United States v. Thomas

Michael Thomas (defendant) was the information-technology (IT) operations manager for ClickMotive, LP, a software company. Thomas’s duties included deleting data, removing programs, and taking systems offline for maintenance. ClickMotive’s policies prohibited interfering with the company’s normal course of business and destroying its assets. Thomas’s friend in the IT department was fired, leaving Thomas with more work. As a result, Thomas electronically sabotaged the company. Thomas deleted hundreds of files, disabled backup operations, disrupted email groups, and removed employees’ remote access to the company’s network. Thomas then resigned from the company before his actions were discovered. The sabotage cost the company thousands of dollars. Thomas was charged with and convicted of violating the Computer Fraud and Abuse Act. At trial, IT experts testified that none of the issues that ClickMotive experienced due to the sabotage could result from normal malfunctions and that Thomas’s actions did not constitute normal troubleshooting or maintenance. The experts also stated that the actions were not consistent with amateurish mistakes. Thomas appealed his conviction to the Fifth Circuit, arguing that because his job gave him full access to the company’s system and required him to damage it at times, he was authorized to take the actions that he did. Thomas further argued that the act was too vague to give him adequate notice of his potential crimes. The court found that Thomas did not lack notice of his potential crimes because scholars wrote about these types of acts as violations and because Thomas admitted to his friend that he may have violated the act. The court then addressed Thomas’s authorization argument.