## Facts

- Christopher Andrew Phillips, a University of Texas at Austin student, agreed to the university’s acceptable-use policy, including a prohibition on port scanning with his university account.
- Within weeks, Phillips used network-scanning and hacking tools to probe computers for vulnerabilities and obtain encrypted data and passwords.
- His intrusions reached hundreds of computers, including systems belonging to other students, private entities, and governmental and foreign systems, and he accumulated sensitive personal and financial information.
- The university’s Information Security Office detected Phillips’s port-scanning activity and warned him on three occasions to stop; Phillips continued.
- After at least one warning, Phillips wrote a program intended to penetrate a university “secure” server (TXClass) used by faculty and staff.
- Phillips exploited vulnerabilities in TXClass to access sensitive university systems and data.
- The university incurred substantial costs to investigate, remediate, and restore systems and strengthen security following the intrusion.

## Issues

1. Whether the evidence was sufficient to prove Phillips intentionally accessed a protected computer without authorization and recklessly caused more than $5,000 in damage within a one-year period under 18 U.S.C. § 1030(a)(5)(A)(ii), (B)(i).
2. Whether the district court’s jury instructions constructively amended the indictment by permitting conviction on an uncharged CFAA theory.
3. Whether the district court erred by refusing to instruct the jury on a lesser-included CFAA offense.
4. Whether restitution of $170,056 was authorized under the Mandatory Victims Restitution Act for costs claimed as “loss” from the offense.

## Decision

- The Fifth Circuit affirmed the conviction and sentence, including restitution.
- The court held the evidence supported findings of intentional unauthorized access to a protected computer and reckless causation of more than $5,000 in damage within the statutory period.
- The court rejected the constructive-amendment claim, concluding the charge, read as a whole, did not allow conviction on an unindicted theory or alter essential elements.
- The court held the evidence did not warrant a lesser-included-offense instruction because it did not reasonably support guilt only on a lesser offense while negating an element of the charged offense.
- The court upheld the $170,056 restitution award as properly tied to compensable response and remediation costs.

## Legal Principles

- Under 18 U.S.C. § 1030(a)(5)(A)(ii), the government must prove intentional access to a protected computer without authorization and reckless causation of damage exceeding the statutory threshold within the relevant period.
- Repeated warnings and continued violations of an access policy may support a finding that subsequent access was “without authorization.”
- A constructive amendment occurs only if the jury instructions broaden the bases for conviction beyond the indictment by changing an essential element or permitting conviction on an uncharged theory; instructions are evaluated as a whole.
- A lesser-included-offense instruction is not required when the evidence does not reasonably permit a jury to acquit on the greater offense yet convict on the lesser.
- For restitution and CFAA “loss,” recoverable amounts may include reasonable costs of responding to the intrusion, assessing damage, restoring systems or data, and related remedial measures when adequately connected to the defendant’s conduct.

## Conclusion

The Fifth Circuit upheld Phillips’s CFAA conviction because the record supported intentional unauthorized access and reckless damage exceeding $5,000, and it affirmed restitution on the basis that the university’s investigation and remediation expenses qualified as compensable loss tied to the offense.


United States v. Phillips, 477 F.3d 215 (5th Cir. 2007)