2d Circuit decision on "loss" requirement in Computer Fraud and Abuse Act action

I usually don't bother commenting on unpublished circuit court decisions, particularly in circuits like the Second Circuit where you can't even mention them as precedent, but this one is worth noting.

In Nexans Wires S.A. v. Sark-USA, Inc., No. 05-3820-cv (2d Cir. Feb. 13, 2006), the Second Circuit issued an unpublished opinion (they call them "summary orders") affirming summary judgment against a plaintiff on its claim under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030 et seq. The CFAA is a neat little criminal statute, with an express but limited civil right of action, aimed generally at unauthorized access to protected computers with the intent to defraud or cause damage.

The key issue was whether the damage claimed by the plaintiff caused a qualifying "loss," as that term is specifically defined in the CFAA, of over $5,000 in any 1 year period. The plaintiffs claimed that the defendants misappropriated confidential data from their computers that caused the plaintiffs to lose over $10 million in profits. Well over the statutory threshold, right? Not so fast, said the court.

The CFAA defines loss as "any reasonable cost to any victim . . . and any revenue lost . . . because of interruption of service" from the unauthorized computer access. It was this last limitation on causation that did in the plaintiff. The court held that there was no evidence that the lost alleged $10 million in lost revenue was due to any "interruption of service." The plaintiffs' "Plan B" argument was that they spent $8000 to fly their German execs over to the US to investigate the defendants' misappropriation, but the court said there was no evidence that the German execs actually performed any computer investigation or repair, or any other type of preventative security measures, for that matter. Rather, the evidence was that they were in the US solely to assess the business loss associated with the misappropriation.

The moral is, remember this important limitation on the $5,000 loss threshold when assessing potential CFAA claims.