United States v. Nosal

Full title: UNITED STATES OF AMERICA, Plaintiff, v. DAVID NOSAL, Defendant.

Court: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA

Date published: Jan 13, 2014

No. CR-08-0237 EMC (N.D. Cal. Jan. 13, 2014)

Opinion

No. CR-08-0237 EMC

01-13-2014

UNITED STATES OF AMERICA, Plaintiff, v. DAVID NOSAL, Defendant.

EDWARD M. CHEN

ORDER REGARDING THE

CALCULATION OF LOSS FOR

PURPOSES OF THE GUIDELINES

I. INTRODUCTION

On April 24, 2013, a jury convicted Defendant David Nosal of three counts of computer fraud in violation of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030(a)(4), two counts of unauthorized downloading, copying, and duplicating of trade secrets without authorization, in violation of the Economic Espionage Act ("EEA"), 18 U.S.C. § 1832(a)(2), and one count of conspiring to violate the EEA. In their sentencing memoranda, the government and Defendant disputed - among other things - what the "actual loss" resulting from defendant's actions was for purposes of U.S.S.G. § 2B1.1. This order memorializes the Court's reasoning expressed at the sentencing hearing held on January 8, 2014. For the reasons stated on the record at that hearing as well as in this order, the Court finds that the actual loss figure includes (1) the costs incurred by Korn/Ferry International ("KFI") in responding to defendant's actions and (2) the development costs of the source lists stolen from KFI in furtherance of the conspiracy. Accordingly, the Court concludes that a reasonable estimate of KFI's actual loss based on the record before the Court is $46,907.88, thus warranting a six level increase in Defendant's offense level.

II. FACTUAL AND PROCEDURAL HISTORY

Defendant is a former high-level employee of KFI, an executive search firm with offices around the world. Second Superseding Indictment ("SSI") ¶¶ 1-2. The company is a leading provider of executive recruitment services, assisting companies to fill executive and other high level positions. Id. ¶ 1. Defendant worked for KFI from approximately April 1996 until October 2004. Id. ¶ 2. When he ceased his employment with the firm, he entered into Separation and General Release Agreement, and an Independent Contractor Agreement with KFI. Id. ¶ 2. In these agreements, he agreed to serve as an independent contractor to KFI from November 1, 2004 through October 15, 2005. Id. ¶ 2. He also agreed not to perform executive search or related services for any other entity during the term of his contract. Id. ¶ 2. In return, he received compensation in the amount of $25,000 per month. Id. ¶ 2. Despite these agreements, Defendant began to set up his own rival executive search firm with the assistance of three other current or former KFI employees: B.C., J.F.L., and M.J. Id. ¶¶ 3-5.¹ J.F.L. was Defendant's assistant while he was a Korn/Ferry employee, and continued to be employed by Korn/Ferry after Defendant's departure. Id. ¶ 4. B.C. was a KFI employee until approximately January 2005. Id. ¶ 3. M.J. was a Korn/Ferry employee until approximately March of 2005. Id. ¶ 5.

1 The enforceability of the non-compete agreements is not an issue for this Court to decide.

The second superseding indictment charges Defendant with three counts of obtaining unauthorized access to a protected computer with intent to defraud and obtaining something of value in violation of the CFAA. Id. ¶ 20-21. The counts are based on three occasions in which J.F.L.'s KFI username and password were used to access KFI's Searcher database. Id. ¶ 20-21. The three incidents took place on April 12, 2005, July 12, 2005, and July 29, 2005. Id. ¶ 21. On each occasion, the person accessing Searcher downloaded information from the database, including source lists of candidates KFI had compiled for previous search assignments. Id. ¶ 21. The government alleges that these searches were performed not by J.F.L., but by B.C. and M.J., neither of whom were KFI employees at the time. Id. ¶ 19.

The second superseding indictment also charges Defendant with unauthorized downloading, copying, and duplicating of trade secrets, as well as unauthorized receipt and possession of trade secrets, all in violation of the EEA. Id. ¶ 22-24. These charges were based on three specific source lists and one set of information drawn from a source list, all of which B.C. obtained from Searcher and emailed to Defendant. Finally, Defendant was charged with conspiracy to commit the CFAA and EEA violations. Id. ¶¶ 12-19.

A jury convicted Defendant on all counts on April 23, 2013. Dkt. No. 408. At the initial sentencing hearing held on October 9, 2013, the Court ordered the parties to file supplemental briefing regarding the calculation of the loss (for purposes of calculating the advisory Sentencing Guidelines range) caused by Defendant's conduct as well as the proper amount of the restitution award under the Mandatory Victim Restitution Act.

In its supplemental brief, the government argues that the Court should consider (1) the costs KFI incurred responding to Defendant's violations of the CFAA and (2) the development costs of the trade secrets (the source lists) Defendant stole from KFI in calculating "loss" for purposes of the Guidelines. Regarding response costs, the government asserts that beginning in May 2005, KFI employees began investigating whether Defendant had stolen data from KFI's systems, the scope of such theft, and whether KFI personnel had participated. United States' Supplemental Sentencing Memorandum ("Gov. Supp. Memo.") at 8-12, Dkt. No. 476. The government further argues that given the substantial time spent creating the source lists, the development costs of these lists should be estimated between $434,925.00 and $923,467.50. Declaration of Marlene Briski ("Briski Decl.") ¶ 41.

Defendant challenges the inclusion of KFI's response costs in the loss calculation and asserts that the government has failed to demonstrate that the development costs or fair market value of the downloaded source lists exceeded $5,000. First, Defendant argues that KFI's internal investigative costs cannot be considered a "response cost" under the Sentencing Guidelines' definition of loss. Defendant's Supplemental Memorandum on Loss ("Def. Supp. Memo.") at 7, Dkt. No. 489. Assuming that such investigatory costs are properly considered, Defendant next asserts that the government has failed to demonstrate that these costs were "caused" by Defendant's actions or that the costs were "reasonably necessary." Id. at 9-10.

Additionally, Defendant raises a number of challenges to the government's estimate of the development costs of the source lists. First, Defendant argues that only the source lists/information expressly referenced in Counts Five and Six can be considered for purposes of the loss calculation. Id. at 4, 12. Second, the Defendant asserts that Ms. Briski and the government have drastically overestimated the hourly rate of KFI employees and the amount of time it takes to add executives' information into the Searcher database or create source lists. For example, while Ms. Briski estimates that it takes at least 15 minutes to enter one executive's information into the Searcher database, Defendant introduces declarations demonstrating that multiple executives could be entered to Searcher per minute through a variety of automated data entry mechanisms. See, e.g., Declaration of Susan Oliver ("Oliver Decl.") at 3-4, Declaration of Karen Guiden ("Guiden Decl.") at 2. Defendant similarly challenges the time involved in creating the source lists from the information in Searcher.

For the following reasons, the Court agrees with the government that KFI response costs and development costs are properly considered in the calculation of "actual loss" under the Guidelines. However, the Court finds that the government has failed to satisfactorily prove the magnitude of those losses it asserts.

III. DISCUSSION

Sentencing under both the CFAA and EEA is governed by United States Sentencing Guidelines Manual § 2B1.1. See U.S.S.G. app. A. Under § 2B1.1, courts are instructed to increase the base offense level based on the amount of "loss." U.S.S.G. § 2B1.1(b). "Loss" is defined as the "greater of actual loss or intended loss." Id. § 2B1.1 cmt. n. 3. "Actual loss," which is involved in this case, means the "reasonably foreseeable pecuniary harm that resulted from the offense." Id. at § 2B1.1 cmt. n.3(A)(I). Harm is reasonably foreseeable if the "defendant knew or, under the circumstances, reasonably should have known, [that the harm] was a potential result of the offense." Id. § 2B1.1, cmt. n.3(A)(iv).

"In calculating the amount of loss under the Guidelines, a sentencing court 'need only make a reasonable estimate of the loss.'" United States v. Rigas, 583 F.3d 108, 120 (2d Cir. 2009) (quoting U.S.S.G. § 2B1.1 cmt. n.3(C)). Accordingly, this Court is not required to make a loss calculation with "absolute precision." United States v. Laurienti, 611 F.3d 530, 558 (9th Cir. 2010). The Court's "reasonable estimate" of loss, "shall be based on available information" including, among other things, the following factors:

(i) The fair market value of the property unlawfully taken, copied, or destroyed; or, if the fair market value is impracticable to determine or inadequately measures the harm, the cost to the victim of replacing that property.
(ii) In the case of proprietary information (e.g., trade secrets), the cost of developing that information or the reduction in the value of that information that resulted from the offense.

U.S.S.G. § 2B1.1 cmt. n.3(C)(i), (ii). As discussed below, costs of responding to the offense incurred by the action are also a relevant factor under n.3(A)(v)(III).

In "calculating the amount of loss, the guidelines look not only to the charged conduct but to all relevant conduct by the defendant." United States v. Flonnory, 630 F.3d 1280, 1286 (10th Cir. 2011). Under the Guidelines, "relevant conduct" includes "all reasonably foreseeable acts and omissions of others in furtherance of . . . jointly undertaken criminal activity" as well as "all acts and omissions . . . that were part of the same course of conduct or common scheme or plan as the offense of conviction." U.S.S.G. § 1B1.3(a)(1), (2). As a result, "[b]ecause relevant conduct may include a broader range of conduct than the underlying conduct, a district court may 'properly consider[] charged, uncharged, and acquitted conduct.'" United States v. May, 706 F.3d 1209, 1213 (9th Cir. 2013) (quoting United States v. Peyton, 353 F.3d 1080, 1089 (9th Cir. 2003)). However, the uncharged conduct must be criminal in nature. See United States v. Catchings, 708 F.3d 710, 712 (6th Cir. 2013). Where, as here, a defendant has been convicted of conspiracy, "[s]entencing enhancements based entirely on the nature and extent of the conspiracy . . . do not require proof by the clear and convincing standard" but rather require proof by a preponderance of the evidence. United States v. Jenkins, 633 F.3d 788, 808 n.8 (9th Cir. 2011).

Finally, any costs incurred by a victim "primarily to aid the government in[] the prosecution and criminal investigation of an offense" are expressly excluded from the loss calculation. U.S.S.G. § 2B1.1 cmt. n.3(D)(ii). A. KFI's Internal Investigation Costs Are Included in the Loss Calculation

The parties dispute whether, and to what extent, internal investigation costs may be included in the Guidelines' loss calculation. The government concedes that this question of whether internal investigation costs may be considered a "loss" under the CFAA has not been addressed in a criminal case. Both parties also recognize that the CFAA's civil provision has a similar definition of loss and that the cases construing this provision are split on this issue. Ultimately, the Court finds that the costs of an internal investigation taken in the wake of a CFAA offense may be considered in the loss calculation.

The application notes to § 2B1.1 contain the following "rule of construction" for considering pecuniary harm caused by a violation of 18 U.S.C. § 1830:

(III) Offenses Under 18 U.S.C. § 1030.—In the case of an offense under 18 U.S.C. § 1030, actual loss includes the following pecuniary harm, regardless of whether such pecuniary harm was reasonably foreseeable: any cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other damages incurred because of interruption of service.

U.S.S.G. § 2B1.1 cmt. n.3(A)(v)(III). Two things are facially apparent from this provision. First, whereas § 2B1.1 normally defines "actual loss" as "reasonably foreseeable pecuniary harm," Note 3(A)(v)(III) expands actual loss in § 1030 cases to include certain harm regardless of whether the defendant could reasonably foresee them. Second, Note 3(A)(v)(III) merely states that actual loss "includes" the enumerated harm. Thus, the Note is not an exhaustive list of the harm that may be considered in the Guidelines calculation for § 1030 offenses.

Consistent with the parties' briefs, the Court has been unable to find a case which construes Note 3(A)(v)(III), let alone one which sheds light on whether courts should include internal investigation costs in the loss calculation. However, the CFAA contains a similar definition of "loss." Under 18 U.S.C. § 1030(g), a person who suffers "damage or loss" by reason of a CFAA violation may bring a civil suit against the violator to obtain compensatory damages. The CFAA then provides:

the term "loss" means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.

Id. § 1030(e)(11). District courts have split on whether a victim's internal investigations may be included within this definition.

On one hand, judges in this district have routinely held that such investigation costs are included within the definition of § 1030(e)(11). For example, in SuccessFactors, Inc. v. Softscape, Inc., 544 F. Supp. 2d 975 (N.D. Cal. 2008), plaintiff's competitor was alleged to have hacked into plaintiff's website, downloaded information from secure areas of the site, and used that information to create a powerpoint presentation critical of the plaintiff's integrity and business practices. Id. at 977. Defendant then sent this presentation to plaintiff's actual and prospective customers. Id. Plaintiff argued it had standing under the CFAA because the following activities took "many hours of valuable time away from day-to-day responsibilities":

analysis of which restricted environments had been accessed (to determine the extent of breach); collection and analysis of IP addresses accessing Plaintiff's network, to determine whether access was internal or hostile (to determine the appropriate response); and review logs of documented users to confirm conclusions.

Id. at 980. The court found that plaintiff had standing and noted that "where the offense involves unauthorized access and the use of protected information, discovering who has that information and what information he or she has is essential to remedying the harm." Id. at 981. It found that the "cost of discovering the identity of the offender or the method by which the offender accessed the protected information" would be deemed to be "part of the loss for purposes of the CFAA." Id.; see also Farmers Ins. Exchange v. Auto Club Group, 823 F. Supp. 2d 847, 855 (N.D. Ill. 2011) (concluding that costs associated with "identifying and ascertaining the extent" of defendant's unauthorized access could satisfy the CFAA's definition of loss).

Similarly, in Mutiven v. Cisco Sys., Inc., 725 F. Supp. 2d 887 (N.D. Cal. 2010), a former employee of Cisco Systems formed a competing company and then sued Cisco alleging an unlawful monopoly and Cisco counterclaimed for a violation of the CFAA. Cisco alleged that the former employee had used another Cisco employee's passwords to access their system and then download Cisco's proprietary and copyrighted software. The court concluded that it is "not necessary for data to be physically changed or erased" to constitute a loss or damage under the CFAA. Id. at 894. Rather, the court concluded:

It is sufficient to show that there has been an impairment to the integrity of data, as when an intruder retrieves password information from a computer and the rightful computer owner must take corrective measures 'to prevent the infiltration and gathering of confidential information.' Costs associated with investigating intrusions into a computer network and taking subsequent remedial measures are losses within the meaning of the statute.

Id. at 895.

On the other hand, there is a body of case law narrowly construing CFAA's definition of loss. For example, in Harley Automotive Group, Inc. v. AP Supply, Inc., No. 12-1110, 2013 WL 6801221 (D. Minn. Dec. 23, 2013), the court granted defendant's motion for summary judgment, finding that the plaintiff had not offered evidence that it suffered a "loss" for purposes of the CFAA. The plaintiff had asserted that it "had to expend resources to analyze its system so as to discover how information was accessed." Id. at *7. The court found this insufficient and held that the CFAA loss requirement was limited to "actual computer impairment." Id. at *6. As a result, because plaintiff did not provide any evidence that its computer system was impaired or that its service was interrupted, it had failed to demonstrate a CFAA loss. Id. at *7; see also Jarosch v. Am. Family Mut. Ins. Co., 837 F. Supp. 2d 980, 1022 (E.D. Wisc. 2011) (holding that "to state a claim based on loss, the loss must relate to the impairment or unavailability of data on a computer," and that "loss" does not "include the cost of responding to a security breach").

The Court concludes that under § 2B1.1 and Note 3(A)(v)(III) "actual loss" includes those costs incurred as part of an internal investigation reasonably necessary to respond to the offense, for example by identifying the perpetrator or the method by which the offender accessed the protected information. Cf. United States v. Middleton, 231 F.3d 1207 (9th Cir. 2000) (affirming use of a jury instruction in a CFAA case which defined loss, in part, as costs "reasonably necessary to resecure the data, program, system, or information from further damage"). The Court reaches this conclusion for two reasons. First, the plain language of Note 3(A)(v)(III) and § 1030 itself both include in the definition of loss the cost of generally "responding to an offense." In addition to this general statement, both provisions then expressly state that (1) conducting a damage assessment; (2) restoring data or a system to its prior condition; or (3) lost revenue resulting from any interruption of service all qualify as "loss." If, as the cases which narrowly construe loss suggest, "loss" required some actual damage to a computer system or data, the phrase "responding to an offense" would be rendered superfluous by the more specific provisions.

Second, in situations where the CFAA violation constitutes covert, unauthorized access into a computer system, taking corrective actions or otherwise "responding to an offense" will often be difficult (if not impossible) until the victim knows (1) who perpetrated the offense; (2) how the offense was perpetrated, and (3) the scope of any resulting damage or the degree to which the integrity of its data has been compromised. See SuccessFactors, 544 F. Supp. 2d at 981. Individuals who access a computer without authorization and with an intent to defraud are unlikely to announce their presence, inform the victim what information they have accessed, and advise the victim on how it could protect itself in the future. See 18 U.S.C. § 1030(a)(4). Rather, an internal investigation will often be necessary to determine these critical facts. The very purpose of the "loss" enhancement to a Guideline offense level is that the reasonably foreseeable loss caused by an offender's actions represents a proxy for that offender's culpability. See United States v. Parsons, 141 F.3d 386, 392-93 (1st Cir. 1998). Determining who breached the system security and the manner and extent of the intrusion, is a reasonable and foreseeable step a victim is expected to take in response to a CFAA violation; it may well inform what remedial steps need be taken, steps which are clearly cognizable as losses under the CFAA. In Middleton, supra, the Ninth Circuit held that costs in resecuring data, program, system or information from further damage constitutes loss under the CFAA. It would be inconsistent with the purpose of the § 2B1.1 to absolve a defendant of culpability for these reasonably foreseeable costs including investigatory costs to determine the nature and scope of the offense for the reasons stated above.

This is not to say that there are not limits to the investigative costs that can be used to enhance a sentence. For example, as discussed above, the Ninth Circuit in Middleton at least implied that the victim's response costs must be "reasonably necessary." There may be instances where a victim has the information necessary to take corrective action without the need of an extensive investigation. Additionally, because the CFAA gives victims a civil remedy, it is likely that at some point, a victim's actions will shift away from responding directly to an offense and toward building a civil case against the offender. Costs incurred for the purpose of building or supporting the victim's civil case should not be considered "loss" for purposes of the Guidelines calculation. Cf. Brooks v. AM Resorts, LLC, — F. Supp. 2d —, 2013 WL 3343993 (E.D. Pa. July 3, 2013) (holding "litigation costs are not a compensable loss under the CFAA because they are not related to investigating or remedying damage to the computer"); Mintel International Group, Ltd. v. Neergheen, No. 08-cv-3939, 2010 WL 145786 (N.D. Ill. Jan. 12, 2010) (holding that costs incurred in retaining an expert to assist with civil litigation may be a "legitimate business concern, it does not transform any harms allegedly suffered by Mintel into 'losses' under the CFAA").

In light of the above, the Court finds that some, but not all, of KFI's internal investigation costs are properly included in the loss calculation under § 2B1.1. First, the Court excludes from the loss calculation the time spent by Mr. Dan Demeter and Mr. Paul Dunn from May 2005 through July 2005. The government asserts that between these months, Mr. Demeter, KFI's former Chief Information Officer, spent approximately 180 hours between May and July 2005 investigating Defendant's thefts from KFI . Gov. Supp. Memo. at 12. Given Mr. Demeter's hourly rate, the government asserts that his time spent on the internal investigation adds $61,600 to the loss calculation. Id. at 11. Unfortunately, Mr. Demeter had a major stroke in August 2010 and the government has been unable to support these estimates with a declaration from Mr. Demeter which describes what actions he took to investigate Mr. Demeter's and how long he spent on these various actions. Rather, the government has arrived at an estimate of Mr. Demeter's time by relying on Ms. Briski who looked at Mr. Demeter's emails and Outlook calendars between May and July 2005 to arrive at a "very conservative" estimate of his time. Briski Decl. ¶¶ 22-24. Thus, the government is relying upon hearsay upon hearsay to arrive at this estimate. "[H]earsay is admissible at sentencing, so long as it is 'accompanied by some minimal indicia of reliability.'" United States v. Littlesun, 444 F.3d 1196, 1200 (9th Cir. 2006).

Here, the Court finds that the government has failed to make this minimal showing. Mr. Briski's description of Mr. Demeter's time is too general and the government did not seek to introduce the documents upon which Ms. Briski relied on making this estimate. As a result, the Court cannot determine the nature of Mr. Demeter's actions, whether those actions satisfy the standard articulated above, and whether these actions were reasonable (particularly in light of the investigatory actions being conducted by Ms. Briski during the same time period). Accordingly, the Court will not consider Mr. Demeter's time in arriving at the loss calculation.

For similar reasons, the Court declines to include the time spent by Mr. Peter Dunn (KFI's General Counsel) between the months of May and July 2005. While Mr. Dunn has submitted a declaration which estimates the time he spent during these months, it is far too general for the Court to determine if his actions are cognizable as a loss for purposes of the Guidelines calculation. Specifically, his declaration states that:

During each of May, June and July 2005, I estimate that I spent approximately 60 hours per month, for a total of 180 hours, working with Korn/Ferry employees, outside counsel, and investigators retained by Korn/Ferry to investigate theft of data from Korn/Ferry by Nosal, Jacqueline Froehlich-L'Heureaux, Becky Christian, and Mark Jacobson.

Declaration of Peter Dunn ("Dunn Decl.") ¶ 4, Dkt. No. 477. This description suffers from two defects. First, the Court is unable to determine whether Mr. Dunn's activities were in fact investigating the who, what, and how behind Defendant's offenses as opposed to preparing for civil litigation, which would not be included for the reasons discussed above. Second, Mr. Dunn acknowledges that "[s]ince July 2005 to the present, I have assisted the government in its investigation and subsequent prosecution of Nosal." Id. ¶ 6. However, Mr. Dunn does not attempt to apportion the 60 hours he spent in July between his assistance in the government's investigation and his participation in KFI's internal investigation. This is significant because costs incurred by a victim with the primary purpose of aiding the government's investigation are not included under § 2B1.1. See U.S.S.G. § 2B1.1 cmt. n.3(D)(ii). The government seeks to account for this by including only half of the time Mr. Dunn (and Ms. Briski's) spent on these activities in July. Gov. Supp. Memo. at 9. However, at the hearing, the government candidly admitted that it had no basis, beyond its own judgment, for drawing the line at half. The Court declines to allow such speculative estimates to be included in the loss calculation. See, e.g., United States v. Dominguez, 109 F.3d 675, 676 (11th Cir. 1997) (the district court "must not speculate concerning the existence of a fact which would permit a more severe sentence under the guidelines").

However, the Court will include time spent by Ms. Briski investigating Defendant's actions in May and June 2005 in the Guidelines loss calculation. In May 2005, Ms. Briski asserts that she spent approximately 80 hours

downloading reports of Searcher activity for individuals with connections to Nosal whom Korn/Ferry believed were the most likely candidates to be assisting Nosal in making intrusions into Searcher, as well as monitoring Searcher, and analyzing their activity on Searcher. As part of this work, [she] prepared various charts and graphs regarding Searcher activity . . . . [She] also worked to develop and implement additional audit capabilities in the Searcher database that allowed Korn/Ferry to capture additional information regarding queries run and other Searcher activity by individuals using Searcher.

Briski Decl. ¶ 7. Ms. Briski continued these activities for 120 hours in June 2005. Id. ¶ 8. The Court finds these actions are appropriate response costs directed at determining the identity of those individuals involved in the intrusion into KFI's system, the scope of that intrusion, and the remedial actions that should be taken. Conversely, the Court will not include the time Ms. Briski spent in July 2005. In her declaration, Ms. Briski states that her work in July 2005 "included assisting with preparing for potential civil litigation and arbitration." Id. ¶ 9. As discussed above, such litigation focused activities are not properly considered in the loss calculation. Ms. Briski does not seek to estimate what portion of her time in July 2005 was spent investigating (which can be included) and what portion was spent preparing for litigation (which cannot). Accordingly, because the government has provided nothing in the record which would permit the Court to determine where this line should be drawn as to the July activities of Ms. Briski, the Court will not consider Ms. Briski's July 2005 time. See Dominguez, 109 F.3d at 676.

In sum, the Court finds that KFI's costs associated with its internal investigations into Defendant's actions will be included in the loss calculation under § 2B1.1. Because the Court concludes that the government has only demonstrated that Ms. Briski's May and June 2005 activities are properly included, the Court finds that $27,400 will be included in the loss calculation (representing the 200 hours Ms. Briski spent over these 2 months multiplied by her estimated $137 hourly rate which properly includes her base salary, bonuses and benefits - incremental costs associated with her employment, and excludes fixed costs such as company overhead). B. Development Costs of the Stolen Source Lists Is Properly Included in the Loss Calculation

In addition to the $27,400 in investigation costs discussed above, the Court finds that the development costs of KFI's source lists will be included in the loss calculation. As discussed, under U.S.S.G. § 2B1.1, one of the factors the court should consider in a case involving trade secrets is "the cost of developing that information or the reduction in the value of that information that resulted from the offense." Id. § 2B1.1 cmt. n.3(C)(ii). Thus, in United States v. Ameri, 412 F.3d 893 (8th Cir. 2005), the Eighth Circuit upheld a $1.4 million loss calculation in a case involving theft of trade secrets, finding the development cost of the software at issue was $700,000 (the defendant had made two copies of the software). Id. at 900.

As an initial matter, the Defendant argues that the only source lists which can form the basis of a cognizable loss are those associated with Counts Two, Five and Six - representing 374 names. The Court disagrees. As discussed above, sentencing courts may consider all "relevant conduct" in imposing sentence, including "all acts and omissions . . . that were part of the same course of conduct or common scheme or plan as the offense of conviction." U.S.S.G. § 1B1.3(a)(1). In addition, the court may consider the acts or omissions committed by others that were "in furtherance of . . . jointly undertaken criminal activity." Id.; see also Treadwell, 593 F.3d at 1004 (recognizing that under § 1B1.3, the Court must determine the "scope of each defendant's joint undertaking and the amount of losses reasonably foreseeable to each defendant").

Defendant was convicted of conspiracy to misappropriate KFI's trade secrets. Further, Defendant was not a mere participant in the conspiracy, but rather was instrumental in organizing and directing the conspiracy. Accordingly, the Court finds that the government, through evidence at trial and at sentencing, as shown by a preponderance of the evidence that the misappropriation of the following executive information contained in source lists was within the scope of the conspiracy and reasonably foreseeable to the Defendant:

• The 349 executive names and information contained in Government Exhibit 58.
• The 85 executive names and information from the source list contained in Government Exhibit 43.
• The 25 executive names and information contained in Government Exhibit 60 and cut and pasted from a source list.
• The 2,784 executive names and information downloaded by Becky Christian in the fourth quarter of 2004 and described in Government Exhibit 23.
• The 2,406 executive names and information contained in Government Exhibit 47.

Accordingly, in determining the loss occasioned by Defendant and his coconspirator's theft of KFI's trade secrets (the source lists), the Court will consider the development cost of placing the names and information of 5,649 executives into source lists. Briski Decl. ¶ 35. Because the Court is focused on determining the development cost of the source lists, it will not include in the loss calculation the 450 names which Defendant and his co-conspirators obtained from the Searcher database but which were not placed into source lists.

Defendant and the government spend the majority of their memoranda disputing the time necessary to actually create the source lists as well as the hourly rate of KFI personnel. Ms. Briski's estimate of the development cost of the source lists is composed of two components - the time required to enter executives' information into FKI's Searcher database and the time required to actually create source lists from the information in the Searcher database. As to the former, Ms. Briski estimated that a standard KFI research associate "could typically generate contact information for two to four executives worthy of inclusion in Searcher per hour." Id. ¶ 37. She then estimates the hourly rate of a research associate at $150.00 an hour (which includes their compensation, benefits, and overhead). Id. From this, she estimates that it cost between $152,475.00 (6,099 names, multiplied by .25, multiplied by $150.00) and $457,425.00 (6,099 names, multiplied by .5, multiplied by $150.00) for KFI research associates to place 6,099 names into the Searcher database. Id.

Ms. Briski then estimates the amount of time (and thus the cost to KFI) of placing 5,649 names from the Searcher database into source lists. Ms. Briski estimates, based on her experience at KFI, that a "conservative estimate of the time it takes to conduct the work required to locate and initially evaluate an individual candidate for inclusion on a source list . . . is an average of .25 to .33 of an hour (i.e., three to four executives per hour)." Id. ¶ 41. Further, she states that a Senior Associate in 2005 cost KFI between $200 and $250 per hour. Id. Accordingly, Ms. Briski estimates that the cost of finding the 5,649 executives whose information was contained in the misappropriated source lists was between $282,450.00 (5,649 names, multiplied by .25, multiplied by $200.00) and $466,042.50 (5,649 names, multiplied by .33, multiplied by $250.00). Id. As a result, Ms. Briski estimates that the total development cost of the source lists at issue is between $434,925.00 and $923,467.50. Id. ¶ 42.

The Court declines to adopt Ms. Briski's estimate as to the development costs of the source lists. The Court is concerned that Ms. Briski's estimates appear to assume that each of the 5,649 names on the source lists were obtained via individualized effort and manual entry and fails to consider the extent to which economies of scale may have expedited the process. Defendant has proffered evidence, and the government does not contest its validity, that KFI personnel were able to import or copy over information regarding multiple executives (either from commercially available sources or prior search lists) into its database and source lists. Significantly, the Defendant's evidence includes the creation of portions of source lists that are at issue in this case which demonstrate the speed by which some lists may be compiled. For example, the Defendant has introduced evidence that in a single day, Larry Ormsby of KFI added 45 names into the Perkin Elmer P2 source list (one of the source lists involved in this case). Under Ms. Briski's estimates, this should have taken Mr. Ormsby between 11 and 15 hours. The Court finds it unlikely that Ms. Ormsby spent this period of time on 45 names in a single day. Similarly, Defendant has offered a declaration by Kristin Speer, a former KFI employee who was involved in the creation of the Perkin Elmer P1 source list. She estimated that it took her approximately 18.8 hours to place 218 names on this list - approximately 5 minutes per name. See Declaration of Dennis P. Riordan, Ex. A, Dkt. No. 489-2; Declaration of Kristin Speer ("Speer Decl."), Dkt. No. 499-3.

The government is correct that it need only provide a "reasonable estimate" of the loss. However, given the state of the record, the Court adopts a conservative approach and applies the 5 minute per name figure contained in the Speer Declaration. Accordingly, the Court estimates that the development of the source lists involved in this case took 470.75 hours (5,649 names multiplied by 5 minutes and then divided by 60 minutes).

The parties also contest what hourly rate should apply. Ms. Briski estimates that senior associates in 2005 - the least expensive KFI personnel involved in the creation of the source lists - have hourly rates of between $200 and $250 an hour when you include benefits, compensation, and overhead. Briski Decl. ¶ 41. Assuming a 2080 hour work year, this hourly rate yields places the yearly cost of a senior associate at $416,000. By contrast, Ms. Speer states in her declaration that she made $86,190 in 2005. Speer Decl. ¶ 2. This figure yields an hourly rate of $41.44. It appears that the main difference between Ms. Speer's and Ms. Briski's hourly estimate is Ms. Speer's omission of benefits and administrative overhead in her account of her 2005 salary.

The government cites the case of United States v. Sablan, 92 F.3d 865 (9th Cir. 1996), for the proposition that the victim's overhead is properly considered in the calculation of loss. In that case, a former employee of a bank broke into the bank after it was closed, logged onto the computer system and severely damaged several files that required numerous hours of computer programming to fix. Id. at 866. The Ninth Circuit concluded that in calculating the cost of repairs for purposes of the loss calculation, the district court properly used the bank's standard hourly rate for its employees' time, computer time, and administrative overhead. Id. at 869-70. Specifically, the court found that "had it not been necessary for the bank to devote its employees' time and computer time to making these repairs, the administrative overhead and profit would have been paid to the bank by its normal customers." Id. at 870. Thus the Ninth Circuit found that on those facts "[t]he utilization of the normal bank charges in valuation of the loss was a reasonable approach by the district court." Id. (emphasis added).

Notwithstanding the reasonableness of the approach in Sablan, the Court declines to consider KFI's overhead costs in the development cost estimate. In Sablan, the devotion of employee and computer time - time that otherwise could have been spent assisting customers - was a direct result of the defendant's conduct. Here there is no connection between the Defendant and his co-conspirator's offenses and the development cost of the source lists. Stated another way, KFI would have incurred its overhead costs regardless of whether the source lists in this case were created. In short, overhead costs are not proximately related of the offenses committed. Accordingly, the Court concludes that overhead costs should not be included on the facts of this case and will adopt the conservative $41.44 figure found in Ms. Speer's declaration.

Accordingly, the Court finds that a conservative, and reasonable, estimate of the source lists' development cost is $19,507.88.

IV. CONCLUSION

For the foregoing reasons, the Court finds that, based on the record before the Court, a reasonable estimate of the actual harm suffered by KFI is $46,907.88. This represents $27,400 in KFI's response costs and $19,507.88 in development costs of the misappropriated source lists.

IT IS SO ORDERED.

_______________

EDWARD M. CHEN

United States District Judge