## Facts

- Nicholas Middleton, a former systems/PC administrator for an internet service provider, had extensive knowledge of internal systems and passwords.
- After leaving the company and sending threatening emails, he retained a customer email account.
- Using that account, he accessed the company’s system and used a “Switch User” program to assume the identity of a receptionist, gaining unauthorized employee-level privileges.
- Company logs tied his dial-in connections to the account-switching activity and revealed the unauthorized access.
- The intrusion caused damage requiring investigation, repair, and restoration efforts by employees, generating response and remediation costs.
- The government treated employee time (valued at labor rates) and related remedial expenses as statutory “loss” exceeding the then-applicable $5,000 threshold.

## Issues

1. Whether the CFAA’s reference to damage to “one or more individuals” excludes corporations, thereby barring conviction when the victim is a corporate entity.
2. Whether the district court erred in instructing the jury on “damage” and “loss,” including requiring that losses be the natural and foreseeable result of the damage.
3. Whether the evidence was sufficient to prove the statutory loss threshold, where the loss calculation relied substantially on employee time and associated costs.

## Decision

- The Ninth Circuit affirmed the conviction under 18 U.S.C. § 1030(a)(5)(A).
- The court held that “individuals” in the relevant CFAA definition does not exclude corporations, so damage to a corporation’s computer systems can satisfy the statute.
- The court upheld the jury instructions requiring that claimed losses be the natural and foreseeable result of the damage.
- The court found the evidence sufficient for a rational jury to conclude that response and repair costs, including monetized employee time, met the statutory threshold.

## Legal Principles

- In the CFAA context at issue, the term “individuals” may include corporations; the statute is not limited to harms suffered only by natural persons.
- Statutory interpretation should consider context and purpose and avoid readings that would produce absurd results inconsistent with protecting computers used in interstate or foreign commerce.
- CFAA “loss” may include reasonable costs of responding to an offense, assessing damage, and restoring systems, including the monetary value of employee time spent on those tasks.
- Jury instructions properly link recoverable loss to damage by requiring a causal connection: losses must be the natural and foreseeable result of the defendant’s damaging conduct.
- Disputes about the reasonableness of hours and rates used to value employee time are for the trier of fact.

## Conclusion

The Ninth Circuit sustained a CFAA conviction where a former administrator used unauthorized privilege escalation to damage a company’s systems, holding that corporate victims fall within the statute’s protection and that employee response and repair time, reasonably valued, can establish the required loss threshold when causally tied to the damage.


United States v. Middleton, 231 F.3d 1207 (9th Cir. 2000)