Computer Fraud and Abuse Act Continues to be "Employer Friendly"
The Computer Fraud and Abuse Act (“CFAA”) is a federal law that, in part, makes it a crime to access a computer in an unauthorized manner. In the employment context, the statute has proven valuable in protecting confidential and proprietary information that employees can access on their employers’ electronic systems.
Recent decisions by the United States Courts of Appeals for the Ninth and Third Circuits emphasize the breadth of the CFAA’s application to the workplace. In U.S. v. Nosal, 642 F.3d 781 (9th Cir. 2011), reh’g en banc granted 2011 U.S. App. LEXIS 21777 (Oct. 27, 2011), the court held that employees violated the CFAA where their use of an employer’s systems exceeded their authority under the employer’s policies, which warned of criminal liability for misuse. The court went one step further in U.S. v. Tolliver, No. 10-3439, 2011 U.S. App. LEXIS 19090 (3d Cir. Sept. 15, 2011), finding that an employee who accessed her employer’s systems as part of bank fraud exceeded authorized access even though the employer only generally prohibited use of its electronic systems for non-business reasons.
Nosal
In Nosal, the defendant worked for an executive search firm. When his employment with the firm ended, he entered into a non-competition agreement with the firm. Despite the agreement, the defendant purportedly asked three current employees of the firm to help him compete against his former employer. These employees allegedly transferred confidential information from the firm’s computer database to this individual – information that the employees were authorized to access as employees of the firm.
Notably, pursuant to firm policy, employees only could access the information using individualized usernames and passwords. Additionally, the employees agreed only to use and disclose such information for legitimate business reasons. The firm also marked the information as “proprietary and confidential” and warned that employees needed “specific authority to access” the information and that access “without the relevant authority can lead to disciplinary action or criminal protection.