United States v. Millot

Thomas Millot (defendant) was an information technology (IT) professional at a pharmaceuticals company. As an IT professional, Millot had a security identification card that had the highest available access level in the company. Part of Millot’s role was disabling employees’ security identification cards after the employees left the company. When one employee left the company, instead of disabling the card, Millot reassigned it to the highest level of clearance. Shortly thereafter, the company outsourced its security functions to a third-party contractor. Several IT employees went to the third-party company, but Millot was not one of them. Millot retained his security identification card, which allowed him to continue accessing the company’s network. Millot then used the employee’s card he had reassigned to access a former colleague’s account and delete it. Millot’s actions required the third-party contractor to spend hours performing a security audit and restoring accounts, costing the contractor more than $20,000 for its work. There was no evidence, however, that the third-party contractor actually billed the pharmaceuticals company for this work. The United States charged Millot under the Computer Fraud and Abuse Act (CFAA). The case went to trial, and a jury convicted Millot of the charges. Millot appealed, claiming that there was insufficient evidence to prove that he had caused more than $5,000 in damages, as required by the CFAA.