Case Law
Structured notes on the decisions that actually govern this field — read, summarised, and linked back to the opinion.
Each note follows the IRAC form a lawyer already reads in: the issue the court had to decide, the rule it applied, its application of that rule to the facts, and the conclusion it reached. Every note carries short verbatim quotations from the opinion and a link to the full text on CourtListener, so nothing here has to be taken on trust.
These are summaries prepared by the Journal, not legal advice, and not a substitute for reading the opinion.
598 U.S. 617 (2023) · Supreme Court of the United States · decided May 18, 2023
Does Section 230(c)(1) of the Communications Decency Act immunize a platform against Anti-Terrorism Act claims premised on its algorithmic recommendation of terrorist content? And should the Court reach that question when the underlying complaint may fail on the merits regardless?
598 U.S. 471 (2023) · Supreme Court of the United States · decided May 18, 2023
Does a social-media company aid and abet an act of international terrorism under 18 U.S.C. § 2333(d)(2) when it knowingly allows a foreign terrorist organization to use its generally available platform and recommendation algorithms, but does nothing more? What must a defendant have aided and abetted — the terrorist organization generally, or the specific attack that injured the plaintiff?
593 U.S. 374 (2021) · Supreme Court of the United States · decided June 3, 2021
Does a person who is authorized to access a computer system "exceed authorized access" under 18 U.S.C. § 1030(e)(6) when he retrieves information he is permitted to retrieve but does so for a purpose forbidden by an employer policy or terms of use?
No. 23-132 (2d Cir. July 21, 2025) (published; no reporter citation recorded in CourtListener at the time of retrieval) · United States Court of Appeals for the Second Circuit · decided July 21, 2025
Does a global bank aid and abet a terrorist attack under JASTA when it keeps providing ordinary banking services to a lawful customer after the government tells the bank that the customer's product is being diverted to bombmakers?
117 F.4th 13 (2d Cir. 2024) · United States Court of Appeals for the Second Circuit · decided September 3, 2024
Where a plaintiff sues a foreign state under the FSIA's state-sponsored terrorism exception, may that state take an immediate collateral-order appeal from the denial of sovereign immunity by confining its appeal to rulings on other FSIA exceptions?
82 F.4th 74 (2d Cir. 2023), rev'd and remanded, 606 U.S. 1 (2025) · United States Court of Appeals for the Second Circuit · decided September 8, 2023
May Congress create personal jurisdiction over a foreign non-sovereign entity by declaring that specified post-enactment conduct will be 'deemed' consent to suit, consistent with the Fifth Amendment's Due Process Clause?
77 F.4th 667 (D.C. Cir. 2023) · United States Court of Appeals for the District of Columbia Circuit · decided July 7, 2023
Can a foreign bank that knowingly evaded U.S. sanctions and served as a state sponsor of terrorism's gateway to the dollar system be held secondarily liable to victims of an attack that state's guests later carried out?
31 F.4th 1180 (9th Cir. 2022) · United States Court of Appeals for the Ninth Circuit · decided April 18, 2022
Where a website's pages are open to anyone with a browser and no credential is required, does a cease-and-desist letter aimed at one scraper make its continued automated collection access 'without authorization' under the Computer Fraud and Abuse Act?
17 F.4th 930 (9th Cir. 2021) · United States Court of Appeals for the Ninth Circuit · decided November 8, 2021
May a privately owned foreign corporation that builds and licenses intrusion software to foreign governments invoke common-law conduct-based foreign sovereign immunity for operations its state customers direct, when it does not meet the Foreign Sovereign Immunities Act's definition of a "foreign state"?
14 F.4th 1213 (11th Cir. 2021) · United States Court of Appeals for the Eleventh Circuit · decided September 27, 2021
Is a mass shooting carried out on U.S. soil by a lone, self-radicalized attacker an act of "international terrorism" within 18 U.S.C. § 2331(1), such that social-media companies can be secondarily liable for aiding and abetting it? Does a foreign terrorist organization's after-the-fact claim of responsibility satisfy § 2333(d)(2)?
934 F.3d 53 (2d Cir. 2019) · United States Court of Appeals for the Second Circuit · decided July 31, 2019
Does 47 U.S.C. Sec. 230(c)(1) shield a social network from federal anti-terrorism liability where the plaintiffs allege it hosted a designated terrorist organization's pages and used algorithms to route that content to the eventual attackers? Does the use of matching algorithms take a service outside the statutory meaning of 'publisher'?
929 F.3d 1143 (9th Cir. 2019) · United States Court of Appeals for the Ninth Circuit · decided July 12, 2019
When an insurance policy excludes loss caused by "war" or "warlike action by a military force," does that exclusion reach violence committed by a non-state armed group, or does the insurance industry's customary usage confine both terms to hostilities between de jure or de facto sovereigns?
921 F.3d 617 (6th Cir. 2019) · United States Court of Appeals for the Sixth Circuit · decided April 16, 2019
Can victims of an attack by a self-radicalized domestic shooter recover under the Anti-Terrorism Act from social media companies whose platforms hosted the terrorist propaganda he consumed, where no defendant had any connection to the shooter himself?
844 F.3d 1058 (9th Cir. 2016), amending and superseding 828 F.3d 1068 (9th Cir. 2016) · United States Court of Appeals for the Ninth Circuit · decided July 12, 2016
Does a platform's cease-and-desist letter and IP block revoke authorisation under the CFAA, so that continued automated access is 'without authorization' even though the platform's own users consented to the defendant acting on their accounts?
828 F.3d 865 (9th Cir. 2016), amended and superseded on denial of rehearing en banc, 844 F.3d 1024 (9th Cir. 2016) · United States Court of Appeals for the Ninth Circuit · decided July 5, 2016
Does a person act 'without authorization' under 18 U.S.C. § 1030(a)(4) when, after the computer owner has revoked his credentials, he re-enters the system using the login credentials of a current employee who lends them to him?
748 F.3d 525 (3d Cir. 2014) · United States Court of Appeals for the Third Circuit · decided April 11, 2014
Where is a computer intrusion offence committed for venue purposes when the defendants, the servers they queried and the recipient of the data were all in different states, and none of them in the charging district?
928 F.2d 504 (2d Cir. 1991) · United States Court of Appeals for the Second Circuit · decided March 7, 1991
Does 18 U.S.C. § 1030(a)(5)(A) require proof that the defendant intended the resulting damage as well as the access, and does a user authorised on some networked computers 'access without authorization' when he exploits program defects to propagate a worm onto other computers?
315 F. Supp. 3d 1 (D.D.C. 2018) · United States District Court for the District of Columbia · decided March 30, 2018
Does the CFAA's access provision criminalise breaching a website's terms of service, and if it is read narrowly, may researchers who must create false tester profiles and scrape public pages still press a First Amendment challenge to it?
278 F. Supp. 3d 1165 (C.D. Cal. 2017) · United States District Court for the Central District of California · decided October 6, 2017
Does a policy exclusion for "war" and "warlike action by a military force" take its lay, dictionary meaning — so that any sufficiently violent armed conflict qualifies regardless of the combatants' sovereign status — or must the insured first prove the parties intended a narrower insurance-trade meaning?
175 F. Supp. 2d 367 (D. Conn. 2001) · United States District Court for the District of Connecticut · decided December 6, 2001
Does a United States district court have jurisdiction over Computer Fraud and Abuse Act, Hobbs Act, and access-device charges against a defendant who was physically in Russia throughout the alleged intrusion and extortion of a computer system located in the United States?
The scholarship behind these questions is in the peer-reviewed archive, and the subject hubs collect it by theme: international law, cyber warfare, and the private sector.