{"id":28817,"date":"2026-04-24T08:33:10","date_gmt":"2026-04-24T15:33:10","guid":{"rendered":"https:\/\/blog.ericgoldman.org\/?p=28817"},"modified":"2026-04-24T08:34:47","modified_gmt":"2026-04-24T15:34:47","slug":"tenth-circuit-broadens-cfaa-loss-beyond-technological-harm-moxie-v-nielsen-guest-blog-post","status":"publish","type":"post","link":"https:\/\/blog.ericgoldman.org\/archives\/2026\/04\/tenth-circuit-broadens-cfaa-loss-beyond-technological-harm-moxie-v-nielsen-guest-blog-post.htm","title":{"rendered":"Tenth Circuit Broadens CFAA \u2018Loss\u2019 Beyond Technological Harm–Moxie v. Nielsen (Guest Blog Post)"},"content":{"rendered":"

by guest blogger Kieran McCarthy<\/a><\/p>\n

After the Supreme Court\u2019s first and only CFAA decision in Van Buren v. US <\/em>in 2021, I wrote that the Court<\/a> \u201ccould have done 10% more work here and provided clarity on very key questions\u2026.[but SCOTUS] declined the opportunity to do so. In the end, there are remarkably few clear, declarative sentences in this opinion that provide guidance for future cases.\u201d<\/p>\n

The Court intentionally left open many key questions. And so it should come as no surprise that there has been an emerging doctrinal divergence related to key concepts with the CFAA. Perhaps most notably, Courts have been applying the concept of \u201ctechnological harm\u201d in the CFAA differently in different circuits.<\/p>\n

In Van Buren<\/em>, Justice Barrett wrote:<\/p>\n

\u2026\u00a71030(a)(2) also gives rise to civil liability, \u00a71030(g), with the statute defining \u2018damage\u2019 and \u2018loss\u2019 to specify what a plaintiff in a civil suit can recover. \u2018[D]amage,\u2019 the statute provides, means \u2018any impairment to the integrity or availability of data, a program, a system, or information.\u2019 \u00a71030(e)(8). The term \u2018loss\u2019 likewise relates to costs caused by harm to computer data, programs, systems, or information services. \u00a71030(e)(11). The statutory definitions of \u2018damage\u2019 and \u2018loss\u2019 thus focus on technological harms<\/strong>\u2014such as the corruption of files\u2014of the type unauthorized users cause to computer systems and data. Limiting \u2018damage\u2019 and \u2018loss\u2019 in this way makes sense in a scheme \u2018aimed at preventing the typical consequences of hacking.\u2019 Royal Truck<\/em>, 974 F. 3d, at 760. The term\u2019s definitions are ill fitted, however, to remediating \u2018misuse\u2019 of sensitive information that employees may permissibly access using their computers.<\/p><\/blockquote>\n

Van Buren v. United States,<\/em> 141 S. Ct. 1648, 1659\u201360 (2021) (quoting 18 U.S.C. \u00a7 1030(e)(8), \u00a7 1030(e)(11)).<\/p>\n

Multiple district courts, especially in SDNY and the Northern District of California, began to interpret Van Buren<\/em> to demand that any CFAA \u201closs\u201d be tethered to technological harm. Meanwhile, some other district courts read the statute to allow any claim to proceed that included an allegation that a plaintiff had investigated an offense and incurred $5,000 in so doing.<\/p>\n

Where this comes up most consistently is in the context of an internal investigation related to alleged unauthorized access. Courts increasingly have disagreed about whether an internal investigation, untethered to \u201ctechnological harm,\u201d meets the standard for a qualifying loss under \u00a71030(e)(11). While not quite rising to the level of a circuit split, lower courts in the 2d, 3d, and 9th Circuits have increasingly required specific pleading at the motion to dismiss stage to allege that the internal investigation posited as a \u201closs\u201d was tethered to \u201charm to computer data, programs, systems, or information services.\u201d In the 5th, 7th, and 11th circuits, courts were much less inclined to require that specific pleading.<\/p>\n

—<\/p>\n

On Jan. 21, 2026, the Tenth Circuit became the first circuit court to squarely reject the CFAA interpretation that investigations must be tethered to technological harm. It did so with Moxie Pest Control (Utah), LLC v. Nielsen<\/a>, <\/em>and it concluded that investigative costs qualify as a CFAA \u201closs\u201d even when the plaintiff does not show or even allege \u201ctechnological harm\u201d like corrupted data or damage to systems.<\/p>\n

According to the Tenth Circuit, under \u00a7 1030(e)(11)\u2019s plain text, any reasonable cost of responding to an offense<\/em> qualifies.<\/p>\n

—<\/p>\n

This was the general divide that had emerged around the country pre-Moxie<\/em>.<\/p>\n

The first camp suggests that costs must be tethered to clear evidence of technological harm to qualify as a loss.<\/strong><\/p>\n

The courts in this camp do not reject investigative costs as a category. But conclusory pleadings related to investigations in the absence of technological harm often get dismissed. These courts have demanded specifics about what was done, why the investigation was necessary, how it ties to the intrusion, and evidence that the \u201closs\u201d was tethered to \u201charm to computer data, programs, systems, or information services.\u201d<\/p>\n

Many recent decisions have been pushing in that direction:<\/p>\n