Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 1 of 18 PageID #: 1635

Transcription

1 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 1 of 18 PageID #: 1635 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF TEXAS SHERMAN DIVISION UNITED STATES OF AMERICA v. No. 4:13cr227 Judge Mazzant MICHAEL THOMAS GOVERNMENT S RESPONSE TO DEFENDANT S POST-TRIAL MOTION FOR JUDGMENT OF ACQUITTAL The United States opposes the Defendant s Post-Trial Motion for Judgment of Acquittal (dkt. 96) (Motion). The motion is untimely and does not support the claim that a rational juror could not have found the essential elements of the crime proven beyond a reasonable doubt. A. The motion is untimely. Federal Rule of Criminal Procedure 29(c)(1) states that a defendant may move for a judgment of acquittal, or renew such a motion, within 14 days after a guilty verdict or after the court discharges the jury, whichever is later. The jury returned its guilty verdict on June 8, 2016, at approximately 6 pm CST. They were shortly thereafter discharged by the Court and permitted to speak with the attorneys at approximately 6:45 pm CST on June 8, The defendant s motion was filed at approximately 8:21 pm CST on June 22, 2016, deemed June 23, 2016, pursuant to Local Rules CV.5(a)(3)(C) and CR.49(a), therefore more than 14 days after the jury was discharged. Accordingly, the motion should be dismissed as untimely. PAGE 1 OF 18

2 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 2 of 18 PageID #: 1636 B. The jury appropriately found that the defendant acted without authorization when he caused damage. 1. The defendant was not authorized to damage ClickMotive s systems. The defendant attempts to have-it-both-ways by first arguing in his motion that he was authorized to damage ClickMotive systems (Motion at 2) but then also later arguing that that no rational juror could have found that he damaged or intended to damage ClickMotive (Motion at 21, 29). This logical problem aside, the government will address each point in its response. Evidence presented at trial proved that the information that was altered or deleted was valuable to ClickMotive and that the defendant was not authorized to damage things that are valuable. While it is undisputed that the defendant had access and the ability to perform certain functions like deletions of obsolete material in his course of employment, he confuses that access with having permission to damage. The defendant s cited case of U.S. v. Stratman, 2013 WL (D. Neb. Oct. 18, 3013) (not reported), even discussed this issue when it considered damage, stating that the modifier without authorization is necessary in the text of '1030(a)(5)(A) because the statute does not distinguish between unauthorized and authorized damage. Id. at *4. The Court in Stratman further highlighted that there is a difference between authorized and unauthorized damage (Id. at *5), also explaining that the statute s legislative history intended to punish anyone who intentionally damages a computer, regardless of whether they were an outsider or an insider otherwise authorized to access the computer. Id. at *2, *5. The co-owner and Chief Technology Officer (CTO) of ClickMotive, Ray Myers, similarly testified as to the difference between having computer permissions versus having actual permissions. As presented at trial, and contrary to the claims asserted in the motion, the damage PAGE 2 OF 18

3 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 3 of 18 PageID #: 1637 at issue was unauthorized not because of a mere stipulation in an employee handbook, but plainly because the property was valuable and actively in use by ClickMotive and, as an employee and not an owner, the defendant did not have the legal right to damage it. As presented to the jury, the defendant was authorized to manage the replacement of virtual machines, the adding and removing of employees from the pager system according to company direction and per org-chart and rotating-weekend work schedule, and the updating of company wiki pages to reflect current best practices. He was not authorized to systematically destroy active parts of ClickMotive s backup systems and all of the alert systems and fail-safes in the form of pager alerts and wiki how-to pages, thus hindering remediation efforts. In addition to these activities while employed by ClickMotive, the evidence further showed that the defendant deleted a wiki page after he left his resignation on the evening of Sunday, December 5, 2011, thus rendering any claim of authorization without merit. 2. The statute is not unconstitutionally vague. Central to the defendant s vagueness challenge is his misplaced reliance on United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009), a case charged under a different statute with different facts. In Drew, the government relied on MySpace s specific terms of service when it alleged that Drew had exceeded her authorized access, not caused damage, when she created a false profile in order to intentionally inflict emotional distress on her daughter s 13-yr old classmate. Drew, 259 F.R.D. at 452. The holding in Drew turned on whether basing a CFAA violation under '1030(a)(2)(C) and '1030(c)(2)(A) upon the conscious violation of a website s terms of service runs afoul of the void-for-vagueness doctrine, which the Court ultimately held that it did. Drew at 464. Drew s facts bear nothing on the present issue of causing damage without authorization. PAGE 3 OF 18

4 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 4 of 18 PageID #: 1638 Drew s holding was rationalized by discussing how MySpace s terms of service failed to put Drew on actual notice that her actions could be criminalized and the government s reliance on the terms of service left an absence of minimum guidelines to govern law enforcement. Drew at 461, This is wholly separate and distinct from an allegation of damage without authorization, which is essentially a simple matter of property law. Access is arguably subjective, hence the vagueness claims, however damage is not. In the instant matter the government did not allege, argue, nor rely on a contractual agreement when it proved the defendant s criminal culpability. Testimony from the owners of the company that the defendant s actions causing damage were not authorized was clear and sufficient proof beyond a reasonable doubt to support the guilty verdict. The defendant persists in his motion that the government in this case is attempting to impose criminal penalties for breach of an employment agreement. See, e.g., Motion at But it is solely the defendant in this case who has made such a claim and, try as he might, such a claim is wholly unsupported by the facts and evidence produced at trial. And contrary to these claims, the employment agreement is not the only question separating innocent from criminal conduct. Motion at 19. Rather, the question is whether the defendant intentionally caused damage to ClickMotive s computers, an answer not guided by the terms of any contractual agreement. Instead of attempting to stretch analogies to inapplicable case law, one need only look to United States v. Yucel, 97 F. Supp.3d 413 (S.D.N.Y. 2015) for a discussion on the constitutionality of 18 U.S.C. '1030(a)(5)(A) with respect to its damage and without authorization provisions. In Yucel, the defendant similarly claimed that the remote access tool he deployed was perfectly legal and [] used by systems administrators to manage and test computer systems everywhere. Yucel at 421. However, the district court rightly pointed out that PAGE 4 OF 18

5 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 5 of 18 PageID #: 1639 an authorized tool does not cause damage within the meaning of the statute, because the authorized remote access tool does not corrupt or impair the computer, but modifies it in an open and intended manner that benefits the owner or user. Id. (emphasis supplied). Michael Thomas s conduct worked similarly: he claimed he performed functions that could be used in a perfectly legal way, that is, in a manner that is open and benefits the owner or user. However, that is not how he executed the functions, choosing instead to cause damage in a way that did not benefit the owners or the users, as demonstrated at trial. The district court in Yucel held the statute was not unconstitutionally vague as applied to damage after applying the following 2-prong test set out in United States v. Morrison, 686 F.3d 94 (2d Cir. 2012): 1. Did the statute, either standing alone or as construed, make it reasonably clear at the relevant time that the defendant s conduct was criminal (see also United States v. Roberts, 363 F.3d 118, 123 (2d. Cir. 2004); and 2. Does the statutory language define the criminal offense in such a manner that does not encourage arbitrary and discriminatory enforcement. Morrison, 686 F.3d at 103. After applying the test to the instant case, one can find that no person of ordinary intelligence could believe that it was somehow legal to delete valid, active, relied-upon, and in-use data contrary to established procedure, and cause the disabling of employees remote access, all without notifying anyone, and in one instance, after his resignation. As to the second prong, the government again cites to Yucel when it stated the terms of the statute s definition of damage are strikingly dissimilar to the sorts of terms. that have been held to be vague. They do not require wholly subjective judgments without statutory definitions, narrowing context, or settled legal meanings. Yucel at 422 (citing Williams, 553 U.S. at 306). The court further held that prosecutorial discretion is further cabined by the other elements of the offense under section 1030(a)(5)(A), including the mens rea requirement, which PAGE 5 OF 18

6 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 6 of 18 PageID #: 1640 help to ensure that the statute does not sweep in innocent conduct. Yucel at Without Authorization The defendant s lengthy discussion about a circuit split regarding the definition of without authorization only highlights the circuit split among the access without authorization line of cases under 18 U.S.C. '1030(a)(1)-(4), which is separate and distinct from the damage without authorization statute in '1030(a)(5)(A). The defendant offers no support for his position that his chosen reasoning applies to '1030(a)(5)(A), but instead uses the questionable technique of substituting damage for access when citing to his authority. Compare, e.g., Motion at 14 (citing LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (2009)) with Brekka at Once again citing to Yucel, the government can do no better than to restate that the circuit divide has arisen in cases construing subsections of the CFAA that prohibit accessing a computer without authorization, not causing damage without authorization. Yucel 422. Although without authorization is not defined by the CFAA, Webster s Dictionary defines authorize as to permit, by or as if by some recognized or proper authority. Webster s Third International Dictionary 146 (1993). A defendant thus causes damage without authorization when he has not been permitted by the victim to cause that damage. This straightforward reading of the phrase easily satisfies both prongs of the vagueness test. Yucel at 422. C. The jury appropriately found that the defendant caused damage to ClickMotive computers. The plain language of the statute is clear: the term damage means any impairment to the integrity or availability of data, a program, a system, or information. 18 U.S.C. 1030(e)(8). Evidence at trial proved that the defendant took several actions damaging ClickMotive s PAGE 6 OF 18

7 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 7 of 18 PageID #: 1641 computers between December 2, 2011, and December 5, See para. B.2, infra. Contrary to claims made within the motion, damaging these services was not within the defendant s job description, was not a quick-fix, and the extent of damage was not immediately obvious. 1. Michael Thomas intended to cause damage to ClickMotive computers. Courts interpreting 18 U.S.C. 1030(a)(5)(A) violations require that the transmission causes intentional damage without authorization. Devon Energy Corp. v. Westacott, 2011 WL , at *10 (S.D. Tex. Mar. 24, 2011) (the Fifth Circuit has acknowledged that when the relevant testimony and evidence are disputed, intent is generally a factual question uniquely within the realm of the trier of fact because it so depends on the credibility of witnesses). The jury heard from the defendant s colleague, Andrew Cain, a man who acknowledged Thomas was his only friend, and testified that the defendant admitted to have tinkered with ClickMotive computers. See Motion at 30. Cain also stated that the defendant stated he thought he broke the law and didn t want to go to jail. The defendant s intention to tinker with ClickMotive computers went part-and-parcel with his intention to damage ClickMotive. Further testimony from the case agent proved that the defendant was motivated to make the job more difficult for his replacement. These witnesses were properly submitted to the trier of fact who unanimously convicted the defendant. The defendant further cites Devon Energy v. Westacott, 2011 WL (S.D.Tex. March 24, 2011), that [Plaintiff] has not contended that, had the file remained easily accessible on the network drive, any damage would have occurred. Devon Energy at *11. This passage is ripped from its context in a summary judgement motion, where it was placed to describe an appropriate issue for civil trial regarding the intent of a defendant to cause damage to a computer. PAGE 7 OF 18

8 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 8 of 18 PageID #: 1642 The summary judgement motion was denied. Id. Likewise, here, the defendant would not have been charged under the statute had the files remained easily accessible and the damage not been done. 2. Intentional harm to protected computers is no less significant because it is repaired quickly. The defendant argues that the speed of repair of wiki pages and backup files is evidence that no damage was done. See Motion at 23. However, the court in Stratman clarified damages with an illustration about a homeowner with a broken lock on her front door. See United States v. Stratman, No. 4:13-CR-3075, 2014 WL at *4 (D. Neb. July 8, 2014). [T]he losses from that crime include the value of the stolen property and cost of investigation. Id. There is no law to support the assertion that it would not be damage or loss if the homeowner could replace damaged or stolen items the same day. Harm is no less significant because a company diverted many trained employees over the course of several weeks to investigating and repairing the harm, even if they are able to get some processes repaired quickly. Where the extent of damage is difficult to determine, and harm is done deep in the computer system, cost of detection and repair is an appropriate calculation of damage. See United States v. Lindsley, 254 F.3d 71, at 4 (5th Cir. 2001). It is undisputed that the defendant deleted files and programs belonging to ClickMotive. Intentional damage by deletion is a valid claim for damages under 18 U.S.C. 1030(a)(5)(A) even when the data is not permanently lost because it has been misappropriated and an impairment of its integrity occurred. See, e.g., Frisco Medical Center, L.L.P. v. Bledsoe, No. 4:12-C-37/4:15cv105, 2016 WL , at *10 (E.D. Tex. Nov. 30, 2015) citing Shurgard PAGE 8 OF 18

9 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 9 of 18 PageID #: 1643 Storage Ctr. Inc. v. Safeguard Self Storage, Inc., 119 F.Supp.2d 1121, 1122 (N.D.Wash 2000). Further, the disruption itself, as well as the hours spent restoring accounts and investigating the intrusion, are appropriate damage assessments and costs/losses to the company. See United States v. Millot, 43 F.3d 1047, (8th Cir. 2006). In Millot, the Eighth Circuit affirmed a conviction for a former employee who kept his log-in credentials after termination, deleted management accounts, and disrupted the ability of current employees to remotely access/monitor the company network from home. As with ClickMotive, access was restored within a relatively short period of time but the company continued to experience problems for several weeks. 3. In the alternative, even if the defendant was authorized to delete some files in the completion of his job, he exceeded the intended-use of ClickMotive s protected computers. Even if the defendant was authorized to delete some files, he exceeded the intended-use as applied in United States v. Phillips, 477 F.3d 215, 220 (5th Cir. 2007). There, a defendant was convicted under 18 U.S.C. 1030(a)(5)(A) for a brute-force attack of the University of Texas computer systems. The defendant was an authorized student user who exceeded the expected norms based on the intended use and nature of the relationship established between the computer owner and user. Phillips at The defendant asserts that because he was allowed to delete virtual machines as an IT employee for ClickMotive that he was allowed to delete any virtual machine, at any time. However, this belief is inconsistent with the expected norms and intended use of the ClickMotive computers and IT professionals in general. Multiple witnesses testified to a proper procedure, created by the defendant himself, for safeguarding ClickMotive systems while building a new virtual machine to replace old virtual machines. Further, multiple witnesses testified that these PAGE 9 OF 18

10 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 10 of 18 PageID #: 1644 procedures were not exclusive to ClickMotive but were the type of safeguard employed industry wide by IT professionals like the defendant. Multiple witnesses and command logs showed that the defendant did not follow those procedures between December 2, 2011, and December 5, 2011, because he intended damage to ClickMotive systems and data. The district court s decision in United States v. Stratman, No. 4:13-CR-3075, 2013 WL (D. Neb. Oct. 18, 2013) (denying a motion to dismiss) illustrates the point well: [t]he fact that the defendant in this case did access the system, with authorization, does not change the fact that if he intentionally damaged the system without authorization, he may be charged with violation 1030(a)(5)(A). Id. at *2. The court included Senate Judiciary Committee reports stating this would cover anyone who intentionally damages a computer, regardless of whether they were an outsider or an insider otherwise authorized to access the computer because those who intentionally damage a system, without authority, should be punished regardless of whether they are authorized users. Id. The law does not distinguish between the intentional actions of an insider and those of an outsider. Several witnesses including ClickMotive s co-founder, co-owner, and CTO Ray Myers testified at length about the impairment or availability of data caused by the defendant s actions. While the defense may attempt to argue that the defendant had the authority to, for example, take a machine offline or turn off paging alerts in the course of maintaining the system, testimony from every witness at trial, including the defendant s own expert, testified that his conduct fell outside the scope of normal trouble-shooting and maintenance. At the very least he had to turn the systems back on and plainly, he did not. It was not simply contrary to a corporate policy, his actions actually violated a criminal statute. Consider, for example, a neighbor given a key to PAGE 10 OF 18

11 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 11 of 18 PageID #: 1645 one s house to feed the cat while the owners are away. Simply having a key to the house does not authorize that person to ransack it. Likewise, the defendant cannot hide behind his job title and access and claim authority. He cannot give himself permission to cause damage under the statute. Like well-recognized crimes of theft, assault, and criminal mischief, the unlawfulness turns on whether or not the owner gave consent for such damage or loss to occur. Here, the fact that the damage occurred, and that it occurred without consent of the owner, was undisputed at trial. The judgment of conviction must be sustained if there is substantial evidence, taking the view most favorable to the Government, to support it. United States v. Schechter, 475 F.2d 1099, 1101 (5th Cir. 1973). A finding of guilty, whether at the hands of court or jury, is not to be overturned unless there is no substantial evidence to support it. Id. In the instant case, the jury was presented with hundreds of pages of code, logs, video evidence, expert testimony by witnesses for the government and the defense, and many of the defendant s colleagues who worked with him and knew him over the alleged time period. The defendant was unanimously found guilty of intentionally causing damage to a protected computer without authorization under 18 U.S.C. 1030(a)(5)(A). Further, [t]he use of term integrity in the statute to define damage requires some diminution in the completeness or usability of data or information on a computer system. Likewise, the use of word availability suggests that a party asserting a claim under subsection 1030(a) may prove damage by showing that defendant's actions somehow made certain data or program not readily obtainable. Cheney v. IPD Analytics, L.L.C., CIV, 2009 WL , at *6 (S.D. Fla. Apr. 16, 2009), report and recommendation adopted sub nom. Cheney v. IPD Analytics, LLC, CIV-MORENO, 2009 WL (S.D. Fla. May 8, 2009) PAGE 11 OF 18

12 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 12 of 18 PageID #: 1646 (internal quotations and citations removed). The Cheney court reiterates that even parties authorized to access and manipulate computers are appropriate defendants, but dismisses a claim against the defendant. However, unlike the defendant in Cheney, the trial record in Mr. Thomas s case clearly establishes that the ClickMotive team was unaware of the extent of damage, the damage was not limited to files on a single laptop but backups across multiple servers and devices, and a clear interruption of service was supported by the diversion of hundreds of hours of ClickMotive employee time away from their ordinary duties to research and address the damage caused by the defendant. D. The government proved beyond a reasonable doubt that ClickMotive suffered at least $5,000 in loss. To support the defendant s felony conviction, the Government proved beyond a reasonable doubt to a unanimous jury that the defendant caused at least $5,000 worth of loss to ClickMotive. Loss includes any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service. 18 U.S.C. 1030(e)(11). 1. Losses were appropriately an issue for the trier of fact. Determining whether the amount of time spent by the employees to investigate and repair damage, and their imputed hourly rates, is properly answered by the trier of fact. United States v. Millot, 433 F.3d 1057, (8th Cir. 2006) (citing United States v. Middleton, 231 F.3d 1207, (9th Cir. 9000)). This evidence was properly presented to the jury by multiple PAGE 12 OF 18

13 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 13 of 18 PageID #: 1647 witnesses, including an expert for the defense, and the jury is the proper vehicle for assessing the credibility of whether losses are attributable to the defendant. The jury found the defendant guilty beyond a reasonable doubt of causing losses in excess of $5, Costs of investigation and response include opportunity costs of diverting employees to repair damage caused by defendant s harm to ClickMotive computers. Defense counsel cites Frisco Medical Center by pointing out that the term loss encompasses only two types of harm: costs to investigate and respond to a computer intrusion, and costs associated with a service interruption. Frisco Medical Center, 2015 WL , at *10. All loss established by ClickMotive was sustained in the investigation and response to harm caused by the defendant. Defense counsel takes umbrage with the term opportunity cost to reflect the costs incurred by ClickMotive as a result of the defendant s actions. Merriam Webster provides this definition, the added cost of using resources... that is the difference between the actual value resulting from such use and that of an alternative. This is supported by law the cost of an employee, whether hourly or salaried, of responding to intentional damage takes them away from the work that they would otherwise have been doing and is an appropriate loss under the CFAA. See Millot, 433 F.3d at ; see also United States v. Fowler, 445 Fed. Appx. 298, 300 (11th Cir. 2011). Business losses, in the form of opportunity cost for employees who would otherwise have worked on other projects, is properly included under the sentencing guidelines for 1030 regardless of whether these costs were foreseeable to the defendant. See United States v. Musacchio, 590 Fed. Appx. 359, (5th Cir. 2014); see also United States v. Schuster, 467 F.3d 614, 617 (7th Cir. 2006). PAGE 13 OF 18

14 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 14 of 18 PageID #: 1648 The defendant also objects to the cost of maintenance and forensic imaging. However, CTO Ray Meyers testified that line items and maintenance costs refer to the cost of investigation and repairing the ClickMotive systems. The defendant also points to Mud King to establish that forensic imaging costs were not appropriate here. See Motion at 25. However, in Mud King the court held that those costs were attributable to preserving digital evidence for trial rather than investigation. In re Mud King Products, Inc., No. BR , 2015 WL , at *7 (S.D. Tex. Feb. 27, 2015). Here, ClickMotive employed a forensic imaging firm for troubleshooting and protection purposes as demonstrated by the heat-of-the-moment contracting of the firm on December 6, 2011, the day after discovering the damage. The defendant attempts to assert that these costs were accrued under litigation costs, however the issue was never raised on cross-examination of either ClickMotive s former CEO or CTO, nor at the time of introduction of ClickMotive s spreadsheet detailing the costs of investigation. See Gov. Ex. 5. Further, fees paid for forensic investigations and damage assessments are proper loss under the CFAA. See Frisco Medical Center, 2015 WL , at *9. The Motion asserts that the cost of remediation and reallocation of existing employees to put out the fires set by the defendant was improper because these employees took longer to complete tasks than a trained IT professional, like Thomas, would have. See Motion at The cost of reallocating existing employees is a proper assessment of loss to ClickMotive. See Millot, 433 F.3d at Further, defense counsel appears to criticize the emergency response plan put in place to repair damage caused by the defendant. Interestingly, multiple witnesses testified at trial that the defendant offered to come back to work for ClickMotive after PAGE 14 OF 18

15 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 15 of 18 PageID #: 1649 submitting his resignation and causing the damage, at a rate of $400 an hour, far in excess of the industry standard. Defense counsel is, in essence, asking the court to second-guess business decisions made in response to Thomas intentional damage to ClickMotive. 3. A rational jury found Michael Thomas intentionally inflicted damage to ClickMotive computers resulting in loss in excess of $5,000. The defendant is attempting to work around the jury verdict by highlighting individual lines within Government Exhibit 5 that were not loss in an effort to bring the total loss for the damage he caused below $5,000. These efforts are ultimately not supported by law. First, the defendant points to legal costs as evidence of improper loss calculations. Motion at 27. However, legal costs in assessing risk to ClickMotive and their customers are appropriate loss in the face of unknown, potentially catastrophic damage. See, e.g., Phillips, 477 F.3d at The defendant also points to maintenance and support as lines unrelated to restoring ClickMotive Computers. Motion at 27. However, ClickMotive CTO Ray Meyers testified that he created Government Exhibit 5, which used to track losses as they were incurred by compiling the labor of all employees participating in the restoration process. He further testified that the entire team pitched in to take different parts of the project. Several processes that defense counsel points to clearly relate to restoration including Tech Support, restoring , Support Communication, and meeting with Support Team. Motion at 27, fn. 10. In this, the defendant is attempting to use internal record keeping citations to undermine direct testimony from Ray Meyers outside of cross-examination. In fact, in footnote 11, the defendant directly attacks line-items never questioned at the introduction of Government Exhibit 5 or on PAGE 15 OF 18

16 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 16 of 18 PageID #: 1650 cross-examination including Buchannon and inventory cleanup failure (tied to Thomas account). The jury had the opportunity to judge the credibility of all of the evidence and witnesses before returning their unanimous guilty verdict. The defendant further asserts that the line items between the second week of January 2012 and March 2013 were unrelated to any damage caused (Motion at 28), however, multiple witnesses testified that they never knew for sure if the defendant s damage was fully identified and remediated, and were therefore vigilant for months looking for additional damage. As to the defendant s attacks on management decisions regarding replacing him and Cain as employees, there is no legal basis for this attack on ClickMotive s calculations of loss. Even loss that is unforeseeable to defendants at the time of their action is appropriate if directly related. See Musacchio, 590 Fed. Appx. at Further, the defendant in the same paragraph attacks both the decision not to hire replacements for himself and Cain, and the costs of flying Mr. Gonzalez across the country to cover the network IT work, restoration, and assessment. Here, the defendant is attempting to reduce loss twice for the same business decision. This argument lacks merit. Further, attacks on the time spent by Mr. Gonzalez to repair the VPN are specious. See Motion at 29. The defendant intentionally damaged ClickMotive computers and hid the fail-safes designed to alert other users. It is not surprising that, without knowing what damage had occurred, remediating the VPN issue took longer than it normally would have if the technicians had known what they were looking for in the first place. Similarly, superficial complaints that employees did more than repair damage caused by Thomas are outside the bounds of ClickMotive s loss calculations. See Motion at 29. First, PAGE 16 OF 18

17 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 17 of 18 PageID #: 1651 Cain was intentionally terminated and his position assumed by several employees of ClickMotive. Mr. Gonzalez testified that he had been asked prior to Cain s termination to take on some of Cain s responsibilities and that he agreed to do so. Both the CEO and CTO testified as to the careful planning and Cain s overall performance prior to termination. Any attempts to subtract Cain s job/hours from the total loss is unsupported by testimony at trial. Further, the long hours noted in the Motion are attributable to the stress and fear of potentially losing the company and the unknown damage caused by Thomas. Both the CEO and CTO testified that Thomas could have cost them the entire company. The defendant intentionally damaged the computers of a software company without notifying anyone at any time, before or after, of his actions. The only note he left during his destruction was his resignation and an offer to return to work for $400 an hour. For the foregoing reasons, the government respectfully requests that the Court deny the defendant s motion. Respectfully submitted, JOHN M. BALES United States Attorney Eastern District of Texas /s/ Camelia Lopez Camelia Lopez Assistant United States Attorney Texas Bar No E. Park Blvd., Suite 500 Plano, Texas tel: (972) fax: (972) Camelia.Lopez@usdoj.gov PAGE 17 OF 18

18 Case 4:13-cr ALM-CAN Document 99 Filed 07/06/16 Page 18 of 18 PageID #: 1652 CERTIFICATE OF SERVICE I certify that a copy of this document was served by and ECF to defense counsel, Aaron Williamson on July 6, /s/ Camelia Lopez Camelia Lopez PAGE 18 OF 18