By Robert R. Baron, Jr., David S. Fryman, Corinne Militello, and Philip N. Yannella
A Pennsylvania federal magistrate judge has tossed an employer’s claims under the Computer Fraud and Abuse Act (CFAA), holding that the CFAA does not extend to punish employees for the misuse of information that was accessed with permission. The recent ruling follows the Fourth and Ninth Circuits, and district courts in the Third Circuit, in endorsing a narrow view of the CFAA, making it more difficult for employers in those jurisdictions seeking to state a claim under the CFAA against disloyal former employees. Consequently, employers should review the levels of computer system access granted to employees, as well as the scope of information that may be accessed at different levels.
In Carnegie Strategic Design Engineers v. Cloherty, et al. [enhanced opinion available to lexis.com subscribers], engineering firm Carnegie sued five former employees who it claimed had departed with confidential business information accessed through the company’s secure computer network, and then used that information when they went to work for a competitor. Carnegie valued the information at $10 million. The complaint included claims for violations of the CFAA, conversion, and misappropriation of trade secrets, but Carnegie dropped the latter two claims.
To state a claim for civil liability under the CFAA, an employer must show that the defendant accessed a protected computer without authorization or by exceeding authorized access. The CFAA defines the phrase “exceeds authorized access,” but not the word “authorization.” “Exceeds authorized access” means “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled to so obtain or alter.”
Courts have been left to freely interpret the word “authorization,” resulting in a circuit split on that word’s meaning. The Courts of Appeals for the Fourth and Ninth Circuits have applied a narrow interpretation of the CFAA, holding that access to a work computer system results in authorization—and invalidates a CFAA claim—regardless of the employee’s intent or any company policies restricting the use of information. The First, Fifth, Seventh, and Eleventh Circuits have adopted a broad view of the CFAA, wherein an employee’s misuse of information accessed permissibly revokes prior authorization, allowing a CFAA claim to proceed.
Carnegie pointed to the Third Circuit’s 2011 decision in United States v. Tolliver [enhanced opinion], in which the Third Circuit upheld the criminal conviction of a former bank employee accused of using authorized means to access customer financial information on the bank’s computer system, but then misusing that information as part of a fraudulent check-cashing scheme. Judge Cynthia Reed Eddy, however, found the Tolliver holding inapplicable. “The Court had no occasion and did not address the [meaning of the term ‘authorizaton’],” she stated. Judge Eddy concluded that a narrow interpretation of “authorization” is consistent with Congress’ intent to create an anti-hacker statute and the term’s interpretation by other district courts in the Third Circuit. The Tolliver court’s failure to address the circuit split, she reasoned, was evidence that it had not analyzed the meaning of “authorization.”
Carnegie’s narrow interpretation of the CFAA limits its reach in situations where confidential business information was validly accessed. An employee’s breach of a contract or policy—such as a confidentiality agreement or computer-use policy—does not revoke the employee’s authorized access, regardless of intent or detriment to the employer. The CFAA does, however, extend to situations where an employee is granted access to a computer system but then finds a way to hack into information beyond the bounds of the employee’s authorization.
The Carnegie holding addresses only contract-based restrictions on use of information, and does not address such restrictions on access to information; thus, employers also may wish to revisit their contracts with employees and employment policies to assess whether added access restrictions may keep CFAA claims afloat. Ballard Spahr will be monitoring this issue to see how the Third Circuit may respond.
Our attorneys have extensive experience in obtaining and defending against temporary restraints and injunctions in all facets of trade secret use and restrictive covenants. We partner with computer forensic consultants to conduct data analyses on hard drives, and we also help conduct internal investigations for companies faced with allegations of misappropriation. In addition, we assist employers in drafting and revising policies governing employee access to computer systems.
For more information, please contact Robert R. Baron, Jr., at 215.864.8335 or email@example.com, David S. Fryman at 215.864.8105 or firstname.lastname@example.org, Corinne Militello at 215.864.8145 or email@example.com, Philip N. Yannella at 215.864.8180 or firstname.lastname@example.org, or any other member of the firm’s Intellectual Property Department, Labor and Employment Group, or Privacy and Data Security Group with whom you regularly work.
Copyright © 2014 by Ballard Spahr LLP. www.ballardspahr.com (No claim to original U.S. government material.)
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.
This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.
For more information about LexisNexis products and solutions, connect with us through our corporate site.