Jan
24
Narrow view of CFAA in N.D. Ill.
Posted by Dirk Avery at 1:41 pm under Internet, Trade Secret.
In a slip opinion (Garelli Wong & Assoc. v. Nichols, N.D. Ill., Jan. 16, 2008), Judge Kocoras dismissed a civil claim under the Computer Fraud and Abuse Act (CFAA) for failure to state a claim. Nichols, a former employee of Garelli Wong, allegedly took confidential information from GW’s database of “candidate and client activity tracking information.” GW had sought to maintain the confidentiality of the information. After Nichols resignation, he allegedly contacted a candidate using information only available in the database.
Judge Kocoras found that Garelli Wong must allege both “loss” and “damage” in a civil action under 18 U.S.C. § 1030(g). GW didn’t specify the CFAA section it relied on for the claim (oops) but the court helped out, pointing to § 1030(a)(5)(B)(i) which states: “by conduct described in clause (i), (ii), or (iii) of subparagraph (A), caused …loss to 1 or more persons.” Since (A)(i)-(iii) all require damage, the court found both to be necessary. Damage, according to the statutory definition, requires “impairment to the integrity or availability of data, a program, a system, or information.” § 1030(e)(8). “Loss” is “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service” § 1030(e)(11).
According to the court, GW could conceivably allege “loss” (even though it didn’t despite the very broad definition) but could not allege “damage.” The court went even further, stating that trade secret misappropriation alone does not rise to the statutory definition of “damage.” Damage could become the narrow gate through which civil CFAA claims must pass.
I get the feeling from the opinion that effective lawyering was no small part of the result.