District courts are divided as to whether there is a private right of action under the Computer Fraud and Abuse Act (CFAA) for persons whose computer service is not interrupted but who nevertheless incur costs (a) responding to a CFAA offense, (b) conducting a damage assessment, or (c) restoring computerized data or programs as they were prior to the offense. A Georgia U.S. district court judge recently sided with those jurists who hold that a service interruption is not required. Southern Parts & Eng’r’g Co. v. Air Compressor Services, LLC, Case No. 1:13-CV2231-TWT (N.D. Ga., Feb. 19, 2014).
Two employees of Southern, a manufacturer of air compressors, resigned and created a competitor corporation. Allegedly, both before and after their resignation, the two employees accessed Southern’s computerized confidential information, but the employees did not cause an interruption in the company’s computer service. Southern sued the employees in a Georgia federal court for violating the CFAA. The employees moved to dismiss on the ground that Southern had not sustained a compensable loss because no “interruption of service” had occurred. Acknowledging a split of authority, the Georgia judge ruled that a service interruption is not required, and so the motion to dismiss was denied.
A jurisdictional requirement under the CFAA is a “loss” of at least $5,000 caused by a violation of the Act. The CFAA defines a “loss” as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). Courts are divided as to whether the phrase “incurred because of interruption of service” (a) modifies “any reasonable cost to any victim,” or (b) applies only to “any revenue lost, cost incurred, or other consequential damages.”
Some judges have concluded that the CFAA provides for recovery of expenses resulting from “responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense,” regardless of whether there was an “interruption of service.” The other view is that an “interruption of service” is a condition precedent to any recovery.
The judge in the Southern Parts case adopted the former interpretation — “interruption of service” is not a prerequisite — as have judges in the Middle and Southern Districts of Florida, the Middle District of Louisiana, and the Southern District of Texas, and one judge in the Eastern District of Michigan. By contrast, judges in the Northern District of Florida, the Northern District of Illinois, the District of Maryland, and the Southern District of New York, and a different judge in the Eastern District of Michigan, disagree. (Those are not the only courts to have ruled on the issue.) Clearly, reasonable minds can differ!
The victim of a CFAA violation must demonstrate that it has incurred $5,000 in expense in a single year. In the absence of an “interruption of service,” there may be an opportunity for forum shopping. The victim might consider whether personal jurisdiction and venue would be proper in a court that allows CFAA suits to proceed even though no interruption occurred. If the victim selects such a forum, the alleged wrongdoer might consider the possibility of seeking to transfer the litigation either to a district that declines to adjudicate CFAA lawsuits when there has been no “interruption of service” or, at least, to a district that has not yet weighed in on the issue.