Tuesday, May 14, 2013

7th Circuit dismisses CFAA civil claim for failure to satisfy $5,000 loss requirement

This case focuses a bit more on the civil side of the Computer Fraud and Abuse Act (CFAA). In Modrowski v. Pogatto, the Seventh Circuit Court of Appeals demonstrates the importance of the value requirement of a civil suit under the CFAA. 18 U.S.C. § 1030(g) states, in relevant part, that

[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator . . . . A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages . . .
Thus, a claimant who wishes to bring a civil suit under § 1030(c)(4)(A)(i)(I), as the plaintiff did in this case, must show that a CFAA violation resulted in the “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.” Now, under the CFAA, “loss . . . aggregating at least $5,000 in value” may seem quite easy. The CFAA broadly defines “loss,” 18 U.S.C. § 1030(e)(11), as
any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.
As Modrowski demonstrates, the $5,000 loss requirement is essential to a civil claim under the CFAA, specifically § 1030(c)(4)(A)(i)(I). Leon Modrowski was fired as the property manager for TAQ Properties and Capps Management in 2008. During his employment, Modrowski had merged his personal and business Yahoo! email accounts. When Modrowski was terminated, the employer “locked” Modrowski out of his account, thus preventing Modrowski from accessing his personal e-mails. When access was finally granted, “Modrowski discovered that several years’ worth of his personal correspondence had vanished.” As a result, Modrowski filed numerous claims, including a civil suit under the CFAA.

The district court granted the defendant’s motion for summary judgment after Modrowski failed to amend his complaint “to elaborate on the economic harm caused by the defendant’s actions.” The district court found that Modrowski failed “to offer ‘any evidence in response to defendant[‘s] motion, let alone evidence sufficient to raise a triable issue of fact.’”

On appeal Modrowski argued that “his obligation to point to evidence in his favor was never triggered, because the defendants failed to meet their initial burden of production.” The court notes that the defendants did not attempt to provide “affirmative evidence that negates an essential element of [Modrowski’s] claim,” but were attempting, successfully, to “following a ‘somewhat trickier’ path to summary judgment by asserting that the “[Modrowski’s] evidence [was] insufficient to establish an essential element of [Modrowski’s] claim.” The court’s focus on a “representative element of Modrowski's claims,” the $5,000 loss requirement, attempts to highlight the shortcomings of Modrowski’s argument
To prevail on his Computer Fraud and Abuse Act claim, Modrowski would have had the burden of proving that the defendants' actions “caused [a] loss . . . during any 1-year period . . . aggregating at least $5,000 in value.” 18 U.S.C. § 1030(c)(4)(A)(i)(I). Were the defendants aiming affirmatively to negate that element—say, by asserting that the evidence irrefutably showed Modrowski's injury totaled only $2,500—the absence of citations to the evidence on record would be problematic. But that was not the defendants' strategy. They asserted that, if the case went to trial, Modrowski would be unable to produce evidence sufficient to meet his burden of proving that his injury exceeded $5,000. Modrowski counters that he was under no obligation to conduct formal discovery, and this is certainly true. See Praxair, Inc. v. Hinshaw & Culbertson, 235 F.3d 1028, 1032 (7th Cir. 2000) (“Discovery is costly and in cases in which the stakes are small, or there is a clearly dispositive legal argument, forbearing to conduct discovery is not negligence.”). But once the defendants pointed out the gap that they believed existed in Modrowski's case, he was obliged to point to evidence that, if believed by the trier of fact, would be sufficient to show that his loss did in fact exceed $5,000. Modrowski could have come forward with affidavits from would-be business partners who were unable to contact him while he was locked out of his account; he could have submitted receipts reflecting the fees he paid to procure duplicates of lost financial and billing records; or perhaps he might have contented himself with a personal affidavit attesting to the number of hours he devoted to recovering his emails. See Butts v. Aurora Health Care, Inc., 387 F.3d 921, 925 (7th Cir. 2004) (court may consider self-serving affidavits at summary judgment if they are based on personal knowledge and set forth specific facts). Instead, he rested exclusively on his complaint, and this was plainly inadequate.
The $5,000 loss requirement for civil claims under the CFAA is a relatively broad requirement. However, as Modrowski highlights, a prospective claimant should be prepared to have some evidence that his or her loss can be valued at $5,000.

Interesting Note: Modrowski also brought a claim under the Stored Wire and Electronic Communications Act (18 U.S.C. § 2701) and the Federal Wire Tapping Act (18 U.S.C. § 2511). However, both were dismissed with prejudice by the district court because “Modrowski acknowledged that he voluntarily linked his personal account with the defendants' business account.”

Author's recommendation: Don't do that.

0 comments:

Post a Comment