Court: In CFAA definition of "loss," "'and' means 'or'"

The Computer Fraud and Abuse Act (18 U.S.C. § 1030) criminalizes the unauthorized access of computers. In its original forms, it was only concerned with computers of the federal government and financial institutions but has since expanded to cover computers in interstate or foreign commerce. Civil suits may also be brought for loss attributable to the access. Many cases now concern an employer filing suit against a former employer who continued to access the company's network after going to work for a competitor.

It's a long statute complicated by its sentence structure. The first part of the statute, § 1030(a)(1), is only a sentence fragment, but contains 155 words and 16 commas. While commas are not necessarily bad, courts have struggled to understand whether certain conjunctions apply to only part (or the entirety) of a section.

In 2000, while working on CFAA revisions, it was proposed that the statute should better explain what "loss" meant (S. 2430, 106th Cong. § 2(4)(f) (2000)). The proposed language was:

the term "loss" includes—
(A) the reasonable costs to any victim of—
(i) responding to the offense;
(ii) conducting a damage assessment; and
(iii) restoring the system and data to their condition prior to the offense; and
(B) any lost revenue or costs incurred by the victim as a result of interruption of service.

Thus, it's clear that loss can include either damage from subsection (A) or (B). However, as passed, the statute reads:

the term "loss" means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.

Courts have held that the proposed section (A) losses become subject to the "interruption of service" requirement under the actual statute because of the "and" conjunction (highlighted in yellow). See, e.g., Nexans Wires S.A. v. Sark-USA, Inc., 166 Fed. Appx. 559 (2nd Cir. 2006); SKF USA, Inc. v. Bjerkness, 636 F. Supp. 2d 696 (N.D. Ill. 2009); General Sci. Corp. v. SheerVision, Inc., 2011 U.S. Dist. LEXIS 100216 (E.D. Mich. 2011).

In a recent case, however, the court (also the Eastern District of Michigan as in the citation above for the opposite proposition) held, "The 'and' means 'or.'" Dice Corp. v. Bold Techs., 2012 U.S. Dist. LEXIS 10727 (E.D. Mich. 2012). According to the court, it matches the proposed statute and the legislative history, and therefore the definition "is disjunctive."

The court's reasoning certainly makes sense, and the statute is much more effective as a result of this approach. It seems reasonable to me, however, to look at this a different way. Because the word "and" appears after "conducting a damage assessment," it is obvious that the section is separate and that the other "and" is simply providing an additional definition. Thus, the statute reads that "loss" is (A) and (B). That I know of, no court has accepted (or considered) that idea.