Summary
recognizing that "a narrow reading of avoids criminalizing common conduct—like violating contractual terms of service for computer use or using a work computer for personal reasons—that lies beyond the antihacking purpose of the access statutes"
Summary of this case from Sandvig v. BarrOpinion
No. 16-41264
12-11-2017
UNITED STATES of America, Plaintiff-Appellee v. Michael THOMAS, Defendant-Appellant
Camelia Elisa Lopez, Assistant U.S. Attorney, U.S. Attorney's Office, Plano, TX, Benjamin Fitzpatrick, U.S. Department of Justice, Washington, DC, for Plaintiff-Appellee. Aaron Kyle Williamson, Tor Ekeland, Tor Ekeland, P.C., New York, NY, for Defendant-Appellant.
Camelia Elisa Lopez, Assistant U.S. Attorney, U.S. Attorney's Office, Plano, TX, Benjamin Fitzpatrick, U.S. Department of Justice, Washington, DC, for Plaintiff-Appellee.
Aaron Kyle Williamson, Tor Ekeland, Tor Ekeland, P.C., New York, NY, for Defendant-Appellant.
Before WIENER, HIGGINSON, and COSTA, Circuit Judges.
GREGG COSTA, Circuit Judge:
Michael Thomas worked as the Information Technology Operations Manager for ClickMotive, LP, a software and webpage hosting company. Upset that a coworker had been fired, Thomas embarked on a weekend campaign of electronic sabotage. He deleted over 600 files, disabled backup operations, eliminated employees from a group email a client used to contact the company, diverted executives' emails to his personal account, and set a "time bomb" that would result in employees being unable to remotely access the company's network after Thomas submitted his resignation. Once ClickMotive discovered what Thomas did, it incurred over $130,000 in costs to fix these problems.
A jury found Thomas guilty of "knowingly caus[ing] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally caus[ing] damage without authorization, to a protected computer." 18 U.S.C. § 1030(a)(5)(A). Thomas challenges the "without authorization" requirement of this provision of the Computer Fraud and Abuse Act. He contends that because his IT job gave him full access to the system and required him to "damage" the system—for example, at times his duties included deleting certain files—his conduct did not lack authorization. In support of his view that the statute does not reach those whose access to a system includes the ability to impair it, Thomas invokes the rule of lenity and principle that vague statutes cannot be enforced. But we conclude that Thomas's conduct falls squarely within the ordinary meaning of the statute and affirm his conviction.
I.
Thomas's duties at ClickMotive included network administration; maintaining production websites; installing, maintaining, upgrading, and troubleshooting network servers; ensuring system security and data integrity; and performing backups. He was granted full access to the network operating system and had the authority to access any data and change any setting on the system. Thomas was expected to perform his duties using his "best efforts and judgment to produce maximum benefit" to ClickMotive.
Thomas was not happy when his friend in the IT department was fired. It was not just a matter of loyalty to his former colleague; a smaller IT staff meant more work for Thomas. So Thomas, to use his word, "tinkered" with the company's system. The tinkering, which started on a Friday evening and continued through Monday morning, included the following:
• He deleted 625 files of backup history and deleted automated commands set to perform future backups.
• He issued a command to destroy the virtual machine that performed ClickMotive's backups for one of its servers and then Thomas failed to activate its redundant pair, ensuring that the backups would not occur.
• He tampered with ClickMotive's pager notification system by entering false contact information for various company employees, ensuring that they would not receive any automatically-generated alerts indicating system problems.
• He triggered automatic forwarding of executives' emails to an external personal email account he created during the weekend.
• He deleted pages from ClickMotive's internal "wiki," an online system of internal policies and procedures that employees routinely used for troubleshooting computer problems.
• He manually changed the setting for an authentication service that would eventually lead to the inability of employees to work remotely through VPN. Changing the setting of the VPN authentication service set a time bomb that would cause the VPN to become inoperative when someone rebooted the system, a common and foreseeable maintenance function.
• And he removed employees from e-mail distribution groups created for the benefit of customers, leading to customers' requests for support going unnoticed.
"A virtual machine is a self-contained operating environment that isolates an application from the entire computer on which it runs, denying the application access to other compartments of the system." Jonathan L. Zittrain, The Generative Internet, 119 HARV. L. REV. 1974, 2037 n.220 (2006).
Thomas was able to engage in most of this conduct from home, but he did set the VPN time bomb on Sunday evening from ClickMotive's office, which he entered using another employee's credentials. It was during this visit to the office that Thomas left his resignation letter that the company would see the next day. When the dust settled, the company incurred over $130,000 in out-of-pocket expenses and employees' time to undo the harm Thomas caused. In a subsequent interview with the FBI, Thomas stated that he engaged in this conduct because he was "frustrated" with the company and wanted to make the job harder for the person who would replace him.
A grand jury eventually charged Thomas with the section 1030(a)(5)(A) offense. But two days before the grand jury met, Thomas fled to Brazil. Nearly three years later, Thomas was arrested when he surrendered to FBI agents at Dallas/Fort Worth International Airport.
At trial, company employees and outside IT experts testified that none of the problems ClickMotive experienced as a result of Thomas's actions would be attributable to a normal system malfunction. They further stated that Thomas's actions were not consistent with normal troubleshooting and maintenance or consistent with mistakes made by a novice. ClickMotive employees asserted that it was strange for the wiki pages to be missing and that someone in Thomas's position would know that changing the setting of the VPN authentication service would cause it to become inoperative when someone rebooted the system.ClickMotive's employee handbook was not offered at trial and there was no specific company policy that governed the deletions of backups, virtual machines, or wiki modifications. Employees explained, however, that there were policies prohibiting interfering with ClickMotive's normal course of business and the destruction of its assets, such as a virtual machine or company data. Thomas's own Employment Agreement specified he was bound by policies that were reasonably necessary to protect ClickMotive's legitimate interests in its clients, customers, accounts, and work product.
The jury instructions included the statutory definition of "damage," which is "any impairment to the integrity or availability of data, a program, a system, or information." 18 U.S.C. § 1030(e)(8). The district court denied Thomas's proposed instruction for "without authorization," which was "without permission or authority." It did not define the phrase.
After the jury returned a guilty verdict, the district court sentenced Thomas to time served (which was the four months since he had been detained after returning to the country), plus three years of supervised release, and ordered restitution of $131,391.21. Thomas then filed an unsuccessful motion for judgment of acquittal. That motion, like this appeal, argued that the evidence was not sufficient to convict Thomas because he was authorized to damage the computer as part of his routine IT duties.
II.
A.
Although raised in the context of a sufficiency challenge which usually focuses on the evidence, Thomas's argument is principally a question of statutory interpretation. So we will begin with an analysis of the statute as the elements of the statute establish what the evidence must prove.
We often see arguments focusing on the meaning of words in a criminal statute raised via a challenge to the jury instruction. But as will be discussed, Thomas's requested instruction of "without authorization" did not include the limiting language he urges on appeal. This explains why a sufficiency challenge is the vehicle for his statutory argument. The government does not contend that his request for a different definition in the jury instruction estops him from arguing for a more limited definition in the context of a sufficiency challenge.
Because Thomas's argument that he was authorized to damage a computer seems nonsensical at first glance, it is helpful at the outset to explain the steps he takes to get there. He first points out that his job duties included "routinely deleting data, removing programs, and taking systems offline for diagnosis and maintenance." Thomas says this conduct damaged the computer within the meaning of the Computer Fraud and Abuse Act because damage is defined to just mean "any impairment to the integrity or availability of data, a program, a system, or information," 18 U.S.C. § 1030(e)(8) ; there is no requirement of harm. And the damage he caused by engaging in these routine tasks was not "without authorization" because it was part of his job. So far, so good. Next comes the critical leap: Thomas argues that because he was authorized to damage the computer when engaging in these routine tasks, any damage he caused while an employee was not "without authorization." Thus he cannot be prosecuted under section 1030(a)(5)(A). This argument is far reaching. If Thomas is correct, then the damage statute would not reach any employee who intentionally damaged a computer system as long as any part of that employee's job included deleting files or taking systems offline.
This assumes Thomas is correct that the "damage" element does not require a showing of harm. The just-quoted statutory definition does not include the words "harm" or "loss." This contrasts with a separate subsection of the same damage statute that requires both "damage and loss," 18 U.S.C. § 1030(a)(5)(C), with a separate statutory definition for loss, 18 U.S.C. § 1030(e)(11). But some courts addressing the damage element do require some negative effect on the system. See United States v. Yucel, 97 F.Supp.3d 413, 420 (S.D.N.Y. 2015) (concluding that damage occurs when "the system no longer operates as it did when it first came into the owner's possession and has an unwanted characteristic"); Trademotion, LLC v. Marketcliq, Inc., 857 F.Supp.2d 1285, 1292 (M.D. Fla. 2012) (stating that "impairment to integrity" requires "some diminution in the completeness or usability of date or information on a computer system"). In any event, the government concedes that at least some of what Thomas and other IT professional do in the normal course of their duties constitutes damage within the meaning of the statute. So we will assume that "damage" is defined as broadly as Thomas contends because even under his definition we conclude that he lacked authorization for the particular acts of damage charged as criminal conduct.
Thomas's support for reading the statute to cover only individuals who "had no rights, limited or otherwise [to] impair" a system comes from cases addressing the separate "access" provisions of section 1030. See, e.g. , LVRC Holdings LLC v. Brekka , 581 F.3d 1127, 1133 (9th Cir. 2009) ("[A] person who uses a computer ‘without authorization’ has no rights, limited or otherwise, to access the computer in question."); see also Pulte Homes, Inc. v. Laborers' International Union of North America , 648 F.3d 295, 303–04 (6th Cir. 2011) (relying on Brekka ). But there are important differences between the "access" and "damage" crimes that make it inappropriate to import access caselaw into the damage statute.
Section 1030(a)(5)(A) is the only independent "damage" provision, meaning it does not also require a lack of authorization to access the computer. Contrast 18 U.S.C. § 1030(a)(5)(B), (C) (both applying to damage that results from unauthorized access of a computer). It prohibits "intentionally caus[ing] damage without authorization." As discussed, the statute defines damage. And as numerous courts have recognized in discussing both the damage and access provisions, the ordinary meaning of "without authorization" is "without permission." See Brekka , 581 F.3d at 1133 (quoting Random House Unabridged Dictionary to define "authorization" as "permission or power granted by an authority"); United States v. Valle , 807 F.3d 508, 524 (2d Cir. 2015) (same); WEC Carolina Energy Solutions LLC v. Miller , 687 F.3d 199, 204 (4th Cir. 2012) (defining "without authorization" as "without approval"); Yucel , 97 F.Supp.3d at 422 (citing Webster's Third International Dictionary); see also Orin S. Kerr, Cybercrime's Scope: Interpreting "Access" and "Authorization" in Computer Misuse Statutes , 78 N.Y.U. L. REV. 1596, 1661–62 (2003) ("[T]he damage statute uses the phrase ‘without authorization’ to mean merely ‘without permission’...."). Indeed, Thomas asked that the jury be told that "without authorization" means "without permission or authority"; he did not seek an instruction that "without authorization" is limited to those who have no rights to ever impair a system. As the caselaw and Thomas's proposed instruction recognize, the plain meaning of the damage provision is that it makes it a crime to intentionally impair a computer system without permission. And notably, it applies to particular acts causing damage that lacked authorization. See 18 U.S.C. § 1030(e)(8) (defining damage to include a single impairment of the system). Nothing in the statutory text says it does not apply to intentional acts of damage that lacked permission if the employee was allowed to engage at other times in other acts that impaired the system.
Crimes involving unauthorized access are more numerous in the Computer Fraud and Abuse Act. See, e.g. , 18 U.S.C. § 1030(a)(1), (2), (3). Some of these provisions distinguish between "intentionally access[ing] a computer without authorization," and "exceed[ing] authorized access." See id . § 1030(a)(1), (2). To give meaning to the separate provisions, courts have interpreted "access without authorization" as targeting outsiders who access victim systems, while "exceeds authorized access" is applied to "insiders," such as employees of a victim company. See Valle , 807 F.3d at 524 (citing United States v. Nosal , 676 F.3d 854, 858 (9th Cir. 2012) (en banc)). It is this attempt to police that statutory line—between those who have no permission to access a system and those who have some permission to access but exceed it—that led to the language Thomas invokes about a "no authorization" case being limited to a person with "no right[ ], limited or otherwise, to access the computer in question." Brekka , 581 F.3d at 1133 (emphasis added). This ensures that "access without authorization" applies to outsiders. Indeed, Brekka begins its analysis by recognizing that "authorization" has the ordinary meaning of "permission"; the separate term "exceeds authorized access" is the source for its conclusion that access without authorization must be an all-or-nothing proposition. Id . at 1133. In addition to its support in the bifurcated statutory scheme for access crimes, a narrow reading of those statutes avoids criminalizing common conduct—like violating contractual terms of service for computer use or using a work computer for personal reasons—that lies beyond the antihacking purpose of the access statutes. See, e.g. , Valle , 807 F.3d at 512–13, 526–27 (involving police officer charged with violating section 1030(a)(2)(B) for accessing a government computer for a non-law enforcement purpose); United States v. Drew , 259 F.R.D. 449, 466 (C.D. Cal. 2009) (involving defendant charged with violating sections 1030(a)(2)(C) and 1030(c)(2)(B)(ii) for creating a fictitious profile on a social networking website and then using the account to cyberbully a teenager in violation of the website's Terms of Service); Kerr, supra , at 1663 ("If we interpret the phrase "exceeds authorized access" to include breaches of contract, we create a remarkably broad criminal prohibition that has no connection to the rationales of criminal punishment.").
None of these concerns translates to the damage statute. "Without authorization" modifies damage rather than access. Id . at 1661 (explaining that the federal damage statute uses "without authorization" in "a very different way" from how it is used in the access statutes). Section 1030(a)(5)(A) makes no distinction between all-or-nothing authorization and degrees of authorization. Its text therefore covers situations when the individual never had permission to damage the system (an outsider) or when someone who might have permission for some damaging acts causes other damage that is not authorized (an insider). Tellingly, other subsections of the same damage statute are limited to those who inflict damage while "intentionally access[ing] a protected computer without authorization." 18 U.S.C. § 1030(a)(5)(B), (C). Because section 1030(a)(5)(A) is the one subsection of the damage statute that also applies to insiders, it would make no sense to import a limitation from the access statutes that is aimed at excluding insider liability. In support of his attempt to extend to the damage statute the limitation courts have read into the "access without authorization" statutes, Thomas cites the "presumption that identical words used in different parts of the same act are intended to have the same meaning." Atlantic Cleaners & Dyers, Inc. v. United States , 286 U.S. 427, 433, 52 S.Ct. 607, 76 L.Ed. 1204 (1932). But in light of the significant statutory differences between the access and damage crimes, Chief Justice Marshall's corollary to the "consistent usage" canon is more apt: "It has been also said, that the same words have not necessarily the same meaning attached to them when found in different parts of the same instrument: their meaning is controlled by context. This is undoubtedly true." Cherokee Nation v. Georgia , 30 U.S. (5 Pet.) 1, 19, 8 L.Ed. 25 (1831), quoted in Antonin Scalia & Bryan Garner, READING LAW: THE INTERPRETATION OF LEGAL TEXTS 171 (2012).
Nor is there a significant threat that liability under the damage statute would extend to largely innocuous conduct because the requirement of "intentionally causing damage" narrows the statute's reach. Cf. Kerr, supra , at 1660–62 (stating that section 1030(a)(5)(A)"adds a very important weapon to the arsenal of computer crime statutes" and complements the access statutes that present a serious risk of being applied too broadly). Applying the damage statute to employees like Thomas also does not extend the law beyond what Congress intended. The Senate Report on the 1996 amendments to the Computer Fraud and Abuse Act stated that section 1030(a)(5)(A)"protect[s] computers and computer systems ... from damage both by outsiders, who gain access to a computer without authorization, and by insiders, who intentionally damage a computer." S. Rep. No. 104-357, at 9 (1996). It characterized these dual threats as "outside hackers" and "malicious insiders." Id . at 9. This repeated emphasis that the damage statute would apply equally to both threats was made with full awareness, from the time the statute was first enacted a decade earlier that, as Thomas emphasizes, employees are sometimes permitted or even required to engage in "repair activities." S. Rep. No. 99-432, at 12 (1986). Such acts that are "necessary to the repair" of the system, would not be criminal because they are authorized. Id. The statute's mens rea was also cited as a limitation on the statute's reach. S. Rep. No. 104-357, at 11 ("[I]nsiders, who are authorized to access a computer, face criminal liability only if they intend to cause damage to the computer." (emphasis added)). By providing immunity from the damage statute to any "malicious insider" who was permitted to cause "damage" in some situations as part of his job duties, Thomas's interpretation would substantially curtail the statute's intended reach.
See also S. Rep. No. 104-357, at 10 (stating that section 1030(a)(5)(A)"would cover anyone who intentionally damages a computer, regardless of whether they were an outsider or an insider otherwise authorized to access the computer").
This statement that insiders are only liable for intentionally causing damage is further support for the point made above that section 1030(a)(5)(A) is the only damage provision that can apply to insiders. The other two damage provisions, which require unauthorized access, have lower mens rea requirements. Section 1030(a)(5)(B) applies to recklessly causing damage. Section 1030(a)(5)(C) imposes strict liability when it comes to the damage requirement, though the conduct must result in both "damage and loss."
--------
So Thomas's reading of "without authorization" is at odds with the statutory language and legislative intent. His offered construction thus finds no recourse in the rule of lenity because there is no interpretive tie for that principle to break. United States v. Castleman , ––– U.S. ––––, 134 S.Ct. 1405, 1416, 188 L.Ed.2d 426 (2014)(stating that "the rule of lenity only applies if, after considering text, structure, history, and purpose, there remains a grievous ambiguity or uncertainty in the statute, such that the Court must simply guess as to what Congress intended" (internal quotation marks omitted)).
We conclude that Section 1030(a)(5)(A) prohibits intentionally damaging a computer system when there was no permission to engage in that particular act of damage. To the extent more is needed to flesh out the scope of "permission" when a defendant has some general authority to impair a network, there is helpful guidance in one of our cases addressing an access statute, which if anything should define authorization more narrowly for the reasons we have discussed. United States v. Phillips , 477 F.3d 215, 219 (5th Cir. 2007). Phillips says to look at the "expected norms of intended use." Id .
B.
With this understanding of the damage statute, we turn to the more typical sufficiency review and evaluate whether the evidence supported the conviction. This analysis usually begins with talk of the considerable deference the jury's view of the evidence should receive, with it getting to make credibility determinations, draw reasonable inferences, and the like. United States v. Winkler , 639 F.3d 692, 696 (5th Cir. 2011). Reliance on that standard of review is unnecessary here as there is overwhelming evidence to support the jury's view that Thomas did not have permission to engage in the weekend damage campaign.
The nature of Thomas's conduct is highly incriminating. No reasonable employee could think he had permission to stop the system from providing backups, or to delete files outside the normal protocols, or to falsify contact information in a notification system, or to set a process in motion that would prevent users from remotely accessing the network. Phillips , 477 F.3d at 220 (affirming jury finding of lack of authorization to launch a brute-force attack program when that would not be permissible "within the understanding of any reasonable computer user"). Thomas emphasizes the unlimited access he had to the system that gave him the ability to inflict this damage. But it is not conceivable that any employee, regardless of their level of computer access, would be authorized to cause these problems. The incidents for which Thomas was held liable were nothing like the periodic acts he performed as part of his duties. Those tasks may have impaired the system on a limited basis in order to benefit the computer network in the long run. Routine deletions of old files provide that benefit by increasing storage space. Taking systems offline allows for necessary maintenance. In contrast, the various types of damage Thomas caused during the last few days before he resigned resulted in over $130,000 in remediation costs. Regardless of whether the definition of "damage" under the statute requires a showing of harm, impairments that harm the system are much less likely to be authorized than those that benefit the system. It would rarely if ever make sense for an employer to authorize an employee to harm its computer system.
The harmful acts themselves would be enough to support the verdict, but Thomas's words and conduct in response to the criminal investigation provide additional support. When questioned by federal agents, he acknowledged the distinction we have just made. He did not say that he caused the damage in order to maintain or improve the system; instead, his motive was to make things more difficult for the person hired to replace him. And his flight to Brazil is not what is expected of someone who had permission to engage in the conduct being investigated. See Allen v. United States , 164 U.S. 492, 499, 17 S.Ct. 154, 41 L.Ed. 528 (1896) ("[T]he law is entirely well settled that the flight of the accused is competent evidence against him as having a tendency to establish his guilt.").
The circumstances surrounding the damaging acts provide even more support for the finding of guilt. Thomas committed the various acts one after the other in a concentrated time span beginning Friday evening and continuing through the weekend. Thomas did most of this from home, but the one time he had to go the office he did so using another employee's credentials. One of his acts—falsification of contact information in the alert system—prevented Thomas's conduct from being detected during the weekend as employees would not receive notifications about the damage to the system. He submitted his resignation immediately after completing the damage spree and timed the most damaging act—the one that would prevent remote access—so that it would not occur until he was gone. Why this sequence of events if Thomas had permission to cause the damage?
All of this provided ample support to conclude that Thomas lacked permission to inflict the damage he caused. As that question of authorization is the only element he challenges, sufficient evidence supports the conviction.
III.
What we have just said about the straightforward application of the damage statute to Thomas's conduct also dooms his claim that the law is unconstitutionally vague. That is because even if a statute might be vague when applied to some situations, "a defendant whose conduct is clearly prohibited cannot be the one making that challenge." United States v. Westbrooks , 858 F.3d 317, 325 (5th Cir. 2017).
Further proof that Thomas's conduct is a paradigmatic application of section 1030(a)(5)(A) comes from its similarity to a hypothetical use of the statute that a leading computer crime scholar foresaw years ago. Professor Kerr provided the following example that is essentially this case but for a twist that the employee is upset about his own employment situation rather than a colleague's:
Employee sabotage: Sam is a computer programmer who is angry at his employer for denying him a promotion. Sam decides to take revenge by deleting some of his employer's important files, and by launching a denial-of-service attack that overwhelms his company's webserver with requests and takes it offline for a few hours. The deletion of the files will not constitute an unauthorized access. Sam accessed his employer's computer when he used it to delete files, but as a programmer he was authorized to access those files and therefore has not committed access without authorization. Similarly, the denial-of-service attack will not itself constitute an unauthorized access crime. Sending the data to the computer does access the computer, but the access is not without authorization: The webserver has been configured to accept all web traffic requests, such that sending many requests will not circumvent any code-based restrictions.
Sam does not avoid criminal liability, however. The deletion of the files may constitute destruction of property or conversion and, depending on the applicable state laws, he could be prosecuted under general property crime statutes. Sam could also be prosecuted for damaging the computer under the federal
computer damage statute, 18 U.S.C. § 1030(a)(5)(A)(i).
Kerr, supra , at 1664–65 (emphasis added).
The law review article is not all that undermines the contention that Thomas lacked notice that his conduct was criminal. Just a couple weeks after the damage spree, and before the FBI had contacted Thomas, he told the friend whose firing had set this in motion that "he thought he might have broken the law." Which law, the friend inquired? Thomas's response: "the Computer Fraud and Abuse Act."
* * *
The judgment of the district court is AFFIRMED.