Courts continue to read the CFAA narrowly to limit criminal liability — Wentworth-Douglass Hospital v. Young & Novis Prof’l Ass’n, 2012 WL 2522963 (D.N.H. June 29, 2012), and Dana Ltd. v. American Axle & Mfg Holdings, Inc., 2012 WL 2524008 (W.D. Mich. June 29, 2012)
Suppose a terminated employee logs in to her work account one last time (just to copy and delete her personal files, she promises), which the company allows her to do, but she ends up copying files containing the company’s trade secrets and taking them to her new job at a competing company. Employers dealing with this kind of scenario increasingly seem to be turning to the Computer Fraud and Abuse Act (CFAA) for relief (see the post on a recent case just last week). Under the CFAA, “[w]hoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer” is exposed to both criminal penalties and civil liability. 18 U.S.C. § 1030(a)(2)(C). Since the CFAA is a criminal statute, a growing number of courts have been reluctant to read the CFAA too broadly. These courts limit the kind of conduct that would qualify as “access[ing] a computer without authorization” and “exceed[ing] authorized access.” Case in point is the Ninth Circuit’s en banc decision in United States v. Nosal issued in April of this year. And last week, two trial courts issued decisions continuing that trend.
In Dana Limited, employees of the plaintiff copied company files and took them with them to their new jobs with a competing company. Wentworth-Douglass Hospital similarly involved a scenario where ex-employees of a hospital copied data from the hospital’s computers onto portable storage devices. In both cases, the courts decided there was no criminal liability under the CFAA because there was no evidence that the former employers were unauthorized to access the computer systems in the way that they did. How they used the information they obtained might have violated company policy, but the act of access itself was not unauthorized.
Wentworth-Douglass Hospital is noteworthy also because it involved an additional scenario that the court did find to be a violation of the CFAA — another ex-employee of the hospital used her wife’s password to access the hospital’s computers. Although the hospital had issued him his own password, apparently his wife’s account provided access to certain data to which he was not given access. The court granted judgment as a matter of law on the CFAA claim based on those facts.
Two technical comments in the decisions are worth noting. The court in Dana Limited addressed the argument that the ex-employees accessed computer files in an unauthorized manner because they deleted files while logged on, which the company argued amounted to unauthorized “altering” of information. (Note: the CFAA defines “exceeds authorized access” as using unauthorized access to a computer “to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”) The court rejected the argument because there was no proof that the ex-employees deleted original files. The company had backups of the deleted files and was able to function without difficulty despite the deletions. Whether any “altering” occurred was speculative.
The second comment of interest concerns the employer’s argument inWentworth-Douglass Hospital that a company policy stating that employees “are to access only information necessary for completing job responsibilities and to ensure the integrity of the information in their work areas” limited access and use. The court was unpersuaded by this argument, reasoning that an employer cannot convert a use policy into an access restriction simply by calling it one. In the court’s view, an access restriction limits the degree of access an employee has to certain systems and data, while a use restriction limits the varying uses to which such systems and information, once access, can be put to legitimate use. As an example, the court said that a policy prohibiting employees from accessing company data for the purpose of copying it to an external storage device is not an access restriction because its true purpose is to forbid employees from putting company information to personal use. In other words, the policy does not bar the employee from accessing the information; it just says he cannot copy it on to a personal device, presumably for uses unrelated to his job.
LegalTXT Lesson: This recent line of cases provides two quick takeaways for employers. First, be intentional in phrasing internal policies relating to use of company computers and other forms digital technology. Know the difference between an access restriction and a use restriction and be sure the wording of the policy clearly spells out the type of restriction intended. Second, a CFAA claim may not be the best avenue for getting relief. Other claims could be more suitable, such as breach of an employment contract, violation of a trade secrets act (if your state adopts one), and unfair competition.
