mr williamson whenever you're ready case illustrates how under similar thirty two thousand and eleven dollars michael thomas did something that he did every month he deleted backup files from click motives backup server as the i t administrator mr thomas was in charge  backups i clicked must including deciding when and how backups were created and deleted these backups had been created automatically according to a schedule that mr thomas himself had set and typically they would have been deleted automatically after a period of time again time period selected by mr noted this was dictated by clicking the only direction the company gave mr thomas regarding his back up to he was a single line in his employment agreement that said perform backups the company had no data retention policy that stated for how long it back ups must be kept the closest thing the government could point to was policy from employee handbook vaguely recalled by the click motive c t o saying quote or rather containing quote plenty of policies against the destruction of valuable the handbook itself was never introduce on this particular day mr thomas deleted all of the backup files on the backup server these are not all the backups the click motive had the systems that have been backed up maintain their own backups locally motive had never once needed to restore data from these backups and after mr thomas departure they had no i think under no need for them most importantly clear motive had never clearly limited mr thomas's duties or authority regarding how to maintain back though all of their trying to put a virus in his employer's computer system without violate the statute would it would violate  essentially making an unintended use of a computer system now an unintended use under philips is essentially causing the computer to do something or causing a program to do something that it wasn't intended to do and so in philips that was using a brute force hacking attack to to essentially throw the credentials at a computer until it found until it if it authorized the user of the rule is different is derived case the government cites the intended use standard that's not what happened in this case mr thomas used the ordinary functions of the computer to delete files that he had it is admitted under even by the government that at least under some circumstances he had the authority to delete he didn't use the indictment charged a valid offense correct in what sense do you mean well i'm asking you did you move to dismiss the indictment saying it didn't charge a crime your  there is no proof that mr thomas well you're saying there is no evidence for the jury to have found what he did but you didn't object to the indictment and you didn't ask for any jury instructions that say for example access authorization equals access we did ask for a week to ask for a jury instruction on the topic of authorisation your honor we asked for it you have been presented to us that is an error we did not we did not raise it in our in our opening brief ok so what we've got here is were you able to make the argument you're making to us now to the jury did they hear it in disbelieve it in when i read the record you did you put your easement eastham and he made just the argument you're making now which is that mr thomas was in the words you used in closing argument he had the keys to the kingdom all he was doing was wiping out stuff that was bad for the company sometimes you got to wipe it all out but the jury didn't believe him and he was cross examined the cross examination hit home your honor our argument here is not that mr thomas that the evidence shows that mr thomas did things that he believed were good for click motive rather it's that as a matter of law given mr thomas all right this is say as a matter of law i don't see how you're arguing a sufficiency issue you should have asked for a jury instruction that said authorization has the meaning i'm telling you it has which is if the man has access and a five crime can't occur he's an insider it's only aimed at outsiders and then the jury asked these various notes about what impairment wasn't in you guys said we'll use the instructions you've already given them so so it seems like the governor was free to argue he didn't have permission and they put on the company people and admittedly no manual and all that but they basically said he had the benefit the company story here is that jury hears his admissions to the f b i agent that he wanted to make troubles for a successor it's just a pure jury question to the upper mission or didn't and you put your expert on to say yeah he had the keys to the kingdom that was permission they just didn't believe that to us i want to know sort of cut to the core of the this whole case turns on the phrase without authorization ari how can you read without authorization to not apply to intentional creation of damage your honor as we are going to brief the concept of damage that's right your honor when when when one deletes an e mail from their inbox they're intentionally causing death they're not intentionally creating damage there your honor because damage is defined as any impairment to the availability of that and when they delete that e mail that e mail is no longer available the at the availability of it is impaired in courts courts have have accepted that there is authorized damage in an authorized if if damage was necessarily unauthorized or necessarily construed as a violation of the statute then there would be no point in congress having included the term without authorization they could have simply said it is it is a violation of this statute to intentionally cause damage to a protected compute but the point is that some users are authorized to damaged computers damaged data within the meaning of the statute and that's a stretch of the term damage well unfortunately it's unfortunate for my claim your honor that congress chose a term damage that has loaded connotations for this concept but in fact your honor the definition of damage is merely about the impairment of it's the impairment to the accessibility of data or a system but that you did this case looks like a picture perfect case why there are limitations because you put on the expert the tried to say it looks like damage but it actually help this is exactly what the guy was hired to do he had unlimited access and over the weekend he ran into problems he wiped the virtual machine sometimes that's all you can do jury heard that but then the jury also heard no he wanted to mess his successor and we can infer guilty knowledge because he flees to brazil and email backups gone this gone that gone in the jury just had to make the decision about was this harm or was this authorized i t usage but again your honor courts have consistently have consistently acknowledged that damage is not necessarily harm that that damage merely means the impairment of the availability of data in there is  unauthorized damage i'm trying to understand your reading of the statute tell me what two questions what does the statute cover in your mind give me an example and two is it your view that no insider can be guilty under this provision no that's act the the distinction is that those who intentionally damage a system without authority should be punished regardless of whether they are authorized users in other words you can be authorized to access day on a computer but not to damage it not to delete any files not to modify any settings that isn't that that is a clear line that congress true in there's an employee who's not an i t person who just uses their email that would be someone who doesn't have authorization to go in and do all the stuff to the whole system that's right they wouldn't have authorization to delete any file from a server like motives but your so your interpretation depends on saying once you have for someone like your client who's in i t who has all this authorization you're basically saying they can't be prosecuted as i understand your i'm not saying that they're evil though although applying the rule adopted by various circuits including the  cases right they are your honor however they the term each of the prohibitions is is about access one is about access without authorization one is with about damage without authorization and congress gave no indication in the text of the statu that the term without authorization is intended to be construed definite differently in the access and damage cases in fact when the th circuit fruit st through this distinction and said we're not going to follow the nd the seven circuits rule that doing something harmful or contrary to the interests of your employer is necessarily a violation of authorization that th circuit case they were distinguishing wasn't a fight a case that's international airport and they didn't distinguish on the basis that access and damage cases are entirely different but it makes sense that accessing is saying you don't have authority to even get into the system just by accessing it it's a crime here no one is disputing that he could access it all a user can be authorized to cause damage and i wonder what possible theory would he have authorization to damage the computer system by deleting the automatic commands that would perform future backups trade secrets and confidential information he had access to was not found to have acted without authorization when he access those files for that improper purpose the point being that the c f a the term without authorization  because what if we just wiped out all the emails and some of these executives emails accounts your honor the question would be the limits placed on the scope of his authorization in this court could certainly find in some cases that there is a policy that clearly limited his the scope of his authorization but in this case your honor not just common sense and you seem to be saying that the burden is on the company to say don't delete all everyone's files that they're using don't you i mean why can't the criminal statute in order to inform doesn't occasional say terms like the forty permission or are given their common everyday meaning juries that's what they should look to they are given that's why courts don't often get damages defined statutorily but the other some of the other terms aren't and so the courts tell the jury just use your your common everyday understanding of that term they are given their common everyday meaning your honor and and the question is what what effective or what action did the employer that he admitted to the f b i he was could make life difficult for his successor no employer would ever think to say i need to write down in writing that you can't food with a computer system to undermine you replacement your honor the the employers in the united states he knows all in the th circuit united states in the nd circuit w e c carolina energy the miller in the th circuit all specifically said to employees you cannot do the specific thing that these employees were charged with doing which is misappropriating trade secrets misusing confidential information etc despite the common sense that those things were wrong and they shouldn't use their access for those purposes ok i think we have the  candor to note that i do believe the defendant did offer a jury instruction on without authorization and i think it said without authorization equals without permission or thord i would stand ready to be corrected on that that's helpful to know is that if they did not appeal the denial of that it sounds to me like that's their argument here i push it that player i just wanted to make sure that you appreciate it was appreciate me and i'm not saying that sarcastically i may be oversimplifying  that would be the issue had they appealed but if not if all this before sufficiency i just look at them putting the expert on the jury heard exactly the arguments that they're making is that i believe that's true and i was actually at the opening of my argument is that this at this issue this case at its core is presents a narrow facts a specific issue and that is whether to click motive gave mr thomas authorization because the damage that he caused over that weekend in december two thousand and eleven and the evidence that was put forward to the jury proved beyond a reasonable doubt that click motive did not provide him with that authorization it restricted his authority to cause damage on its systems through corporate policies and that therefore mr thomas was was acting without authorization and more importantly that he knew he was without authorization when he took his actions click motive hired mr thomas as you know to maintain its systems and to troubleshoot problems to keep systems on an operational click motive gave him the technical capability to take a wide variety of actions on its systems to preserve the integrity and operability of that system however it never provided mr thomas with unlimited authority to damage its systems and that's a critical point rather click motive defined as job responsibilities as protecting and supporting click motive systems and policies in place that prohibited destroying valuable company property and interfering with corporate processes and to the point about the policies it is true that they were not entered into evidence and that is because they were not available at trial click motive had been sold between the time of this incident and the time of trial which is roughly four and a half to five years and certain documents were not available however what was made available to the jury was the testimony of senior that was also supported by other members i think including mr gonzales who also tell us testified that certain actions were inconsistent with click mode of policy so that explains sort of what the state of what the policies were and how they were presented to the jury despite knowing these policies mr thomas intentionally damaged click motive systems in numerous ways including deleting over six hundred dollars backup files of customer data that click motive c t o said well i guess it's just that it is the policy concern which isn't necessarily our  focus but but is it just an issue of severity i mean how do you everyone does delete things all the time at the end of the day and if the employer turns around and says well our retention policy is keep everything are they all committing federal crimes the question your honor in their search two responses no one is you look at the statute it requires intentional causing of damage without authorization intentionally requires the government to prove beyond a reasonable doubt that the individual knew that they were violating corporate policy and still went ahead and caused the damage but i would also point out in this particular instance the facts show that mr thomas clearly knew that he was acting without authorization including for some of the points that were mentioned earlier his mission to the f b i agent as well as i would point out the turning off of the pager alert system which i think it's reasonable to infer that that action was meant to ensure that others in the company would not receive pager alerts and know the steps he was taking over the course of a weekend when no one or very few people were in the office so you consciously took steps to ensure that no one else made aware of his actions and that i think helps to show that he indeed did know that he himself was without authorization he also signed the employee handbook  the handbook that set forth the claims ploy you have to subjectively know or is it an object of any reasonable employee or than it the as it was we understand statute there must both be an action without authorization so an objective statement of this action was outside the bounds of authorization and also that the employee or the individual must know that they were acting without authorization so those two together and that i think is important to honor because some of the concerns of we set forth a five day is a very unusual aspect of section one thousand and thirty it applies to both insiders and to outsiders traditionally in other sections a to a four and a five b in a five c without authorisation is used to apply purely to outsiders to go to the hypothetical from earlier about the insertion of the virus into an employer system and you know into their employer system i would respectfully submit that's actually a five day is if the person was an insider at he must be applied equally across all of these different statute but we would argue that a five day is different if there's a critical element here is damage not access and those are different damages actually defined term and also here you're trying to encompass two separate categories of honour's in those cases without authorization wasn't always grappled with in the way it's been grappled with here but i think it's safe to say that many courts have looked at a fifty eight cases involving insiders and have had no trouble affirming convictions where the individual is obviously an insider and took some actions additional damage their systems oftentimes just before they they leave the company or they set traps in place and they put a virus in the system they put a corrupted malware a time bomb whatever and then they get fired or they leave in the box so this is the this issue about a five a has been addressed but this court may be something of a so i think the starting point here is that it is important to note that mr thomas did not have unfettered unlimited authority to damage and one of the cases that the defendant pointed to his nose hole and thousand and ten and in that case this court looks very clearly at the company policies that were in place that limited the employees ability to misuse data that they had and cited that as a one of the bases for finding that that person in that case acted exceeded authorized access it's not without authorization case but he was something where this court as many courts have done have looked to corporate policies to understand the limitations that are imposed on employees as to what they're authorized to do and with their own authorized to do so rather than look outside of the circuit that is the naturally the st came to me and you just addressing this point that the divide between the two sides is he's saying that the policies have to have said you can't do this and you seem to be saying well no it's enough the policy didn't authorize him to do this so with looking at the statutory language which  it's almost a burden question that i think are meant is that the policies here exist to the specific factual issue the policies here said very clearly you can't destroy valuable company property and interfere with business operations and i think when you marry that up next to the actions which i can do that would be helpful it shows that his actions clearly satisfied but let's say you had some small operation without policies you know no handbooks no policies couldn't there still be scenarios in which the statutes violent take my virus example there's no policies but one and that clearly be an intentional act to cause damage without a authorization you know honor it the burden would be on the government to prove that the defendant knew that he was acting intentionally that without authorization i would have to say it would depend on some of the facts of the nature of that relationship which does is one of the factors that was articulated in philips where they talked about the  prosecutors would be able to show if they felt they had a case to prove that they could say there was no way this person ever knew that this was authorized then as with any case where all the elements of the statute have been met that the jury believe the way he did the expert testimony on their side i don't think was as the jury found as strong as the expert on the government side as well as all the testimony of the click motive employees who talked about the steps that were taken the damage that was caused the weeks that were spent trying remediate the problem and the fact that mr thomas didn't have any authority to take those particular steps in that particular instance what in your view are the three most egregious steps he took this year on from the  disaster is the backup as we all know are the means by which you would then restore your capabilities this industry they worked in required that they maintain their customer's websites ninety nine nine percent of the time and so they were under significant pressure to honor i would also point to the pager alert and i hone in on that one in particular because i do think that had these alerts been triggered over the weekend the company could have intervened faster it would have been monday morning when they've learned of this it could have been to the government be upset with this company frustrated with his company and then he decided from that point forward to take steps to harm it including going so far as that weekend to meet with mr cain and another former employee and offer to help them with against corporate policy so testimony about what did he normally work weekends i believe there was testimony that because he was an i t department they were always on call available to help out issues as i said the systems have to be up and running all the time and guess it was the age him about his motive when we went is that he was upset and wanted to caution trouble for his he was upset at the at the company for taking this and or in order to cause a problem i believe there is testimony that he admitted to the f b i agent that he took certain steps he also noted that to his friend mr cain when they talk subsequently and he also had the sta the special agent in which he said i wanted to make it life harder for my successor and that i was frustrated and upset with the with the company i believe that all the testimony for the agents rapped about one paragraph mr thomas was acting or knew he was acting without authorization that very clearly undermines the ambiguity in the vagueness or any quirk at any level said the statute who intervened the closest is d drew and the without authorization or exceed to authorize access to view information essentially from and the court is very concerned about the breath of that and they said violation to the terms of service alone on a website shouldn't give rise to the arguments there have been with respect to the access side of the house if you will your honor not with respect a five day your are you from the field office or are you from a specialized unit in maine just on from especially zoom in which which is that computer crime an intellectual property section csub siana and also with respect to vegas we set forth there's many different cases where the courts have upheld even if it's possible to imagine a close case a close case doesn't  solution for a close case is proof beyond a reasonable doubt it's not the vagueness doctrine and we would of course hold that this was not the most case at all and with respect to ambiguity we put forth our arguments but citrin just for the court's knowledge it covers the various issues that we raised in our brief i'd be happy to answer any further questions are going to be further detail on any of these points are going to be helpful here and thank you very much a a an office manager at a company that has a computer abuse policy prohibiting personal use of the internet access to social media is that person browse his facebook for a few minutes every day to catch up on family matters in violation of these policy and then deletes their browsers history in order to prevent that violation from being discovered this is the sort of routine conduct that if the only question is  plains exactly this kind of conduct but it let's say you're right about that hypothetical that that would be a vagueness problem how do you get around the fact that since the johnson decision which found vagueness on a federal statute o and others have said you can bring a vagueness challenge if the statute is clear as to you you can't just give a hypothetical with another defendant that might pose a problem your my my point would be that the statute isn't clear  are both people who who who had authorization to you know delete files on the system that they were deleting files on and who knew that they were not acting in the company's best interests but nonetheless did not have reason to know that they didn't have authorization in this particular context and and it's the government cannot cannot identify any point on a range of sort of list let's go back to the example of the the pagers were disabled the day after there was a power outage in the facility causing several servers to cease to function appropriately the pagers would have continued alerting everyone else in the in the sort of technical chain of command of those errors until they were fixed mr thomas was active actively working to fix those problems and it's common to disable pagers mr mr myers testified if a pager alert went off then it might wake up his wife in the middle of the night and so the point is that the person closest to the problem is the person on the ground in a technical infrastructure which is mr thomas army taking care of those and disabling every single one of the cases cited by the government as examples where insiders were prosecuted under the statute were cases where the insiders authorization had been explicitly revoked prior to the damage being caused so in a couple of those cases and i  apologize though i recognize that might i don't recall which facts are from which case a couple of those cases the person had been terminated or had resigned and then sort of broke into the company systems and caused damage in a couple of the other cases they had planted essentially viruses to part time bombs to cause damage intentionally after they had left the company and so by the time that the damage was caused they were without authorization at all on the company systems and so those are examples where an insider has who had at authorisation to cause any damage some damage was was prosecuted for for causing damage follow the reasoning of the court that applied a limited definition of without authorisation in the access cases why is this different than all these consent based crimes trespass rape any number of things in the criminal law that turn on consent ultimately it's just a hard call as to whether there was permission and we just had competing versions of that issue and the jury made its determination why why is that wrong it's wrong for the same reason that