United States v. Michael Thomas

Case: 16-41264 Document: 00514268309 Page: 1 Date Filed: 12/11/2017

IN THE UNITED STATES COURT OF APPEALS

FOR THE FIFTH CIRCUIT

United States Court of Appeals

Fifth Circuit

No. 16-41264 FILED

December 11, 2017

UNITED STATES OF AMERICA, Lyle W. Cayce

Clerk

Plaintiff - Appellee

v.

MICHAEL THOMAS,

Defendant - Appellant

Appeal from the United States District Court

for the Eastern District of Texas

Before WIENER, HIGGINSON, and COSTA, Circuit Judges.

GREGG COSTA, Circuit Judge:

Michael Thomas worked as the Information Technology Operations

Manager for ClickMotive, LP, a software and webpage hosting company. Upset

that a coworker had been fired, Thomas embarked on a weekend campaign of

electronic sabotage. He deleted over 600 files, disabled backup operations,

eliminated employees from a group email a client used to contact the company,

diverted executives’ emails to his personal account, and set a “time bomb” that

would result in employees being unable to remotely access the company’s

network after Thomas submitted his resignation. Once ClickMotive discovered

what Thomas did, it incurred over $130,000 in costs to fix these problems.

Case: 16-41264 Document: 00514268309 Page: 2 Date Filed: 12/11/2017

No. 16-41264

A jury found Thomas guilty of “knowingly caus[ing] the transmission of

a program, information, code, or command, and as a result of such conduct,

intentionally caus[ing] damage without authorization, to a protected

computer.” 18 U.S.C. § 1030(a)(5)(A). Thomas challenges the “without

authorization” requirement of this provision of the Computer Fraud and Abuse

Act. He contends that because his IT job gave him full access to the system

and required him to “damage” the system—for example, at times his duties

included deleting certain files—his conduct did not lack authorization. In

support of his view that the statute does not reach those whose access to a

system includes the ability to impair it, Thomas invokes the rule of lenity and

principle that vague statutes cannot be enforced. But we conclude that

Thomas’s conduct falls squarely within the ordinary meaning of the statute

and affirm his conviction.

I.

Thomas’s duties at ClickMotive included network administration;

maintaining production websites; installing, maintaining, upgrading, and

troubleshooting network servers; ensuring system security and data integrity;

and performing backups. He was granted full access to the network operating

system and had the authority to access any data and change any setting on the

system. Thomas was expected to perform his duties using his “best efforts and

judgment to produce maximum benefit” to ClickMotive.

Thomas was not happy when his friend in the IT department was fired.

It was not just a matter of loyalty to his former colleague; a smaller IT staff

meant more work for Thomas. So Thomas, to use his word, “tinkered” with the

company’s system. The tinkering, which started on a Friday evening and

continued through Monday morning, included the following:

• He deleted 625 files of backup history and deleted automated commands

2

Case: 16-41264 Document: 00514268309 Page: 3 Date Filed: 12/11/2017

No. 16-41264

set to perform future backups.

• He issued a command to destroy the virtual machine 1 that performed

ClickMotive’s backups for one of its servers and then Thomas failed to

activate its redundant pair, ensuring that the backups would not occur.

• He tampered with ClickMotive’s pager notification system by entering

false contact information for various company employees, ensuring that

they would not receive any automatically-generated alerts indicating

system problems.

• He triggered automatic forwarding of executives’ emails to an external

personal email account he created during the weekend.

• He deleted pages from ClickMotive’s internal “wiki,” an online system of

internal policies and procedures that employees routinely used for

troubleshooting computer problems.

• He manually changed the setting for an authentication service that

would eventually lead to the inability of employees to work remotely

through VPN. Changing the setting of the VPN authentication service

set a time bomb that would cause the VPN to become inoperative when

someone rebooted the system, a common and foreseeable maintenance

function.

• And he removed employees from e-mail distribution groups created for

the benefit of customers, leading to customers’ requests for support going

unnoticed.

Thomas was able to engage in most of this conduct from home, but he

did set the VPN time bomb on Sunday evening from ClickMotive’s office, which

he entered using another employee’s credentials. It was during this visit to

the office that Thomas left his resignation letter that the company would see

1 “A virtual machine is a self-contained operating environment that isolates an

application from the entire computer on which it runs, denying the application access to other

compartments of the system.” Jonathan L. Zittrain, The Generative Internet, 119 HARV. L.

REV. 1974, 2037 n.220 (2006).

3

Case: 16-41264 Document: 00514268309 Page: 4 Date Filed: 12/11/2017

No. 16-41264

the next day. When the dust settled, the company incurred over $130,000 in

out-of-pocket expenses and employees’ time to undo the harm Thomas caused.

In a subsequent interview with the FBI, Thomas stated that he engaged in this

conduct because he was “frustrated” with the company and wanted to make

the job harder for the person who would replace him.

A grand jury eventually charged Thomas with the section 1030(a)(5)(A)

offense. But two days before the grand jury met, Thomas fled to Brazil. Nearly

three years later, Thomas was arrested when he surrendered to FBI agents at

Dallas/Fort Worth International Airport.

At trial, company employees and outside IT experts testified that none

of the problems ClickMotive experienced as a result of Thomas’s actions would

be attributable to a normal system malfunction. They further stated that

Thomas’s actions were not consistent with normal troubleshooting and

maintenance or consistent with mistakes made by a novice. ClickMotive

employees asserted that it was strange for the wiki pages to be missing and

that someone in Thomas’s position would know that changing the setting of

the VPN authentication service would cause it to become inoperative when

someone rebooted the system.

ClickMotive’s employee handbook was not offered at trial and there was

no specific company policy that governed the deletions of backups, virtual

machines, or wiki modifications. Employees explained, however, that there

were policies prohibiting interfering with ClickMotive’s normal course of

business and the destruction of its assets, such as a virtual machine or

company data. Thomas’s own Employment Agreement specified he was bound

by policies that were reasonably necessary to protect ClickMotive’s legitimate

interests in its clients, customers, accounts, and work product.

The jury instructions included the statutory definition of “damage,”

which is “any impairment to the integrity or availability of data, a program, a

4

Case: 16-41264 Document: 00514268309 Page: 5 Date Filed: 12/11/2017

No. 16-41264

system, or information.” 18 U.S.C. § 1030(e)(8). The district court denied

Thomas’s proposed instruction for “without authorization,” which was “without

permission or authority.” It did not define the phrase.

After the jury returned a guilty verdict, the district court sentenced

Thomas to time served (which was the four months since he had been detained

after returning to the country), plus three years of supervised release, and

ordered restitution of $131,391.21. Thomas then filed an unsuccessful motion

for judgment of acquittal. That motion, like this appeal, argued that the

evidence was not sufficient to convict Thomas because he was authorized to

damage the computer as part of his routine IT duties.

II.

A.

Although raised in the context of a sufficiency challenge which usually

focuses on the evidence, Thomas’s argument is principally a question of

statutory interpretation. 2 So we will begin with an analysis of the statute as

the elements of the statute establish what the evidence must prove.

Because Thomas’s argument that he was authorized to damage a

computer seems nonsensical at first glance, it is helpful at the outset to explain

the steps he takes to get there. He first points out that his job duties included

“routinely deleting data, removing programs, and taking systems offline for

diagnosis and maintenance.” Thomas says this conduct damaged the computer

within the meaning of the Computer Fraud and Abuse Act because damage is

2 We often see arguments focusing on the meaning of words in a criminal statute

raised via a challenge to the jury instruction. But as will be discussed, Thomas’s requested

instruction of “without authorization” did not include the limiting language he urges on

appeal. This explains why a sufficiency challenge is the vehicle for his statutory argument.

The government does not contend that his request for a different definition in the jury

instruction estops him from arguing for a more limited definition in the context of a

sufficiency challenge.

5

Case: 16-41264 Document: 00514268309 Page: 6 Date Filed: 12/11/2017

No. 16-41264

defined to just mean “any impairment to the integrity or availability of data, a

program, a system, or information,” 18 U.S.C. § 1030(e)(8); there is no

requirement of harm. And the damage he caused by engaging in these routine

tasks was not “without authorization” because it was part of his job. So far, so

good. 3 Next comes the critical leap: Thomas argues that because he was

authorized to damage the computer when engaging in these routine tasks, any

damage he caused while an employee was not “without authorization.” Thus

he cannot be prosecuted under section 1030(a)(5)(A). This argument is far

reaching. If Thomas is correct, then the damage statute would not reach any

employee who intentionally damaged a computer system as long as any part of

that employee’s job included deleting files or taking systems offline.

Thomas’s support for reading the statute to cover only individuals who

“had no rights, limited or otherwise [to] impair” a system comes from cases

addressing the separate “access” provisions of section 1030. See, e.g., LVRC

Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009) (“[A] person who

uses a computer ‘without authorization’ has no rights, limited or otherwise, to

access the computer in question.”); see also Pulte Homes, Inc. v. Laborers’

International Union of North America, 648 F.3d 295, 303–04 (6th Cir. 2011)

3 This assumes Thomas is correct that the “damage” element does not require a

showing of harm. The just-quoted statutory definition does not include the words “harm” or

“loss.” This contrasts with a separate subsection of the same damage statute that requires

both “damage and loss,” 18 U.S.C. § 1030(a)(5)(C), with a separate statutory definition for

loss, 18 U.S.C. § 1030(e)(11). But some courts addressing the damage element do require

some negative effect on the system. See United States v. Yucel, 97 F. Supp. 3d 413, 420

(S.D.N.Y. 2015) (concluding that damage occurs when “the system no longer operates as it

did when it first came into the owner’s possession and has an unwanted characteristic”);

Trademotion, LLC v. Marketcliq, Inc., 857 F. Supp. 2d 1285, 1292 (M.D. Fla. 2012) (stating

that “impairment to integrity” requires “some diminution in the completeness or usability of

date or information on a computer system”). In any event, the government concedes that at

least some of what Thomas and other IT professional do in the normal course of their duties

constitutes damage within the meaning of the statue. So we will assume that “damage” is

defined as broadly as Thomas contends because even under his definition we conclude that

he lacked authorization for the particular acts of damage charged as criminal conduct.

6

Case: 16-41264 Document: 00514268309 Page: 7 Date Filed: 12/11/2017

No. 16-41264

(relying on Brekka). But there are important differences between the “access”

and “damage” crimes that make it inappropriate to import access caselaw into

the damage statute.

Section 1030(a)(5)(A) is the only independent “damage” provision,

meaning it does not also require a lack of authorization to access the computer.

Contrast 18 U.S.C. § 1030(a)(5)(B), (C) (both applying to damage that results

from unauthorized access of a computer). It prohibits “intentionally caus[ing]

damage without authorization.” As discussed, the statute defines damage.

And as numerous courts have recognized in discussing both the damage and

access provisions, the ordinary meaning of “without authorization” is “without

permission.” See Brekka, 581 F.3d at 1133 (quoting Random House

Unabridged Dictionary to define “authorization” as “permission or power

granted by an authority”); United States v. Valle, 807 F.3d 508, 524 (2d Cir.

2015) (same); WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199, 204

(4th Cir. 2012) (defining “without authorization” as “without approval”); Yucel,

97 F. Supp. 3d at 422 (citing Webster’s Third International Dictionary); see also

Orin S. Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in

Computer Misuse Statutes, 78 N.Y.U. L. REV. 1596, 1661–62 (2003) (“[T]he

damage statute uses the phrase ‘without authorization’ to mean merely

‘without permission’ . . . .”). Indeed, Thomas asked that the jury be told that

“without authorization” means “without permission or authority”; he did not

seek an instruction that “without authorization” is limited to those who have

no rights to ever impair a system. As the caselaw and Thomas’s proposed

instruction recognize, the plain meaning of the damage provision is that it

makes it a crime to intentionally impair a computer system without

permission. And notably, it applies to particular acts causing damage that

lacked authorization. See 18 U.S.C. § 1030(e)(8) (defining damage to include a

single impairment of the system). Nothing in the statutory text says it does

7

Case: 16-41264 Document: 00514268309 Page: 8 Date Filed: 12/11/2017

No. 16-41264

not apply to intentional acts of damage that lacked permission if the employee

was allowed to engage at other times in other acts that impaired the system.

Crimes involving unauthorized access are more numerous in the

Computer Fraud and Abuse Act. See, e.g., 18 U.S.C. § 1030(a)(1), (2), (3). Some

of these provisions distinguish between “intentionally access[ing] a computer

without authorization,” and “exceed[ing] authorized access.” See id.

§ 1030(a)(1), (2). To give meaning to the separate provisions, courts have

interpreted “access without authorization” as targeting outsiders who access

victim systems, while “exceeds authorized access” is applied to “insiders,” such

as employees of a victim company. See Valle, 807 F.3d at 524 (citing United

States v. Nosal, 676 F.3d 854, 858 (9th Cir. 2012) (en banc)). It is this attempt

to police that statutory line—between those who have no permission to access

a system and those who have some permission to access but exceed it—that led

to the language Thomas invokes about a “no authorization” case being limited

to a person with “no right[], limited or otherwise, to access the computer in

question.” Brekka, 581 F.3d at 1133 (emphasis added). This ensures that

“access without authorization” applies to outsiders. Indeed, Brekka begins its

analysis by recognizing that “authorization” has the ordinary meaning of

“permission”; the separate term “exceeds authorized access” is the source for

its conclusion that access without authorization must be an all-or-nothing

proposition. Id. at 1133. In addition to its support in the bifurcated statutory

scheme for access crimes, a narrow reading of those statutes avoids

criminalizing common conduct—like violating contractual terms of service for

computer use or using a work computer for personal reasons—that lies beyond

the antihacking purpose of the access statutes. See, e.g., Valle, 807 F.3d at

512–13, 526–27 (involving police officer charged with violating section

1030(a)(2)(B) for accessing a government computer for a non-law enforcement

purpose); United States v. Drew, 259 F.R.D. 449, 466 (C.D. Cal. 2009)

8

Case: 16-41264 Document: 00514268309 Page: 9 Date Filed: 12/11/2017

No. 16-41264

(involving defendant charged with violating sections 1030(a)(2)(C) and

1030(c)(2)(B)(ii) for creating a fictitious profile on a social networking website

and then using the account to cyberbully a teenager in violation of the website’s

Terms of Service); Kerr, supra, at 1663 (“If we interpret the phrase “exceeds

authorized access” to include breaches of contract, we create a remarkably

broad criminal prohibition that has no connection to the rationales of criminal

punishment.”).

None of these concerns translates to the damage statute. “Without

authorization” modifies damage rather than access. Id. at 1661 (explaining

that the federal damage statute uses “without authorization” in “a very

different way” from how it is used in the access statutes). Section 1030(a)(5)(A)

makes no distinction between all-or-nothing authorization and degrees of

authorization. Its text therefore covers situations when the individual never

had permission to damage the system (an outsider) or when someone who

might have permission for some damaging acts causes other damage that is

not authorized (an insider). Tellingly, other subsections of the same damage

statute are limited to those who inflict damage while “intentionally access[ing]

a protected computer without authorization.” 18 U.S.C. § 1030(a)(5)(B), (C).

Because section 1030(a)(5)(A) is the one subsection of the damage statute that

also applies to insiders, it would make no sense to import a limitation from the

access statutes that is aimed at excluding insider liability. In support of his

attempt to extend to the damage statute the limitation courts have read into

the “access without authorization” statutes, Thomas cites the “presumption

that identical words used in different parts of the same act are intended to

have the same meaning.” Atlantic Cleaners & Dyers, Inc. v. United States, 286

U.S. 427, 433 (1932). But in light of the significant statutory differences

between the access and damage crimes, Chief Justice Marshall’s corollary to

the “consistent usage” canon is more apt: “It has been also said, that the same

9

Case: 16-41264 Document: 00514268309 Page: 10 Date Filed: 12/11/2017

No. 16-41264

words have not necessarily the same meaning attached to them when found in

different parts of the same instrument: their meaning is controlled by context.

This is undoubtedly true.” Cherokee Nation v. Georgia, 30 U.S. 1, 19 (1831),

quoted in Antonin Scalia & Bryan Garner, READING LAW: THE INTERPRETATION

OF LEGAL TEXTS 171 (2012).

Nor is there a significant threat that liability under the damage statute

would extend to largely innocuous conduct because the requirement of

“intentionally causing damage” narrows the statute’s reach. Cf. Kerr, supra,

at 1660–62 (stating that section 1030(a)(5)(A) “adds a very important weapon

to the arsenal of computer crime statutes” and complements the access statutes

that present a serious risk of being applied too broadly). Applying the damage

statute to employees like Thomas also does not extend the law beyond what

Congress intended. The Senate Report on the 1996 amendments to the

Computer Fraud and Abuse Act stated that section 1030(a)(5)(A) “protect[s]

computers and computer systems . . . from damage both by outsiders, who gain

access to a computer without authorization, and by insiders, who intentionally

damage a computer.” S. Rep. No. 104-357, at 9 (1996). It characterized these

dual threats as “outside hackers” and “malicious insiders.” Id. at 9. This

repeated emphasis that the damage statute would apply equally to both

threats 4 was made with full awareness, from the time the statute was first

enacted a decade earlier that, as Thomas emphasizes, employees are

sometimes permitted or even required to engage in “repair activities.” S. Rep.

No. 99-432, at 12 (1986). Such acts that are “necessary to the repair” of the

system, would not be criminal because they are authorized. Id. The statute’s

mens rea was also cited as a limitation on the statute’s reach. S. Rep. No. 104-

4 See also S. Rep. No. 104-357, at 10 (stating that section 1030(a)(5)(A) “would cover

anyone who intentionally damages a computer, regardless of whether they were an outsider

or an insider otherwise authorized to access the computer”).

10

Case: 16-41264 Document: 00514268309 Page: 11 Date Filed: 12/11/2017

No. 16-41264

357, at 11 (“[I]nsiders, who are authorized to access a computer, face criminal

liability only if they intend to cause damage to the computer.” 5 (emphasis

added)). By providing immunity from the damage statute to any “malicious

insider” who was permitted to cause “damage” in some situations as part of his

job duties, Thomas’s interpretation would substantially curtail the statute’s

intended reach.

So Thomas’s reading of “without authorization” is at odds with the

statutory language and legislative intent. His offered construction thus finds

no recourse in the rule of lenity because there is no interpretive tie for that

principle to break. United States v. Castleman, 134 S. Ct. 1405, 1416 (2014)

(stating that “the rule of lenity only applies if, after considering text, structure,

history, and purpose, there remains a grievous ambiguity or uncertainty in the

statute, such that the Court must simply guess as to what Congress intended”

(internal quotation marks omitted)).

We conclude that Section 1030(a)(5)(A) prohibits intentionally damaging

a computer system when there was no permission to engage in that particular

act of damage. To the extent more is needed to flesh out the scope of

“permission” when a defendant has some general authority to impair a

network, there is helpful guidance in one of our cases addressing an access

statute, which if anything should define authorization more narrowly for the

reasons we have discussed. United States v. Phillips, 477 F.3d 215, 219 (5th

Cir. 2007). Phillips says to look at the “expected norms of intended use.” Id.

5 This statement that insiders are only liable for intentionally causing damage is

further support for the point made above that section 1030(a)(5)(A) is the only damage

provision that can apply to insiders. The other two damage provisions, which require

unauthorized access, have lower mens rea requirements. Section 1030(a)(5)(B) applies to

recklessly causing damage. Section 1030(a)(5)(C) imposes strict liability when it comes to

the damage requirement, though the conduct must result in both “damage and loss.”

11

Case: 16-41264 Document: 00514268309 Page: 12 Date Filed: 12/11/2017

No. 16-41264

B.

With this understanding of the damage statute, we turn to the more

typical sufficiency review and evaluate whether the evidence supported the

conviction. This analysis usually begins with talk of the considerable deference

the jury’s view of the evidence should receive, with it getting to make

credibility determinations, draw reasonable inferences, and the like. United

States v. Winkler, 639 F.3d 692, 696 (5th Cir. 2011). Reliance on that standard

of review is unnecessary here as there is overwhelming evidence to support the

jury’s view that Thomas did not have permission to engage in the weekend

damage campaign.

The nature of Thomas’s conduct is highly incriminating. No reasonable

employee could think he had permission to stop the system from providing

backups, or to delete files outside the normal protocols, or to falsify contact

information in a notification system, or to set a process in motion that would

prevent users from remotely accessing the network. Phillips, 477 F.3d at 220

(affirming jury finding of lack of authorization to launch a brute-force attack

program when that would not be permissible “within the understanding of any

reasonable computer user”). Thomas emphasizes the unlimited access he had

to the system that gave him the ability to inflict this damage. But it is not

conceivable that any employee, regardless of their level of computer access,

would be authorized to cause these problems. The incidents for which Thomas

was held liable were nothing like the periodic acts he performed as part of his

duties. Those tasks may have impaired the system on a limited basis in order

to benefit the computer network in the long run. Routine deletions of old files

provide that benefit by increasing storage space. Taking systems offline allows

for necessary maintenance. In contrast, the various types of damage Thomas

caused during the last few days before he resigned resulted in over $130,000

in remediation costs. Regardless of whether the definition of “damage” under

12

Case: 16-41264 Document: 00514268309 Page: 13 Date Filed: 12/11/2017

No. 16-41264

the statute requires a showing of harm, impairments that harm the system are

much less likely to be authorized than those that benefit the system. It would

rarely if ever make sense for an employer to authorize an employee to harm its

computer system.

The harmful acts themselves would be enough to support the verdict, but

Thomas’s words and conduct in response to the criminal investigation provide

additional support. When questioned by federal agents, he acknowledged the

distinction we have just made. He did not say that he caused the damage in

order to maintain or improve the system; instead, his motive was to make

things more difficult for the person hired to replace him. And his flight to

Brazil is not what is expected of someone who had permission to engage in the

conduct being investigated. See Allen v. United States, 164 U.S. 492, 499 (1896)

(“[T]he law is entirely well settled that the flight of the accused is competent

evidence against him as having a tendency to establish his guilt.”).

The circumstances surrounding the damaging acts provide even more

support for the finding of guilt. Thomas committed the various acts one after

the other in a concentrated time span beginning Friday evening and continuing

through the weekend. Thomas did most of this from home, but the one time

he had to go the office he did so using another employee’s credentials. One of

his acts—falsification of contact information in the alert system—prevented

Thomas’s conduct from being detected during the weekend as employees would

not receive notifications about the damage to the system. He submitted his

resignation immediately after completing the damage spree and timed the

most damaging act—the one that would prevent remote access—so that it

would not occur until he was gone. Why this sequence of events if Thomas had

permission to cause the damage?

13

Case: 16-41264 Document: 00514268309 Page: 14 Date Filed: 12/11/2017

No. 16-41264

All of this provided ample support to conclude that Thomas lacked

permission to inflict the damage he caused. As that question of authorization

is the only element he challenges, sufficient evidence supports the conviction.

III.

What we have just said about the straightforward application of the

damage statute to Thomas’s conduct also dooms his claim that the law is

unconstitutionally vague. That is because even if a statute might be vague

when applied to some situations, “a defendant whose conduct is clearly

prohibited cannot be the one making that challenge.” United States v.

Westbrooks, 858 F.3d 317, 325 (5th Cir. 2017).

Further proof that Thomas’s conduct is a paradigmatic application of

section 1030(a)(5)(A) comes from its similarity to a hypothetical use of the

statute that a leading computer crime scholar foresaw years ago. Professor

Kerr provided the following example that is essentially this case but for a twist

that the employee is upset about his own employment situation rather than a

colleague’s:

Employee sabotage: Sam is a computer programmer who is angry

at his employer for denying him a promotion. Sam decides to take

revenge by deleting some of his employer’s important files, and by

launching a denial-of-service attack that overwhelms his

company’s webserver with requests and takes it offline for a few

hours. The deletion of the files will not constitute an unauthorized

access. Sam accessed his employer’s computer when he used it to

delete files, but as a programmer he was authorized to access those

files and therefore has not committed access without

authorization. Similarly, the denial-of-service attack will not itself

constitute an unauthorized access crime. Sending the data to the

computer does access the computer, but the access is not without

authorization: The webserver has been configured to accept all web

traffic requests, such that sending many requests will not

circumvent any code-based restrictions.

14

Case: 16-41264 Document: 00514268309 Page: 15 Date Filed: 12/11/2017

No. 16-41264

Sam does not avoid criminal liability, however. The deletion of the

files may constitute destruction of property or conversion and,

depending on the applicable state laws, he could be prosecuted

under general property crime statutes. Sam could also be

prosecuted for damaging the computer under the federal computer

damage statute, 18 U.S.C. § 1030(a)(5)(A)(i).

Kerr, supra, at 1664–65 (emphasis added).

The law review article is not all that undermines the contention that

Thomas lacked notice that his conduct was criminal. Just a couple weeks after

the damage spree, and before the FBI had contacted Thomas, he told the friend

whose firing had set this in motion that “he thought he might have broken the

law.” Which law, the friend inquired? Thomas’s response: “the Computer

Fraud and Abuse Act.”

* * *

The judgment of the district court is AFFIRMED.

15