The Computer Fraud and Abuse Act (the \u201cCFAA\u201d) has become an increasingly important avenue for employers to bring claims against rogue employees who engage in computer misconduct before they end their employment.\u00a0 While the CFAA was originally passed as a federal criminal statute in 1984 to target hackers, the statute was amended in 1994 to provide private citizens with a civil cause of action.<\/p>\n
In the employment context, the CFAA gives employers a cause of action against an employee who \u201cintentionally accesses a computer without authorization or exceeds authorized access\u201d and obtains or misuses certain of the information obtained from the computer.\u00a0 18 U.S.C. \u00a7 1030. \u00a0The CFAA defines \u201cexceeds authorized access\u201d as \u201cto access a computer with authorization and to use such access to obtain or alter information in the computer the accessor is not entitled so to obtain or alter.\u201d 18 U.S.C. \u00a7 1030(e)(6). The CFAA, however, does not define \u201cwith authorization\u201d or \u201cwithout authorization.\u201d\u00a0 As a result, those terms have been interpreted differently amongst the various circuits, causing the reach of the CFAA to vary by jurisdiction.<\/p>\n
The effect of these various interpretations is most clearly seen in the context of an employee engaging in computer misconduct while still employed.\u00a0 For example, a handful of courts analyze the meaning of \u201cwithout authorization\u201d through an agency lens.\u00a0 Under this analysis, the CFAA applies when an employee is granted access to the employer\u2019s computer systems, but then uses that access for a purpose that is inconsistent with the employer\u2019s interest.\u00a0 See, e.g.<\/em>, International Airport Centers LLC v. Citrin<\/em>, 440 F.3d 418 (7th Cir. 2006). \u00a0Stated otherwise, if the employee accesses his employer\u2019s computers to download information to use when he joins a competitor, he is acting contrary to his agency with his current employer and he may be found to be in violation of the CFAA.<\/p>\n Other courts, however, have taken a narrower approach.\u00a0 Under this approach, when an employee\u2019s access to an employer\u2019s computer systems has not yet been terminated, then the employee is not acting \u201cwithout authorization.\u201d\u00a0 Thus, no matter what the employee\u2019s intent is in accessing the computer systems, so long as that employee has permission to access the company\u2019s computers, then he is not violating the CFAA. \u00a0In effect, this approach has led many courts to hold that the CFAA does not apply when the employee engages in computer misconduct while still employed.\u00a0 See, e.g.<\/em>, LVRC Holdings LLC v. Brekka<\/em>, 581 F.3d 1127 (9th Cir. 2009).<\/p>\n Even in jurisdictions adopting this narrower approach, employers may still be able to bring a CFAA claim against former employees in situations where an employee \u201cexceeds his authorized access.\u201d\u00a0 Specifically, if an employer has company policies or contracts in place limiting an employee\u2019s authorization to access the company\u2019s computer systems, and the employee violates such policies or contractual obligations, the employee\u2019s conduct may constitute a violation of the CFAA.\u00a0 See, e.g.<\/em>, U.S. v. Rodriguez<\/em>, 628 F.3d 1258 (11th Cir. 2010).\u00a0 Although even in this context, there is disagreement amongst courts as to whether a violation of a company\u2019s policy relating to an employee\u2019s use<\/em> of a computer (as opposed to an employee\u2019s access<\/em>) can give rise to a CFAAclaim.<\/p>\n In light of these varying interpretations, the issue regarding the reach of the CFAA is ripe for Supreme Court review.\u00a0 In fact, in a recent case, a South Carolina company petitioned for a writ of certiorari, framing the relevant question as \u201cwhether the CFAA applies to employees who violate employer-imposed computer access and data use restrictions to steal company data.\u201d\u00a0 See WEC Carolina Energy Solutions LLC v. Miller<\/em>, No. 12-518, 2012 WL 5353899 (Oct. 24, 2012) (Petition for Writ of Certiorari to U.S. Supreme Court).\u00a0 However, in early January, the hope for a Supreme Court ruling on the circuit split was dashed, when the parties mutually dismissed the case.\u00a0 Thus, the reach of the CFAA remains unresolved.<\/p>\n Employers should be aware of the potential implications of the unsettled law surrounding the CFAA.\u00a0 More specifically, employers should review their computer policies and employment agreements, as well as the scope of employees\u2019 access to computer systems.\u00a0 The relevant policies and contracts should be revised, with an eye on the rules governing when the CFAA applies, to provide employers with the most potential protection against employees\u2019 computer misconduct.<\/p>\n \n","protected":false},"excerpt":{"rendered":" The Computer Fraud and Abuse Act (the \u201cCFAA\u201d) has become an increasingly important avenue for employers to bring claims against rogue employees who engage in computer misconduct before they end their employment.\u00a0 While the CFAA was originally passed as a federal criminal statute in 1984 to target hackers, the statute was amended in 1994 to […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_mo_disable_npp":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4,9],"tags":[25,29],"acf":[],"yoast_head":"\n