Child Pornography, the Laptop and the Shower

-->

After a jury convicted Paul Stanley of “three counts related to child pornography -- for transportation, receipt, and possession of child pornography, in violation of 18 U.S . Code §§ 2252A(a)(1), (2), (5)(B) -- as well as one count of obstruction of justice, in violation of 18 U.S. Code § 1512(c)(1)”, he appealed.  U.S. v. Stanley, 2013 WL 3770713 (U.S.Court of Appeals for the 4th Circuit 2013).

Stanley made three arguments on appeal:  that the U.S. District Court judge who presided at his trial “erred in admitting expert testimony by the agent who conducted the forensic examination of Stanley's computer;” that the evidence was not sufficient to support his conviction for the child pornography crimes; and that the evidence was not sufficient to support his conviction for obstruction of justice. U.S. v. Stanley, supra.  The Court of Appeals addressed the arguments in this order.

Stanley’s first argument was that

Agent Crystal Gilmer, a computer forensic examiner with the Maryland State police, should not have been permitted to testify as an expert regarding her forensic examination of Stanley's laptop computer. Stanley asserts that Agent Gilmer possessed insufficient specialized knowledge or skill in the software programs used to extract data from Stanley's computer, and failed to offer testimony regarding the reliability of the forensic tools used in the examination.

U.S. v. Stanley, supra. 

The Court of Appeals noted that it reviews a district court judge’s decision to admit expert testimony for “abuse of discretion and will not find an abuse unless a ruling is `arbitrary and irrational.’” U.S. v. Stanley, supra (quoting U.S. v. Cloud, 680 F.3d 396 (U.S. Court of Appeals for the 4th Circuit 2012).  It then explained that Rule 702 of the Federal Rules of Evidence outlines the requirements for admitting expert testimony:

These are four-fold. First, the district court must find that `the expert's scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine the fact in issue.” Rule 702(a). Second, `the testimony [must be] based on sufficient facts or data.’ Rule 702(b). Third and 4th, `the testimony [must be] the product of reliable principles and methods” that “the expert has reliably applied ... to the facts of the case.’ Rule 702(c)-(d).

As to these latter prongs, the district court `must have considerable leeway in deciding in a particular case how to go about determining whether particular expert testimony is reliable.’ Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999). The many factors set forth in Daubert v. Merrell Dow Pharm., Inc., 509 U.S. 579 (1993), and its progeny are neither exclusive nor dispositive. Rule 702, advisory committee's note. Furthermore, `the trial court's role as a gatekeeper is not intended to serve as a replacement for the adversary system,” and consequently, “the rejection of expert testimony is the exception rather than the rule.’ Rule 702, advisory committee's note.

U.S. v. Stanley, supra. 

The Court of Appeals then applied these standards to the testimony at issue, noting that

[d]uring her expert testimony, Agent Gilmer explained the process she used to examine Stanely's laptop, utilizing multiple forensic tools. These tools included a forensic software program called EnCase, which she used to make a `mirror’ image of Stanley's computer in order to examine its contents without risking damage to the original.

Agent Gilmer's examination revealed that Stanley had downloaded and installed a peer-to-peer file sharing program called FrostWire onto his laptop. Agent Gilmer also discovered that the FrostWire program had been used to search for and download child pornography, as well as to view, keep, and share child pornography files.

U.S. v. Stanley, supra. 

The court found the district court judge did not abuse his discretion in admitting Gilmer’s expert testimony, given these facts. U.S. v. Stanley, supra.  It noted that as to Rule 702’s first requirement, “many courts have noted that the process of forensic data extraction requires specialized knowledge or skill conducive to expert testimony. See, e.g., U.S. v. Yu, 411 F. App'x 559 (U.S. Court of Appeals for the 4th Circuit 2010); U.S. v. Ganier, 468 F.3d 920, 926 (U.S. Court of Appeals for the 6th Circuit.2006).” U.S. v. Stanley, supra.  The Court of Appeals also found that, as to the

factual basis and reliability of the testimony, the district court acted well within the wide bounds of its discretion. During the lengthy voir dire that included several rounds of cross-examination, the district court heard considerable evidence regarding Gilmer's education, training, experience, and knowledge of the forensic tools and procedures she utilized, as well as detailed explanations of her use of the forensic software in this particular case.

Gilmer also explained that the forensic tools she used to examine the contents of Stanley's laptop had been accepted as reliable procedures by her law enforcement agency. Having heard all of this evidence and the defense's objections, the district court permitted the government to proceed with its examination of Agent Gilmer as an expert in `computer examination and analysis.’

U.S. v. Stanley, supra.  So it rejected Stanley’s first argument. U.S. v. Stanley, supra. 

The court then took up his second argument, that the evidence presented at trial was not sufficient to support his convictions for transporting, receiving and possessing child pornography. U.S. v. Stanley, supra.  He apparently argued that “downloading, storing, and sharing images using a peer-to-peer program on one's computer cannot establish knowing receipt, possession or transportation of child pornography.” U.S. v. Stanley, supra.  The Court of Appeals did not agree, noting, first, that

[w]e have held that “use of a peer-to-peer file-sharing program qualifies as distribution” in the context of a sentencing enhancement for distribution of child pornography. U.S. v. Layton, 564 F.3d 330 (U.S. Court of Appeals for the 4th Cir.2009).  Thus, `[w]hen knowingly using a file-sharing program that allows others to access child pornography files, a defendant commits an act related to the transfer of [child pornography].’ Id. . . . 

The same rationale applies to transportation, receipt, and possession of child pornography as defined by 18 U.S Code § 2252A.

U.S. v. Stanley, supra.

The court then explained that the evidence at trial supported the jury’s finding that

Stanley possessed the requisite knowledge of his actions for each of the child pornography convictions. In affirming the sufficiency of the evidence to support a defendant's conviction for receipt of child pornography, we have reasoned that `whether a defendant knew that images viewed online would be saved to his computer is a close question only where there is some indication that the images were saved there without his knowledge.’ U.S. v. Johnson, 2013 WL 1767640 (U.S. Court of Appeals for the 4th Circuit 2013). Here, . . . the government presented ample evidence of Stanley's intent and awareness of his illegal acts.

According to Gilmer's testimony, 570 files had been available for sharing at the time Stanley's laptop was seized, all of which were saved in the folder designated for saving and sharing files, entitled `C:/ Users/Paul/shared.’ . . . Upon opening the FrostWire shared folder, it prominently displayed the following warning: `You are sharing 570 files. You can control which files FrostWire shares.’ . . .

The government introduced evidence of common search terms associated with child pornography, which were included in many of the file names found on the laptop. t Gilmer also testified that during the ten days prior to the laptop's seizure, specific images in the FrostWire shared folder had been accessed 209 times, with 173 of the images containing terms indicative of child pornography in their titles.

In addition to this abundance of evidence that Stanley repeatedly sought and viewed child pornography, and was on notice these files were being shared with others through the FrostWire program, the jury also heard testimony about [his] attempt to destroy his laptop by placing it under running water in the shower after officers informed him that they were investigating his involvement in child pornography activities. From this evidence, . . . a rational jury could have concluded beyond a reasonable doubt that Stanley knowingly transported, received, and possessed child pornography, in violation of the charged provisions of 18 U.S.C. § 2252A.

U.S. v. Stanley, supra.  (We’ll get back to the shower in a moment.)

It then took up his final argument – that the evidence was not sufficient to support his conviction for obstruction of justice in violation of 18 U.S. Code § 1512.  U.S. v. Stanley, supra. The Court of Appeals noted that to “sustain a conviction for obstructing a federal proceeding, the government was required to prove Stanley `corruptly . . . alter[ed], destroy[ed], mutilate[d], or conceal[ed] a record, document, or other object, or attempt[ed] to do so, with the intent to impair the object's integrity or availability for use in an official proceeding.’” U.S. v. Stanley, supra (18 U.S. Code § 1512(c)(1)). 

As to the trial, the court noted that the prosecution presented evidence that the

Internet Crimes Against Children Task Force was conducting an online undercover investigation into individuals using peer-to-peer networks to traffic child pornography. In the course of this investigation, officers identified an internet protocol (`IP’) address which they linked to Stanley. When Task Force officers arrived at [his] residence, they identified themselves and informed Stanley they were pursuing an investigation into child pornography activities.

Stanley asked if he could go back into the residence to get dressed, at which point he went into the basement and woke his roommate, Brian Pease, telling him that `[t]he cops are here for my computer.’ When Pease got out of bed a few minutes later, he found Stanley's laptop in the shower under running water, and removed it. 

Meanwhile, Stanley returned to the door and advised the Task Force officers that he no longer had possession of the laptop because he had given it to a friend when it stopped working six months earlier. Task Force officers subsequently obtained a search warrant for Stanley's residence, and recovered the laptop Stanley had placed in the shower.

U.S. v. Stanley, supra.

The Court of Appeals then found that, “viewing this evidence in the light most favorable to the government, we find it more than sufficient to allow a reasonable juror to determine beyond a reasonable doubt that Stanley attempted to destroy or conceal his laptop in order to impair its availability for use in an official proceeding.”  U.S. v. Stanley, supra.

Constructive Possession, Child Pornography and the .rar Files

Faiz Al–Khayyal was charged with with “49 counts of sexual exploitation of children in violation of [Georgia Code] §16–12–100(b)(8)], based upon allegations that he possessed and controlled child pornography in the form of digital files on his laptop computer.” State v.  Al-Khayyal, 2013 WL 3037725 (Georgia Court of Appeals 2013).  

He moved to dismiss the charges for lack of venue and the Superior Court of Clayton County granted the motion. State v. Al-Khayyal, supra. The prosecution appealed the decision pursuant to Georgia Code § 5-7-1(a). State v. Al-Khayyal, supra.

As Wikipedia explains, “venue” refers to the “location where a case is heard.” As Wikipedia also notes, Article III § 2 of the U.S. Constitution addresses venue, stating that the “Trial of All Crimes . . . shall be held in the State” where the crimes were committed.  We will come back to venue, but first, the facts: 

In 2009, while Al–Khayyal, a professor at the Georgia Institute of Technology, was abroad teaching in China, he became the target of an investigation into child pornography. When he returned to the United States on August 5, 2009, bringing his laptop computer, immigration control officers detained him in the Atlanta airport (in Clayton County) and seized that computer.

A forensic computer specialist for the Georgia Bureau of Investigation conducted a forensic examination of the computer, using specialized forensic software, and discovered 29 digital files that contained sexually explicit images of young girls. The files had been placed in the computer's trash folder, which had then been emptied, so the files were permanently deleted or `double-deleted’ and inaccessible to the user. A subsequent examination of the computer yielded 20 additional files that had been `deleted’ but remained saved in the trash folder.

Those files were in a compressed `.rar’ format, and the images contained in the files could be viewed only with an `uncompressing’ or `unzipping’ program that at that time was not loaded on the computer. A different unzipping program, however, was loaded on the computer, and [its] history files showed that the software had been used, though not on the files at issue in this case.

In addition, the computer specialist testified that the software required to access the .rar files is readily available to the public and can be used without special training. When the computer specialist used the required software to `rebuild’ the .rar files in the trash folder, she found that the files also contained sexually explicit images of young girls.

State v. Al-Khayyal, supra.

In his motion to dismiss, Al-Khayyal argued that although he “possessed the computer in Clayton County,” he “deleted the digital files before he entered the county and could no longer access” them and there was, therefore, no evidence that he committed the offenses as alleged in the indictment.” State v. Al-Khayyal, supra. The trial judge granted the motion because he found there was no evidence that Al-Khayyal “was in knowing possession and control of the images in Clayton County.” State v. Al-Khayyal, supra.

On appeal, the prosecution argued that the evidence proved that Al-Khayyal possessed

his computer in Clayton County . . .when the . . . .rar files were present on [its] hard drive. . . . [T]he State contends the evidence establishes that, although the subject files were then assigned to Al–Khayyal's computer's trash folder, he could have accessed the files and viewed the contraband images after downloading software that was readily available to the public.

Further, the State contends that the evidence supports an inference that Al–Khayyal knew the files were on his computer and he could later access them. Because questions concerning Al–Khayyal's knowledge and intent are for the jury to decide, the State contends that . . . the trial court erred in . . . granting his motion to dismiss the indictment.

State v. Al-Khayyal, supra.

Al-Khayyal argued, in response, that the trial judge’s ruling was correct because

while he was in Clayton County, he lacked the ability to access the illegal images stored on his computer. He contends that contraband that is in the form of electronic data `can only be thrown away in one way -- [by] rendering it inaccessible on the computer’ on which the data is stored.

He contends that, before entering Clayton County, he had done `everything he could to discard the [illegal] images and terminate his possession’ and the steps he had taken before he returned to the United States did, in fact, render the subject files `totally inaccessible.’ Based on this, he contends that the trial court correctly determined that, as a matter of law, he was not in knowing possession or control of the contraband in that venue.

State v. Al-Khayyal, supra.

The Court of Appeals began its analysis of the arguments by explaining that

`[u]nder Georgia law, a person who knowingly has direct physical control over a thing at a given time is in actual possession of it. A person who, though not in actual possession, knowingly has both the power and the intention at a given time to exercise dominion or control over a thing is then in constructive possession of it. In any criminal prosecution for possession, therefore, the State must prove that the defendant was aware he possessed the contraband at issue. . . . Barton v. State, 286 Ga. App. 49, 648 S.E.2d  (Georgia Court of Appeals 2007).

`Both knowledge and possession may be proved, like any other fact, by circumstantial evidence.’ . . . Hunt v. State, 303 Ga. App. 855, 695 S.E.2d 53 (Georgia Court of Appeals 2010). Further, `[a]s long as there is slight evidence of access, power, and intention to exercise control or dominion over an instrumentality, the question of fact regarding constructive possession remains within the domain of the trier of fact.’ . . . Hunt v. State, supra.

State v. Al-Khayyal, supra.  For more on actual possession versus constructive possession, check out this prior post.

The Court of Appeals then turned to child pornography, noting that the “common thread in child pornography laws” is “the visual depiction of minors engaged in sexually explicit conduct.”  State v. Al-Khayyal, supra.

[C]hild pornography presents special issues in contemporary times because technology allows images to be ephemerally generated from data stored in a variety of media. Georgia law . . . has evolved to reflect the impact of technology. Some offenses are narrowly drawn to prohibit specified conduct involving a `visual medium’ or `visual or printed matter’ which depicts a minor or a portion of a minor's body engaged in any sexually explicit conduct. The offense at issue in this case, on the other hand, is more broadly drawn to prohibit possession or control of `any material’ which depicts such an image. [Georgia Code] § 16–12–100(b)(8).  

Georgia's appellate courts have upheld convictions under this subsection in cases based on the defendant's possession of a videotape, a compact disc, a DVD, or a USB flash drive that contained prohibited content. Thus, in these storage media cases, evidence that a defendant possessed data capable of generating images of a minor engaged in sexually explicit conduct authorized the jury to find that the defendant possessed prohibited `material’ even though actually viewing the prohibited images would require the use of a machine or electronic device (a videocassette player, a computer equipped with particular software, etc.).

State v. Al-Khayyal, supra (emphasis in the original).

The court also noted that “it is undisputed that Al–Khayyal physically possessed a computer that served as the storage medium for data files capable of generating visual depictions of minors engaged in sexually explicit conduct.”  State v. Al-Khayyal, supra. It also noted that

[d]espite his undisputed physical possession of the computer in Clayton County, Al–Khayyal contends the State cannot prove that he possessed the contraband at issue in that venue because, while he was in the county, he lacked the ability to access the illegal images stored on his computer. He relies in part on evidence that the software required to view the prohibited visual depictions was not loaded on his computer at the same time.

We find no support in Georgia law, however, for the proposition that possession of prohibited material under [Georgia Code] § 16–12–100(b)(8) exists only in conjunction with the defendant's present ability to view illegal visual depictions, especially given the evidence that the needed software was readily available to the public. 

State v. Al-Khayyal, supra.

The court then took up Al-Khayyal’s final argument -- that “the evidence precludes the requisite finding that he possessed the contraband at issue knowingly, that is, that he was aware that the files containing the illegal images were stored in his computer's memory.”  State v. Al-Khayyal, supra (emphasis in the original). It noted that there

was no evidence presented at the hearing on Al–Khayyal's . . . and motion to dismiss that the type of files at issue in this case, .rar files, could have been saved to his hard drive automatically and without his knowledge. Rather, the evidence authorizes an inference that the .rar files originally came to be saved to Al–Khayyal's computer deliberately.

Further, the evidence, including evidence that he actively manipulated the .rar files by deleting them, authorizes an inference that he was aware the files were saved to his hard drive. Evidence that Al–Khayyal had double-deleted other files authorizes an inference that he knew that deleting a file moves it to the trash folder and that, without further action, a deleted file remains stored there. By extension, this evidence also authorizes an inference that he knew that the .rar files at issue in this case were in the trash folder and still accessible.

Evidence that he had used other unzipping software authorizes an inference that he knew about the kind of software needed to access and manipulate compressed files. In addition, all of this evidence must be viewed in light of Al–Khayyal's educational background and professional expertise.

State v. Al-Khayyal, supra.

The Court of Appeals then found that

[t]aking these permissible inferences together, we conclude the evidence does not establish as a matter of law that, while Al–Khayyal possessed his computer in Clayton County, he had no knowledge of the presence of the .rar files in his computer's trash folder. Under the facts presented, the question of whether [his] efforts to abandon the illegal files were successful remains a question of fact for the jury and cannot be determined as a matter of law at this pretrial stage.

Bearing in mind that knowledge and possession may be proved by circumstantial evidence and that slight evidence of access, power, and intention to exercise control or dominion over contraband is sufficient to create a jury issue, the record does not support a finding that it will be impossible for the State to prove that Al–Khayyal committed the offenses in Clayton County, as alleged in the indictment.

State v. Al-Khayyal, supra.

The Court of Appeals therefore held that the trial judge erred in granting Al-Khayyal’s motion to dismiss and therefore reversed that ruling and remanded the case for further proceedings.  State v. Al-Khayyal, supra.

You can, if you are interested, read more about the facts in the case and see a photo of Al-Khayyal in the news story you can find here.

Unauthorized Access, Email and Team Viewer

As I have noted in earlier posts, the general federal cybercrime statute – 18 U.S. Code § 1030 – not only defines criminal offenses, it also, in 18 U.S. Code § 1030(g), creates a civil cause of action for one “who suffers damage or loss by reason of a violation” of the statute’s criminal provisions.  As I have also noted, the Stored Communications Act also, in 18 U.S. Code § 2707, creates a civil cause of action for those “aggrieved by” a violation of its provisions.

This post examines an opinion a district court judge in the U.S. District Court for the Eastern District of Pennsylvania issued recently in a civil case involving claims under both statutes:  Brooks v. AM Resorts, LLC, __ F.Supp.2d __, 2013 WL 3343993 (2013). The opinion begins by noting that Douglas Books sued

AM Resorts, LLC (`AM Resorts’). Brooks alleges  thatAM Resorts gained unauthorized accessed to his computer and email account in violation of the Stored Communications Act (`SCA’), 18 U.S.C. § 2701, et seq., the Computer Fraud and Abuse Act (`CFAA’), 18 U.S.C. § 1030, et seq.

Brooks v. AM Resorts, supra.

In this opinion, the judge is ruling on Brooks’ motion for “partial summary judgment on the issue of liability, arguing that AM Resorts is indisputably liable on the claims brought against it and that trial should be set solely on the issue of damages.” Brooks v. AM Resorts, supra. AM Resorts filed a motion for summary judgment “in its favor on all claims.”  Brooks v. AM Resorts, supra. 

As Wikipedia explains, summary judgment is a judgment a court enters “for one party and against another party summarily, i.e., without a full trial.”  As Wikipedia also notes, to grant summary judgment for a party the court has to find that

1. there are no disputes of `material’ fact requiring a trial to resolve, and
2. in applying the law to the undisputed facts, one party is clearly entitled to judgment. 

It notes that a “material” fact is “one which, depending upon what the factfinder believes "really happened," could lead to judgment in favor of one party, rather than the other.”  So, each side is trying to avoid a trial on some/all of the issues in the case.

The opinion says Brooks is a former employee of AM Resorts.  On March 4, 2010,

AM Resorts terminated [his] employment. . . . After he was fired, Brooks engaged in an email exchange with his lawyers to discuss attorney-client privileged matters pertaining to the termination (the `privileged email exchange’). Neither Brooks nor his attorneys shared this privileged email exchange with any third party. 

However, on March 21, 2010, Brooks received an email from his former supervisor at AM Resorts, Javier Estelrich, that stated, `Doug, I got your email. Tomorrow our lawyers will get in touch either with your lawyer or with you (in case it is not possible with them).’ . . . Attached . . . was the privileged email exchange between Brooks and his lawyers.

The header to Estelrich's March 21, 2010 email to Brooks listed the Internet Protocol (`IP’) address 207.204.53.55. This same IP address . . . appeared in the header of an email Estelrich received on March 10, 2010 from AM Resorts employee, Pepe Morell. Brooks had a Microsoft Hotmail email account. 

A log from the Microsoft Corporation lists the dates and times any user accessed, or attempted to access, Brooks' personal email account in the month of March 2010. This log indicates someone with the IP address 207.204.53.55 accessed Brooks email account on March 19, 2010 at 10:53 p.m. and on March 20, 2010 at 5:43 a.m. . . .

Brooks had given his personal email address and password to AM Resorts because he had experienced difficulty accessing and using his work email account. Additionally, Brooks had allowed Am Resorts to install a program called Team Viewer on his personal desktop computer. 

Team Viewer is a program designed to allow technicians to diagnose problems on a user computer from a remote location. [It] enables an individual to remotely access and control a computer. Brooks alleges that AM Resorts remotely accessed his computer after his termination through the Team Viewer program and accessed his personal email account, either independently of accessing his computer or, while it was remotely controlling his computer through Team Viewer.

Brooks does not know how to access his computer remotely through Team Viewer. There is evidence someone accessed Brooks' computer via Team Viewer on four separate occasions after his termination.

Brooks v. AM Resorts, supra. 

When a parties move for summary judgment, they often provide affidavits or other evidence to support their motions, which apparently happened here:

The parties have presented dueling forensic expert reports. All agree that IP addresses can be static or dynamic. Static IP addresses are assigned by the Internet Service Provider (`ISP’) to an individual or company for a certain period of time. Dynamic IP addresses can change at any time because they are not assigned by the ISP to an individual or company for any certain period of time. All experts agree that it is unknown whether IP address 207.204.53.55 is a static or dynamic address.

Brooks' expert, Brian Harris, concludes that Pepe Morell, an employee of AM Resorts, accessed Brooks' email account. This conclusion is based, to a large extent, on the fact that Morell sent an email from the IP address 207.204.53.55 to Estelrich on March 10, 2010 and that same IP address appeared in the header of the March 21, 2010 email sent from Estelrich to Brooks, which contained the privileged email. . . . Harris concludes that AM Resorts accessed Brooks' desktop computer through Team Viewer, a program that it installed on Brooks' computer.

AM Resorts' experts, Jerry Saperstein and Louis Cinquanto, conclude there is not enough evidence to link AM Resorts to the IP address 207.204.53.55 because it is unknown whether [it] is dynamic or static, the parties never subpoenaed the internet service provider to obtain the name of the person or company that was issued the IP address on a specific date and time, and that IP address may have been used by many people at the same time making it impossible to determine the identity of the person who accessed Brooks' email account. . . . AM Resorts' experts conclude there is insufficient evidence to link any Team Viewer access of Brooks' computer to AM Resorts.

Brooks v. AM Resorts, supra. 

The judge first ruled on several of the issues raised by both parties’ motions for summary judgment, noting, again, that Brooks had moved for summary judgment on

AM Resorts' liability, arguing that the evidence indisputably establishes that AM Resorts accessed his computer and email account in violation of the SCA [and] the CFAA. . . . AM Resorts moves for summary judgment in its favor on all claims, [claiming] the evidence is insufficient to prove AM Resorts accessed Brooks' computer and email address.

Brooks v. AM Resorts, supra. 

She then addressed Brooks’ SCA claim, noting that 18 U.S. Code § 2701(a) makes it a crime to intentionally access a facility through which an electronic communication service is provided without being authorized to do so or by exceeding authorization to do so and “thereby” obtain, alter or prevent authorized access to “a wire or electronic communication while it is in electronic storage”.  Brooks v. AM Resorts, supra.  Both sides agreed “that email messages remaining on an internet service provider's server after delivery fall within the Act's definition of electronic storage.” Brooks v. AM Resorts, supra.  And neither argued that “emails downloaded and stored on a personal computer are not included in the” definition of electronic storage. Brooks v. AM Resorts, supra. 

The judge then ruled on one of the issues in the case, noting that Brooks had

only alleged that AM Resorts obtained a downloaded copy of the privileged email exchange that was stored on Brooks' computer. Thus, AM Resorts argues that Brooks' claim under the SCA fails as a matter of law because emails downloaded and stored on a computer are not included in the Act's definition of electronic storage. 

Brooks agrees with AM Resorts' interpretation of the law. However, he strongly disagrees with AM Resorts portrayal of his allegations.

While it is true that Brooks alleges AM Resorts accessed his computer, [he] has never alleged that AM Resorts obtained a downloaded copy of the privileged email exchange from his hard drive. Rather, Brooks has maintained throughout this litigation that AM Resorts obtained the privileged email exchange by accessing his Microsoft Hotmail email account, an act that qualifies as a violation under the SCA. Brooks has presented evidence that a genuine dispute of material fact exists as to whether AM Resorts accessed his email account. 

Therefore, I will deny AM Resorts' motion for summary judgment on Brooks' SCA claim.

Brooks v. AM Resorts, supra. 

She then took up the CFAA claim, noting Brooks alleges AM Resorts violated the CFAA

by `intentionally access[ing] a protected computer without authorization, and as a result of such conduct, recklessly caus[ing] damage.’ 18 U.S. Code § 1030(a)(5)(B). Because this is a civil action, Brooks must demonstrate that he suffered damage or loss as a result of AM Resorts' violation of the CFAA. AM Resorts argues that Brooks cannot succeed on his CFAA claim because he has not put forth any evidence to support that he has suffered either damage or loss. Brooks argues that he has established evidence of loss.

Brooks v. AM Resorts, supra. 

The judge then explained that In a 1030(g) civil suit for violating the CFAA, the plaintiff must show that the defendant “caused “`loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.’” Brooks v. AM Resorts, supra (quoting  18 U.S. Code § 1030(c)(4)(A)(i)(I)).  She also noted that the “CFAA defines `loss’ as `any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.’” Brooks v. AM Resorts, supra (quoting 18 U.S. Code § 1030(e)(11)).

Next, she reviewed Brooks’ arguments as to why he had alleged loss, noting that he

alleges that he suffered `loss’ when he had to replace his computer while it was shipped to another location for examination. There is no evidence in the record to support this occurrence. Moreover, even if it did occur, there is no evidence to support the amount of economic loss that Brooks suffered as a result. 

Additionally, Brooks includes as `loss’ the litigation costs associated with hiring court reporters and videographers, and obtaining deposition transcripts. However, litigation costs are not a compensable loss under the CFAA because they are not related to investigating or remedying damage to the computer. . . .

Lastly, Brooks points to the invoices Harris, his forensic expert, sent his attorney during this litigation. While fees paid to an expert for investigating and remedying damage to a computer may be a cognizable `loss’ under the CFAA, . . . fees paid to an expert to assist in litigation do not fall within [its] definition of `loss.’ See Mintel Int'l Group, LTD. v. Neergheen, 2010 WL 145786 (U.S. District Court for the Northern District of Illinois 2010).

Brooks v. AM Resorts, supra. 

The judge noted that Brooks claimed AM Resorts violated the CFAA in March 2010 and filed the Complaint that began this suit in February of 2011. Brooks v. AM Resorts, supra.  She then explained that in the “eleven month time period” between the "alleged" violation

and the filing of the Complaint, there is no evidence Brooks hired anyone to assess and/or remedy the damage done to his computer. Rather, it was not until October 2011, . . . that [he] hired Harris to investigate his computer. Harris' deposition testimony and expert report indicate [he] was hired to prove AM Resorts accessed Brooks' computer and email account. 

There is no evidence Harris spent any time investigating, or responding to, damage to Brooks' computer that occurred as a result of AM Resorts unauthorized access.

The invoices cover services . . . performed by Harris in September 2012 through February 2013, including deposition preparation. Moreover, all invoices are addressed to Brooks' attorney in this litigation. This evidence establishes Brooks retained Harris for assistance in his lawsuit against AM Resorts. Therefore, these invoices do not fall within the definition of `loss’ under the CFAA. 

Moreover, even if some of the services Harris performed could arguably fall within the definition of `loss’ . . . , [they] do not meet the minimum loss requirement of $5,000.00. While the total amount billed by Harris was $7,225.00, more than $3,000.00 was. . . for time spent on depositions, declarations, and forwarding documents to opposing counsel, all of which are litigation expenses that are not considered `loss’ under the CFAA.

Brooks v. AM Resorts, supra. 

The judge therefore denied Brooks’ motion for partial summary judgment on liability and denied AM Resorts’ motion for summary judgment on his SCA claim. Brooks v. AM Resorts, supra.  She granted “AM Resorts' motion for summary judgment on Brooks' CFAA claim because he "has not demonstrated that he suffered the requisite `loss’ under the CFAA.”  Brooks v. AM Resorts, supra.