1 The Honorable Howard F. Sachs, United States District Judge for the Western District of Missouri. 

## United States Court of Appeals FOR THE EIGHTH CIRCUIT

___________ No. 04-3962

___________ United States of America, *
* Appellee, * * Appeal From the United States v. * District Court for the * Western District of Missouri. Thomas S. Millot, *
* Appellant. *

___________ Submitted: November 15, 2005 Filed: January 9, 2006

___________ Before SMITH, HEANEY, and BENTON, Circuit Judges.

___________ HEANEY, Circuit Judge. On June 15, 2004, a jury found Thomas S. Millot guilty of unauthorized computer intrusion, in violation of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a)(5)(A)(ii), (a)(5)(B)(i), a nd (c)(4)(B). The district court 1 sentenced Millot to three months of imprisonment, th ree months of home detention, three years of supervised release, a $5,000 fine, and restitution in the amount of $20,350. Millot appeals his conviction, senten ce, and restitution order, a lleging several errors by the district court. We affirm.-2- BACKGROUND

In 2000, Millot worked as a systems analyst in the Information Access Management Group for Aventis Pharmaceuticals. The Information Access Management Group managed the day-to-day computer security duties at Aventis’s Kansas City, Missouri facility. Millot wa s responsible for administration of the SecureID cards and accounts. A SecureID card is an active device that generates a number that, in combination with a username and personal identification number, allows Aventis employees to remotely acce ss the Aventis computer system in order to check email and perform other job-related functions. An employee’s remote access level depends on the individual’s responsib ilities for the company. As a systems analyst, Millot’s access level was the highest available.

Millot had the lead responsibility for disabling remote access accounts when individuals left employment and collecting and tracking returned SecureID cards. On or around August 2000, Millot reassigned the access account of former employee Gernot Fromm to one of the inventoried SecureID cards, and increased the account access level to the highest level available.

In October of 2000, Aventis Pharmaceuti cals outsourced its security functions to International Business Machines (IB M). Although several members of the Information Access Group weresubsequently hired by IB M, Millot was not offered a job with IBM, and left employment with Aventis in September 2000. When he left employment, he kept the SecureID card he assigned to the Fromm account. To keep the card active he periodically accessed th e network. Millot used the Fromm account to access the Aventis computer network nine times between August 26 and December 16, 2000. On December 16, 2000, he used the SecureID card and the Fromm account to log onto the Aventis syst em and delete Jeff Jernigan’s account. Jernigan was the manager of Technical Services for Aventis, and his ability to remotely access and monitor the network wa s essential to his job. December 16,3 2000, was a Saturday, and Jernigan unsu ccessfully attempted to access the Aventis system from his home. Although Geoffery Bridges was able to rebuild Jernigan’s account within a matter of hours, Jernigan continued to experience problems with his account for the following three weeks.

Bridges and Lori Meyer, former Aventis employees then working for IBM, performed the bulk of the activities in res ponse to Millot’s intrusion into the Aventis computer system. Bridges rebuilt the Jernig an account and investigated the intrusion while Meyer performed a security audit to verify that all existing access accounts belonged to current employees, and that each account’s access level was appropriate. Bridges spent 31 hours restoring Jernigan’s account and investigating the computer intrusion, and Meyers spent 376 hours on th e audit for a total of 407 hours. IBM billed its staff’s services at fifty dollars per hour, for a total cost of $20,350.

Investigators traced the unauthorized re mote access back to Millot’s personal internet access account. On March 3, 2003, Millot confessed that he had taken over the Fromm account, repeatedly contacted the Aventis computer system, and deleted the Jernigan account. The grand jury issued an indictment alleging that “it cost more than Five Thousand Dollars ($5,000) [to at least one or more persons] to conduct a damage assessment of, verify the security of, and restore the integrity of the Aventis network computer system.” (R. at 13.)

Millot admitted the underlying conduc t, but challenged the government’s allegation that the loss caused by his conduct amounted to the $5,000 minimum required for a conviction under the CFAA. Fo llowing a two-day trial, the jury found the loss exceeded $5,000 and found Millot guilty of the charged offense. His base offense level was 6, with a four-level e nhancement for loss more than $10,000 but less than $30,000, a two-level enhancement for abuse of position of trust, and a two-level adjustment for acceptance of responsibility. Accordingly, his adjusted offense level was 10 with a criminal history category of I, resulting in a sentencing range of 6 to 122 At the time of this writing, Millot has completed the three months of imprisonment and three months of home detention.

3 United States v. Booker , 543 U.S. 220 (2005).

4 Millot alleges several coro llary errors based on the assertion that IBM was not a victim and therefore should not have been named in the jury instructions. Since we find that the district court correctly in cluded IBM as a potential victim under the CFAA and the evidence was sufficient to show that IBM suffered harm as a result of Millot’s actions, we do not addre ss the remaining related issues.
4 months. On November 10, 2004, the district court sentenced Millot to a split sentence, at the bottom of the range , of three months of imprisonment, 2three months of home detention, and three years supervised release. The district court also ordered Millot to pay a $5,000 fine and $20,350 in restitution for the time spent by Bridges and Meyers. This appeal followed.

ANALYSIS

Millot alleges the government failed to prove damage of at least $5,000 because the district court erred in finding IBM a “victim” under the CFAA. He also alleges that the district court erred in sentencing him under the pre-Booker 3 mandatory sentencing guidelines, and that the restitution order also violated Booker

.

I. Millot’s Conviction Under the CFAA 4

To determine whether we should overturn Millot’s conviction, we must determine whether the district court prope rly classified IBM as a potential victim under the CFAA, and if so, whether the govern ment’s evidence was sufficient for a jury to find that the loss exceeded $5,000.5 We review the district court’s inte rpretation of a statute de novo, see United States v. Moore , 38 F.3d 977, 979 (8th Cir. 1994), and in reviewing a jury verdict, we “view the evidence in the light most favorable to the jury’s verdict, overturning it only if no reasonable jury could conclude that the government has proven all the elements beyond a reasonable doubt,” United States v. Cole , 380 F.3d 422, 425 (8th Cir. 2004).

Millot argues that any costs incurred by IBM should not have been considered in determining whether the loss amountedto the statutory minimum because the system was owned by Aventis and IBM wa s a “volunteer” fixing the system. This argument lacks merit. The CFAA provides for a fine and imprisonment up to five years for an individual who “intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage” and that conduct causes “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.” 18 U.S.C. §§ 1030(c)(4)(B), (a)(5)(A )(ii), (a)(5)(B)(i) (emphasis added). Although th e damage was done to the Aventis computer system, the statute does not restrict consideration of losses to only the person who owns the computer system, and the district court prope rly instructed the jury to consider losses sustained by IBM in determining whether the statutory minimum was met.

Next we address the sufficiency of th e evidence. Millot contends that the government’s evidence was insufficient to es tablish that the actual loss exceeded the $5,000 minimum, because there was no evid ence that IBM specifically billed Aventis the amount alleged. The Ninth Circuit addr essed a similar challenge in United States v. Middleton , 231 F.3d 1207, 1213-14 (9th Cir. 2000). There, the defendant argued that since salaried employees fixed the damage caused by the defe ndant’s conduct, the government could not prove th at the defendant had caused damage in excess of the $5,000 minimum. Id. The Ninth Circuit disagreed, stating “whether the amount of time spent by the employees and their imput ed hourly rates were reasonable for the repair tasks that they performed are questions to be answered by the trier of fact.” Id.6 at 1214. There, the value of the loss was calculated by multiplying the number of hours spent repairing the damage by an estim ated hourly rate based on the employees’ annual salary. Id. at 1213. The Ninth Circuit stated that “[t]here is no basis to believe that Congress intended the element of ‘damage’ to depend on a victim’s choice whether to use hourly employees, outside contractors, or salaried employees to repair the same level of harm to a protected computer.” Id. at 1214.

At Millot’s trial, the government pres ented undisputed evidence regarding the hours spent by Bridges and Meyers in respons e to the unauthorized intrusion, and that the time spent was valued at fifty dollars per hour. IBM undoubtedly paid Meyers and Bridges for their time, and the work was done on behalf of Aventis to remedy damage to Aventis’s computer system that Millo t admits he caused. Millot’s own expert agreed that the work done by Meyers and Bridges was a reasonable response to the discovery of a breach in the security of the computer sy stem. Millot argues that the cost of the work performed was absorb ed by IBM under its existing contract with Aventis. This argument neglects the fact that the hours spent by Bridges and Meyers addressing the issues caused by Millot’s unauthorized intrusion could have been spent on other duties under the contract. SeeUnited States v. Sablan , 92 F.3d 865, 870 (9th Cir. 1996) (holding it proper to base the es timated cost of repairs on the standard hourly rate for the employees who fixed the problem, because their time would have otherwise been devoted to assisting bank customers).

Accordingly, we find that the evidence presented was sufficient to support the conviction.

II. Sentencing

Millot was sentenced, on November 10, 2004, before the Supreme Court issued Booker . The district court imposed a fou r-level enhancement for loss more than $10,000 but less than $30,000, and a two-leve l enhancement for abuse of a position7 of trust. The district court based its e nhancements on its own findings that the amount of loss was $20,350, an amount that was notfound by the jury, and that Millot used his position as a systems analyst to perpetrate the crime.

Millot preserved his objection to the gui delines sentence by raising Blakely v. Washington , 542 U.S. 296 (2004). United States v. Haidley , 400 F.3d 642, 644 (8th Cir. 2005). Therefore, we review the se ntence for harmless error–whether the error affected Millot’s substantial rights. United States v. Sutherlin , 424 F.3d 726, 728 (8th Cir. 2005) (per curiam); Fed. R. Crim. P. 52(a). Because the enhancements had the effect of increasing Millot’s guidelines range, the government must show that the Booker error was harmless beyond a reasonable doubt. Haidley , 400 F.3d 642, 645 (8th Cir. 2005).

Millot’s guidelines sentencing range was 6 to12 months. Since this was a Zone B sentence, the district court could have ordered a probationary sentence, substituting home confinement for some or all of th e actual jail time. USSG § 5C1.1(c)(3). Instead, the district court ordered three months of imprisonment, noting that “a short period of imprisonment [was] probably appropriate” for the purpose of deterring others. (Sent. Tr. at 16.) This court has held that mandatory, rather than advisory, application of the guidelines is harmless error where the district court had the discretion to impose a lesser sentence but instead sentenced the defendant in the middle of the sentencing range. See Sutherlin , 424 F.3d at 728 (citing United States v. Perez-Ramirez , 415 F.3d 876, 878 (8th Cir. 2005)). Here, the court’s refusal to grant a probationary sentence, although it had the discretion to do so, convince us that the district court’s apparent mandatory, rather than advisory, application of the sentencing guidelines was harmless. Theref ore, we affirm the sentence imposed by the district court.8 III. Restitution

Millot next argues that the district court violated his Sixth Amendment rights, under Blakely , by ordering restitution in an amountexceeding that found by the jury. “Booker does not affect restitution orders since they are not subject to any prescribed statutory maximum and they are not in the nature of a criminal penalty.” United States v. Carruth , 418 F.3d 900, 904 (8th Cir. 2005). Millot further claims that the restitution order was not supported by the evid ence. We review this matter for clear error. Id. Here the restitution amount was ba sed on evidence presented at trial regarding the number of hours spent fixing the problem, and the billing rate for that work. Accordingly, the district court di d not err in ordering restitution in the amount of $20,350.

CONCLUSION

For the above-stated reasons we affirm the district court.

______________________________