Under the Computer Fraud and Abuse Act, “loss” and “damage” are not synonyms. The CFAA provides that “any person who suffers damage or loss” caused by a violation of its terms can sue for compensatory damages and or equitable relief. A natural assumption might be that the lawyers who drafted the statute didn’t intend “loss” to mean anything materially different than “damage” and that they just threw in an extra word or two for good measure as lawyers are wont to do. (Only a lawyer would write, “I hereby give, devise, and bequeath” instead of just “I give.”) In the case of the CFAA, however, “loss” and “damage” are not interchangeable; each has a distinct meaning. And suffering either one of them is sufficient to support a compensable claim. Let’s look at a recent real-world example.
Space Systems/Loral v. Orbital ATK was (and remains) a dispute in Virginia federal court between two companies specializing in the design and manufacturing of geostationary satellites, space systems, and robotics technology. In 2015, NASA solicited project proposals through an RFP entitled “Utilizing Public Private Partnerships to Advance Tipping Point Strategies.” NASA awarded Space Systems a contract for its “Dragonfly” project and Orbital a contract for its “CIRAS” project. NASA set up a server to facilitate the sharing of information with the various contractors, and gave both Space Systems and Orbital access to it. Some time later, NASA determined that one or more Orbital employees accessed at least four files on the shared server that contained Space Systems’ proprietary data.