Proof of Interruption of Service Not Necessary to Sustain a Computer Fraud and Abuse Act Claim: Sixth Circuit | Practical Law

Proof of Interruption of Service Not Necessary to Sustain a Computer Fraud and Abuse Act Claim: Sixth Circuit | Practical Law

In Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, the US Court of Appeals for the Sixth Circuit affirmed the US District Court for the Northern District of Ohio's denial of defendant EquipmentFacts' motions for summary judgment and judgment as a matter of law, reasoning that the plaintiffs did not need to prove that EquipmentFacts caused an interruption of service to sustain their Computer Fraud and Abuse Act claim.

Proof of Interruption of Service Not Necessary to Sustain a Computer Fraud and Abuse Act Claim: Sixth Circuit

by Practical Law Intellectual Property & Technology
Published on 26 Dec 2014 • USA (National/Federal)
In Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, the US Court of Appeals for the Sixth Circuit affirmed the US District Court for the Northern District of Ohio's denial of defendant EquipmentFacts' motions for summary judgment and judgment as a matter of law, reasoning that the plaintiffs did not need to prove that EquipmentFacts caused an interruption of service to sustain their Computer Fraud and Abuse Act claim.
On December 22, 2014, in Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, the US Court of Appeals for the Sixth Circuit affirmed the US District Court for the Northern District of Ohio's decision, after a jury trial, denying defendant EquipmentFacts' (Efacts) motions for summary judgment and judgment as a matter of law on plaintiffs Yoder & Frey's and RealtimeBid.com, LLC's (RTB) Computer Fraud and Abuse Act (CFAA) claim (No. 14-3002, (6th Cir. Dec. 22, 2014). In so holding, the Sixth Circuit reasoned that:
  • There was ample evidence for the jury to find that Efacts caused the plaintiffs both the damage and loss required to sustain a CFAA claim under 18 U.S.C. § 1030(a)(5)(C).
  • This conclusion was not altered by the fact that the plaintiffs did not prove that Efacts' acts caused an interruption of the plaintiffs' online bidding services.
Yoder & Frey, a company that hosts auctions for used construction equipment, contracted with Efacts for Efacts to provide the company with online bidding platforms. After several years during which Yoder & Frey worked with Efacts to provide an online bidding service, Yoder & Frey terminated the relationship. Yoder & Frey then began using another online auction service, co-plaintiff RTB.
During trial, the evidence showed that:
  • Efacts had improperly accessed Yoder & Frey's data on RTB's bidding platform by:
    • using login information it acquired during its relationship with Yoder & Frey; and
    • having one of its employees pose as an existing customer of Yoder & Frey.
  • Efacts had placed winning bids in auctions on the RTB system for equipment for which it did not pay.
Among other claims, the plaintiffs alleged that Efacts had violated the CFAA by both:
  • Intentionally accessing a protected computer without authorization.
  • Causing damage and loss as a result of this conduct.
The CFAA defines the statutory requirements of:
  • "'Damage' as "any impairment to the integrity or availability of data, a program, a system, or information" (18 U.S.C. § 1030(e)(8)).
  • "'Loss' as:
    • "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense"; and
    • "any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service" (18 U.S.C. § 1030(e)(11)).
The Sixth Circuit noted that, to prevail on a civil action under the CFAA, the claimant must show that it suffered both damage and loss and that the loss equalled or exceeded $5,000 in any one-year period (18 U.S.C. § 1030(c)(4)(A)(i)(I)). It then affirmed the district court's denial of Efacts' motions for summary dismissal, reasoning that:
  • Efacts caused damage because in placing false bids and occupying bidding slots, it interfered with the ability of the auction platform to function as intended by crowding out the bids of legitimate buyers.
  • Efacts caused loss because its actions required RTB to conduct a damage assessment and probe into the false bidding, resulting in costs of at least $5,000.
Notably, in affirming the district court's judgment, the Sixth Circuit further reasoned that a CFAA claimant can, but need not, show that its losses stem from an interruption of service because the statutory loss requirements may also be satisfied by showing minimum losses of $5,000 consisting of:
  • The reasonable cost of responding to a CFAA violation, conducting a damage assessment or restoring the affected data, program, system or information (18 U.S.C. 1030(e)(11)).
  • A combination of:
    • the foregoing cost of responding to a CFAA violation; and
    • the revenues lost, costs incurred or other consequential damages sustained because of an interruption of service.
Noting that the plaintiffs' investigation of Efacts' CFAA violations and assessment of the resulting damage cost well in excess of $5,000, the Sixth Circuit ruled that a jury could reasonably conclude that the plaintiffs met the proof of loss requirement of their CFAA claim. Further observing that Efacts did not dispute that it accessed the plaintiffs' protected computer (online bidding system) without authorization, the Sixth Circuit affirmed the denial of Efacts' summary judgment and JMOL motions to dismiss the plaintiffs' CFAA claim.