Breaking Code Silence assigned Vanessa Hughes and Jennifer Magill as the Persons Most Qualified to speak on its behalf on the damages alleged. However, during their depositions, both appeared to struggle to articulate any cost to BCS related to the allegations against Mr. Whiteley and Mrs. McNamara.

Note: For brevity, the following format of the transcript highlights is written as [Page Number]:[Line Number]. So Page 13, lines 14-17 would be expressed as 13:14-17

Click here to review relevant parts of Ms. Vanessa Hughes’s Deposition. Please review the following excerpts:

• 13:14-17 – Ms. Vanessa Hughes is the PMQ Designation for Breaking Code Silence
• 68:6-69:7 – Ms. Vanessa Hughes has no knowledge if TXT investigation cost anything
• 70:13-71:7 – Ms.Vanessa Hughes knows of no cost re: Whiteley being added to domain account
• 74:1-75:10 – Ms. Vanessa Hughes knows of no cost re: Google Drive
• 76:20-25 – Ms. Vanessa Hughes knows of no cost re:deindexing investigation

Click here and here to review relevant parts of Ms. Jennifer Magill’s Deposition. Please review the following excerpts:

• 49:16-50:19 – No volunteers were paid
• 65:19-71:25 – Ms. Jenny Magill is unable to quantify the amount of hours or the value of volunteer time
• 92:8-18 – Ms. Jenny Magill can’t speculate what donations were lost
• 95:24-96:3 – “…[I]t’s hard to tell the cause and effect of anything that didn’t happen.”
• 105:20-106:22 – BCS made no payments to attorneys related to the deindexing
• 115:4-116:10 – Ms. Jenny Magill thinks BCS registered in 2023
• 117:9-120:16 – BCS has never been told that it is no longer delinquent
• 121:10-16 – BCS has never been told that it is no longer delinquent
• 126:7-21 – BCS did not successfully register with the AG until 7/18/23
• 133:13-134:5 – Ms. Jenny Magill is not aware whether BCS ever filed IRS Form 990’s despite receiving donations
• 155:15-20 – BCS made no payments to attorneys related to the deindexing

Based on Vanessa Hughes’ and Jenny Magill’s public Linkedin profiles, neither appear to have any formal education, licenses, or professional experience related to accounting, appraising, or forensic accounting.

As with the computer forensic investigation, Breaking Code Silence chose not to retain an expert witness to estimate damages.

Unlike Breaking Code Silence, Mr. Whiteley and Mrs. McNamara’s counsel retained Mr. Bergman as an expert witness in this case. Mr. Bergman is a Managing Directory of Stout – which provides services related to business valuation, financial disputes, claims, and investigations. Mr. Bergman comes with the following credentials and professional experience:

• Licensed in the State of California as a Certified Public Accountant
• Accredited in Business Valuation by the American Institute of Certified Public Accountants
• Accredited as a Senior Appraiser by the American Society of Appraisers
• Bachelor of Science, Economic-Systems Science from the University of California at Los Angeles
• Master of Business Administration, emphasis in Finance from San Diego State University
• 30 years of experience in litigation matters including discovery assistance, causation analysis, damage quantification, and forensic accounting/fraud investigations

Below is Brian Bergmark’s Declaration in support of Mr. Whiteley’s Motion for Summary Judgment:

From Whiteley’s Motion for Summary Judgment:

“While the CFAA is primarily a criminal statute, §1030(g) authorizes a civil lawsuit if one of factors set forth in §1030(c)(4)(A)(i) are met. The only one of these factors alleged by BCS is in its Complaint is that BCS claims to have suffered more than $5,000 in losses. Thus, in order to prove its CFAA claim, BCS must prove a “loss” of at least $5,000 in value.

The CFAA defines “loss” as “any reasonable cost to the victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damage incurred because of interruption of service.”  ) The Ninth Circuit has explained that the CFAA maintains a “narrow conception of ‘loss’” and that the term is limited to harms caused by computer intrusions, not general injuries unrelated to the hacking itself. Section 1030’s definition of harm, therefore, “focus[es] on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data.” (Van Buren – Supreme Court Ruling) “Limiting ‘damage’ and ‘loss’ in this way makes sense in a scheme ‘aimed at preventing the typical consequences of hacking.’”  And although the definition does include “revenue lost,” that refers only to losses that occurred “because of interruption of service.” However, claims of lost business opportunities, damaged reputation, loss of assets, and other missed revenue, however, do not constitute “loss” under the statute. Allegations of any damages related to the value of data that might have been taken, competitive harm in the form of lost business, or lost revenue from misappropriation claims cannot form the basis of “damage”.”

From Whiteley’s Motion for Summary Judgment:

“BCS cannot show any losses or damages. In response to discovery, BCS identified three potential sources of losses: (1) volunteer time; (2) attorney hours; and (3) potential lost donations. As shown below, none of these are cognizable losses or damages here.”

From Whiteley’s Motion for Summary Judgment:

“The CFAA defines “loss” in terms of an “any reasonable cost.” BCS admitted that it has never paid anyone anything to investigate the allegations of the Complaint. All of the time spent in the investigation was by unpaid volunteers or pro bono attorneys. Because BCS did not pay its volunteers or attorneys, the time that the volunteers and counsel have spent are not “costs” or “losses” within the meaning of the statute. It is undisputed that BCS did not pay its volunteers or its attorneys to investigate the allegations of the Complaint.”

From Whiteley’s Motion for Summary Judgment:

“Even if BCS’s employees and attorneys had been paid, BCS still would not be able to satisfy the $5,000 requirement. “Costs associated with investigating intrusions into a computer network and taking subsequent remedial measures are losses within the meaning of the statute.” (Kimberlite Corp. v. Does, No. C08–2147 TEH, 2008 WL 2264485, at *1-2 (N.D. Cal. 2008).) However, once the harm from the intrusion has been remediated, any subsequent investigation is no longer “essential to remedying the harm” and costs relating to such investigation are not recoverable.

BCS claims to have learned that its website was not appearing on Google Search sometime on March 11 and that Jensen resolved the issue by 3:00 or 4:00 the next day. Yet, Breaking Code Silence is claiming more than 800 hours in investigative time for Vanessa Hughes, Jesse Jensen, and Jennifer Magill alone. Clearly, BCS is including in its calculation hours not spent to remediate to the harm.

Likewise, BCS claims more than 560 attorney hours were spent by its attorneys at DLA Piper. However, even a cursory review of DLA’s time entries show that DLA was not seeking to remediate the harm caused by the alleged deindexing, it was preparing for litigation against Defendants. Such “costs” are not recoverable. (United Fed’n of Churches, LLC v. Johnson, 598 F.Supp.3d 1084, 1097 (W.D. Wash. 2022) [“[L]itigation expenses are not ‘losses’ that are cognizable under the CFAA.”].)”

From Whiteley’s Motion for Summary Judgment:

“BCS’s final attempt to establish losses is the theory that it may have lost donations when its website not appearing on Google Search for a brief time between March 11 and March 12. BCS’s lost donations theory is fatally speculative.

First, BCS did not have the ability to track its web traffic around the time of the alleged deindexing, having disabled the Google Site Kit that allowed it to track its website traffic. Accordingly, it is unknown whether BCS even lost web traffic.

Second, as explained by Brian Bergmark (McNamara and Whiteley’s expert witness), the donations that BCS has historically received are sporadic in nature. BCS’s PayPal records show that from June 19, 2021 through March 9, 2022, BCS only received donations on 59 out of 264 days, approximately 22% of the days. Thus, even assuming that BCS did not receive any donations for some indeterminate period of time between March 9 and 12, there is no evidence that the lack of donations was the result of the website not appearing on a Google Search, as opposed to the normal variability in donations BCS historically received.

Moreover, when you average the donations BCS received during that same time period, BCS only received an average of $37.62 in donations and $6.59 in subscriptions daily. (Id.) The notion that BCS would have received thousands of dollars in donations on March 11 and/or 12 is improbable.

Regardless, at the time, BCS was not authorized to legally accept donations having failed to properly register with the California Attorney General’s Registry of Charitable Trusts. (UMF 58; see Cal. Code Regs., tit. 11, §999.9.4 [“A person or entity subject to the registration requirements of Government Code section 12580 et seq., must be registered and in good standing with the Registry of Charitable Trusts to operate or solicit for charitable purposes.”].)”

See also: Break on Through: An Analysis of Computer Damage Cases

Like this post? Read more here: A Plot to Sue?