Court finds CFAA loss claim without actual damage

An Illinois federal court ruled in Farmers Ins. Exchange v. Auto Club Group, 2011 WL 4888889 (N.D. Ill. 2011) that a claim for damages under the Computer Fraud and Abuse Act (CFAA) can be brought for loss incurred as a result of an investigation into the CFAA violation, regardless of whether any actual economic damage occurred (such as destroying a hard drive with a hammer). This is an ongoing split across the country - whether there can be a loss when there is no damage, and the court here thoroughly evaluates both sides.

The court also provides a list of examples of damage that can be recovered under 18 U.S.C. § 1030. Damage is "any impairment to the integrity or availability of data, a program, a system, or information." As courts have found, that may include:

• Destruction, corruption, or deletion of electronic files
• Physical destruction of a hard drive
• Any diminution in the completeness or usability of the data on a computer system

And here is what doesn't count as damage:

• Mere copying of electronic information from a computer system - even giving to a competitor
• Disclosure of trade secrets
• Impaired the integrity of databases

This same conclusion that loss is possible without damage was upheld in EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001) (see also A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (4th Cir. 2009)). After a brief search, I found no circuit court has found to the contrary, though district courts across the country have done so.