Two new developments this past year have made it easier for employers to sue employees in federal court for stealing data from company computers. The most recent is the U.S. Court of Appeals for the Ninth Circuit’s July decision in U.S. v. Nosal interpreting what it means to access a company computer “without authorization” under the Computer Fraud and Abuse Act (CFAA), the federal computer criminal statute. 18 U.S.C. 1030. The other development is the May amendment to the Economic Espionage Act (EEA), the federal criminal trade secrets act, permitting companies to file a federal civil action against individuals who steal the company’s competitively sensitive data. 18 U.S.C. 1831, et. seq.
The recent decision in Allied Portables v. Youmans from the U.S. District Court for the Middle District of Florida underscores the need for businesses to establish explicit, well-advertised written policies identifying the scope of permissible employee access to company computers. Absent such policies, employers may be precluded from using the civil remedy in the federal computer crime statute, the Computer Fraud and Abuse Act, to sue employees who steal or destroy data from a company computers.
Allied properly recognized that for a CFAA claim to succeed, the plaintiff employer must be able to show the critical element that the defendant employee accessed a company computer by exceeding the authorized access to the computer.
On January 2015, the Obama administration announced a series of proposals to strengthen the country’s response to cyberattacks including, most notably, specific amendments to the federal computer crime statute, the Computer Fraud and Abuse Act (CFAA). These changes are not only significant to the cyber crime-fighting efforts of federal prosecutors, but also to private companies. This is because the CFAA allows companies victimized by violations of the statute to bring civil actions against the perpetrators. 18 U.S.C. 1030(g). The CFAA, among other things, makes it a crime when an individual “accesses” a computer “without authorization or exceeds authorized access” to steal data.
In all jurisdictions the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, the federal computer crime statute, applies to former employees who steal data from the company computer, but in two federal circuits it does not apply when the theft occurs during employment. The difference in jurisdictions is significant to employers because the CFAA provides a civil remedy for damages and injunctive relief for a company that “suffers damage or loss” by reason of a violation of the CFAA. 18 U.S.C. 1030(g).
Last year the U.S. Court of Appeals for the Ninth Circuit in U.S. v. Nosal, 676 F.3d 854 (9th Cir. 2012), disagreed with certain of its sister circuits and narrowly interpret-ed what it means to access the company computer “without authorization,” effec-tively eliminating a company’s ability in that jurisdiction to use the CFAA against current employees. This column will review the conflicting interpretations of the CFAA that distinguishes between current and former employees and the strategies and options companies can employ to navigate this conflict.
At issue is whether the Computer Fraud and Abuse Act applies to data theft by employees; the circuits are split. BY Nick Akerman On July 26, the U.S. Court of Appeals for the Fourth Circuit became the first circuit to adopt the Ninth Circuit’s holding in U.S. v. Nosal, 676 F.3d 854 (9th Cir. 2012),… Read More
Yesterday the 9th Circuit Court of Appeals issued an opinion holding that limiting an employee’s access to the company computers solely for business purposes, i.e. not stealing the data for a competitor, cannot be the predicate for a violation of the federal computer crime statute, the Computer Fraud and Abuse Act (“CFAA”), Title 18, U.S. C. § 1030. U.S. v. Nosal, 2012 WL 1176119 (9th Cir. April 10, 2012). The CFAA makes it a crime in various instances to access a computer “without authorization” or to have “exceeded authorized access” to obtain information from the computer and permits those, including companies, who are victims of violations of the statute to bring a civil action against the perpetrators. Acknowledging that its decision conflicts with the 5th, 7th and 11th Circuits, there is a good chance the Supreme Court will have the final say on this issue if the Department of Justice decides to appeal. As the dissent pointed out, this decision is counter to the common sense notion that a “bank teller is entitled to access a bank’s money for legitimate purposes, but not to take the bank’s money for himself.”
Last month I posted my article from the National Law Journal, entitled, “Time to Review Computer Policies,” discussing three recent cases, including LVRC Holdings LLC v. Brekka, 81 F.3d 1127, 1131 (9th Cir. 2009). I cited Brekka for the proposition that it is important to delineate the scope of an employee’s permissible access to the… Read More