## Facts

- Thomas S. Millot worked as a systems analyst responsible for computer security administration at a pharmaceutical facility, including management of remote-access accounts and SecureID cards.
- Millot had the highest access level available and was responsible for disabling remote-access accounts when employees left and for collecting returned SecureID cards.
- Before leaving employment, Millot reassigned a former employee’s remote-access account to a SecureID card he controlled and elevated the account’s access to the highest level.
- After leaving, Millot retained the SecureID card and periodically accessed the company network using the reassigned account to keep it active.
- Millot accessed the network multiple times over several months and, on December 16, 2000, used the account to delete the remote-access account of a manager who depended on that access to monitor the network.
- A security contractor then performed investigation, auditing, and restoration work in response to the intrusion and deletion; the government presented evidence valuing the response work at more than $20,000 in labor.
- Millot was convicted by a jury of violating the Computer Fraud and Abuse Act (CFAA) and sentenced to a short term of imprisonment and home detention, supervised release, a fine, and restitution of $20,350.

## Issues

1. Whether the evidence was sufficient to prove the CFAA’s $5,000 statutory threshold by showing “loss” exceeding $5,000 within a one-year period.
2. Whether response and remediation labor costs qualify as CFAA “loss” when the responding personnel are salaried or the work was not shown to be separately invoiced to the victim.
3. Whether the district court erred in calculating loss for sentencing purposes and in ordering restitution in the amount of $20,350.

## Decision

- The court affirmed the conviction, holding that a rational jury could find the government proved the statutory “loss” threshold under the CFAA.
- The court held that reasonable costs of responding to the offense—such as investigation, security auditing, and restoration work—constitute “loss” under the CFAA.
- The court rejected the argument that the government must show a discrete invoice or out-of-pocket payment to establish cognizable “loss.”
- The court affirmed the sentence and upheld the restitution award, concluding the district court’s loss and restitution findings were supported by the evidence and were not clearly erroneous.

## Legal Principles

- Under the CFAA, “loss” includes reasonable costs incurred in responding to an offense, conducting damage assessments, and restoring systems or accounts to their prior condition.
- Labor costs tied to investigation and remediation may satisfy the CFAA’s monetary threshold even if performed by salaried personnel or by a contractor that does not separately bill the victim for the work.
- Appellate review of loss and restitution calculations defers to supported factual findings; loss and restitution amounts may be based on reasonable valuation of response time and effort.

## Conclusion

The Eighth Circuit upheld a CFAA conviction and related sentencing and restitution determinations, concluding that the government may meet the statute’s $5,000 threshold through proof of reasonable investigation and remediation labor costs incurred in direct response to unauthorized access and resulting account/system disruption.


United States v. Millot, 433 F.3d 1057 (8th Cir. 2006)