## Facts

- John Larkin Trotter was an information technology supervisor for the Midland Division of the Salvation Army in St. Louis, Missouri, and was terminated on September 12, 2003.
- Starting in October 2003, the Salvation Army’s computer network suffered repeated intrusions and disruptions, including deletion and erasure of files, shutdown of a computer-operated phone system, insertion of obscene files, and “Trotter was here” pop-up messages on employee computers.
- The Salvation Army spent more than $19,000 repairing damage attributed to the attacks.
- Investigators traced the intrusions to a DSL account registered to Trotter’s cohabiting girlfriend; the associated email address incorporated Trotter’s name and birth year.
- Trotter was charged under the Computer Fraud and Abuse Act with knowingly transmitting code/commands and intentionally causing damage without authorization to a “protected computer,” in violation of 18 U.S.C. § 1030(a)(5)(A)(i).
- In a plea agreement, Trotter admitted he sent commands from his residence to his former employer’s network and intentionally caused damage without authorization.
- Trotter also admitted the network was connected to the Internet and used to communicate with computers in other states.

## Issues

1. Whether 18 U.S.C. § 1030(a)(5)(A)(i) exceeded Congress’s Commerce Clause authority as applied to damage to a not-for-profit organization’s Internet-connected computer network used for interstate communication.
2. Whether the Salvation Army’s network qualified as a “protected computer” under 18 U.S.C. § 1030(e)(2)(B) based on its Internet connection and interstate communications.

## Decision

- The Eighth Circuit affirmed the conviction, sentence, and restitution order.
- The court held § 1030(a)(5)(A)(i) constitutional as applied because the Salvation Army network was a “protected computer” used in interstate commerce or communication.
- The court rejected the argument that the victim’s local, not-for-profit status removed the conduct from federal reach.
- The court treated the Internet as a channel and instrumentality of interstate commerce and concluded Congress may regulate and protect computers participating in such interstate communications.

## Legal Principles

- Under the CFAA, a “protected computer” includes a computer “used in interstate or foreign commerce or communication,” including systems connected to the Internet that communicate across state lines. 18 U.S.C. § 1030(e)(2)(B).
- Congress may, consistent with the Commerce Clause, regulate the channels and instrumentalities of interstate commerce and prohibit intentional damage to computers used in interstate communications.
- In an as-applied constitutional challenge, a defendant’s admissions about the system’s interstate use and the unauthorized, intentional nature of the damage can establish the required interstate-commerce nexus for federal regulation.

## Conclusion

The court upheld application of the CFAA to intentional attacks on an Internet-connected organizational network, holding that interstate Internet communications bring such systems within the statutory “protected computer” definition and within Congress’s Commerce Clause authority, regardless of the victim organization’s not-for-profit status.


United States v. Trotter, 478 F.3d 918 (8th Cir. 2007)