CFAA Tag Archives — The Virginia Business Litigation Blog

February 12, 2018

Loss or Damage Is Sufficient Under CFAA

Under the Computer Fraud and Abuse Act, “loss” and “damage” are not synonyms. The CFAA provides that “any person who suffers damage or loss” caused by a violation of its terms can sue for compensatory damages and or equitable relief. A natural assumption might be that the lawyers who drafted the statute didn’t intend “loss” to mean anything materially different than “damage” and that they just threw in an extra word or two for good measure as lawyers are wont to do. (Only a lawyer would write, “I hereby give, devise, and bequeath” instead of just “I give.”) In the case of the CFAA, however, “loss” and “damage” are not interchangeable; each has a distinct meaning. And suffering either one of them is sufficient to support a compensable claim. Let’s look at a recent real-world example.

Space Systems/Loral v. Orbital ATK was (and remains) a dispute in Virginia federal court between two companies specializing in the design and manufacturing of geostationary satellites, space systems, and robotics technology. In 2015, NASA solicited project proposals through an RFP entitled “Utilizing Public Private Partnerships to Advance Tipping Point Strategies.” NASA awarded Space Systems a contract for its “Dragonfly” project and Orbital a contract for its “CIRAS” project. NASA set up a server to facilitate the sharing of information with the various contractors, and gave both Space Systems and Orbital access to it. Some time later, NASA determined that one or more Orbital employees accessed at least four files on the shared server that contained Space Systems’ proprietary data.

June 28, 2017

You Can Sue If Someone Intentionally Hacks Into Your Email

by Lee E. Berlik

Unauthorized access to another’s email account can give rise to a variety of claims. The Computer Fraud and Abuse Act (“CFAA”), for example, prohibits a wide variety of improper computer activity, including unauthorized access to another’s email account. Specifically, it makes it illegal to intentionally access a computer without authorization and to thereby obtain information which results in a loss worth at least $5000 over the course of a year. (See 18 U.S.C. § 1030(a)(2)(C)). In Virginia, the Computer Crimes Act prohibits “computer fraud,” which occurs when a person uses a computer without authority and thereby obtains property or services by false pretenses. It also makes it a crime to commit “computer invasion of privacy,” which occurs when a person, without permission, logs onto someone else’s computer and examines that person’s employment, salary, credit, or any other financial information.

To obtain relief under the Virginia Computer Crimes Act, a plaintiff must have suffered injury to person or property. (See Va. Code § 18.2-152.12). And as mentioned above, you need at least $5000 in damages to recover anything under the CFAA. But what if someone hacks into your email and reads your personal messages without actually causing any direct pecuniary loss or personal injury?

April 22, 2017

Accessing Former Employer’s Google Account May Violate CFAA

by Lee E. Berlik

Suppose your employer asks you to create a Google account for the company. So you do. You set up everything yourself: Google Drive, Google+, Gmail–the works. You even set the password to your dog’s name. All of Google’s terms and conditions are accepted by you personally when creating the account. You proceed to use the account on behalf of the company, using Google Drive to store hundreds of company documents. Then you leave your job. Is the Google account yours? You created it, so are you free to make whatever use of the account you wish? Can you delete it?

Marcelo Cuellar thought so, but he was wrong. According to papers filed in Estes Forwarding Worldwide v. Cuellar in the Eastern District of Virginia, here are the facts. Cuellar joined Estes Forwarding Worldwide (“EFW”)–a transportation logistics company–in 2010. EFW has developed trade secrets relating to the best transportation solutions for various types of shipments, including information about type of freight, freight dimensions, routing decisions, vendor selection, and so on. It keeps this information in spreadsheets and other electronic documents.