A civil CFAA claim for damages requires damage to computers, systems, or data — Schatzki v. Weiser Capital Mgmt, LLC, 2012 WL 2568973 (S.D.N.Y. July 3, 2012)
As I said in a previous post, we are seeing more activity dealing with the Computer Fraud and Abuse Act (CFAA). The CFAA is both a criminal and civil statute. The CFAA imposes criminal penalties on someone who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer” or “intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage.” A civil claim is available if, in addition to establishing the elements of a criminal violation, the plaintiff can show “damage or loss” as a result of the violation. The damage or loss must be at least $5,000.00.
Schatzki is the latest case to read the terms “damage” and “loss” narrowly. The defendants in the case allegedly obtained information from plaintiff’s computer systems without authorization and trafficked in computer passwords. This access enabled the defendants to obtain valuable private and confidential information about the plaintiff’s clients, the plaintiffs said. As a result, the plaintiffs had to hire consultants and incur legal fees.
The court said that the plaintiffs did not show the required “damage” or “loss,” and here’s why. The plaintiffs failed to allege that the defendants’ access to the computer system damaged the data accessed or the system itself, or that the costs to recover the system/data exceeded $5,000. The court also would not allow the plaintiffs to base their CFAA claim on other kinds of damages like lost profits, invasion of privacy, trespass to personal property, or misappropriation of confidential data.
LegalTXT Lesson: Quantify your damages if you are bringing a civil claim under the CFAA. Also, remember that the CFAA is more in the nature of an anti-hacking statute than an anti-misappropriation statute. Attempts to seek damages under the CFAA on a theory that someone gained access to electronic information and used it for improper purposes might not go very far.
