afternoon your honors dennis riordan appearing on behalf of appellant knows will we needed an unusual historical moment when both conservative and liberal judges on the supreme court have joined in bemoaning and i quote the deeper pathology in federal criminal law in the eighth case and when both republican and democratic legislators are preparing bills to attack the over criminalization of conduct that albeit being undesirable is better remed means other than the criminal law yet today this panel is called to decide upon whether two federal statutes the c f a and the computer fraud and abuse act in the economic espionage act should be interpreted in an unprecedented and radically expansive manner that would criminalize relatively minor misappropriations of information to accept the government's position on either the c f a or the e is bad law bad policy and would aggravate the plague of over criminalization that the courts and legislatures are now struggling to ameliorate i begin with the c f a which is this court sitting on bank and what i'll call knows all one held is an anti hacking statute directed at the circumstances circumvention of technological barriers not at the misuse of information obtained from the computer the bank pinion also ruled that the terms of the c f a which would include without authorisation must be read consistently throughout the act the same reading applies to the misdemeanor provisions as applied to the so that's the meaning that this court is going to find today the government's position on the c f a is a this should be a bright line rule all password sharing all consensual password sharing that leads to an entry into a computer without the consent of the computer owner or in violation of the computer owner's policy is quote without authorization and therefore is a dealing with here but it's a crime and we know two things one we know that that reading of the c f a was not contemplated by congress when it passed the c f a in one thousand nine hundred four because in one thousand nine hundred four there were no connected computers it wasn't like the world today where hundreds of millions of people have password accounts to their facebook accounts to their instagram accounts to their business their banking records their home computers there  computers so we know that this issue this criminalization of shit password sharing was not on the mind of congress in one thousand nine hundred four and we know today congress would never ever pass a statute with that definition of without authorization and i think the best evidence of that is the amicus brief of the software foundation coalition that's before this court and what they point is that technology as it often does has outstripped in this case the government's understanding of criminal law because cloud computing relates lies very very heavily on  shared password and password sharing of consensual sharing of passwords by the account holder that all of these devices intended to protect a person's privacy intended to protect their financial security depend on the account holder of an account of the bank giving its password to one of these applications in the cloud which then checks on the account the bank does not consent to it and it probably is in violation of their policy but  to to criminalize that password sharing is the government would do is to turn literally millions of honest citizens who are using these devices in the criminals make me i am direct your attention to the specifics on this case yes or no i appreciate that you've characterize it as password sharing on a broad scale in terms of how you frame the case but if you take yourself back to the braca case where we also considered what does without authorization mean in the brecon case the court said that without authorization and in that case it was an employer employee kind text or the employer has rescinded permission to access the computer and that if n is a computer anyway that's without authorization so my question is  is there any doubt that the company here revoke their rescinded mr and assaults permission and how do you square this situation with braca which we sa also one we were building on well your honor of fact this would be a terrible case to apply the government's who because of the facts of this case peter dunne the general counsel of k a five the party claiming a breach of the search or data base testified under oath that mr knowles will was permitted to s k f by employees to provide them with any and every piece of information in this search or pay if i search your database that your seven twenty seven twenty two at ten thirty three their understanding was that he could get anything he wanted out of the search or database by asking a k f an employee to give it to him now do the understanding with understand that it was related to his on going you're talking about now after he leaves the company and he got into and he's an independent contractor a related to the searches he was doing exactly your honor now of course dunn's point was he wasn't supposed to misuse that information but the point of no zal one is that the c f a is an anti hacking statute not a misuse statute we'll come to whether that was misuse and could be criminalized under under the trade secret statute but the fact of the matter is we're dealing with a case in which as far as k f i was concerned he could ask anybody to get anything he wanted out of search or and you know they had an understanding of what we be doing it and  his cohorts jacobson christian is a christian in jacobson who were working with him there authorization had been terminated correct yes they had left they had left the company and it was them who was going in and asking the assistant or her password so that they could access information right they they were asking her to share a password so that well in some in and one says that she goes in and then they actually download the information but the fact of the matter is that we all agree on this if mr knowles will had call ahead directly called  difficulty with is that basically everyone knows that they're going through the back door to get with the can't get through the front door they don't work there anymore they're authorizations been room so they get the assistant to give the password and she even admits she can't understand how to get some of the stuff herself so they go in with the password right well let my license why isn't that with that with authorization there's not disagreement  talking about whether it's a crime and we'll get to that but under the c f a and my point is that the court cannot find that is a federal crime without finding that that consensual password sharing is authorization so let me let me just ask you under the statute let's take this let's say we got some russian spy agent right he gets involved with a honeypot situation with an executive assistant in some company doesn't have to be careful i it some company and so he kind of sweet talks are into and he has no other ization to get into the company's computer but he kind of sweet talks or and she says ok well i give you my password and then he goes in crime or no crime crime it means that anybody has the authority to give anybody else their password and therefore under your construct you could never have a crime you know you can have a lots of crime but you can't have this crime you can't have this crime that's right indulge a hypothetical i know you try but hypotheticals count when we're talking about the abstract often they do it depends on how it went and i don't know that you were here for the beginning of our arguments but it could be that both sides are a little bit wrong about how they construe the statute that we don't so i appreciate now i want to hear the hypothetical but it all depends on how you construe authorization doesn't well and you what is being said and what this software coalition says is that you can't define shared password entries consentual password entries in the sharing context as as as defined it as without without authorization generally and in this case the reason it can't do it generally is that perhaps we need a statute that's in between those two views but congress hasn't written it and secondly if the court came up with that kind of formulation it would have to reverse this conviction because certainly the elements the new elements that we're framing to come up with a view between one view and the other we're not place for the jury and found to be elements of these o example construe circumventing a technological barrier as including consensual passwords i mean in knows a one we said we were focused on hacking we focus on technological barriers but obtaining a consensual password can it seems to me form the idea of circumventing a barrier here's why we've got two women employees at leviathan one of the major head hunting companies in the world the name well let's say carly and hilary right both have passwords that give them access to the database right on a particular day carli calls hillary and says you know i don't know my laptop i'm out of the office can you give me some information out of the database sure give me your password i'll get some information out of the database she gives of the past word in the point is that they share a password and it's absolutely prohibited by company policy and but it's they go ahead and do their work now the company is never going to complain about that until hillary or as judge kozinski pointed out in the on bank opinion hilary or carly complains about sex discrimination at which point the company is going to say you keep both committed in c f a violation because you shared your password and you better quit you have to write as if that should not be a c f a violation you have to define without authorization in such a way authorization because i'm working in the same group and hillary and carly have gotten together now in joint forces and they're working in the same group and they need the information she's on the road and that is sufficient authorization and knows a one we're not going to rely just what company policy or some handbook that's written and stuck that way so why why can't they look at the facts but you know you're dealing with situation on the facts here that the information that mr kno received was actually information that he was permitted to receive for one purpose as opposed to another but the way he got it i mean the the way he got it was to go through the back door and everybody know other offense but it's not a c f a violation because we're not concerned we're concerned with anti hacking here and not right you said what made you would you agree that a password is a form of a technological device consensual sharing because of phishing sunfish that they get their on their computer in other words they're duped into giving their traps consensually give their password out to a third party who has malicious attempt they do it they do voluntarily defrauding someone deceiving them is not a consensual use of the password that if we're dealing with the facts you know that's a hypothetical that's on another side of the line completely well what did you do to give the hypothetical you wanted or did y i just want to show you got to it because other to bank i'm not sure like you answered why braca doesn't apply here saying that if the employer is rescinded permission which we know they have or he has with respect  have the permission to receive this information so it predicating his criminal liability and there isn't a situation where he's getting information that k of ice that he could had i think is an issue that certainly wasn't dealt with below and would involve a formulation of the statute that would entitle him to be retried under the new definition or the defining of it comes up your honour's there are some really significant  trade secret issues here and i want to two minutes away from the end let me make one point before i turn to them which is this if if the court were to find that the definition there's a flaw in the definition under the c f a and therefore a flaw in the c f a prong of the count one conspiracy it has to reverse all five of the substantive counts without even getting to the trade secret count and the reason for that is substantive offenses could rest simply on his conviction count one conspiracy the government below argued to the jury that if you convict him of count one he's guilty of all substance of offenses trade secret and we specifically said to the court below you might want to so the government from itself because it's asking for a picket theory and if there's any defect in the count one conspiracy then all of the substantive counts have to go but let's turn to trade secrets now because there's very few five minutes because it will give the government an extra five absolutely so let me deal with the biggest problem because it's huge coming up before this court case call lou that's pending here as well the government's position is that on trade secrets is that it doesn't have to be secret as we've understood that the united states for ruckelshaus versus month the son of the supreme court said if you disclose information to a third party either without a confidentiality agreement or one that's expired it is not a trade secret their position is that they did not have to prove that these source lists had been either sold or distributed as part of what they call shootouts beauty pageants so forth all they had to prove is that the company continued to take reasonable measures to protect them so their view of that guts monsanto they are saying that under the e p a something does not have to be secret as it's traditionally understood in trade secret cases that is hasn't been sold hasn't been given away without a confidentiality agreement they never attempted to prove actual secrecy to the government to the jury they never argued the monsanto principle that could i just ask a point on that to understand where i read this and maybe i misunderstood i had understood that in these so called beauty contest situations that there was a confidentiality understanding was there testimony on that or notice didn't it there was these are the beauty pageants you're not you're don't have a client ok you're talking to somebody who has no contractual obligation you at all what there was testimony that said that that often there was confidentiality agreements there was no effort to prove that these lists were ever subject to a confidentiality agreement or to prove that they hadn't been handed out of shootouts or sold as part of a mapping obligation and the government's attempt to reconstruct evidence of actual can spirity here on appeal is actually quite misleading for two reasons one they say that never cited to the jury that marilyn brisky said that these lists had not been given out she said nothing of the sort the government said marilyn briskest description of searches is speculative because she hasn't done it for twenty five years we cite that in the brief they then ask are with these lists given out and she says i have no information on that question it's like asking her you know have the giants won the world series in the last ten years i don't follow baseball i have no information that is not evidence that it didn't happen that is the evidence that they rely on and secondly they say that we don't contest that when in fact as in our reply brief and on our new trial motion we hammered at them  opposition reply brief on the new trial motion for misstating the evidence because she said again she said they hadn't been released when she wouldn't have known she wasn't a search person for twenty five years and secondly she didn't say they hadn't really she no if the trade secret counts including the trade secret pronk of the conspiracy count are defective then you have to reverse on the c f a counts as well because the government's argument is that if you can convict of conspiracy all counts all five substantive counts have to go one really important point on this the government says that we say they didn't offer any evidence that any of these people knew what a trade secret was and the court instructed on the substance of counts they have to know what a trade secret is even on the conspiracy count where it said they have to have a firm belief the government says no no ignorance of the law is not a defense the truth of the matter is ignorance of the law is the defense when knowledge of some aspect of the law is an element of the fence as it wasn't lip or rather no one can and that that mens rea requirement was put in there to protect the unwitting you have to have knowledge as as the supreme court said in cheek if you don't know what the statute exists or the content of it or you misunderstand it you can't be found  knowing that you have a duty under it and it is simply disingenuous for the government to say when an element of the fence is knowledge of illegal status trade secret status that that there is no it has no obligation to prove that the defendant actually knew anything about the nature of trade secrets and one thing about this case is all people agreed that mr knows and didn't know anything about search he never used it he relied on other people to do it it has a pop up that says stuff in here is secret he never saw it in never used it so there's a very compelling argument but he did know he didn't have to know how to get it out but he did going to suggest that he didn't know that the kind of may it please the court johnny alex and for the united states since the court was just discussing the trade secrets issue i'll start with that i'd like to clarify one thing right out of the gate which is that the government has never taken the position that protect those trade secrets but also that those trade sourceless got had independent economic value from not being generally known to a reasonably ascertainable by the public we do not run away from that burden the only question before the court is whether the evidence in this case was sufficient to establish that element and whether the jury whether reasonable jury could conclude that this source list did in fact derive independent value from not so the statutory definition of trade secrets is that with respect to this problem have the definition that the end the information derives independent economic value actual or potential from not being generally known to i think in that hypothetical situation it would be difficult to prove that pronk that's not what we have in this case though in this case there was there was no evidence presented that any of the source lists that issue in counts five or six were disclosed to anybody other a compilation of information some of which is that some public and some private eyes as well what portion of the source solicitors who in this case came from purely nonpublic sources your honor it's not entirely clear there are some of the information certainly is available publicly available other information on the source lists such as cell phones the witnesses at trial testified that that was generally not information cell phone numbers that they could obtain through public sources but the question so we have cell phones done to determine who would be potential candidates for a particular type of position in a particular type of industry so if so and these industries can be fairly narrowly focused and the positions can also be fairly narrow so for example who would be a good chief financial officer in medical device field and there is there was there was no testimony about there being a publicly available source from which you could get a compilation of all of the potential candidates to fill that type of job so even though the information was drawn from some of it from public sources the way it was come by and by korn ferry the victim in this case gave it independent economic value the statement you made earlier though does conflict with what mr reardon suggested to us you said that there's no evidence that these sourcing documents had been disclosed outside the company yes disclosure of sourceless that instead it was other types of information that also potentially came from search or but what matters in this case is not you know what fair is general practices were with respect to sourceless to other source less what matters is what the evidence was with respect to the source listed issue in this case and there was no evidence that the source left issue in this case were ever disclosed during any of those pitch meetings and i'd like to point to three pieces of evidence that the jury could rely on to conclude that these specific source lists were in fact even they that they were not generally known to the public the first is marlene brisky is testimony and mr reardon says that marlene as not capable of opining on this issue but miley brisky was one of the two people who headed up the investigation into the intrusion and corn fairies computers and so she although she perhaps was not the best person to talk about what happened as a general matter during korn ferry sessions she was uniquely qualified to testify about what had happened with the sourceless that issue in this case because her investigation was going into what had happened with these particular sourceless and so there  so the fact that she said that as far as she knew these source lists had never been made public that's certainly evidence that the jury could have credited second and critically miss co conspirator becky christian testified that she went into the search your database to get these source lists because as far as she knew no they were not available from any other source that's an excerpt of record three seventy nine two three eighty and miss christian was a former partner at korn ferry she was experienced in the search and in the search field if she was unaware with her special or her expertise in the area if she was not aware that these source lists were available anywhere else i think the jury could conclude that they were not in fact generally known b recently ascertainable through proper means by the general public and then finally just the evidence about how much work went into the creation of these source lists the measures that corn ferry took to protect them all of that again confirms these source lists were not the type that they were not something that you could google they were something that required a great deal of work to put together and it's basically the centerpiece of future you would begin your search by pulling potentially relevant source lists they would go to when the role of what was publicly accessible information become a trade secret just because someone with compiles if it's compiled into a unique combination into a combination that is not readily ascertainable and that has independent economic value in that combination then then yes your honor and public information compiled and in a way that is not obvious can constitute a threat here that it was not just public information there was stuff added by the korn ferry staff well that information so as to the research department i mean the research department would supplement sourceless by adding additional names in addition the database also contained with respect to you know people that korn ferry had spoken to that would contain that information that was not part of what was downloaded and also pull the time in terms of customer lists and there's  the way we put the customer list together even though the information is yes and you know i don't think so this is this is really i mean and again this is a sufficiency question is whether the evidence was sufficient to allow the jury to determine this and i think even just based on alone on becky christian's testimony and her testimony about the conversations she had with mr knows all about this where they were discussing what they needed to complete those searches that were the focus of the april twelfth downloads and mr knows will begin talking to her about these are the specific source lists i need he did not suggest that she could get the information from him by another means and this christian testified that as far as she knew there was no other way to get this combination of the count counts five and six we were required to to prove that and we were not required to prove that for the conspiracy count ok ok let's talk last words what actually do there is that there is one other one other issue that i just wanted to touch on  court would presumably reverse those two counts counts five and six but it would not there would not be a basis for reversing the other counts because there was still sufficient evidence with respect to the other counts what about the if you ha government's last estimate in this case was different than the estimate that the court adopted and our last estimate i think was it was over four hundred thousand dollars and i think the company estimated that the sourceless were actually worth nine hundred thousand dollars in the district  not adopt that but i did just want to make that point we can talk more about restitution once we get through because when we get through the ten thirty issues so i'd also like to clarify something right out of the gate on the without authorization issue which is that the government is not asking the court to adopt a bright line rule that sharing a password constitutes per se access without authorization under the  and you use the computer anyway you have acted without authorization under the statute enforcing that rule will not have ramifications outside of the employment context it will not  authorization depends on the actions taken by the employer so first of all we have to assume that the employer had taken action to prohibit that to revoke the access and also to clarify that access couldn't be shared with others outside the company we have that you're assuming that that satisfied then yes i think under this statute and under braca if a current employee without the authorization of the employer shares her logon credentials to her employer's computers with an outsider that would be without authorization access but without authorization alone is not enough to make something a crime under section ten thirty you still need to satisfy the other requirements of the statute  and section to see which is the one that the court focused on in the on bank opinion in this case you have to have your without authorization access be intentional so that means that you have to know that you are not authorized tax s that computer that means that you have to know that the person who has his share their access with you that that does not constitute proper on authorization this is in the statute that's and you're talking about section  c and so just to read the relevant language of that provision it's whoever intentionally access is a computer without authorization or exceeds authorized access and thereby obtains information from any protected computer so that mens rea requirement ensures that there's no danger that someone who is using someone else's password believing that that person why didn't you charge him under that seem even easier than the one you did charge one he committed the offense under under the intent to defraud provision that's what that's yeah well i mean but could you would you have equally charged him under was charged with any even if we have to read consistently we he was charged with this thing about intent to defraud does intent to defraud do nothing because you could just go on your age and you would have to worry information but mr know saul because he was an independent contractor and he had someone that he was trying to place or find placements for he actually had authorization he just  didn't do it directly he did it indirectly what is your response to that so he had no authorization to access corn faeries computers and that's clear from the record and he in fact asked for permission to continue having access to his e mail account and was denied that request what he could do under the terms of his independent contractor evolving agreement with korn ferry is that the first pacific searches that he was still working on he could ask certain  employees who were assigned to those searches as well to get him information that was relevant to those searches but having the authority to obtain information does not give you a thirty to access the computers on which that information may be stored for people it was not something she knew how to do so if you'd asked for this information specifically you could have asked for i don't think you could have your honor because his authorization to obtain information was limited to information that was pardon but yes you could ask but the company would not have given him probate and what was her testimony specifically on that point about whether he had asked if you'd asked where the company would have given him from this i can't remember if there was have gotten the information anyway and there was testimony of now there was testimony that he could get he could get information that was relevant to his current searches and i apologize for not having a perfect recall of what the testimony was about the specific source list but i believe the well your honor it wouldn't be a crime under section ten thirty because he wouldn't be accessing a computer without authorization so the key here is that his coconspirators and that's another thing also just i'd like to point out i wasn't the one who actually did you know he wasn't even the person who used the password it was his coconspirators who had no no authorization at all so what do you do with the larger issue i mean he fits arguably in the breck a situation but the statute is the statute so what do you do with the broader issue that is raised in amicus and other parts of the brief that you would in effect criminalize password sharing per se facebook giving your husband or wife or spouse access to the bank account that sort of thing and we're not taking the position that what's what the ramifications of the statute and how we interpret it so i think i think the question of what happened outside the employment context is a fact specific one and this court's opinion and braca is clear about what happens in the employment context that it's the actions of the employer that determines whether someone has authorisation but outside the employment context it's less clear what bracco would require whether back to means that only the computer owner has i mean so i see that i'm over time i hope i can still into the courts question so what baucus says is that brecker refers to whether you have a you have gotten permission granted by an authority and so i think the question in these cases is whether  fact based on the facts of these specific hypotheticals whether the person who shares their password is a person constitutes an authority with the power to do so and i think that inquiry is likely to be fact specific i don't want to rule that this court should adopt that would apply to the field because i suspect that this is going to be a more nuanced thankfully the court doesn't have to grapple with that problem here because this case is on all fours with braca is is the authority you have a global corporation what was the testimony on who was the person who gave the authority so that there was a korn ferry had kind of an i t policy that explained how everything worked with passwords that included the restrictions on password sharing but who had the authority i think the jury could infer from the existence of this policy and the fact that it was issued by the i t department that the i t department perhaps question because if we're going without authority should we be concerned with who gave the who have the power to give authority if again we're writing on a broader camera somewhere on this case yes i think that the question of whether someone is a  person with the authority to grant permission i think that is a significant question but there's no doubt that there is always someone at current ferry who determined who was allowed to have passwords to access the system and someone  should not have access i know that i'm well over time and there was one one small issue i wanted to address that i haven't had time to address but i understand if the court you can address with mr are going to get equal time yes  they may not be in the excerpts of record if you look at exhibit c d i j k they were all sorts lists that he had asked for and were readily given to him no nobody screened that there's no testimony to support the notion that there would said eighty eight eighty five they were disclosed during pitches they were sold during mapping engagements the government is quite correct there is no specific information that these source lis were sold or mapped out in the record the government also has to concede there is no information in the record that these three sourceless were not sold or mapped out marlene brisky can't say that the government said she speculate she doesn't know anything about searches and search lists that we cite that in the brief but here's the ridiculousness there a line on the christianson saying well i didn't know where else i could get them well if the if i sold them to best buy if it disclosed them to general lecter eck of course she would know that she could call up and get them she couldn't call up and they wouldn't give it to them but that doesn't mean it didn't happen they offered no evidence nor did they argue that these things were actually secret and make one point which is just it wasn't the government has welcomed them to respond becky christiansen said that the reason that david knows will use the dame david nelson sometimes in doing searches was because he was trying to hide the fact that all and all cited to the pages there is only one reason he would use the name date i'm sorry david nelson and that's because he's guilty of the conspiracy there is no other reasonable explanation why he would use the name david nelson well that was a completely reasonable explanation ferrie had yoked him to a blatantly illegal non compete agreement under california law and of course he would want to get in litigation about it he wanted to avoid it but he was entitled to not comply with that and the court refused to allow us to put that evidence in while allowing a government witness to testify that he was dishonest lee breaching his contractual obligations it either we said either keep the one compete out entirely no reference to it or let us prove the invalid to it and his right under the law to not respect it and the court neither of those alternatives and it was enormously useful to the government to label him guilty of the can spira see simply because of things related be scheduled but i'm sure you can still make the reception