Opinion ID: 47625
Heading Depth: 2
Heading Rank: 1

Heading: FSI’s CFAA Claims

Text: Despite the jury’s finding that Daniel Roehrs, Thomas Hazelton, and Rick Hobbs violated § 1030(a)(4) of the CFAA, 2 Defendants stated that they only wished to pursue these cross-appeals in the event that this court does not affirm the district court’s final judgment. Because we do not, the crossappeals are considered in this discussion. 6 entitling FSI to damages totaling $36,000, the district court held that the CFAA does not create a civil cause of action for violations of § 1030(a)(4), and it entered a take-nothing judgment on the claim. FSI appeals, alleging that civil claims for violations of § 1030(a)(4) can be brought under § 1030(g) and that the jury found the elements necessary for entry of judgment on FSI’s behalf. We agree. The CFAA criminalizes various fraudulent or damaging activities related to the use of computers. Two of its provisions were before the jury in this case. Section 1030(a)(4) prohibits the “knowing[] . . . access[ of] a protected computer without authorization,” with intent to defraud, if “such conduct furthers the intended fraud and [the violator] obtains anything of value.” 18 U.S.C. § 1030(a)(4). Section 1030(a)(5) punishes those who cause damage to a protected computer, either through the knowing transmission of a program, information, code, or command, or through intentional, unauthorized computer access. Civil actions are authorized for some, but not all, violations of § 1030's substantive provisions. Section 1030(g) provides: Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B) . . . . 7 Based on its reading of § 1030(g), the district court held that the section does not create a civil action for violations of § 1030(a)(4). Similarly, defendants argue that the explicit terms of § 1030(g) only authorize civil actions for violations of § 1030(a)(5). However, this interpretation is at odds with the language of the statute, which plainly allows such an action to proceed.3 Section 1030(g) extends the ability to bring a civil action to any person suffering damage or loss under “this section,” which refers to § 1030 as a whole, as subsection (g) does not proscribe any conduct itself. And although § 1030(g) refers to subsection (a)(5)(B), the statute does not limit civil suits to violations of § 1030(a)(5). Indeed, if Congress intended to limit civil actions in this manner, it could have simply provided that civil actions may only be brought for violations of subsection (a)(5). Instead, the statute provides that a claim brought under any of the subsections of § 1030 must involve one of the factors listed in the numbered clauses of subsection (a)(5)(B). These factors are:
1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, 3 In cases involving statutory construction, the plain language of the statute is conclusive unless Congress clearly expressed a contrary intent. Burlington N. & Santa Fe Ry. Co. v. Poole Chem. Co., 419 F.3d 355, 362 (5th Cir. 2005). 8 loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value;
potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals;

or for a government entity in furtherance of the administration of justice, national defense, or national security . . . . 18 U.S.C. § 1030(a)(5)(B). Accordingly, a civil action may be maintained under § 1030(a)(4) of the CFAA if the violative conduct involves any one of these factors.4 Our interpretation is consistent with that of other circuits that have addressed this question. See P.C. Yonkers, Inc. v. Celebrations the Party & Seasonal Superstore, LLC, 428 F.3d 504, 512 (3d Cir. 2005) (“We do not read section 1030(g)'s language that the claim must involve one or more of the numbered subsections of subsection (a)(5)(B) as limiting relief to claims that are entirely based only on subsection (a)(5), but, rather, as requiring that claims brought under other sections must meet, in addition, one of the five numbered (a)(5)(B) ‘tests.’”); Theofel v. Farey-Jones, 359 F.3d 1066, 1078 n.5 (9th Cir. 2004) (“[S]ubsection (g) applies to 4 Thus, for a civil action involving a violation of subsection (a)(4), the requirements of subsection (a)(5)(A) need not be met. 9 any violation of ‘this section’ and, while the offense must involve one of the five factors in (a)(5)(B), it need not be one of the three offenses in (a)(5)(A).”). Nonetheless, defendants argue that even if a civil cause of action may be maintained under § 1030(a)(4) when one of the § 1030(a)(5)(B) factors is established, the jury instructions for FSI’s § 1030(a)(4) claim do not mention any of those factors. Only the first factor from § 1030(a)(5)(B) is at issue here, requiring loss during any 1-year period that aggregates to at least $5,000 in value. We review jury instructions for abuse of discretion when the instructions were properly objected to in the district court. See United States v. Freeman, 434 F.3d 369, 377 (5th Cir. 2005). But when the challenging party failed to preserve the error below, the instructions are reviewed for plain error. Positive Black Talk Inc. v. Cash Money Records Inc., 394 F.3d 357, 368 (5th Cir. 2004). To avoid plain error review, a specific objection must have been made on the ground raised on appeal, rather than a general objection to the instructions as a whole or an objection on a different ground. See id.; United States v. Fuchs, 467 F.3d 889, 500 (5th Cir. 2006). Defendants objected to the § 1030(a)(4) instructions on the ground that “there is no civil cause of action under (a)(4) of the CFAA,” but did not object on the ground that the jury was not instructed on the loss element, and accordingly this challenge is subject to plain error 10 review. “In reviewing jury instructions for plain error, we are exceedingly deferential to the trial court.” Tompkins v. Cyr, 202 F.3d 770, 784 (5th Cir. 2000). For defendants to prevail under the plain error standard, they must show that (1) an error occurred; (2) the error was plain, which means clear or obvious; (3) the plain error affects substantial rights; and (4) failing to correct the error would seriously impact the fairness, integrity, or public reputation of judicial proceedings. Septimus v. Univ. of Houston, 399 F.3d 601, 607 (5th Cir. 2005). In determining whether a particular jury instruction was erroneous, we must consider the instructions as a whole. Russell v. Plano Bank & Trust, 130 F.3d 715, 721 (5th Cir. 1997). Although the jury charge failed to specifically instruct the jury to find one of the § 1030(a)(5)(B) factors as a prerequisite to civil liability under § 1030(a)(4), the damages instruction required the jury to determine the amount of loss caused by the CFAA violation. Following this instruction, the jury found that the three defendants’ violations of § 1030(a)(4) caused FSI loss totaling $36,000, which far exceeds the $5,000 loss requirement. Despite defendants’ argument that the “loss” found in the damages instruction is somehow different from the substantive element of “loss” within § 1030(a)(5)(B)(i), the damages instruction defined 11 “loss” exactly as defined in § 1030.5 The damages instruction also required the jury to find that the loss was “proximately caused by the conduct” that violated § 1030(a)(4), which was more than enough to satisfy the § 1030(g) requirement that the violative conduct “involve” one of the § 1030(a)(5)(B) factors. And even if this aspect of the instructions was erroneous, the jury’s damages finding shows that no substantial rights were affected, as the jury would have found the $5,000 minimum met if instructed properly. Further, although the damages instruction erroneously failed to require a finding that the $5,000 minimum loss occurred during a one-year period, the time element was inherent in the jury’s finding, demonstrating that no substantial rights were affected. Of the damages alleged by FSI, defendants only identify $26,000, incurred by the efforts of a data recovery expert, as including some charges that derived from more than a year after the time of the CFAA violation. But § 1030(a)(5)(B)(i) does not require that the loss only occur within a year of the CFAA violation; rather, it requires that the loss aggregate to $5,000 “during any 1-year period.” 18 U.S.C. § 1030(a)(5)(B)(i) (emphasis added). As 5 As the jury instructions and § 1030 provide, “the term ‘loss’ means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). 12 defendants acknowledge, the data recovery expert first became involved in November 2004, and his $26,000 fee included work through January 2005, all of which took place well within a oneyear span. Regardless, the jury found $36,000 in loss, which at a minimum must have included $10,000 in loss associated with FSI’s original data recovery efforts, all of which took place within a one-year span itself. Accordingly, the district court’s failure to instruct the jury that it must find a loss of $5,000 during a one-year period was inconsequential.
FSI also appeals the district court’s summary judgment dismissal of FSI’s claim for injunctive relief under the CFAA. The district court held that injunctive relief was unavailable to FSI because the CFAA only allows an injunction to prevent ongoing or future unauthorized access to FSI’s computers, neither of which is shown here. FSI responds that it is threatened with present and future harm from defendants’ possession and use of trade secrets stolen by defendants through the acts that violated § 1030(a)(4) and that an injunction should be available under the CFAA to remedy such a harm. We need not address the question of whether an injunction may issue against the use of the information obtained through a past violation of § 1030(a)(4). Although the jury found that defendants violated § 1030(a)(4), which required a finding that 13 the defendants obtained something of value through their unlawful computer access, the jury also found that FSI falsely accused defendants of being thieves. Thus, the value obtained by defendants could not have included stolen trade secrets. “[T]he scope of injunctive relief is dictated by the extent of the violation established,” and an injunction must be narrowly tailored to remedy the specific action necessitating the injunction. John Doe #1 v. Veneman, 380 F.3d 807, 818 (5th Cir. 2004) (citing Califano v. Yamasaki, 442 U.S. 682, 702 (1979)); Valley v. Rapides Parish Sch. Bd., 646 F.2d 925, 942 (5th Cir. May 1981). Because the jury determined that defendants did not steal trade secrets through the acts that violated § 1030(a)(4), the requested injunction would be improper under the CFAA.6