{"id":1565,"date":"2021-07-30T14:35:59","date_gmt":"2021-07-30T14:35:59","guid":{"rendered":"https:\/\/www.bfvlaw.com\/supreme-court-rules-on-computer-fraud-and-abuse-act-what-should-employers-do-now\/"},"modified":"2022-08-15T14:34:34","modified_gmt":"2022-08-15T14:34:34","slug":"supreme-court-rules-on-computer-fraud-and-abuse-act-what-should-employers-do-now","status":"publish","type":"post","link":"https:\/\/www.bfvlaw.com\/supreme-court-rules-on-computer-fraud-and-abuse-act-what-should-employers-do-now\/","title":{"rendered":"Supreme Court Rules on Computer Fraud and Abuse Act: What Should Employers Do Now?"},"content":{"rendered":"\r\n

The United States Supreme Court recently overturned an Eleventh Circuit decision in Van Buren v. United States<\/em>, 141 S. Ct. 1648, 1649 (2021). It ruled that a police officer did not violate the Computer Fraud and Abuse Act (\u201cCFAA\u201d) when he obtained information from a law enforcement database that he was generally authorized to access, but which he accessed for an improper purpose.<\/p>\r\n\r\n\r\n\r\n

In doing so, the Court resolved a long-standing split between federal appellate courts<\/a>. This decision has significant implications for employers, as, although the CFAA originally targeted hackers, some employers have been able to use the CFAA\u2019s civil remedy provisions to assert CFAA claims in unfair competition lawsuits against former employees who misappropriate information using a computer.<\/p>\r\n\r\n\r\n\r\n

Computer Fraud and Abuse Act: Background<\/strong>
The Computer Fraud and Abuse Act provides a civil cause of action against anyone who \u201cintentionally accesses a computer without authorization or exceeds authorized access\u201d and obtains or misuses certain information obtained from the computer.[1]<\/a>\u00a018 U.S.C. \u00a7 1030.\u00a0<\/p>\r\n\r\n\r\n\r\n

While the CFAA defines the phrase \u201cexceeds authorized access,\u201d it has proven to be an ambiguous term in application.[2]<\/a> Adding to the confusion, the CFAA does not define \u201cwith authorization\u201d or \u201cwithout authorization.\u201d\u00a0As a result, the CFAA has been interpreted differently by the various circuits, causing the\u00a0reach<\/a>\u00a0of the CFAA to vary by jurisdiction.<\/p>\r\n\r\n\r\n\r\n

Prior to Van Buren<\/em>, some federal appellate courts analyzed the CFAA through an agency lens. Under this analysis, the CFAA was found to apply when an employee was granted access to the employer\u2019s computer systems, but then used that access for a purpose that was inconsistent with the employer\u2019s interest.[3]<\/a><\/p>\r\n\r\n\r\n\r\n

Stated otherwise, if the employee accessed his or her employer\u2019s computers to download information to use in the future at a competitor, the employee was acting contrary to his or her agency to the current employer and could be found to be in violation of the CFAA. Appellate courts in other circuits construed the CFAA more narrowly, holding that an employer must show that the employee engaged in misconduct within a computer, database, or server that the employee did not have authority to access in the first place, or whose authority had clearly been terminated.[4]<\/a><\/p>\r\n\r\n\r\n\r\n

Case Background<\/strong>
Van Buren was a sergeant with the Cumming, Georgia, Police Department. As part of his job, Van Buren had authorization to use the Georgia Crime Information Center (\u201cGCIC\u201d) database for criminal investigations. Van Buren was charged with violating the CFAA after he used his patrol-car computer to access the GCIC to retrieve information about a particular license plate number in exchange for money. A jury convicted Van Buren and sentenced him to 18 months in prison.<\/p>\r\n\r\n\r\n\r\n

On appeal, Van Buren argued (consistent with some courts outside the Eleventh Circuit) that the \u201cexceeds authorized access\u201d clause applies only to those who obtain information to which their computer access does not extend, not to those who misuse access that they otherwise have.[5]<\/a> However, consistent with Eleventh Circuit precedent, the panel held that Van Buren had violated the CFAA and affirmed his conviction. Van Buren thereafter successfully petitioned the Supreme Court to hear the case.<\/p>\r\n\r\n\r\n\r\n

The Supreme Court\u2019s Decision
<\/strong>The Supreme Court reversed the Eleventh Circuit\u2019s ruling. It determined that a person only \u201cexceeds authorized access\u201d within the meaning of the CFAA when they use a computer with authorization but then acquire information located from a restricted area of that computer \u2014 be it from a file, folder, etc.\u2014that is off limits.<\/p>\r\n\r\n\r\n\r\n

Accordingly, the Court held, Van Buren did not violate the CFAA by obtaining information from the GCIC database for an improper purpose since he was authorized to access that database as part of his job duties.<\/p>\r\n\r\n\r\n\r\n

The Supreme Court focused on the text and structure of the CFAA, agreeing with Van Buren that \u201cwithout authorization\u201d and \u201cexceeds authorized access\u201d should be understood as a \u201cgates-up-or-down inquiry \u2014 one either can or cannot access a computer system, and one either can or cannot access certain areas within the system.\u201d[6]<\/a><\/p>\r\n\r\n\r\n\r\n

The parties agreed that Van Buren had authority to access the GCIC database by virtue of his job. Because the \u201cgates were down\u201d, that Van Buren accessed the GCIC for an improper reason was insufficient to establish a violation of the CFAA.<\/p>\r\n\r\n\r\n\r\n

The Supreme Court further observed \u201cthe interplay between the \u2018without authorization\u2019 and \u2018exceeds authorized access\u2019 clauses\u201d of the CFAA, preferring Van Buren\u2019s interpretation because it would \u201cplace the provision\u2019s parts into a harmonious whole.\u201d[7]<\/a><\/p>\r\n\r\n\r\n\r\n