Every employer has to contend with employee turnover, including key personnel leaving for a competitor. The loss or compromise of confidential data is a significant risk in such a scenario. One way for an employer to protect itself is by resorting to the Computer Fraud and Abuse Act (CFAA), a civil remedy that allows a private party to seek compensation for losses caused by the unauthorized access to data on a protected computer by a current or former employee.
There is a split in the federal circuits regarding the interpretation of "unauthorized access" under the CFAA. We will explore this split, and also provide an analytical framework for employers to use when assessing the prospects of pursuing a CFAA claim.
Statutory Background
The CFAA is a statutory provision that was part of the Comprehensive Crime Control Act of 1984 passed by Congress. Pub. L. 98-473, S. 1762, 98 Stat. 1976, enacted October 12, 1984). It contains a civil remedy provision whereby a private party may seek compensatory damages and equitable relief upon satisfying elements that require pleading proof of recoverable damage or loss that occurred within one year of the date of the complained of loss or discovery of the damage. 18 U.S.C. 1030(g). Id. To plead a claim under the CFAA, one must sufficiently allege that a defendant: (1) intentionally accessed a computer; (2) lacked authority to access the computer or exceeded granted authority to access the computer; (3) obtained data from the computer; and (4) caused a loss of $5,000 or more during a one year span. Clarity Services, Inc. v. Barney, 698 F.Supp.2d 1309, 1313 (M.D. Fla. 2010); Continental Group, Inc. v. K.W. Property Management, L.L.C., 622 F.Supp.2d 1357, 1369-71 (S.D. Fla. 2009); Ill. Corp. v. A-1 Tool Corp., 714 F.Supp.2d 863, 876 (N.D. Ill. 2010). Restated, employers must satisfy the cited elements of the CFAA when pleading their story about how a defendant improperly accessed a protected computer with the intent to defraud. Id.
The CFAA covers a "protected computer," and speaking beyond the servers of the United States government or a financial institution, the CFAA defines a "protected computer" as meaning a computer "which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States [.]" 18 U.S.C. 1030(e)(2)(B). Most employers pursuing a CFAA claim against a current or former employee—and against the employee's new employer or business venture—will find coverage for their computers under the general provision on protected computers.
Split in the Circuits Regarding "Access without Authorization"
Litigation involving the CFAA often revolves around the absence of any definitions in the CFAA of the terms "access" or "without authorization." The CFAA defines "exceeds authorized access," as meaning "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter." 18 U.S.C. 1030(e)(6). The lack of a statutory definition of what qualifies as "access," or accessing a computer "without authorization," however, has created a split between the Circuits of the U.S. Court of Appeals over what actions by an employee qualify as exceeding authorized access under the CFAA.
The First, Fifth, Seventh, and Eleventh Circuits of the U.S. Court of Appeals broadly read the CFAA as covering employees who misuse data obtained from an employer-provided computer—even when the employee was authorized to obtain data from the employer's computer. Some of these courts even use common-law agency and duty of loyalty principles when interpreting the CFAA. As a general rule, these courts focus on the employer's computer use policies and the intended use of the data by the employee as significant factors when determining...
