Intellectual Property Law

Damages and Losses Under the Computer Fraud and Abuse Act

By IBLS Editor

The Computer Fraud and Abuse Act define ?damage? as "impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. Sec 1030 (e)(8).  Likewise, CFAA defines ?loss? as ?any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.? Id., at (e)(11).

CFAA § 1030 (5) (A) is the best example of illegal conduct that require damages under CFAA.  For instance, this article requires that anyone that knowingly transmits information and intentionally causes damage to a protected computer; or anyone who intentionally accesses a protected computer without proper authorization and due to this conduct, he recklessly causes damages; or anyone who accesses a computer without authorization and due to this conduct causes damages to its owner is liable for his conduct under CFAA.  Subsection (B) establishes that any of the above conducts are actionable if they cause ?loss? to 1 or more persons during 1 year period, aggregating at least $5,000 in value. 

Hence, it is clear from the wording of the statute that under subsection (A) proof of damages, intentionally or recklessly caused, is required.  Yet, the addition of subsection (B) creates doubts as to whether a plaintiff has to prove both damages and losses for a successful claim under CFAA or if proving damages is sufficient.

The US District Court for the Northern District of Illinois, in Garelli Wong & Associates, Inc. v.  Nichols addressed this specific question (440 F.3d 418 (7th Cir. 2006)).  In this case, the plaintiff company sued the defendant, a former employee, alleging breach of contract claims and violation of CFAA.   The employee and the company had entered into an employment agreement containing a confidentiality clause.  The employee could not use the company?s customer information found in the company?s database.  Some time after, the employee resigned and started his own business whose activities competed with the plaintiff?s company.  Additionally, the employee caused some damage to the database and stole some customers? information.

The plaintiff company sued the employee and concertedly alleged violation of the employment agreement and of CFAA §1030(A).  After the employee filed a motion for summary judgment claiming that there were not damages or losses in this case, the court considered whether both damages and losses were essential requirements under CFAA § 1030 (A)(B).   

The employee relied on Airport Centers, LLC v. Citrin which held that copying or deleting e-mails or files from the company?s system was not enough for a civil action under CFAA.  Relying on Pacific Aerospace & Electronics, Inc. v. Taylor, the company claimed that misappropriation is considered to be damage or loss under CFAA. 

After a lengthy analysis of what damages and losses are under CFAA, the Court granted summary judgment for the employee.  The court held that both damages and losses are required for a valid civil action under CFAA. 

Full post as published by IBLS Internet Law Blog on April 07, 2008 (boomark / email).