The Computer Fraud and Abuse Act (“CFAA”) requires, among other things, that a plaintiff demonstrate a “loss” of $5,000 or more. See 18 U.S.C. § 1030(c)(4)(A)(i)(I).
In Animators at Law, Inc. v. Capital Legal Solutions, LLC, et al., Case No. 10-CV-1341 E.D.Va. (May 10, 2011) (unpublished) (TSE) two former employees of Animators’ abruptly left to join a competitor. Shortly thereafter, Animators’ president noticed that one of the former employee’s laptop containing sales and other confidential information was missing. Thus, Animators initiated an investigation concerning whether defendants copied, deleted, or otherwise misused Animators’ confidential information after leaving Animators’ employment, including an (i) outside forensic analysis, (ii) internal investigation, and (ii) outside counsel investigation. Capital Legal disputed whether the outside forensic analysis constituted a qualified loss under the CFAA, because Animators did not “actually pay” cash for these services, as well as the propriety of the other two investigations.
The District Court first noted that “hindsight must not guide such an analysis of whether such actions were reasonably necessary in response to a CFAA violation … perpetrators of unauthorized access should foresee that their actions may result in significant investigations and costs far exceeding the actual damage to the system.” The District Court then held that “the CFAA does not require losses to be paid for in cash. Indeed, a holding that CFAA losses must be reduced to a cash exchange would conflict with the principle that a CFAA plaintiff may recover damages for its own employees’ time spent responding to CFAA violations.” Finally, the District Court stated that it appears that well documented internal investigations and outside lawyer’s fees also “appear to be” qualifying losses: “[w]hile defendants may contend that [the outside lawyer] is not the appropriate person to oversee the investigation and response to the intrusion, given his high hourly rate and legal, rather than technical expertise, even a reduction or outright elimination of [the outside lawyer] charges would still leave Animators with well over $5,000 in qualified losses.”
Accordingly, apart from obtaining the return of their valuable data, the potential recovery of outside counsel fees under the CFAA, as well as computer forensic examiner fees, may provide a necessary element and a significant incentive to companies to pursue CFAA claims should their data be compromised by departing employees.