.

The Case

In July of the same year Snap-on sued O’Neil alleging Computer Fraud and Abuse Act, trespass to chattels, unjust enrichment, breach of contract, copyright infringement, and misappropriation of trade secrets. (We will discuss the allegations that are most relevant in relation to the Facebook v. Power Venture case).

Under the licensing agreement which was signed between Mitsubishi and Snap-on, Mitsubishi would provide snap-on with details about the parts and snap-on would convert these details to a searcheable database. Snap-on would then license the finished system to Mitsubishi under this agreement. It also signed a web-hosting agreement with Mitsubishi to make the contents of this electronic data available through a website.

When Mitsubishi approached snap-on for a copy of its parts in electronic format, the parties disputed Mitsubishi’s ownership in the information stored on Snap-on’s database. (The database was not a finished product).

Discussion

Who can Can Authorize Access?

The key question on the Computer Fraud and Abuse Act claim was whether O’Neil’s access of the website was “without authorization”.  In this case the parties dispute whether Mitsubishi had authority to grant any access to the defendant in the first place, rather than whether the defendant had lost its access rights because of its actions. O’Neill argued that it was authorized by Mitsubishi to access data allegedly owned by Mitsubishi. Snap-On argued that its license agreement prohibits Mitsubishi from authorizing access to third-parties.

Unlike in the case of Facebook multiple contractual agreements were in play, which led the court to conclude that there was a genuine dispute of material facts. The web hosting agreement made Mitsubishi solely responsible for “authorizing security” but at the same time the license agreement limited the access to “individuals associated with dealers”.

One take-away from this case is that companies should be extremely consistent and clear when defining and communicating access authorization. One can argue that if Snap-On had included the access authorization provisions from the license agreement in its web hosting agreement that it may have been able to move for a summary judgement in its favor at this stage in the legal process. Instead, it had provided O’Neill a slim opening to move for summary judgement in the defendants favor.

Breach of Contract

While the plaintiff and defendant did not have a direct license agreement, Snap-On claims that O’Neill entered into and breached its EULA each time that O’Neill accessed the the website.

In the Facebook case the same claim was made, but on the grounds of the user having entered a “click-wrap” agreement when setting up the account. The user/defendant  was required to take an affirmative action in order to agree to the EULA and setup the account.

In the Snap-On case the user was not required to select a check box or click a button. Instead the EULA was hosted on the website and had to be discovered by the user/defendant.  Snap-On therefore did seek to enforce a “browse-wrap” agreement, which meant that courts have focused on establishing “whether the… user has actual or constructive knowledge of a site’s terms and conditions prior to using the site”.

After a thorough discussion of preceding cases the court found that it was reasonable to expect O’Neill to be aware of the EULA, since below the “enter” button, used to login, it was stated clearly and prominently that “the use of and access to the information on this site is subject to the terms and conditions set out in our legal statement [green button with arrow].

However, the EULA did not serve Snap-On well, because it also stated that “if the users signed a written license agreement… the written agreement will continue in effect and its terms will control over any inconsistent terms of this Agreement”. Since the court had already established a genuine dispute of material fact about Mitsubishi’s authorization to, this genuine dispute was now extended to the EULA.

So in thend, although the court did hold the browse-click valid, it had to conduct a much more complicated analysis than in the Facebook case. Considering the FTC had even considered “click-wrap” questionable in the Sears  reading, exclusively relying on “browse-wrap” may expose one to unnecessary doubts  as to whether the user was sufficiently informed of the EULA conditions. More importantly, the coordination of legal agreements could have been managed in a more consistent and cohesive manner, as the court denied summary judgement.

Trespass of Chattels

Both Snap-On and Facebook alleged that they incurred damages or loss, as they were either subject to the scraping or were blocking the scraping. However, their allegations were grounded in two different statutes.

Snap-On alleged “Trespass of Chattels” because it had experienced “network traffic spikes that crashed the system”. Because the court had already found that there was genuine dispute of material fact whether O’Neill had authorized access, it solely “ analyzed whether Snap-On showed adequate impairment or deprivation.”

Facebook’s costs were presumably less severe than those of Snap-On – in fact they were never enumerated. However,  the court found that “Section 502 sets no threshold level of damage or loss that must be reached to impart standing to bring suit. Under the plain language of the statute, any amount of damage or loss may be sufficient.”

While the courts found in favor of both Snap-On and Facebook it should be noted that the burden of proof was significantly higher for tresspass of Chattels and that “other courts have been more reticent to find a trespass where the intangible damage is speculative and minimal”. In the case of Snap-On, it had clearly enumerated and documented its costs, and defendants own employees had advised that “normal server traffic does not… load…and…request images n the numbers we are”.

Copyright Infringement

Snap-on argued that the “database structure” is entitled  to copyright protection and Snap-on owned the copyrights in the structure. The court went through the Feist analysis. In Feist, the court held that a “factual compilation is eligible for copyright if it features an original selection or arrangement of facts, but the copyright is limited to the particular selection or arrangement. In no event may copyright extend to the facts themselves. O’Neil argued that the “arrangement” or the database structure was obvious and was thus not entitled to copyright protection.

The court agreed with Snap-on asserting that factual disputes preclude summary judgement on copyrightability and ownership.

Case and References:

Snap-On Business Solutions, Inc. vs. O’Neil & Associates, Inc.
Feist v. Rural
FACEBOOK, INC. v. POWER VENTURES, INC., Dist. Court, ND California 2009
FACEBOOK, INC. v. POWER VENTURES, INC., Dist. Court, ND California 2010
In the Matter of Sears Holdings Management Corporation (Order)
In the Matter of Sears Holdings Management Corporation (Complaint)

This entry was posted in Uncategorized. Bookmark the permalink.