“Interruption of Service”

As I’ve noted in earlier posts, the basic federal computer crime statute – 18 U.S. Code § 1030 – creates a civil cause of action for those who have been “harmed” by conduct that violates the statute’s criminal provisions. That’s not uncommon. The federal anti-racketeering act (“RICO), also creates a civil cause of action for those who have been “harmed” by conduct that violates 18 U.S. Code § 1962 and related provisions.

As I’ve noted, the theory behind provisions like §1030(g) is that private citizens act essentially as “adjunct Attorneys General.” That is, private citizens who bring suits under a statute like this are presumed to enhance the effectiveness with which the statute deters criminal violations, since the private suits also act as a sanction against those who violate the statute.

This post examines a recent ruling in a civil suit brought under 18 U.S. Code § 1030(g), the section of the general federal computer crime statute that creates the civil cause of action noted above. The case is Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 2011 WL 2433504 (U.S. District Court for the Northern District of Ohio 2011) and this, according to the ruling in question, is how the case arose:

Yoder is an Ohio auction company that derives a substantial portion of its business from a yearly heavy equipment auction conducted in Florida. Though the auction is conducted in person and in the presence of the equipment, Yoder has also provided online services to its buyers and sellers for several years.

Until January 2008, Yoder had contracted with Defendant (a New Jersey LLC) to run the online bidding service. After terminating the relationship, Yoder hired RTB to maintain the online auction services for the 2010 auction. Online access to the 2010 auction was not open to the public; a potential participant must apply and satisfy both Plaintiffs.

Plaintiffs allege that Defendant obtained unauthorized access to the 2010 online auction system, using an administrative identification and password, and posted negative comments on the system chat board. Later, Defendant falsely registered for the online auction using the name of a Yoder customer who was registered for the auction in general. Further, Plaintiffs allege, Defendant used this fraudulent registration to place bids in the auction, placed the winning bid on over one million dollars worth of equipment, and failed to pay on those winning bids.

Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra.

I don’t have access to the First Amended Complaint, which is the source for the facts set out above, but in the original Complaint, there were two plaintiffs: Yoder & Frey and RealTimeBid.Com, LLC. Complaint, 2010 WL 4526896 (U.S. District Court for the Northern District of Ohio, July 19, 2010). According to the original Complaint, RealTimeBid.Com, LLC (`RTB’) is a limited liability company duly organized and existing under the laws of the State of Ohio, having its principal place of business in Holland, Ohio.” Complaint, supra, at ¶ 2.

When the plaintiffs filed the original Complaint, they didn’t know the names of the persons/entity/entities whom they believed engaged in the conduct outlined above, so they referred to them as the “John Doe Defendants.” Complaint, supra, at ¶ 2. At some subsequent point, they apparently identified EquipmentFacts LLC as one of the John Doe Defendants, and so substituted its name in the caption of the case, as the defendant. This is how the original Complaint describes what the John Doe Defendants allegedly did:

21. Prior to and during the annual Florida auction in 2010, the John Doe Defendants, without authorization, wrongfully and intentionally accessed the online bidding system using an administrative user name and password in order to post untrue, negative and defamatory statements on a chat board maintained as part of the system.

22. After the unauthorized use of the administrative user name and password was discovered and terminated by Plaintiffs, John Doe Defendants, without authorization, wrongfully and intentionally assumed the identity of a long-time customer of Yoder & Frey and using this stolen identity registered as a bidder for the annual Florida auction.

23. John Doe Defendants, using the stolen identity, continued to post untrue negative and defamatory statements about Plaintiffs on the chat board.

24. On February 10 and 11, 2010, John Doe Defendants using the stolen identity registration, submitted false bids on many items in the annual Florida auction sale and, in fact, submitted the highest bid on eighteen items with a combined purchase price of $1,171,074.00.

25. John Doe Defendants failed to pay for the items on which they had submitted the high bids.

Complaint, supra, at ¶¶ 22-25.

The Plaintiffs alleged several causes of action against the defendant(s), the first of which was the 18 U.S. Code § 1030 claim. Paragraph 30 of the original Complaint (and, I’m guessing, a similar/identical paragraph in the Amended Complaint) alleges that the Defendant(s) “knowingly and intentionally accessed Plaintiffs' computers and online bidding system without valid authorization or in excess of any authorization and as a result of such conduct caused damage and loss (18 USC § 1030(a)(5)(c)).” Complaint, supra, at ¶ 30.

The Defendant (I’m going to use that term because it’s shorter than the company’s name) responded by filing a Rule 12(b)(6) motion to dismiss the § 18 U.S. Code § 1030 cause of action. Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra. As Wikipedia explains, a Rule 12(b)(6) motion “is how lawsuits with insufficient legal theories underlying their cause of action are dismissed from court.”

The Defendant relied on the language of 18 U.S. Code § 1030(g), the portion of the statute that creates a civil cause of action for those “harmed” by a violation of 18 U.S. Code § 1030’s criminal provisions. Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra. Section 1030(g) provides, in part, that “[a]ny person who suffers damage or loss by reason of a violation of” § 1030(g)’s criminal provisions can bring civil suit seeking damages for that loss.

In its motion to dismiss, the Defendant challenged the “Plaintiffs’ allegation of `loss’” under the statute. As I understand it, the Defendant was claiming the Plaintiffs hadn’t actually “lost” anything as a result of the conduct alleged in the Complaint. Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra. The district court judge began his analysis of the argument by noting that 18 U.S. Code § 1030(e)(11)

defines `loss’ as `any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.’

Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra (emphasis added in opinion).

The judge first noted that the “Plaintiffs allege such consequential damages due to lost commissions from the failed auction on the items for which Defendant allegedly submitted the winning bid and the cost of making whole the sellers of those items.” Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra. He then explained that the “parties disagree over whether `interruption of service’ only covers large scale sabotage, such as crashing a website or a computer, or whether it can include the smaller scale sabotage at issue here, where Defendant allegedly assumed the identity of another in order to cast fraudulent bids at a site devoted to an auction.” Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra.

(In a footnote to this last statement, the judge said that if the “Defendant objected to the type, rather than scale, of the sabotage alleged, the Court would have to consider whether Plaintiffs' auction website was in service if Defendants submitted fraudulent winning bids for every item in the auction.” Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra.)

In analyzing the “interruption of service” issue, the federal judge pointed out that the statute “does not define `interruption of service’” and “[c]ase law provides little further hint” as to the correct interpretation of the phrase, “essentially leaving the Court with a question of first impression.” Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra. The judge found that most (all?) of the cases the Defendant relied “upon to show that the [Plaintiffs’] allegations do not involve an `interruption of service’” involved the “misappropriation of information, rather than [the] disruption of operations.” Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra. He also noted that the cases the Defendant relied on were “factually distinct because they involve former employees and misappropriation, they only speak to the effect of deletion, not disruption.” Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra.

Since neither the plain language of the statute nor case law provided the answer to the question raised by the Defendant’s Rule 12(b)(6) motion to dismiss, the judge

look[ed] for guidance to the legislative history of 18 U.S. Code § 1030(e)(11). In describing the definition of `loss’ . . . the record specifically invokes `responding to a computer hacker’ as the proper scope of the definition. 147 Cong. Rec. S10990–02, 20 (2001). Black's Law Dictionary 780 (9th ed.2009) defines `to hack’ as `to surreptitiously break into the computer, network, servers, or database of another person or organization.’ Here, Plaintiffs allege that Defendant surreptitiously (by pretending to be a particular Yoder customer) gained access to the auction website.

Given the legislative history, the language of the statute, and the paucity of case law, the Court finds Defendant's alleged intentional disruption of even a portion of the online auction through surreptitiously submitted false bids interrupted the service of that site. While the online auction was not totally thwarted, a number of individual online transactions were. As such, the auction website did not provide service to either Plaintiffs or the buyers and sellers in the auction while Defendants allegedly submitted false winning bids.

Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra.

The judge therefore denied the Defendant’s motion to dismiss the 18 U.S. § 1030(g) cause of action. Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, supra.

What that means, of course, is that the cause of action is still a part of the civil suit; this decision simply held that the Plaintiffs had adequately pleaded the 18 U.S. Code § 1030(g) cause of action against the Defendant. It in no way held, or established, that the Defendant is liable to the Plaintiffs under that provision. That issue will have to be decided at trial or, perhaps, on a motion for summary judgment.