## Facts

- Daniel Stratman unlawfully accessed protected computer systems operated by the University of Nebraska and the Nebraska State College System.
- The accessed systems contained large amounts of personally identifiable information and other sensitive data.
- Stratman pleaded guilty to a Computer Fraud and Abuse Act offense under 18 U.S.C. § 1030.
- The Probation Office prepared a presentence report that calculated “loss” and restitution largely from victim response costs.
- The asserted losses consisted primarily of internal and external investigation/remediation expenses (IT staff time, forensic work, and consultant fees).
- The victims also incurred expenses to notify approximately 185,000 individuals of a potential data compromise, estimated at about $308,000.
- Stratman objected that the loss and restitution amounts were unsubstantiated and sought access to the evidence supporting the figures and an opportunity to respond, including through expert testimony.

## Issues

1. Whether victim investigation, remediation, and notification expenses qualify as “loss” for purposes of a loss-based enhancement under U.S.S.G. § 2B1.1 in a CFAA intrusion case.
2. What process is required at sentencing when the loss amount is reasonably disputed, including the defendant’s entitlement to notice of supporting evidence and a meaningful opportunity to contest it.

## Decision

- The court resolved the sentencing dispute in a written decision.
- The court treated reasonable, documented victim response costs—internal labor, outside forensic/consulting expenses, and notification expenses—as includable “loss” under the Guidelines framework applied to CFAA offenses.
- The court rejected Stratman’s objections to the extent they argued these cost categories were legally improper measures of loss.
- The court applied a loss-based Guidelines enhancement and imposed restitution corresponding to the accepted loss calculation.
- The court required that the defendant be informed of the evidence used to support the loss figures and be given a meaningful opportunity to challenge the calculations.

## Legal Principles

- For CFAA offenses sentenced using U.S.S.G. § 2B1.1, “loss” may include reasonably necessary and properly supported costs incurred to investigate, respond to, and mitigate a computer intrusion.
- Loss may include expenses tied to notifying affected individuals of a potential compromise of personal information when the notification is a reasonable response to the intrusion.
- At sentencing, when a material factor such as loss is reasonably in dispute, the parties must have an adequate opportunity to present information, and the defendant must receive notice of the evidence supporting the government’s loss position and a meaningful chance to respond.

## Conclusion

The court held that, in a CFAA hacking case, documented incident-response and data-breach notification costs can be counted as Guidelines “loss” and as a basis for restitution, provided the defendant is given adequate notice of the supporting evidence and a fair opportunity to contest the amounts at sentencing.


United States v. Stratman, No. 4:13CR3061, 2014 WL 3109805 (D. Neb. June 25, 2014)