This is a pretty bad headline. I don't know that i would characterize this as revived. The same 9th circuit who held last year that LinkedIn could not block hiQ from scraping public data, just got asked to reconsider the same case, except now there is additional precedent that SCOTUS says if you had permission to access the computer then it's not a violation of the CFAA (even if you are a shady corrupt cop). Hard to…
Also, the injunction preventing LinkedIn from blocking HiQ has nothing to do with the CFAA. LinkedIn can't block HiQ because HiQ is alleging that doing so constitutes tortious interference under California law. Again, whether it is or not hasn't been decided, it was only ruled that HiQ raised "serious doubts" as to whether that's the case. Were HiQ and LinkedIn not competitors, LinkedIn would be free to continue blocking HiQ.
The CFAA bit has to do with whether LinkedIn can sue HiQ under the CFAA; it's just an alternative to try to kill their business in the event they lose the tortious interference part. It's a federal law, so it may supersede the state level tortious interference laws. The issue at hand in that case is whether a user can be considered "unauthorized" without providing an affirmative form of authentication. I.e. does IP blocking someone and sending a cease-and-desist make them unauthorized, and does ignoring that cease-and-desist and circumventing IP blocks constitute "unauthorized access"? Or, more generally, does the CFAA protect systems that aim to keep specific people out, or only ones designed to only allow specific people in?
So at this point, it's "revived" in the sense that SCOTUS made a ruling, and the actual case can move forward to resolution. I expect it to end up in the Supreme Court.
I like the outcome of the 9th Circuit's decision, but their reasoning is horrid. The difference between a system that only allows 3 people in and a system that stops everyone except those 3 from logging is purely semantic. The former is far, far more common, but the difference is largely one of practicality. It's drastically easier to build a system that only allows 3 people in than one that keeps everyone else out. However, in their ruling it's perfectly legal to circumvent the banlist solution. It's only illegal to circumvent allowlist solutions.
It also seems incoherent with regards to DDoS attacks. Their stance is that sites that don't require authorization are open to the public (they are "entitled to access by a computer"), regardless of the method in which the public chooses to consume the information as long as it is via computer. A DDoS is a form of access, and their opinion is that companies cannot set terms around how you access their computers; therefore it would follow that since they can't "unauthorize" me, I am implicitly authorized to DDoS them. And if I'm not, where's the line between DDoS and not? Accessing public data can't be a crime; is accessing it in whatever the most expensive way for them to serve it to me a problem? I can make a scraper that pulls competitors prices from their site using their search bar and do it in the most inefficient way possible by iterating through all the character combinations to overwhelm their search infrastructure. Is their only recourse really to put that behind a login?
I don't see any way to read the CFAA under their opinion that makes any kind of sense. I agree, public data should be public, but it really should be addressed in another piece of legislature. This is just going to be an awful can of worms to open.