CD-ROM Not a "Computer"

As I explained in an earlier post, 18 U.S. Code § 1030, which is the basic federal computer crime statute, also creates a private cause of action for people who were injured by criminal conduct in violation of § 1030.

This essentially means that a victim of a federal computer crime can sue the victimizer, seeking “compensatory damages” and/or injunctive relief (I.e., forcing the violator to stop committing the crime).

If you want to read about the elements of such a claim and the other issues involved in such a suit, check out that earlier post.

A recent decision from a federal district court in Pennsylvania – GWR Medical, Inc. v. Baez, 2008 WL 698995 (E.D. Pennsylvania 2008) – held that a CD-ROM does not constitute a “computer” encompassed by the provisions of § 1030.

As the district court noted, the case arose from “a contractual and trade secrets dispute between GWR Medical, Inc., a manufacturer and seller of various health-care products, and Hector M. Baez, one of GWR's former sales representatives.” GWR v. Baez, supra.

On May 9, 2003, GWR and Baez entered into the contract that forms the basis of this [dispute]. The Contract . . . gives Baez the right to market and sell GWR's products and trademarks . . . to medical providers.

The contract provides that GWR `may. . . terminate the Agreement . . . for any reason whatsoever, subject to giving [Baez] no less than thirty days prior written notice.’ This termination clause provides that Baez `will receive commissions on any payments received by GWR up to the final termination date.’ . . .

GWR and Baez operated under the Contract . . . for three-and-one-half years. GWR then terminated the Contract by letter dated January 23, 2007, demanding that Baez return GWR's proprietary business information and trade secrets. GWR also `tendered all sums due to [Baez] . . . under the [Contract].’ GWR then filed this suit . . . seeking . . . monetary damages.

GWR v. Baez, supra.

GWR later filed a second, expanded (amended) complaint in which it added a claim under § 1030:

GWR contends that Baez received trade secrets while he was employed, including . . . at least one training CD-ROM for proprietary Management Information System, showing all `functionality, electronic records of patient accounts, software reports and marketing materials.’ . . . Baez received a CD-ROM containing `animated screen shots with voice-overs of the Management Information System and its functionality.’ Baez refused to return this CD-ROM after his termination. . . .

GWR v. Baez, supra.

Baez moved to dismiss the § 1030 claim, arguing that it did not state a cognizable civil cause of action because “the CD-ROM does not fit the definition of a `computer’” under § 1030. GWR v. Baez, supra. As I mentioned in an earlier post, a motion to dismiss such as this is really the ultimate move in the procedural chess game of litigation. If it succeeds, it knocks out the basis on which the plaintiff (in a civil suit like this) is seeking relief, and effectively ends at least that part of the case.

In ruling on this motion to dismiss, the court reviewed the basis of GWR’s § 1030 claim:

Under [§ 1030(a)(2)] `whoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information . . . is in violation of the [statute]. Section (a)(4) states that, `whoever knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value’ is in violation of [§ 1030]. GWR asserts that Baez exceeded his access to at least one CD-ROM containing GWR's trade secrets. GWR argues that Baez's dishonesty in retaining the information exhibits an intent to defraud.

GWR v. Baez, supra.

Section 1030(e)(1) defines a “computer” as an

electronic, magnetic, optical, electrochemical, or other high speed data processing device that performs logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include an automated typewriter or typesetter, a portable hand held calculator, or similar device.

Baez argued that a CD-ROM “is not a `data storage facility”’ and does not "process information,” and so could not “be used to support a claim that he has ongoing access to GWR's computers”. GWR v. Baez, supra. GWR, of course, argued the opposite.

Baez won. After hearing testimony from experts presented by both sides, the court found as follows:

[Section 1030’s] definition of a computer has three requirements: (1) `An electronic, magnetic, optical, electrochemical, or other high speed data processing device;’ (2) `performing logical, arithmetic, or storage functions;’ which (3) `includes any data storage facility or communications facility directly related to or operating in conjunction with such device.’ As Professor Amer testified, and Professor Martin agreed, a CD-ROM is an optical, high speed device which performs storage functions. However, the expert witnesses disagreed on whether a CD-ROM processes information, communicates information, or includes a data storage facility. Because the CD-ROM at issue must meet all three parts of the statutory definition of a computer, a failure of one part leads to the conclusion that a CD-ROM cannot be defined as a computer under [§ 1030].

Based on the testimony of both experts, this Court finds that a CD-ROM does not, in and of itself, process information. The CD-ROM . . . is analogous to a compilation of documents and training materials, and cannot be considered a computer under [§ 1030] without processing capabilities. Moreover, GWR does not assert that the CD-ROM was ever used, nor that Baez has ongoing access to GWR's computer system. . . . Baez was given the CD-ROM appropriately and in the course of his business. Retaining the CD-ROM does not violate [§ 1030] . . . because the CD-ROM does not meet the definition of a computer with ongoing access. The Defendant's Motion is Granted. . . .

GWR v. Baez, supra.

Not being a technical expert, it seems to me that the court reached the right decision. And its order granting Baez’s motion to dismiss did not leave GWR without any remedy: GWR could still proceed on its original contractual and trade secrets claims.