I’ll try to be as concise as possible. Some details have been changed to protect myself.
I used to operate a website that hotlinked to an asset from $company’s S3 bucket. When $company was made aware of my doing from the FBI, the FBI asked them to calculate the loss amount. They did this by looking at IPs that hit the bucket over a span of 1 month, and the IPs that logged into $company’s service. The number of IPs that they didn’t recognize (about 25,000), multiplied by some multiplier, came out to about $6MM.
The problem: I know how many people I had on my website that hit that asset. It was in the hundreds, not the thousands, definitely not tens of thousands. I know this because my site required a subscription and I know how many subscribers I had. There were (and still are!) hundreds of sites that hotlink to $company’s S3 bucket today, causing them loss, that are free and easily accessible. I can show this.
When I told my lawyer that this couldn’t possibly have been calculated correctly, he said that I’m pretty SOL in arguing this loss amount. He’s not technical so I don’t know if he really understands. Regardless, I’m in the process of discharging him because he’s failed me multiple times in this case so far.
This reeks of all sorts of wrong. $company is an organization known to probably 95% of HNers, they’re a technical organization, and they could not have possibly made the calculation in good faith.
If anyone has any advice, I’d appreciate it. I’ll be checking this thread closely, but I can also be reached by email at hotlinking@protonmail[.]com.