In recent years, courts in the Northern District of Illinois have made clear that without actual harm to data, a plaintiff cannot claim “damage” under the Consumer Fraud and Abuse Act, 18 U.S.C. 1030 et seq. (“CFAA”). See, e.g., Garelli Wong & Assoc. v. Nichols, 551 F. Supp. 2d 704, 704 (N.D. Ill. 2008) (holding there was no “damage” because the defendant’s “unauthorized acts of copying and e-mailing [Plaintiff’s] computer files did not impair the integrity or availability of the information in the Database and did not cause any interruption of service.”) To circumvent this strict reading of the CFAA, companies have used the term “loss” in the statute, arguing that a company suffered a “loss” by undertaking efforts to investigate and assess what “damage” may have been caused. 18 U.S.C. 1030 (e)(11) (defining “loss” to include “conducting a damage assessment.”). A recent case calls into question whether such allegations will continue to suffice.
In Kluber Skahan & Associates, Inc. v. Cordogan, Clark & Assoc., Inc., the court addressed whether allegations of a “loss” suffered within two years were sufficient to toll the limitation period under the CFAA, which requires a case to be brought within two years of discovery of any “damage.” In answering in the negative, Judge Zagel further shortened the reach of the CFAA. In Kluber, the court defined the elements of CFAA as requiring proof of: (1) damage or loss, (2) as a result of (3) a violation of some other provision of section 1030, and (4) conduct involving one of the facts set forth in section 1030 (c)(4)(A)(i). Kluber Skahan & Associates, Inc. v. Cordogan, Clark & Assoc., Inc., No. 08-cv-1529, 2009 WL 466812, * 6 (N.D. Ill. Feb. 25, 2009). The court undertook an analysis of the definitions of “loss” and “damage” under Section 1030, finding that the words were not only different in definition, but different in concept. Specifically, the court stated “whereas ‘damage’ contemplates harms to data and information, ‘loss’ refers to monetary harms.” Id. at * 7. The court went one step further, announcing that “Section 1030(g) does not require damage for a CFAA claim to arise.” Id. at *8 n. 14. It is ironic that with such an emphasis on the distinction between these harms, the court would later take effort to amalgamate them.
Ultimately, the court refused to toll the limitations period, holding that Congress explicitly chose to provide a two-year limitation for injury-discovery regardless of whether a “loss” had occurred. Id. at * 8 (“It was well within Congress’ power to include a separate two-year limitation of the discovery of loss. The text of the CFAA reflects that Congress declined to do so, and so will I.”). It supported its decision by emphasizing that the purpose of the statute is primarily criminal and that the statute was not meant to “cover the disloyal employee who walks off with confidential information.” Id (citing Am. Family Mut. Ins. Co. v. Rickman, 554 F. Supp. 2d 766, 771 (N.D. Ohio 2008)). Thus, it concluded that “[l]osses are monetary harms attenuated from the underlying concern of the Act: damage to data.” Id.
Thus, although courts have been quick to distinguish, both by definition and concept, “damage” and “loss,” it appears that, at least in the Northern District of Illinois, a plaintiff will need to demonstrate some “damage” to prove a “loss” for purposes of pursuing a CFAA claim.