Cloud Computing Protections for Employers in New Bipartisan Bill?

by Unfair Competition & Trade Secrets Counsel on October 22, 2012

By Harry Jones

Who says D.C. is completely gridlocked?

In September, Senators Amy Klobuchar (D–Minn.) and John Hoeven (R–N.D.) introduced the Cloud Computing Act of 2012 (S.3569) as a proposed amendment to the Computer Fraud and Abuse Act (CFAA). 

The CFAA is a hybrid criminal-civil law, passed originally as a purely anti-hacker criminal statute, which prohibits wrongful access to computers. It has been used with varying success by employers to deal with internal data breaches and misappropriation by employees.

This bipartisan tweak to the CFAA would specify that each instance of “unauthorized access” (the lynchpin of liability under the CFAA) of a cloud computing account is a separate offense. Loss is presumed to be the greater of the value of the loss of use or information, or a minimum of $500 multiplied by the number of cloud computing accounts accessed. 

Continue Reading

Minnesota Federal Court Restricts Employer Use of Computer Fraud and Abuse Act

by Unfair Competition & Trade Secrets Counsel on August 20, 2012

By Harry Jones

Increasingly, employers who suffer data breaches from employees are using the Computer Fraud and Abuse Act (CFAA) to trigger federal question jurisdiction and have the dispute heard in federal court. As a hybrid criminal-civil statute, the CFAA forbirds knowing and fraudulent access of computers without “authorization” or “exceeding authorized access” to further fraud and “obtain anything of value.” 

The federal courts of appeal have diverged in how to interpret the two “authorization” components (lacking or exceeding authorization) of the CFAA in civil suits. The Seventh Circuit, in International Airport Centers LLC v. Citrin, interpreted the CFAA broadly as a federal misappropriation statute, where disloyal abuse of prior permission to use employer computers robs the employee of “authorization.” The narrower and more popular view is the Ninth Circuit’s interpretation in U.S. v. Nosal, where the court concluded the CFAA offense of “exceeding authorized access” does not encompass the insider employee who merely violates computer use restrictions.” This interpretation was recently adopted by the Fourth Circuit. Adherents to Nosal rely on the rule of lenity, which strictly construes criminal laws in favor of defendants.

Continue Reading

Fourth Circuit Joins Courts Limiting Use of Computer Fraud and Abuse Act to Prosecute Disloyal Employee

by Unfair Competition & Trade Secrets Counsel on August 02, 2012

By Matthew J. Hank

Although the Computer Fraud and Abuse Act (CFAA) is primarily a criminal statute designed to combat hacking, it allows an employer to bring a civil action against an employee who accesses the employer’s computers “without authorization” or in a manner that “exceeds authorized access.” Employers often bring claims under the CFAA in the “disloyal employee scenario” when an employee (typically, an employee who has accepted employment with a competitor) downloads or emails to himself confidential information for the benefit of a competitor.

In WEC Carolina Energy Solutions LLC v. Miller, the Fourth Circuit Court of Appeals confronted such a situation. According to the complaint, shortly before the former employee resigned from his position as project director for WEC, he downloaded to his personal computer and emailed to himself WEC’s “proprietary information.” The former employee then used WEC’s information to make a presentation to a potential WEC customer on behalf of WEC’s competitor. Although WEC had authorized the former employee’s access to the company’s intranet and computer servers, WEC’s policies prohibited using that information without authorization or downloading it to a personal computer. After the customer awarded two projects to the competitor (allegedly as a result of the former employee’s actions), WEC sued the former employee under the CFAA, claiming that he violated the Act because, under WEC’s policies, he was not permitted to download WEC’s proprietary information to a personal computer. By doing so, WEC argued, the former employee breached his fiduciary duties to WEC and through that breach he either (1) lost all authorization to access the confidential information; or (2) exceeded his authorization.

Continue Reading

Washington Court Clarifies Pleading Requirements for CFAA Claims

by Unfair Competition & Trade Secrets Counsel on July 09, 2012

By John Lassetter 

Trade secret disputes increasingly center on an ex-employee copying trade secret information from the former employer’s computer system and using that information to benefit his or her new employer. Civil claims under the federal Computer Fraud and Abuse Act (CFAA) can be a useful tool for employers seeking to enjoin ex-employees and competitors from benefiting from unlawfully obtained trade secret information and to recoup losses. In order to assert a civil claim under the CFAA, a plaintiff must plead losses aggregating at least $5,000 over a one-year period. The decision in Del Vecchio v. Amazon.com, Inc., No. C11-cv-00366-RSL, from the U.S. District Court for the Western District of Washington, indicates that employers asserting CFAA claims must plead facts that clearly reflect actual losses of $5,000 and facts connecting those losses to an ex-employee’s unlawful theft of trade secrets in order to survive a motion to dismiss. Employers should carefully detail the calculation of actual losses and facts reflecting the connection between those losses and the theft of the trade secrets in dispute to avoid dismissal of a CFAA claim. 

In Del Vecchio, the court granted the defendant company’s motion to dismiss the plaintiffs’ CFAA  claim. The plaintiffs were individuals who claimed that the company had unlawfully transferred cookies onto their computers. They alleged that the company had placed internet cookies on their computers against their wishes by “‘exploiting’ a known frailty in the cookie-filtering function of Microsoft’s Internet Explorer browser software” in violation of the CFAA. Citing the U.S. Supreme Court’s Iqbal/Twombly precedent requiring that a complaint “state a claim to relief plausible on its face,” the court in Vecchio dismissed the plaintiffs’ CFAA claim, finding that the plaintiffs failed to allege facts sufficient to demonstrate that a $5,000 loss had occurred.   

Continue Reading

Michigan Federal Court Limits Use of Computer Fraud and Abuse Act to Prosecute Disloyal Employee

by Unfair Competition & Trade Secrets Counsel on June 12, 2012

By Matthew J. Hank

The Computer Fraud and Abuse Act (CFAA) prohibits (among other things) an employee from accessing an employer’s computers “without authorization” or in a manner that “exceeds authorized access.” Employers frequently invoke the CFAA when a disloyal employee downloads or emails to himself confidential information. In that scenario, employers file CFAA claims, often with claims for misappropriation of trade secrets, because the CFAA provides a basis for federal question jurisdiction, triggers the possibility of enhanced sanctions (including criminal penalties), and arguably provides a means of protecting confidential information that does not rise to the level of a “trade secret.” 

A common question that such use of the CFAA presents is whether an employee provided with unlimited access to the employer’s computer system, but who uses that access to misappropriate the employer’s data, has accessed the employer’s computer “without authorization” or in a manner that “exceed[ed] authorized access.” Several federal courts of appeals have answered that question affirmatively, reasoning that an employee acts “without authorization” or in a manner that “exceeds authorized access” whenever he uses the employer’s computer to misappropriate the employer’s confidential information or facilitate another breach of the duty of loyalty.

Continue Reading

Ninth Circuit Rules the CFAA Requires Proof of Hacking

by Unfair Competition & Trade Secrets Counsel on April 19, 2012

Locked Keyboard.jpgBy Lena K. Sims

Last week, the Ninth Circuit published its long awaited en banc decision, authored by Chief Judge Alex Kozinski, in United States v. Nosal [pdf].  The 9-2 reversal of the 3-judge appellate decision holds that the Computer Fraud and Abuse Act's phrase “exceeds authorized access” is limited to violations of restrictions on physical access to information and does not extend to violations of restrictions on the use of information.  Prosecution under the CFAA thus requires proof of “hacking” and employers will not be able to bring a claim for violation of the CFAA based on a violation of a computer use policy.    

The decision calls out for United States Supreme Court review.  It departs from the Fifth, Seventh and Eleventh Circuit decisions concerning interpretation of the same statutory language and criticizes those courts for taking a short-sighted approach that focused on the facts of the cases before them while criminalizing acts that are wide-spread, commonplace and trivial.  

Unlike those cases, the Nosal decision makes only a quick introductory recitation of the facts of the case.  Those following the case will recall that Nosal persuaded his former colleagues still working for his former employer to help him start a competing business by accessing information from the company’s database and then transferring that information to Nosal.  The employees had access to the database, but use of the information was restricted by policy:  “This product is intended to be used by Korn/Ferry employees for work on Korn/Ferry business only.”  Nosal was criminally prosecuted for aiding and abetting the employees in “exceeding their authorized access” with intent to defraud the employer.       

Continue Reading

Minnesota Court Narrowly Interprets the Computer Fraud and Abuse Act

by Unfair Competition & Trade Secrets Counsel on March 20, 2012

By Kerry L. Middleton

Recently, a Minnesota federal district court construed the federal Computer Fraud and Abuse Act narrowly and dismissed an employer’s CFAA claim against three former high-level employees.   In Walsh Bishop Associates, Inc. v. O’Brien, et al. [pdf], the court held that civil liability under the CFAA does not extend to an employee’s alleged later misuse of information that the employee was authorized to access.  Thus, the court concluded that civil liability under the statute turns on whether the former employees were authorized to access the data at issue, not on whether the former employees allegedly misused the data after accessing it. 

The CFAA makes it unlawful for any person to obtain information from a computer by intentionally accessing the computer without authorization or by exceeding authorized access.  Employers frequently include a CFAA claim in suits against former employees for trade secret misappropriation.    

In Walsh Bishop, the defendants were former executive-level employees.  Among other things, the employer alleged that the defendants accessed documents the employer claimed were confidential and took those documents with them after leaving the employer’s employ.    

Continue Reading

Define Your Own Legal Protection with Computer Access and Non-Disclosure Policies

by Unfair Competition & Trade Secrets Counsel on September 16, 2011

gavel and laptop.JPGBy Eric C. Bellafronto and Michael E. Harvey

Employers often prohibit employees from using work computers for personal, non-work related purposes, but let’s say an employee accesses a work computer to plan a personal vacation to Hawaii or shop for clothes for a child.  Has the employee committed a federal crime?  The question of whether it is a federal crime for an employee to access a company computer for purposes outside the scope of a company’s computer policy was posed by the Ninth Circuit during a recent oral argument regarding the reach of the Computer Fraud and Abuse Act (“CFAA”), in the case of En Pointe Technologies, Inc. v. Sarcom, Inc., et al.

In January 2010, En Pointe filed a federal lawsuit against two former employees seeking $1,000,000 in damages.  En Pointe alleged that its former employees violated the CFAA by taking confidential information from company computers.  The CFAA is a federal law that prohibits certain actions that range from obtaining information from a computer without authorization, to damaging a computer through unauthorized access.  En Pointe alleged that its former employees unlawfully exceeded their authorization to access its computers and fraudulently obtained valuable company information.  The lower court dismissed the claims because the former employees were authorized to access En Pointe’s computers.  Therefore, the court reasoned that no violation of CFAA could have occurred – notwithstanding other laws protecting employer information. 

On appeal, En Pointe urged a three-judge panel to reinstate its CFAA claims based on the Ninth Circuit’s prior ruling in United States v. Nosal.  In that case, the court held that a CFAA claim may stand against former employees who obtain information from their employer’s computers in violation of a computer access policy. Highlighting the importance of the employer’s policy, the court reasoned that an employee may violate the CFAA by exceeding the employer’s restrictions on the employee’s use of the computer itself or the information contained in that computer.

Continue Reading

"It Is As Simple As That": Your Own Policy Determines Whether You Have A CFAA Claim

by Unfair Competition & Trade Secrets Counsel on June 01, 2011

By Lena K. Sims

Locked Keyboard.jpgIt is a common scenario that hopefully has not happened to you (yet). Your employees leave and start a competing business.  You soon learn that one or more of them accessed your computer system in the days prior to departure, and they forwarded your proprietary information to their personal email accounts.    

Setting aside other avenues of recourse, have they violated the federal government’s Computer Fraud and Abuse Act (CFAA)?  According to United States v. Nosal [pdf], the answer depends on whether you have a policy by which you defined the permitted access to your computers and computer systems.  

Nosal is welcome news for employers with operations in the states governed by the Ninth Circuit (including California, Oregon, Nevada, Washington, Alaska, Hawaii, Idaho, Montana).  The Ninth Circuit previously held in LVRC Holdings LLC v. Brekka that an employer without a policy prohibiting the employee from emailing company documents to his personal email account had no claim under the CFAA against a former employee who did just that. To employers it may seem self-evident that taking company documents is theft, but the court took a different view and dismissed the claim.  It ruled that without a policy defining an employee’s authorized access, the employee “had no way to know whether – or when – his access would have become unauthorized.” 

Continue Reading