California Case Summaries

Allababidi v. Microsoft Corp. — Automatic-update consent defeats CFAA theory at screening

Unreported / Non-Citable

Case
Ehab Allababidi v. Microsoft Corporation, Tencent Cloud LLC, Tencent Holdings Limited, and Aceville Pte. Ltd.
Court
U.S. District Court — Northern District of California
Judge
P. Casey Pitts (Joseph R. Biden Jr., 2023)
Date Decided
2026-10-30
Docket No.
5:26-cv-10487-PCP
Status
Unreported
Topics
In forma pauperis screening, Computer Fraud and Abuse Act, authorization, RICO pleading, supplemental jurisdiction, leave to amend

Background

Ehab Allababidi, representing himself, sued Microsoft Corporation and several Tencent-related entities after an April 2026 Microsoft update allegedly locked him out of an encrypted hard drive. The full caption names Microsoft Corporation, Tencent Cloud LLC, Tencent Holdings Limited, and Aceville Pte. Ltd. as defendants. Allababidi alleged that the lockout deprived him of his only workstation, software he had written, legal work product, and a proprietary methodology he treated as trade secrets.

The complaint asserted federal claims under the Computer Fraud and Abuse Act (CFAA) and the Racketeer Influenced and Corrupt Organizations Act (RICO), along with California computer-access, unfair-competition, fraud, products-liability, negligence, and trespass-to-chattels theories. Because Allababidi sought to proceed in forma pauperis—without prepaying the filing fee—the court had to screen the complaint under 28 U.S.C. § 1915(e)(2). The court granted his fee application, his request for electronic-filing access, and his request concerning paper case-opening documents, but separately examined whether the pleading stated a federal claim and established subject-matter jurisdiction.

The Court’s Holding

Judge P. Casey Pitts dismissed the complaint with leave to amend. The CFAA theory failed because the pleaded facts did not show that Microsoft acted “without authorization,” an element of the provisions Allababidi invoked. Although he alleged that Microsoft knowingly transmitted an update that locked him out, he also alleged that Windows Update was turned on. The court treated that setting as consent to transmission of the update. The unwanted result of an authorized update therefore did not, on the facts alleged, establish unauthorized access or transmission under the CFAA.

The RICO claim also was inadequately pleaded. Allababidi attempted to supply supporting facts by referring to pleadings from a separate Northern District of Illinois action against some of the same defendants. Federal Rule of Civil Procedure 10(c) permits adoption by reference within qualifying pleadings, but the court explained that it does not allow a plaintiff to adopt allegations from a wholly separate lawsuit. Without those outside allegations, this complaint contained no facts supporting the asserted RICO enterprise, pattern, or conspiracy.

After dismissing both federal theories, the court declined supplemental jurisdiction over the remaining state-law claims. It did not resolve those claims on their merits. The conclusion set December 18, 2026—not November 18—as the deadline for an amended complaint and warned that missing that deadline would result in dismissal without further leave to amend. Thus, the order is a screening dismissal with an opportunity to replead, not a final merits judgment against every possible claim.

Key Takeaways

  • A plaintiff invoking the CFAA must plead the required lack of authorization; alleging harmful consequences from software that the user permitted to update is not enough by itself.
  • A complaint cannot rely on allegations located only in a different lawsuit, even when that action involves overlapping parties.
  • When the federal claims disappear at the outset, a federal court ordinarily may decline to keep associated California claims under supplemental jurisdiction.
  • Allababidi may amend by December 18, 2026; the order did not dismiss the case without leave at this stage.

Why It Matters

For technology companies and litigants, the order separates permission to transmit an update from a dispute about what the update later did. That distinction can be decisive under CFAA provisions built around conduct “without authorization,” although an amended pleading with materially different facts could require a new analysis.

The decision is also a practical pleading warning. Each federal complaint must contain its own supporting facts, especially for a demanding RICO theory. California claims were left for possible repleading or another forum rather than adjudicated, so practitioners should not describe this order as a ruling that the state-law theories themselves failed.

Read the full opinion (PDF) · Court docket

Scroll to Top