BP Won’t Recoup Hacker Investigation Costs as Victim Restitution

BP PLC won’t recover $550,000 for helping law enforcement identify a former employee who made an unsuccessful hacking-related extortion attempt because a federal restitution law isn’t that expansive, the Fifth Circuit said Wednesday.

BP’s digital security team incurred the expenses in 2017 while working with the FBI to identify the person threatening to release personally identifying information of employees if he wasn’t paid off in cryptocurrency.

The teamwork revealed that the “foreign hacker” was actually a Chicago-based employee. He pleaded guilty to one count of wire fraud and was sentenced to two years in prison.

The trial judge was wrong, however, to order restitution on the grounds that the BP’s security team’s work were “other expenses” covered by the Mandatory Victims Restitution Act, Judge Andrew S. Oldham said for the U.S. Court of Appeals for the Fifth Circuit.

A corporate victim may be entitled to restitution under the MVRA, but the overall act is concerned with “the sort of expenses a natural person incurs” as he or she assists with an investigation and attends hearings, the court said.

“BP’s expenses for its digital security team and outside contractors are not remotely similar to lost income, child care, or transportation,” which are examples named within the relevant MVRA section, the court said.

The government’s reliance on “and other expenses” was too expansive for the law’s residual clause, considering its broader structure and purpose, the court said.

The court vacated the restitution order and remanded the case for further proceedings.

Judges Jennifer W. Elrod and Don Willett joined the opinion.

The case is United States v. Koutsostamatis, 5th Cir., No. 18-20594, 4/15/20.