TechLaw

As far as we know, Internet access providers don't guarantee uninterrupted or quality service. Here in the Washington, D.C., area, the most subscribers can expect is a modest credit on the next month's bill when service is entirely unavailable for more than 24 hours.

Apparently the situation is different when the balky connection is caused by a hacker. The Seventh Circuit, in a criminal case brought under the Computer Fraud and Abuse Act, affirmed a $6,014  restitution award to compensate a business for "lost productivity" attributable to the defendant's disruption of the company's wireless Internet connection.

The court's opinion is not clear on how this sum was calculated. The victim was a small manufacturing company that accessed the Internet through a wireless provider. The defendant, a recently fired computer technician, made unauthorized use of the company's wireless account, preventing the victim's employees from accessing the Internet at the same time. The victim's loss is twice described as "lost productivity” and once as "lost productivity for approximately five days." The court remarks elsewhere that the defendant's conduct “adversely affected their productivity.”

The victim's characterization of its loss, submitted in the form of an affidavit by the president of the company, mentions just $164 in actual losses. However, the affidavit also claims 144 hours (@ $65/hour) of lost productivity. These lost hours are attributed to the need to burn files to disc and overnight them to customers, plus "customer visits," "loss of customer confidence," and "unable to communicate with customers." None of these losses were quantified or documented. 

The case appears to be first to treat this sort of "loss" as something protected by the CFAA. The statute, at 18 U.S.C. 1030(e)(11), defines "loss" as

any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service;

The federal Sentencing Guidelines, Section 2B1.1, Application Note 3, advise that for CFAA offenses, "actual loss" means

pecuniary harm, regardless of whether such pecuniary harm was reasonably foreseeable: any reasonable cost to the victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other damages incurred because of interruption of service.

While it is certainly possible to make a reasoned argument that "lost productivity" is a valid CFAA loss -- for example, by building on the expansive language used by the court in EF Cultural v. Explorica Inc., 274 F.3d 577 (1st Cir. 2001), the trial court and the Seventh Circuit clearly seem to be breaking new ground here.

Unlike lost revenue, which is mentioned in the CFAA, lost productivity,  which is not, is very difficult to substantiate. Did the victim have an alternative means of accessing the Internet? Did the victim pay overtime to compensate for the diminished productivity of its workers? Did the defendant's conduct affect the victim's revenues or expenses at all?

Consideration of "lost productivity" in this case yield a 15-month prison term for the defendant plus $6,014 restitution for the victim. The same harm, if caused by an Internet access provider, would have been worth about $20 off the next month's bill.

The case is United States v. Schuster, No. 05-4244 (7th Cir., Oct. 27, 2006).