The criminal statutory provisions commonly referred to as the Computer Fraud and Abuse Act (“CFAA”) were first enacted in 1984[i] as a means to prosecute computer crimes related to hacking.[ii] However, the scope of prohibited actions in the CFAA extends well beyond traditional hacking. More generally, the CFAA criminalizes conduct that involves accessing computers without authorization or in excess of authorization, and then the subsequent use of such access to obtain information that causes loss or damage, or defrauds another or the government.[iii] The CFAA also provides a private cause of action for persons who suffer damage or loss as a result of such computer access, and it provides for damages and equitable relief.[iv]

This survey focuses on the most litigated provisions of the CFAA in cases decided between June 1, 2009 and June 1, 2010.

Many of the cases decided under the CFAA in the last year involved civil causes of action between employers and their erstwhile employees. The fact patterns underlying these civil claims are often quite similar: an employee obtains confidential information from the employer’s computer system while employed, and then uses the information to the employer’s detriment.[v] Upon discovery, the employer asserts a cause of action under the CFAA (and often other claims) against the former employee, alleging that the employee intentionally accessed a computer without authorization or in excess of authorized access, and obtained and used information accessed from the computer.[vi]

However, courts have struggled with the element of “authorization,” which has led to a circuit split. The CFAA defines “exceeds authorized access” to mean “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter.”[vii] However, the CFAA does not define “without authorization,” and courts differ on the meaning and scope of “without authorization,” as well as whether use (or misuse) of information even implicates the CFAA.[viii] Two federal circuits weighed in on these controversial issues last year.

In February 2010, in United States v. John, a criminal case, the U.S. Court of Appeals for the Fifth Circuit resolved an issue related to the statutory interpretation of “exceeds authorized access.”[ix] The court examined whether information obtained by permitted access to a computer system, but used beyond limits placed on the use of such information, falls within the definition of “exceeds authorized access” under the CFAA.[x] In this case, an employee of a financial institution had access to customer account information and passed it along to others, who then incurred fraudulent charges on those customers’ accounts.[xi] The employee was convicted because she exceeded her “authorized access” to a computer system and obtained information from a financial record of a financial institution.[xii] The court held that “the concept of ‘exceeds authorized access’ may include exceeding the purposes for which access is ‘authorized.’”[xiii] Affirming the conviction,[xiv] the court held that the employee’s access to her computer was limited and that she exceeded her authorization when she accessed information for use in a fraudulent scheme, which she knew or should have known was unauthorized.[xv]

In LVRC Holdings LLC v. Brekka, an employee e-mailed confidential documents to his home computer while he was still employed, intending to use the information to compete with the employer after termination.[xvi] The employer brought a CFAA action against the employee, asserting that the employee exceeded his “authorized access” or was “without authorization” at the moment the employee decided to use the computer contrary to the employer’s interest.[xvii] The U.S. Court of Appeals for the Ninth Circuit rejected that argument,[xviii] and held that “without authorization” means “without permission,”[xix] reasoning that to expand the meaning of “without authorization” beyond that would give no effect to “exceeds authorized access” in the CFAA.[xx] Applying its new rule, the court held that the employee had authorization (i.e., permission) to access the computer because his job required him to use the computer.[xxi] The court noted that had the employee accessed the computer after he was terminated from employment, he would have undoubtedly accessed a computer “without authorization.”[xxii]

This decision is in direct contrast to International Airport Centers, L.L.C. v. Citrin, a decision by the U.S. Court of Appeals for the Seventh Circuit in 2006.[xxiii] In that case, the Seventh Circuit held that an employee’s authorization to access an employer’s computers ended at the time the employee breached his duty of loyalty to the employer.[xxiv] The court found that such a breach occurred when the employee decided to erase from his laptop all company data and other incriminating information showing that he started a competing business in violation of his employment agreement.[xxv] Using agency principles, the court held that the employee’s breach of his duty of loyalty terminated his authorization to access the laptop.[xxvi]

There is a similar split among district courts.[xxvii] Courts in Alabama, Florida, Georgia, and Tennessee are in agreement with the Ninth Circuit, holding that “without authorization” means that initial access to the computer was not permitted.[xxviii] Those same courts in Alabama and Tennessee, along with courts in Pennsylvania and Texas, addressed the issue of information misuse, holding that “without authorization” or “exceeds authorized access” does not extend to circumstances involving improper use of information that one was authorized to access.[xxix] All of these courts either dismissed the CFAA claims or granted summary judgment to the defendants, as applicable, because the defendants in each case clearly had permission to access the obtained information.[xxx]

However, two district courts appear to have aligned themselves with the Seventh Circuit in holding that improper use of information was sufficient to allege “without authorization” or “exceeding authorized access.”[xxxi] Each court denied the employee-defendant’s motion to dismiss the employer-plaintiff’s CFAA claim, holding that the employers sufficiently alleged that the employees acted “without authorization” or exceeded their “authorized access” when the employees obtained information that they were authorized to access but later misused.[xxxii]

Section 1030(g) of the CFAA provides a civil remedy for any person who suffers “damage or loss by reason of a violation” of the CFAA.[xxxiii] The CFAA defines the term “loss” to mean “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.”[xxxiv] The CFAA cases in this survey show that district courts have strictly interpreted the meaning of “loss,” refusing to expand the definition beyond the plain language of the statute. For example, some courts held that economic costs and lost revenue unrelated to computer systems did not fall within the CFAA’s definition because such losses were not incurred due to an “interruption of service.”[xxxv] Others held that the cost of examining a defendant’s improper actions and examining other parties’ computers were not losses that related to the investigation or repair of a computer system.[xxxvi]

Additionally, the term “damage” under the CFAA means “any impairment to the integrity or availability of data, a program, a system, or information.”[xxxvii] In the last year, courts treated the definition of “damage” similar to that of “loss,” refusing to expand the definition beyond the plain language of the statute. For example, courts held that merely copying information from a computer system or utilizing a computer’s resources do not fall within the CFAA’s definition of “damage.”[xxxviii]

Last year’s criminal cases brought two constitutional challenges to the CFAA under the void-for-vagueness doctrine. In United States v. Drew,[xxxix] the defendant used a fictitious account on the social networking site Myspace.com to befriend and subsequently reject a thirteen-year-old girl who later committed suicide.[xl] The defendant was convicted of misdemeanor violations of the CFAA.[xli] The court found that the defendant’s creation and use of a fictitious MySpace account to impersonate another and commit a tort was in direct violation of the MySpace terms of service.[xlii] The court held that an intentional breach of the MySpace terms of service constituted access to the MySpace computers “without authorization” or in excess of the defendant’s authorization to Myspace.com under the CFAA because a website’s terms of service defines the scope of authorized access to the website.[xliii] However, the court concluded that prosecution and conviction for a CFAA misdemeanor violation based upon the conscious violation of a website’s terms of service was void for vagueness.[xliv] The court held that deficiencies in actual notice and an absence of minimal guidelines to govern law enforcement meant that individuals were not reasonably on notice that a breach of the terms of service could constitute a criminal violation of the CFAA.[xlv] As a result, the court granted the defendant’s motion for judgment of acquittal for the misdemeanor.[xlvi]

In United States v. Powers,[xlvii] a void-for-vagueness challenge arose out of a criminal indictment alleging that the defendant accessed a woman’s e-mail account to which he had previously been given the password.[xlviii]  The defendant then forwarded previously sent, partially nude photos of the woman to others.[xlix] The defendant challenged the indictment, asserting that the section prohibiting accessing a computer and obtaining information from the computer “without authorization” or by “exceed[ing] authorized access” is unconstitutionally vague  because it does not provide reasonable notice of what conduct is prohibited.[l] The court concluded that the CFAA defines the statutory terms with sufficient particularity to provide adequate notice of prohibited conduct under the statute,[li] and held that the defendant exceeded his “authorized access” when he obtained compromising images from past e-mail messages and sent those images to others.[lii]

Regardless of the outcome of the hotly contested issues reported in this survey, business lawyers should consider reexamining company policies that define acceptable uses of business computer systems and company information, and, when necessary, consider if reliance on the CFAA as a cause of action against rogue employees is justified. Continued controversy over the parameters of the CFAA can be expected to continue until there is more uniformity and consistency in its interpretation and application.

---