Frees, Inc. v. Phil McMillian, et al.
Civil Act. No. 05-1979 (W.D. La., August 6, 2007)
Lost Profits From Misuse Of Data Improperly Obtained Recoverable Under the CFAA
Court holds that under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. section 1030, the costs incurred by the owner of a computer system in retaining consultants to conduct forensic investigations of the use by defendants of the computer system, and the harm such use may have caused, constitute a “loss” within the meaning of the statute, which can be used to meet the CFAA’s $5000 jurisdictional threshold.
The Court further held that, under the CFAA, once the Act’s jurisdictional threshold has been met, the plaintiff can recover “compensatory damages” caused by the defendant’s violation of the Act. Such “compensatory damages” include lost profits and revenue caused by the defendants’ use of data improperly obtained in violation of the CFAA. Importantly, the court held that such lost profits can be recovered even in the absence of an interruption in service caused by defendants’ conduct.
Former Employees Use Data Obtained From Plaintiff’s Computers To Aid Competitor
Defendants McMillian and Pierceall were former employees of plaintiff Frees Inc., a company that manufactures and markets ventilation and dust control systems. Both defendants went to work for Southeast, a competitor of plaintiff. The complaint alleged that defendants improperly obtained proprietary data from plaintiff’s computer systems, which they used to assist Southeast in competing with Frees. Defendant McMillian was also alleged to have deleted data from Frees’ computers before he left its employ. As a result, plaintiff expended over $16,000 to engage computer consultants to conduct a forensic investigation of its computers, and the harm McMillian may have caused. Frees did not suffer any interruption of service as a result of defendants’ alleged misconduct.
Plaintiff commenced this suit, asserting claims under the Computer Fraud and Abuse Act, 18 U.S.C. section 1030. Plaintiff sought to recover both the funds expended in retaining the computer consultants, as well as the revenues it lost as a result of defendants’ use of its proprietary data.
Forensic Investigatory Costs Are Losses Recoverable Under The CFAA
Defendants moved to dismiss, or alternatively, to dismiss so much of plaintiff’s claim that sought to recover such lost revenues. The Court denied defendants’ motion.
To maintain an action under the CFAA, a plaintiff must sustain “damage” or “loss” as a result of a violation of the Act. The Act defines “damage” as “any impairment to the integrity or availability of data, a program, a system or information.” 18 U.S.C. Section 1030(e)(8).
If the plaintiff has not sustained “damage” within the meaning of the Act, he can only proceed with his claim if he sustained “losses” aggregating at least $5000 in value. 18 U.S.C. Section 1030(a)(B)(i). Under the CFAA, “loss” is defined as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. section 1030(e)(11).
The Court held that the costs Frees incurred in retaining computer consultants to conduct a forensic investigation both as to defendant’s computer activities, and any injury they may have caused, constituted a “loss” within the meaning of the statute. As these losses exceeded $16,000, plaintiff satisfied the jurisdictional threshold for a CFAA claim, and defendants’ motion to dismiss was accordingly denied. Said the Court:
Courts have consistently interpreted “loss,” both before and after the term was defined in the 2001 amendment, to mean a cost of investigating or remedying damage to a computer, or a cost incurred because the computer’s service was interrupted.
Lost Profit Recoverable Under The CFAA
More importantly, the Court held that Frees could recover the lost profits it allegedly sustained as a result of defendants’ use of data improperly obtained in violation of the CFAA to aid a competitor. Under the CFAA:
Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief.
The Court held that in interpreting this statute, it must be presumed that Congress used the phrase “compensatory damages” in its ordinary sense. As “compensatory damages” traditionally include lost profits of the type claimed by Frees, the Court held that Frees could proceed with a claim therefore under the CFAA. Importantly, to recover such lost profits, it was not necessary for the plaintiff to establish that they were caused by an interruption in service arising from defendants’ violation of the CFAA. Said the Court:
[W]ithout an express indication to the contrary, ‘compensatory damages’ must be interpreted to have its ordinary, established meaning, thereby allowing ‘lost profits’ as recoverable damages. … When a defendant copies unauthorized data to gain a competitive edge, it makes no sense to limit the plaintiff’s recovery when the lost revenue is a direct result of defendant’s misconduct.
It should be noted that the Circuit courts that have considered this issue to date have come to differing conclusions. The Ninth Circuit in Creative Computing v. Getloaded.com, LLC, 386 F.3d 930 (9th Cir. 2004) “held that loss of business and business goodwill constitutes recoverable damages under the CFAA.” However, the Second Circuit, in Nexans Wires S.A. v. Sark-USA Inc., 166 Fed. Appx. 559 (2d Cir. 2006) “excluded lost profits from the recoverable damages, stating … ‘ the plain language of the statute treats lost revenue as a different concept from incurred costs, and permits recovery of the former only where connected to an ‘interruption of service.’”