Impostor bids in online auction sufficient allegation of interrupted service under CFAA

Yoder v. Equipmentfacts, 2011 WL 2433504 (N.D.Ohio June 14, 2011)

[This is a post by Jackson Cooper. Jackson graduated from DePaul University College of Law in May 2011 with a certificate in intellectual property and information technology law. Jackson also recently passed the Kentucky bar exam and will begin practicing soon. You can find him online at jacksonccooper.com or follow him on Twitter at @jacksoncooper.]

The plaintiffs here were an auction company and a firm employed to assist them with running a private online auction.  They sued the defendant, a firm previously employed by the auction company to assist them with running online auctions.  The plaintiffs  alleged violations of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, stemming from the defendant’s unauthorized access to a private auction conducted by the plaintiffs after the defendant’s relationship with the auction company was terminated.  According to the plaintiffs, the defendant made unauthorized access to the auction system using an administrative user name and password to post negative comments, and later impersonated a customer in order to place fraudulent bids as that customer.  The plaintiffs further alleged that the defendant, posing as a customer, won auctions for over one million dollars of equipment and failed to pay on those winning bids.

The defendant asked the court to dismiss the CFAA claim, challenging the plaintiffs’ pleadings on the issue of “loss” as defined by the CFAA. The CFAA defines “loss” as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” Plaintiffs alleged lost commission resulting from the defendant’s fraudulent bids and resulting failed auctions.  Defendant claimed that the small scale sabotage as at issue here did not satisfy the “interruption of service” requirement, and therefore could not support the claimed violation of the CFAA.

The court, noting the lack of a definition of “interruption of service” in the statute and the lack of case law dealing with disruptions of this type, treated the issue as one of first impression.  The court concluded that the disruption alleged here was sufficient to support the “interruption of service” requirement in the CFAA.

The court found that the defendant’s alleged “intentional disruption of even a portion of the online auction” constituted an interruption of the service of the site. Although the auction system was not taken offline by defendant’s alleged activities, the court found that thwarting individual transactions and the resulting denial of service to plaintiffs and their customers was an interruption as envisioned by the statute.

Violent posts on social media profile determined to be threats

This is a post by Jonathan Rogers. Jon is a licensed attorney in California, with a focus on technology and entertainment law. You can reach him by email at jon@jonarogers.com or follow him on Twitter at @jonarogers.

Holcomb v. Com., — S.E.2d —, 2011 WL 2183100 (Va.App., Jun 07, 2011)

Appellant challenged his conviction over posts he made to MySpace on his profile page, arguing that they did not constitute the knowing communications of a threat. He argued that MySpace posts were not the type of communication contemplated by the statute, and his postings did not constitute a threat. Appellant posted violent original lyrics which were clearly about his child’s mother.

Appellant had been convicted under a provision of Virginia law that provides:

Code § 18.2–60(A)(1):

Any person who knowingly communicates, in a writing, including an electronically transmitted communication producing a visual or electronic message, a threat to kill or do bodily injury to a person, regarding that person or any member of his family, and the threat places such person in reasonable apprehension of death or bodily injury to himself or his family member, is guilty of a Class 6 felony.

Appellant argued that he did not knowingly communicate the posts within the meaning of the statute because he posted them through his profile, which was available for anyone to view, as opposed to a communication aimed directly at the victim. The court found that there was no requirement that a threat be communicated directly to the intended victim. It instead focused on the fact that an “electronically transmitted communication” produced a “visual or electronic message” that could be viewed by anyone accessing the MySpace profile. It was enough that the victim was able to identify herself based on the references in his posts and that the appellant knew the victim had access to the profile. In fact, the court found, he knew she had viewed it previously.

Appellant’s second argument was that the posts were not threats under the statute. He argued they were lyrics which he had a history of writing and posting on his profile. The court disagreed, finding that because of specific references to the victim, and the unusual subject matter of the lyrics, the post contained statements that would place the victim in “reasonable apprehension of death or bodily injury.” The court pointed to actions taken by the victim, including moving in with her parents, and her testimony that she felt scared after seeing the postings.

The court found the online postings to MySpace where threats which placed apprehension in the victim. So the court upheld the convictions.