Computer Fraud Law Doesn’t Require Interrupted Service

Keep up with the latest developments and legal issues in the telecommunications and emerging technology sectors, with exclusive access to a comprehensive collection of telecommunications law news,...

By Alexis Kramer

A furniture company’s expenses for its response to an alleged hack of its employees’ e-mail accounts qualified as a “loss” under a federal computer fraud law even though the company’s computer service wasn’t interrupted, the U.S. Court of Appeals for the Eleventh Circuit ruled Jan. 25 ( Brown Jordan Int’l, Inc. v. Carmicle , 2017 BL 20954, 11th Cir., No. 16-11350, 1/25/17 ).

The costs incurred as a result of the violation need not be related to an interruption of service to be recoverable, the court said in an opinion written by Judge Susan Harrell Black affirming the lower court’s ruling. Courts have split on whether loss under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, must be the result of such an interruption.

The law prohibits the unauthorized access of a protected computer for purposes of obtaining information, resulting in a loss of at least $5,000 in value. “Loss” is defined “as any reasonable cost to any victim,” including costs of responding to the violation and revenue lost or costs incurred due to an interruption of service.

Separate Clauses

Plaintiff Brown Jordan International Inc. alleged that a former employee accessed other employees’s e-mail accounts without authorization, in violation of the CFAA. Defendant Christopher Carnicle argued that Brown Jordan didn’t suffer a loss from the alleged action, as defined in the statute, because he caused no damage to the company’s computer system nor an interruption of service.

According to the court, the U.S. Court of Appeals for the Fourth and Sixth Circuits have interpreted “loss” to include the costs of responding to the offense, regardless of whether an interruption of service occurred.

The 11th Circuit looked to Yoder & Frey Auctioneers Inc. v. EquipmentFacts LLC , 774 F.3d 1065 (6th Cir. 2014), in which the 6th Circuit ruled that the costs incurred from investigating the unauthorized access of an online auction satisfied the CFAA’s loss requirement even if there was no interruption of service. Plaintiffs may recover under the CFAA if they establish a loss of at least $5,000 in value, regardless of whether the loss is composed of costs identified in the statute’s first clause, the second clause or both, the Yoder court said.

The 11th Circuit said the plain language of the definition contains two separate types of loss. “The statute is written in the disjunctive, making the first type of loss independent of an interruption of service,” the court said.

To contact the reporter on this story: Alexis Kramer in Washington at aKramer@bna.com

To contact the editor responsible for this story: Keith Perine at kperine@bna.com

For More Information

Full text at http://src.bna.com/lG2

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Tech & Telecom on Bloomberg Law