Phillips entered the University of Texas at Austin (“UT”) in 2001 and was admitted to the Department of Computer Sciences in 2003 . . . [O]nly a few weeks after matriculating, Phillips began using various programs designed to scan computer networks and steal encrypted data and passwords. He succeeded in infiltrating hundreds of computers, including machines belonging to other UT students, private businesses, U.S.

Government agencies, and the British Armed Services webserver. In a matter of months, Phillips amassed a veritable informational goldmine by stealing and cataloguing a wide variety of personal and proprietary data, such as credit card numbers, bank account information, student financial aid statements, birth records, passwords, and Social Security numbers.

The scans, however, were soon discovered by UT’s Information Security Office (“ISO”), which informed Phillips on three separate occasions that his computer had been detected port scanning hundreds of thousands of external computers for vulnerabilities. Despite several instructions to stop, Phillips continued to scan and infiltrate computers within and without the UT system, daily adding to his database of stolen information.

At around the time ISO issued its first warning in early 2002, Phillips designed a computer program expressly for the purpose of hacking into the UT system via a portal known as the “TXClass Learning Central: A Complete Training Resource for UT Faculty and Staff.” TXClass was a “secure” server operated by UT and used by faculty and staff as a resource for enrollment in professional education courses. Authorized users gained access to their TXClass accounts by typing their Social Security numbers in a field on the TXClass website’s log-on page. Phillips exploited the vulnerability inherent in this log-on protocol by transmitting a “brute-force attack” program, which automatically transmitted to the website as many as six Social Security numbers per second, at least some of which would correspond to those of authorized TXClass users.

. . . Phillips asserts that the Government failed to produce sufficient evidence that he “intentionally access[ed] a protected computer without authorization” under § 1030(a) (5)(A)(ii) . . . Phillips’s insufficiency argument takes two parts: that the Government failed to prove (1) he gained access to the TXClass website without authorization and (2) he did so intentionally.

Questions:

1. What is the defendant’s legal argument in the appeal?
2. Should a defendant in these types of case be forced to pay restitution to the damaged parties?