[eli]

Some courts have interpreted the definition of "unauthorized access" in the CFAA pretty broadly. That checkbox about WP Engine is arguably an "access control mechanism" since you can't access the site without checking it. Maybe it's a stretch but it's not that much of a stretch.

I could see a breach of contract argument too.

IANAL.

[throwup238]

IANAL either but I was under the impression that changed with the Van Buren v United States Supreme Court case [1]. If you register and accept a EULA, it’s no longer “unauthorized” access, regardless of whether you exceed EULA limits, as long as you’re using the authorized interface (as opposed to trying to get access to the servers via SSH or some other side channel). It’s not the criminal courts’ job to enforce access limits.

[1] https://www.law.cornell.edu/supct/cert/19-783

[arielcostas]

IANAL, not from the US either. But if you register, you are signing a legally-binding licence agreement. Doesn't lying or giving false information nullify this contract?

For example, if you register on wordpress.org while claiming you have no affiliation with WPE, but you did have any sort of affiliation, they could consider the contract null/void, and claim the access was unauthorised because the contract wasn't valid.

[throwup238]

The contract can be null and void but if you can still login, it’s not unauthorized access. The burden is on the company to pursue breach of contract. That’s my reading of the decision but again, IANAL.