## Facts

- Allan Carlson conducted large-scale email campaigns involving Philadelphia Phillies-related messages using spoofed third-party sender addresses.
- In “direct” attacks, he sent thousands of emails (apparently forged as coming from others) to a single target address to flood that account.
- In “indirect” attacks, he sent a single spoofed email to many recipients, many of which were invalid, causing thousands of “undeliverable” bounce-backs to be delivered to the impersonated sender’s inbox.
- The government’s evidence showed the campaigns clogged recipients’ email accounts and systems, causing delays and impaired account access.
- In some instances, users or administrators purged entire mailboxes to restore functionality, resulting in loss of business-related emails.
- Carlson did not dispute sending the messages but argued he did not intend to cause damage and did not anticipate the indirect attack’s bounce-back volume.
- After trial in federal district court, Carlson was convicted under the Computer Fraud and Abuse Act (CFAA) for intentionally causing damage to protected computers and appealed based on insufficiency of evidence of intent.

## Issues

1. Whether the evidence was sufficient to allow a rational fact-finder to conclude beyond a reasonable doubt that Carlson intentionally caused “damage” to a “protected computer” under 18 U.S.C. § 1030(a)(5).

## Decision

- The Third Circuit affirmed the conviction.
- The court held that the record permitted a rational fact-finder to find that Carlson intentionally caused damage within the meaning of the CFAA.
- The court accepted that the email flooding impaired the availability of accounts and that mailbox purges with resulting loss of business emails constituted damage.
- The court concluded Carlson’s repeated, high-volume, spoofed email activity supported an inference of intent despite his claimed lack of awareness of all technical consequences.

## Legal Principles

- “Damage” under the CFAA includes impairment to the integrity or availability of data, a program, a system, or information; substantial email flooding that delays or blocks access can satisfy this element.
- Intent to cause CFAA damage may be proven by circumstantial evidence, including the scale, repetition, and method of transmission, and may be inferred from the natural and probable consequences of the conduct.
- On sufficiency review, the evidence is viewed in the light most favorable to the government; the question is whether any rational trier of fact could find the elements proven beyond a reasonable doubt.
- Email systems used in interstate communication may qualify as “protected computers” under the CFAA.

## Conclusion

The Third Circuit upheld Carlson’s CFAA conviction, finding sufficient evidence that his repeated, high-volume spoofed email campaigns intentionally impaired the availability and integrity of others’ email systems and data, constituting damage to protected computers.


United States v. Carlson, 209 F. App’x 181 (3d Cir. 2006)