F OR P UBLICATION



### UNIT E D ST AT E S CO URT O F APPE AL S FO R T H E NINT H CIRCUIT

U N I T E D S T A T E S O F A M E R I C A , Plaintiff-Appellee

,

v.

D A V I D N O S A L , D efendant-Appellant. Nos. 14-10037 14-10275

D.C. No. 3:08-cr-00237-EMC-1

OPI NI ON

A ppeal from the United States District Court for the Northern District of California Edward M. Chen, District J u dg e, Presiding

Arg ued and Submitted October 20, 2015 San F rancisco, California

F iled J uly 5, 2016

B efore: Sidney

R. Thomas, Chief J udg e and Stephen Reinhardt and M. Marg aret McKeown, Circuit Judg es.

Opinion by

J udg e McKeown; Dissent by

J udg e ReinhardtU N I T E D S T A T E S V

. N O S A L 2

SUMMARY *

Crim inal Law

The panel affirmed convictions for knowing ly and w i t h intent to defraud accessing a pro tected computer “without authoriz ation,” in v iolation of the Computer F raud and Abuse Act (CF AA), and f

or trade secret theft, in violation of the Economic Espionag e Act (EEA); and v acated in part a nd remanded the restitution order for r ec o n sideration of the reasonableness of the attorney s’ fees award.

The panel held t h a t the d e f endant, a former employ ee whose computer access c re d e n tials were revoked, acted “without authoriz ation” in violation of the CF AA when he o r his former emp l o y ee co-conspirators used the log in credentials of a current employ ee to g ain access to computer data owned by the former employ er and to circumve n t t he revocation of access. The panel rejected the defendant’s contentions r eg arding jury instructions and sufficiency of the evidence in c onnection with the CF A A c ounts, as well as his sufficiency -of-the-evidence, instructional, a nd evidentiary challeng es to his EEA convictions for trade secret theft.

The panel determined that the restitution order was within the bounds of the statutory framework set forth in the Mandatory Victim Restitution Act, rejecting the defendant’s contention that the a ward is invalid b ecause it ex ceeds the actual loss that the district cou r t d etermined for purposes o f the Sentencing Guidelines. Reviewing for abuse of discretion

* T h is su m m ary co n stitu

tes n o part o f th e o p in io n o f th e co u rt. It h as b een p rep ared b y

co u rt staf

f f o r th e co n v en i en ce o f

th e read er.U N I T E D S T A T E S V

. N O S A L 3

t h e district court’s decision to award nearly $1 million, t h e panel remand e d f

o r the district court to reconsider the reasonableness of the award wit h r e spect to the defendant’s former employ er’s attorney s’ fees.

Dissenting

, J udg e Reinhardt wrote that this case is about password sharing

, a

nd that i n h i s view, the CF AA does not make the millions of people who eng ag e in this u biquitous, useful, and g enerally harmless conduct into unwitting federal criminals.

COUNSEL

Dennis P. Riordan ( arg ued) and D onald M. Horg an, Riordan & Horg an, San F rancisco, California; T e d Sampsell-J ones, W illiam Mitchell Colleg e of L aw, St. Paul, M i n n esota; for Defendant-Appellant.

J enny C. Ellickso n ( arg ued), Trial Attorney
, Criminal Division, A ppellate Section; L eslie R. Caldw e l l

, Assistant Attorney G eneral; Sung

- Hee Suh, Deputy Assistant Attorney General; United States Department of J ustice, Washing ton, D.C.; B arbara J

. Valliere, A ssistant United States Attorney
, Chief, A p p e l late Division; Ky le F

. W alding e r and Matthew A. Parrella, Assistant United States Attorney s; United States Attorney ’s Off

i c e, San F rancisco, California; for PlaintiffAppellee.

Ja m i e Wi l l i a

m s , S a n F rancisco, California, for Amicus Curia e Electronic F rontier F oundation.U N I T E D S T A T E S V

. N O S A L 4

M a r tin Hansen, Coving ton & B urling

, W ashing ton, D .C

. ; Simon J

. Fr ankel and Matthew D. Kellog g , Conving ton & B urling

, San F r ancisco, California, for Amicus Curiae B SA | The Software Alliance.

David Nied, Keenan W

. N g and Michael S. Dorsi, Ad Astra L aw Group, San F rancisco, California, for Amicus Curiae NovelPoster.

OP INION

McKEOW

N, Circuit J udg e:

This is the second time w e consider the scope o f the Computer F raud and Ab u s e Act (“CF AA”), 18 U .S.C. § 1030, with respect to D avid Nosal. Th e C FA A imposes criminal penalties on whoever “knowing ly and with intent to d e f r a u d

, a c c e s s e s a p r o t e c t e d c o m p u t e r w i t h o u t authorization

, or exceeds authorized access , and by means o f such conduct furthers the intended fraud and obtains a ny thing of value . . . .” Id. § 1030(a)(4) (emphasis added).

Only t h e f

i r s t p rong of the section is before us in this appeal: k n owing ly and with intent to defraud accessing a computer “without authoriz ation.” Embracing our earlier precedent and joining our sister c ircuits, we conclude that “without authoriz a tion” is an u nambig uous, non-technical
term that, g iven its plain and ordinary meaning

, means accessing a protected c o m p u t er without permission. This definition has a simple corollary : once authoriz ation to access

a computer has been affirmatively revoked, the user cannot sidestep t he statute by g oing throug h the back door a nd accessing the c omputer throug h a third party

. UnequivocalU N I T E D S T A T E S V

. N O S A L 5

revocation of computer access closes both the front door a nd the back door.

No s a l worked at the e x ecutive search firm K o rn/F erry I nternational when he d ecided to launch a competitor a l o n g with a g roup of co-workers. B ef o r e leaving Korn/F e rry , N o s a l ’ s co l l e a gu es b e ga n d o w n l o a d i n g confiden t i al information from a Korn/F erry database to u se at their new enterpris e

. A l thoug h they were authoriz ed to a ccess the database a s current Korn/F erry employ ees, their downloads

on behalf of Nosal violated Korn/F erry ’s confidentiality and computer use policies. I n 2012, w e addressed whether those employ e es “e x ceed[ e d] authoriz e d access” with intent to defraud u nder the CF AA. United States v. No s a l ( Nosal I ), 676 F .3d 8 5 4 (9th Cir. 2 0 1 2 ) (en banc). Disting u ishing between access restrictions a n d u s e r estrictions, we concluded that the “ex ceeds authoriz ed access” prong of § 1030(a)(4) o f the CF AA “does not ex tend to violati o n s o f [ a company ’s]

use restrictions.” Id. at 863. W e affirmed the district court’s dismissal of the five CF A A counts relat e d to Nosal’s aiding and abetting misuse of data accessed by his co-workers with their own passwords.

The remaining counts relate to statutory provisions that

were not at issue in Nosal I : access to a protected computer “without authoriz ation ” under the CF AA and trade secret theft under the Economic Espionag e Act (“EEA”), 18 U .S.C. § 1831 et seq

. W hen Nosal left Korn/F erry , the company revoked h is computer access credentials, even thoug h he remained for a time a s a con t r a ct o r

. The company took the

same precaution u

pon th e departure of his accomplices, B ecky Christ i a n a

n d Mark J acobson. Nonetheless, they continued to access the database using the credentia l s o f Nosal’s former ex ecutive assistant, J acqueline F roehlich-U N I T E D S T A T E S V

. N O S A L 6

L ’Heureaux (“F H”), who remained at Korn/F erry at Nosal’s request. The question w e consider i s whether the jury properly convict e d N osal of conspiracy to violate the “without authoriz ation” provision of the CFA A for

una uthoriz ed access to, and downloads from, his f ormer employ e r’s database c alled Searcher. 1 Put simply

, we a re asked to decide whet h er the “without authoriz ation” prohibition of the CF AA ex tends to a former employ e e whose computer access credentials have been rescinded but who, disreg ardi ng the revocation, accesses the computer by other

means.

W e d irectly answered this question in LVRC Holdings L LC v. Brekka

, 581 F .3d 1127 (9th Cir. 2009), and reitera t e

our holding here: “ [ A ] person u ses a computer ‘without authoriz ation’ under [ the CF AA]

. . . when the employ er has

r e s cinded permission to access the computer and t h e defendant uses the computer any way .” Id. at 1135. This straig htforward principle embodies the c ommon sense, ordinary meaning of the “without authoriz ation” prohibition.

Nosal and various amici spin hy p otheticals about the dire
consequences of criminaliz ing passw o r d sharing

. B ut these warning s miss the mark in this case. This appeal is not about
p a ssword sharing

. Nor is it about v iolating a company ’s inter n a l computer-use p olicies. The conduct at issue is that of Nosal and his co-conspirators, w hich is cov e r e d by the

1 A s in No sa l I

, No sal d i d n o t h im self access an d d o w n lo ad in f o rm atio n f ro m Ko rn /Ferry ’ s datab ase. No sal w as co n v icted o f t h r e e su b s tan tiv e CFA A co u n ts o n eith er an aid in g an d ab ettin g o r co n sp iracy th eo ry

. Un der eith er, No sal is liab le f o r th e co n d u c t o f Ch ristian an d J aco b so n

. S ee Pin kerto n v. Un ited S ta tes , 3 2 8 U.S. 6 4 0
, 6 4 7 (1 9 4 6 ) (co n sp i r acy liab ility ); Un ite d S t a t es v. S h o rt , 4 9 3 F.2 d 1 1 7 0
, 1 1 7 2 (9 th Cir. 19 7 4) (aid in g an d ab ettin g liab ility ).U N I T E D S T A T E S V

. N O S A L 7

plain lang uag e of the statute. N osal is charg ed wi th conspiring with former K orn/F e rry employ ees whose user accounts had been terminated, but who n onetheless accessed trade secrets in a proprietary database throug h the back door when the front d oor had b ee n fi rm l y closed. N osal knowing ly and w ith intent to defraud Korn/F erry blatantly circumvented the affirmative revocation of his computer sy stem access. This access falls squarely within the CF AA’s prohibition on access “without authoriz ation,” a n d thus we affirm Nosal’s conviction for violations of § 1030(a)(4) of the CF AA.

T h e dissent mistakenly focuses on F H’s authority

, sidestepping the a

uthoriz ation q

u e s tion for Christian a

nd J acobson. T o beg in, F H had n o authority from Korn/F erry to provide her password to for m e r employ ees w hose computer access had been revoked. Also, in collapsing the distinction b e t w een F H’s authoriz ation and that of Christian a nd J acobson, the dissent would render meaning less the concept of authoriz ation. And, pertinent here, it would r emove from the scope of the CF AA any hacking conspiracy with an inside person. That surely w as not Cong r ess’s intent.

W e also affirm N o sal’s convictions under the EEA for downloading

, receiving and posses s i n g trade secrets in the form of source lists from Search er. W e vacate in p art a nd remand the restitution order for reconsideration of the reasonableness of the attorney s’ fees award.U N I T E D S T A T E S V

. N O S A L 8

B A C K G R O U N D

I. F A C T U

A L B A C K

G R O U N D

Nos a l w a s a hig h-level reg ional director at the g lobal

ex e c utive search firm Korn/F erry I nternational. Korn/F erry ’s bread and butter was identify ing and recommending potential candidates for corporate po s i t i o n s. I n 2004, after being passed over for a promotion, Nosal a n nounced his intention
to leave Korn/F erry

. Neg o tiations ensued and No s a l a g reed
to stay on for an additional y ear as a contractor t o f i n i sh a handful of open searches, subject t o a blanket noncompetition ag reement. As he put it, Korn/F erry was g iving him “a lot of money ” to “stay out of the market.”

During this interim period, Nosal w as very busy

, secretly launching his o wn search firm along w i th other K o rn/F erry employ e es, including Christian, J acob s o n and F H

. As o f December 8, 2004, Korn/F erry revoked Nosal’s access to its

c omputers, althoug h it permitted him to ask Korn/F e rry employ e es for research h elp o n his rem a i n ing open assig nments. I n J anuary 2005, Christian left Korn/F e rry and, under instructions from Nosal, set up an ex ecutive search firm—Christian & Associates—from which Nosal retained 80% of fees. J acobson followed her a few months later. As Nosal, Christian and J acobson beg an work for clients, N osal

u sed the name “David Nelson” to mask his identity wh e n interviewing candidates.

Th e start-up company was missing Korn/F e rry ’s core asset: “Searcher,” an internal database of information o n over

one million ex ecutives, includ i ng contact information, employ ment history

, salar i es, biog raphies and resumes, all compiled since 1995. Se ar c h er was central to Korn/F erry ’sU N I T E D S T A T E S V

. N O S A L 9

work for c lients. W hen launching a new search to fill an open ex ecutive p osition, Korn/F e r r y teams started b y compiling a “source list” of potential candidates. I n constructing the list, t h e employ ees would r un queries in Searcher to g enerate a li s t o f c andidates. To speed up the
process, employ ees could look at o ld source lists in Searcher
to see how a search for a similar position was constructed, o r to identify suitable candidates. The resulting source list could include hundreds of names, but then was narrowed to a short list of candidates presented to the client. K orn/F e r r y considered these source lists proprietary

.

S earcher included data from a number of public a n d quasi-public sources like L inkedI n, corporate f iling s a nd I nternet searches, and also included internal, non-public
sources, such as personal connections, unsolicited resumes sent to Korn/F erry and data inputted directly by c andidates via Korn/F erry ’s website. The data was coded upon entry ; a s

a result, employ ees could run targ eted searches for c andidates by criteria such as ag e , industry

, ex pe r i e n c e o r other data points. However, once the information b e ca m e part o f the Searcher sy stem, it was integ rat e d w i t h other data a nd there
was no way

to identify

the source of the data.

Searcher was hosted on the company ’s internal computer network and was considered confidential and for u se only in Korn/F erry business. Korn/ Fe rr y issued each employ e e a unique username and password to its c omputer sy stem; no separate password was required to access Searcher. Password sharing was prohibited by a c o n fidentiality ag reement that Korn/F erry r equired eac h n e w e mploy ee to sig n. W hen a

u s e r requested a custom report in Searcher, Search e r display ed a messag e w hich stated: “This product is intendedU N I T E D S T A T E S V

. N O S A L 10

to be used by K orn/F e r

ry employ ees for work o n K o rn/F erry business only .”

Nosal a nd his c ompatriots downloaded information a nd

source lists f

rom Searche r in p reparation to launch the new competitor. B efore leaving Korn/F erry , they

used their o wn

usernames a

nd passwords, compiling p roprietary K o rn/F erry data in violation of Korn/F erry ’s computer use policy

. Those efforts were e ncompassed in the CF AA accounts appealed in Nosal I

. S ee Nosal I

, 676 F

. 3d at 856.

After Nosal became a contractor and Christian a nd J acobson left Korn/F erry , Korn/F erry revoked e a c h of their

c r e d entials to access Korn/F erry ’s computer sy stem. Not t o be deterred, on thr e e o ccasions Christian and J acobson borrowed access credentials f r o m F H
, who stay ed o n at Korn/F erry at Nosal’s request. I n April 2 0 05, N osal instructed Christian to obtain some source lists from Searcher
to ex pedite their work f

or a new client. Thinking it would be difficult to ex plain the request to F H, C h r istian asked to borrow F H’s access credentials, w hich Christian then used to log in to Korn/F erry ’s computer sy stem an d r u n q ueries in Searcher. Christian sent the r esults of her searches to Nosal. I n J uly 2005, Christian ag ain log g ed in as F H to g enerate a custom r e p ort and search f or information on three individuals. L ater in J uly

, J acobson also log g ed in a s F H, to download informa t i on on 2 ,400 ex ecutives. None of these searches relate d t o any open searches that fell under Nosal’s independent contractor ag reement.

I n March 2005, Korn/F erry r e ceived an email from an unidentified person a dvisi n g t hat Nosal was conducting his

own business in v iolation of his non-compete ag reement. TheU N I T E D S T A T E S V

. N O S A L 11

company launched an i n v estig ation and, in J u ly 2005, contacted g overnment authorities.

II. P R O C E D U R

A L B A C K

G R O U N D

I n the fir s t indictment, Nosal was c harg ed w ith twenty criminal counts, including eig ht counts under the CF AA, two trade secrets c ounts u nder t h e Economic Espionag e Act a nd

one conspiracy count. F ive o f t h e e ig ht CF AA counts were based on alleg ations that F H and Christian downloaded material from S e ar c h er using their own credentials while employ e d by Korn/Fe r r y in violation of company p olicies. The district court dismissed these counts, citing our decision Brekka

, 581 F

. 3d 1 1 27. That d ismissal was a f f i r med by the

en banc court in Nosal I

, and the case was remanded for trial on the remaining counts. 676 F .3d at 864.

The g o vernment f

iled a second superseding indictment in F ebruary 2013 with three CF AA counts, two t r a d e secrets counts and one conspiracy count. Nosal’s remaining CF A A
counts were based on the three occasions when Christian a nd J acobson accessed Korn/F e rry ’ s sy stem for their new c lients using F H’s log in credentials. The district court d e n ied Nosal’s motion to dismiss the three remaining CF AA counts, rejecting the arg ument that Nosal I limited t h e s tatute’s applicability “ to h acking crimes whe r e the defendant circumvented technolog ical barr i e rs to access a computer.” United States v. Nosal

, 930 F

. Supp. 2d 1051, 1060 ( N.D. Cal. 2013). Alternatively

, the co u r t h eld that “the indictment sufficiently alleg e[ d] such circumvention.” Id

. at 1 0 6 1

. A jury convicted Nosal on all counts. The distri c t court sentenced Nosal to one y e a r and one day in prison, three
y e a r s of supervised release, a $60,000 fine, a $600 specialU N I T E D S T A T E S V

. N O S A L 12

assessment and approx imately $828,000 in restitution to Korn/F erry

.

A N A L Y S I S

I. C O N V I C T I O N S U N D E R T H E C O M P U T E R F R A U D A N D A B U S E A C T

A. Background of

the CF AA

The CF A A was orig inal l y e n acted in 1984 as the C ounterfeit Access Device a nd Computer F raud and A bu s e Act, Pub. L

. No. 9 8-473, § 2102( a ), 98 Stat. 2190 (1984). The act was a imed a t “ h a ckers w ho a ccessed computers to steal information or t o disrupt or destroy computer functionality

. . . .” Brekka

, 581 F .3d at 1130–31 (citing H.R. Rep. No. 98-894, at 8

– 9 (1984), reprinted in 1984 U.S.C.C.A.N. 3689, 3694). The o rig inal leg islation protected
g overnment and financial institution computers, 2 and made it

a felony to access c lassified information in a computer “without authoriz ation.” Counterfeit Access Device and Computer F raud and Abuse Act § 2102(a).

2 A co m p u ter is d ef

in ed b ro ad ly as “ an electro n ic

. . . d a t a p r o cessin g d ev ice p erf

orm in g lo g ical, arith m etic, o r sto rag e f u n ctio n s, an d in clu des

an y d ata sto rag e f

acility o r co m m u n icatio n s f

acility d irectly related to or

o p eratin g in co n

j u n ctio n w ith su ch d ev ice .

. . .” 1 8 U.S.C. § 1 0 3 0 (e)(1 ). T h e CFA A ’ s restrictio n s h av e b een ap p l i ed to co m p u ter n etw o rk s, d atab ases an d cell p h o n es. S ee, e.g

. , U n ited S ta tes v. Va lle

, 8 0 7 F.3 d 5 0 8
, 5 1 3 (2 d Cir. 2 0 1 5) (restricted p o lice d atab ases); Un ited S ta tes v. Ba rrin gto n , 6 48 F.3 d 1 17 8
, 1 1 8 4 (1 1 t h Cir. 2 0 1 1 ) (a u n iv ersity ’ s In tern etb ased g rad in g sy s tem ); Un ited S ta tes v. Kra mer , 6 3 1 F.3 d 9 00 , 9 0 3 (8 th Cir. 2 01 1 ) (cell p h o n es); Un ited S ta t es v. S hea

, 4 9 3 F.3 d 1 1 1 0
, 11 1 5

– 1 6 (9 th Cir. 2 00 7 ) (co m

p u ter n etw o rk ).U N I T E D S T A T E S V

. N O S A L 13

J ust two y ears later in 1986, Cong ress amended the statute to “deter[ ] and punish[ ] c ertain ‘hig h-tech’ crimes

, ” and “to penaliz e thefts of property via c o mputer that occur as p art o f

a scheme to d efraud,” S. Rep. No. 99-432, at 4, 9 (1986),

r e p rinted in 1986 U.S.C.C.A.N. 2479, 2 482, 2486–87. T h e amendment ex panded the C FA A ’s protections to private computers. Computer F r aud and Abuse Act of 1 9 86, Pub. L

. No. 99-474, § 2(g )(4), 100 Stat. 1213-15. 3

The key section of the CF AA a t issue is 1 8 U .S. C. § 1030(a)(4), which provides in relevant part:

W h oever

. . . knowing ly and with in t e n t to defraud, a c cesses a protected computer without authoriz a tion, or e x ceeds authoriz ed
access, and by means of such conduct furthers
t he intended fraud and obtains any thing o f value . . . shall be punished . . . .

The CF AA defines “ex ceeds authoriz ed access” as “ ac c ess [ to] a computer with authoriz ation and [ using ] such access to obtain or alter information in th e c omputer that the accesser is not entitled so to obtain o r al ter.” Id. § 1030(e)(6). The statute does not, however, define “without authoriz ation.”

B o th terms are u sed throug hout § 1030. Su b section 1030(a) ( 2 )

, which mirrors (a)(4) but r equires that access be intentional, penaliz es access w i t h out authoriz ation a nd

ex c e eding authori z ation. Subsection 1 030(a)(1) also

3 T h e act w as later ex p an d ed to p ro t ect an y co m p u ter “ u sed in in terstate

o r f o reig n co m

m erce o r co m

m un i c atio n .” Eco n o m ic Esp io n ag e A ct of 1 9 9 6
, P u b

. L

. 10 4

- 2 9 4, § 20 1 (4 )(B ), 1 1 0 S t at. 3 4 8 8
, 3 4 9 3 (co d i f ied as

am en d ed at 1 8 U.S.C. § 1 0 3 0(e)(2 )(B )).U N I T E D S T A T E S V

. N O S A L 14

incorporates b oth terms in relation t o a ccessing a computer and o b taining national security information. Subsection 1030(a)(7)(B ) criminaliz es ex tortion b y threats to obtain information “w i t hout authoriz ation or in e x cess o f authoriz ation.” The remaining subsections pertain on ly to

access “ wi t h o ut authoriz ation.” Subsection 1030(a)(3) prohibits access “without a uthoriz ation” to nonpublic
g overnme nt computers. Subsections 1030(a)(5) and (6) employ th e t e rm “without a u thoriz ation” with respect to, among other thing s, “transmission of a prog ram, information, code, or command,” § 1030(a)(5)(A); intentional access that “causes damag e and loss,” § 1030(a)(5)(C); and trafficking in
p a s s words, § 1 030(a)(6). I n construing the statute, w e a re cog niz ant of the need fo r cong ruence a mong these subsections.

B. Meaning of

“Authorization” Under the CF AA

The interpr e tive f

ireworks under § 1030(a)(4) of the CF AA have been reserved for its second prong , the meaning of “ex ceeds authoriz ed access.” Not s u r p r i sing ly

, there has been no division among the circuits o n the straig htforward “without authoriz ation” prong of this section. W e beg in with the two Ninth Circuit cases t h a t bind our interpretation o f “without authoriz a tion”— Brekka and Nosal I

— and then

move on to address the cases from our sister circuits that a re in accord with Brekka

, ag reeing that “without authoriz ation” is an unam b i gu ous term that should be g iven its ordinary meaning

.

Brekka involved a f

o r mer employ ee in circumstances

r e m arkably similar to Nosal: he wanted to compete u s i n g confidential d ata from his former company

. Christopher B rekka worked as an internet marketer with L VRC Holding s,U N I T E D S T A T E S V

. N O S A L 15

L L C (“L VRC”), a residential addiction treatment center. Brekka

, 581 F .3d at 1129. L VRC assig ned him a computer and g ave him access credentials to a third-party website that tracked traffic a

nd other information for L VRC’s website. Id.
at 1129–30. When neg otiations to become part owner o f L VRC b roke down, B r ekka left the c o m p any

. Id. at 1130. L VRC sued him, claiming that he vio l ated the CF AA b y emailing c ertain confidential company documents to his
perso n a l email account w hile an employ ee a nd also b y continuing to access L VRC’s account on the ex ternal website after he left the company

. Id.

I n Br ekka w e analy

z ed both the “without authoriz ation”

a n d “ ex ceeds authoriz a tion” provisions of the statute und e r §§ 1030(a)(2) and (4). Id. at 113 2

– 3 6

. B ecause the CF A A does n ot d efine the term “authoriz a tion,” we looked to the

o r d i n a r y , c o n t em p o r a n e o u s m e a n i n g o f t h e t e r m : “‘permission or power g

ranted by an authority

. ’ ” Id. at 1133 (quoting Random House U nabridg ed Dictionary 139 (2001)). I n determining whether a n employ e e has aut h o r iz ation, we stated that, consistent with “the plain languag e of the statute

. . . ‘authoriz ation’ [ to use a n employ er’s computer] depends

on actions taken by the employ er.” Id. at 1135. W e concluded th at b e c ause B rekka had permission to use his

e m p l o ye r ’ s c o m p u t e r , “ [ t ] h e m o s t s t r a i g h t f o r w a r d interpretation of §§ 1030(a)(2) a n d ( 4) is that B rekka h ad authoriz ation to use the computer” while an employ ee. Id. at 1133.

B r ekka’s access after L

VRC terminated his employ ment presented a starkly different s ituation: “There is n o dispute that if B rekka accessed L V R C ’ s information on the [ traffic monitoring ] website after he left the co m p any

. . . , B rekka would have acc e s sed a protected computer ‘withoutU N I T E D S T A T E S V

. N O S A L 16

a u t h o riz ation’ for purposes of the CF AA.” Id. at 1136. 4 S t a t e d differently

, we held that “a person uses a comput e r ‘without authoriz ation’ u n der §§ 1030(a)(2) and (4)

. . . when th e employ er has rescinded permission to access the computer and the defendant uses the computer any way .” Id. at 1 135. I n B rekka’s case, there was no g enuine issue o f material fact

as to whether B rekka actually accessed the website, and thus

we a ffirmed the d istrict court’s g rant o f summary judg ment. Id. at 1137.

Not surprising l y , i n Nosal I as in this appeal, b oth the
g overnment and Nosal cited Brek ka e x tensively

. The focus

o f N o sal’s first appeal was w hether the CF AA could be interpret e d “broadly to cover v iolations of corporate computer use restrictions o r violatio n s o f a duty of loy alty

. ” Nosal I

, 676 F .3d at 862. W e unequivocally said “no”: “F o r our part, we continue to follow in the path blaz ed by Brekka and the g rowing number of courts that have reached the same conclusion. These courts recog niz e that the plain lang uag e o f the CF AA ‘targ et[ s] the unauthoriz ed procurement o r

a l t e r a t i o n o f i n f

o r m a t i o n , n o t i t s m i s u s e o r misappropriation.’” Id. at 863 (i n t er nal citations omitted) (alteration in orig inal). I n l ine with Brekka

, w e stated that “‘[ w] ithout authoriz ation’ would apply to o u tside hackers (individuals who have no authoriz ed access to the computer at all) and ‘ex ceeds authoriz a tion access’ wo u l d apply to inside hackers (individuals whose initial access to a computer

4 B rek k a’ s au th o rizatio n t erm in ated w h en h is em

p lo y m e n t term in ated

, n o t b ecau se h is p assw o rd ex p ired

. Ex p ired p assw o rd s do n o t n ecessarily

m ean th at au th orizatio n term i n ates: au th o riz e d a cco u n t- h o ld ers o f ten l et th eir p assw o rd s l ap se b ef o re u p d atin g th e p assw o rd o r co n tactin g th e

co m pan y ’ s tech n ical su

p p o rt team

f o r h elp , b u t ex

p iratio n o f a p assw o rd d o esn ’ t n ecessarily

m ean th at acco u n t au th o rizatio n h as term i n ated

.U N I T E D S T A T E S V

. N O S A L 17

is authoriz ed but who access unauthoriz ed information o r files).” Id. at 858 (emphasis in orig inal). B ecau s e N o s a l ’s accomplices had authority to access the company computers,

we affirmed the district court’s dismissal of the CF AA c ounts related to the period when the acc o m plices were still employ e d at Korn/F erry

. Id. at 864.

I n Nos a l I

, authoriz ation was not in doubt. The employ e es who accessed t h e Korn/F erry computers unquestionably had authoriz ation from the company to access the sy stem; the question was whether they ex ceeded it. W hat Nosal I did not a ddress was w hether Nosal’s a c ce s s to K o r n /F e rry computers after both Nosal and his coc o n s p i r a t o r s h a d t erminated their employ ment and Korn/F er

r y revoked their permi s s i o n to access the c omputers was “without a

uthoriz ation.” Brekka is squarely on point on that i s sue: Nosal and his co-conspirators a cted “with o u t authoriz ation” when they continued t o a c c ess Searcher b y other means after Korn/F erry rescinded p ermission to access its computer sy stem. As Nosal I made clear, the CF AA was
not intended to cover unauthoriz ed u se o f information. Such

use is not at issue here. Rather, u nder § 1030(a)(4), Nosal is charg ed with unauthoriz ed access—g etting into the computer after categ orically

being barred from entry

.

The tex t of t h e CF AA confirms Brekka ’s approach. Employ ing classic s t atutory interpretation, w e c onsider the pl a i n and ordinary meaning of the words “without authoriz ation.” See United States v

. Stewart
, 311 U .S. 6 0, 63 (1940). Under our analy sis in B rekka

, “authoriz ation” means “‘permission or power g r a n ted by an authority .’” 581 F .3d at 1133 (quoting Random House Unabridg ed Dictionary 1 3 9 (2001)). Other sources employ simila r definitions. B lack’s L aw D ictionary defines “ a uthor i z ation” as “[ o ] fficialU N I T E D S T A T E S V

. N O S A L 18

p e rmission to do something ; sanction or warrant.” Black’ s Law Dictiona ry 159 (10th ed. 2 014). T he Ox ford Eng lish Dictionary defines it as “the action o f authoriz ing ,” which

means to “g ive officia l p er mission for or approval to.” Oxford E nglish Dictionary 107 (3d e d. 2014). That common

sense meaning is not f

oreig n to Cong ress or the courts: the
terms “authoriz e,” “authoriz ed” or “authoriz ation” are used without definiti o n o v e r 400 times in Title 1 8 of the United States Code. 5 W e conclude that g iven its ordinary meaning

, access “without authoriz a tion” under the CF A A is not ambig uous. See United States v

. James
, 810 F

. 3d 674, 681 (9th Cir. 2016) ( concl uding that the mere fact that a broad, but o t h e r w ise clear, statutory term is “susceptible to application to v arious factual situations that can come before a jury ” does not by

itself render a term ambig uous). 6

5 Fo r ex am

p le, T itle 1 8 co v ers a n

u m b er o f o f f en ses th at ste m fr o m

co n d u ct “ w ith o u t au th o rizatio n .” S ee, e.g

. , 1 8 U.S.C. § 1 3 88 (a)(2 )(B ) (h o ld i n g liab le an y p erso n w h o “ w illf u lly an d w ith o u t p ro per au th o rizatio n i m p e d [es]” access to a f

u n eral o f a m em

b er o f t h e A rm ed Fo rces) ; 1 8 U.S.C. § 1 8 3 1 (a) (h o ld in g l iab le f o r eco n o m ic esp io n ag e “ [w ]h o ev er, in ten d in g o r k

n o w in g th at th e o f

f en se w i ll b en ef

it an y f o reig n g o v ern m en t

. . . k n o w in g ly

. . . w ith o u t au th o rizatio n ap p ro priates, tak es, carries aw ay , o r co n ceals” trad e secrets); 1 8 U.S.C. § 2 7 0 1 (h o ld in g l iab l e an y p erso n

w h o “ in ten tio n ally accesses w ith o u t au t h o rizatio n a f

acility th ro u g h w

h ich

an electro n ic co m

m u n icatio n serv ice is p ro v id ed

. . . an d th ereb y ob tain s, alters, o r prev en t s au th o rized access t o a w ire o r electro n ic co m m u n icatio n

w h ile it is in

electro n ic sto rag e”).

6 W e d o n o t in v o k e th e ru le o f len ity b ecau se “ th e to u ch sto n e o f th e ru le

o f len ity is statu to ry am

b ig u ity ,” Bifu l co v. Un ited Sta tes , 4 4 7 U.S. 3 8 1
, 3 8 7 (1 9 8 0 ) (in t ern al q u o tatio n s o m itted ), an d “ [t ] h e r u le co m es in to

o p eratio n a t t h e en d o f th e p ro cess o f co n s tru in g w h at Co n g ress h as

ex p ressed

, n o t at th e b eg i n n in g as an o v errid in g co n sid eratio n o f b ein g l e n i en t to w

ro n g d o ers,” Ca lla na n v. U n ited S ta tes , 3 6 4 U.S. 5 8 7
, 5 9 6 (1 9 6 1). Here, b ecau se th e s t atu te “ u n am big u ou sly co v er[s] th e d ef en d an t ’ s co n d u ct, th e ru l e d o es n o t co m e i n to p lay .” Un ited S ta tes v.U N I T E D S T A T E S V

. N O S A L 19

I mplicit in the definition of authoriz ation is the notion that
someone, including an entity

, can g r a n t or revoke that permission. Here, that entity was Korn/F erry a nd F H had no mantle or authority to g ive p ermission to former emplo y ees whose access h ad been catego ri cally revoked by the
company

. 7 T here is n o q uestion that Korn/F erry owned a nd controlled access to its computers, including the Searcher database, and that it retained ex c lusive discretion to issue or revoke access to the database. After Nosal’s log in credentials

were revoked on December 8, 2 004, he b ecame an “outsider” and w as no longe r authoriz ed to access K o rn/F erry comp u ters, including Searcher. 8 Christian and J acobson’s credentials were also revoked after they left, at which point

none of the three former employ ees were “insiders” accessing

Litch field

, 9 8 6 F.2 d 2 1
, 22 (2 d Cir. 1 9 9 3). T h at th e CFA A m ig h t su p p o rt

a n arro w er in terp retatio n , as th e d issen t arg u es, d o es n o t ch an g e o u r

an aly sis. S

ee Mo s ka l v. Un ited Sta tes , 4 9 8 U.S. 1 0 3
, 1 0 8 (1 9 9 0 ) (h o ld in g th at t h e ru le o f len ity is n o t trig g ered b ecau se i t is “ p o ssib le to articu late”

a n arro w er co n stru ctio n

o f a statu te).

7 T h e dissen t rests its arg u m en t o n th e f

act th at B rek k a h ad “ n o p o ssib le

so u rce o f au th o rizatio n .” T h e sam e is tru e h ere—No sal h ad “ n o p o ssib le

so u rce o f au th orizatio n ” sin ce th e co m p an y rev o k ed h is au th o rizatio n an d

, w h ile FH m ig h t h av e b een w ran g led in t o g iv in g ou t h er p assw o rd

, sh e an d th e o th ers k

n ew th at sh e h ad n o au th o rity to co n t ro l sy stem

access.

8 N o sal arg u es th at h e can n o t b e h eld liab le becau se, as a co n t racto r, h e

w as en titled to access in f o rm atio n f

ro m Ko rn /Ferry ’s d atab ase. No sal

m isco n stru es h is au th o rizatio n f o llo w in g h is d ep artu re f

ro m Ko rn /Ferry : h e w as o n l y en titled to in f o rm atio n related to h i s o p en search es, an d b ein g

en titled to receiv e in f

o rm atio n d o es n o t eq u ate to p erm issio n to access th e d atab ase. Fu

rth er, No sal’ s liab ility

as a co

- co n sp irato r t

u rn s on w h eth er Ch ristian an d J aco b so n

acted “ w ith o u t au th o rizatio n .”U N I T E D S T A T E S V

. N O S A L 20

company information. Rather, they were “outsiders” w ith no authoriz ation to access Korn/F erry ’s computer sy stem. 9

Ou r a naly sis is consistent w ith that o f our sister circuits, which have also determined that the term “without authoriz ation” is unam b i g u ous. 1 0 Althoug h the meaning o f “ex c eeds a

uthoriz ed access” in the CF AA has been subject to much debate amon g t h e federal courts, 1 1 the definition o f

9 W e n o te th at th e term s “ in sid er” an d “ ou tsid er” in th ese circu m stan ces

are sim p l y d escrip tiv e p ro x ies f o r t h e statu s o f th e p arties h ere an d in B rekka

. T h ere ob v io u s ly co u ld b e an “ in sid er” in a co m p an y , su ch as a clean i n g o r m ain ten an ce p erso n , w h o is n o t au th o rized to access an y

co m pu ter o r c o m

p an y in f o rm atio n b u t w

h o , n o n eth eless, accesses th e

co m pan y co m p u ter “ w i th o u t au th orizatio n .”

10 A lth o u g h th e Su

p rem e Co u

rt recen tly af

f irm ed a co n v ictio n u

n d er th e CFA A w ith f

acts sim ilar t o th o se h ere, it d id n o t ad d ress in terp retatio n of

“ w ith o u t au th orizatio n .” See Mu sa cch i o v. Un ited S ta t es , 1 3 6 S. Ct. 7 0 9 ( 2 0 1 6 ). W ith o u

t elab o ratio n , th e Co u rt n o ted th at “ [t]h e statu te th u s p ro v id es tw o w ay s o f co m m ittin g th e cr i m e o f im

p ro p erly accessin g a p r o tected co m

p u ter: (1 ) o b tain in g access w ith o u t au th orizatio n ; an d (2 ) o btain in g access w ith au th orizatio n b u t th en u s in g th at access im p ro p erly .” Id

. at 7 1 3

.

1 1 See d iscu s sio n in No sa l I
, 6 7 6 F.3 d at 8 6 2– 6 3

. Co mp are U n i t e d S ta tes v. Va lle

, 8 0 7 F.3 d 5 0 8 , 5 2 6

– 2 8 (2 d Cir. 2 0 1 5 ) (h o ld in g th at w h i le th ere is su

p p o rt f o r b o t h a n arr o w an d b ro ad read in g o f “ ex ceed s

au th orized access,” th e ru l e o f l en ity req u i res th e co u rt to ad o p t a n arro w er in terp retatio n in th e d ef en d a n t ’s f

av o r), with W

EC Ca ro lin a En erg

y S o lu tio n s LLC v. Miller

, 6 8 7 F.3 d 1 99
, 2 0 4 (4 th Cir. 2 0 1 2 ) (co n clu d in g th at “ an em

p lo y ee ‘ ex ceed s a u t h o r ized access’ w h en h e h as ap p ro v al to

access a co m

p u t er, b u t u s es h is access to o btain o r alter in f orm atio n th at f alls o u t sid e t h e b o u n ds o f h is ap p ro v ed access”), a nd Un i t ed S ta tes v. Jo h n , 5 9 7 F.3 d 2 63
, 2 7 2 (5 t h C ir. 20 1 0 ) (“ A ccess to a co m p u t er an d d ata th at can b e ob tain ed f

ro m th at access m ay b e ex ceed ed if th e pu rp o ses f or

w h ich access h as b een g iv en are ex ceed ed .”), a n d U n i t e d S ta tes v. Ro d rig u ez , 6 28 F.3 d 1 25 8
, 1 2 6 3 (1 1th C ir. 2 0 1 0 ) (h o ld in g th at anU N I T E D S T A T E S V

. N O S A L 21

“without authoriz ation” has not eng endered dispute. I ndeed, Nosal provides no contrary authority that a former employ ee whose computer a c c ess has been revoked can access his former employ er’s computer sy stem and b e deemed to act with authoriz ation.

B e g inning in 1991, in c o ns t ruing § 1030(a)(5)(A), 1 2 the Second Circuit recog niz ed that “authoriz ation” is a word “of

common usag e , without any technical or ambig uous meaning

. . . . ” United States v. M orris
, 928 F .2d 504, 511 (2d C i r. 1991). The court reaffirmed t h i s holding in 2 0 15, citing Brekka and stating that “common usag e of ‘authoriz a tion’
sug g ests that one ‘accesses a computer without authoriz a tion’ if he accesses a computer without permission to do so at all.” United States v. Valle , 807 F .3d 508, 524 (2d Cir. 2015).

The F ourth Circuit’s a

n aly sis mirrors the conclusion that the “without authoriz ation” lang uag e i s unambig uous based on its ordinary

meaning :

Recog niz ing that the distinction betw een [ “ex ceeds authoriz ed access” and access

em p l o y ee w h o v io lates em

p l o y er u se restrictio n s “ ex ceed s au th orized access”), a n d In t’l Airp o rt Ctrs., L.L.C. v. Citrin
, 4 4 0 F.3 d 41 8, 4 2 0

– 2 1 (7 th Cir. 2 0 0 6 ) (h o ld i n g th at w h ile th e “ dif

f eren ce b etw een access

‘ w ith o u t au th o rizatio n ’ an d ‘ ex ceed in g au th o rized access’ is p ap er t h in ,”

an em plo y ee w h o b reach ed a d u ty of lo y alty term in ated t h e ag en cy relatio n sh ip an d ex ceed ed au t h o rized access i n u sin g co m p an y la p t o p ),

a n d EF C u ltu ra l T ra vel BV v. Exp lo rica

, In c. , 2 74 F.3 d 5 7 7
, 5 8 1

– 8 4 (1 st Cir. 2 0 0 1 ) (h old in g th at f o rm er em p lo y ees w

h o v io la t e d co n f

id en tiality
ag reem en ts ex ceed ed au th o rized access).

12 T h is sectio n o f th e CFA A crim in alizes in ten tio n al “ tran s m issio n o f a p ro g ram , i n fo r m atio n , co de, or co m m an d ” to a p ro tected co m p u ter

“ w ith o u t au th o rizatio n ” cau sin g d am ag e. 1 8 U.S.C. § 1 0 3 0 (a)(5 )(A ).U N I T E D S T A T E S V

. N O S A L 22

“without authoriz atio n”] is arg uably minute,

we n e vertheless conclude based on the ordinary

, contemporary , common meaning o f

“ a u t h o r i z a t i o n , ” t h a t a n e m p l o y e e i s authoriz ed to a c c e s s a computer when his employ er approves or sanctions h is admission
to that computer. Thus, he accesses a

co m p uter “ without authoriz ation” when he
g ains admission to a computer wi t h o ut approval. S i m ilarly

, we conclude that an

em p l oy ee “ex ceeds authoriz ed a ccess” when he has a pproval to a ccess a computer, but uses h is access to obtain or alter information tha t falls outsid e the bounds of his approved

access.

W EC Carolina Energy Solutions LLC v. Miller

, 687 F .3d 199, 204 (4th Cir. 2012) (internal citations omitted).

L ike the other courts, the Six th Circu i t noted that “[ t] he plain meaning of ‘authoriz ation’ is ‘[ t] he co n ferment o f leg ality ;

. . . sanction.’ Commonly understood, then, a defendant who accesses a computer ‘without a uthoriz a tion’ does so without sanction o r permission.” Pulte Homes, Inc.

v. Laborers’ Int’l Union of N. Am.
, 648 F .3d 2 95, 303–04 (6th Cir. 2011) (quoting 1 O

xford English Dictionary 798 (2d ed. 1989)). B ased on ordinary usag e , the Six th Circuit similarly reasoned that “‘a person who u s e s a computer ‘without authoriz ation’ has no rights

, limited o r othe r w i se , to access the computer in question.’” Id. a t 3 04 (alteration in orig inal) (quoting Brekka

, 581 F .3d at 1133); see also United States v

. W illis , 476 F .3d 1121, 1124–27 (10th Cir. 2007) (upholding

a conviction for aiding a n d a b etting access to a protected computer “without authoriz a tion” where an employ ee g aveU N I T E D S T A T E S V

. N O S A L 23

log in credentials for a financial inf ormation website to an associate o f his drug d ealer who in turn used the access ed information for identity

theft).

I n the face of multiple circuits that a g ree with our p l a i n meaning construction of the statute, the dissent would h ave us ig nore common sense and turn the statute inside out. I ndeed, the d issent frames the question upside down in assuming that permission from FH i s at issue. U nder this approach, ig noring r eality and practice, a n employ ee could willy nilly
g ive out passwords to any one outside the company —former employ e es whose access had b een revoked, com p e t itors, industrious hackers, or b ank r obbers who find it less risky a nd

more convenient to access a ccounts via the I n t e rnet rather than throug h armed robbery

.

Our con c l u s i o n does nothing to ex pand the scope o f violations u nder the CF AA bey ond Brekka ; nor does it rest on the g race of prosecutorial d iscretion. W e are mindful of the

ex a mples n o t e d in Nosal I— and reiterated by Nosal a nd various amici

— that ill-defined terms may capture a rg u ably innocuous conduct, such as password sharing a mong friends and family

, inadvertently “mak[ ing ] criminals of larg e g roups of people who would h ave little re as o n to suspect they a re committing a federal c ri m e.” Nosal I
, 676 F .3d at 859. B ut the circums t a n ce here—former employ ees whose computer

access w as categ orically revoked a n d who surreptitiously accessed data o wned by their former employ er—be ar s little resemblance to asking a spouse to log in to an email account to print a boarding pass. The charg es at issue in this appeal do not stem from t h e a m b ig uous lang uag e of Nosal I —“ex ceeds authoriz ed access”—but instead relate to a common, unambig uous term. Th e r eality is that facts a nd
contex t matter in apply ing the term “without authoriz ation.”U N I T E D S T A T E S V

. N O S A L 24

The B rekka analy sis o f the specific phrase “ without authoriz ation”—which is consistent with our sister circuits—remains controlling and persuasive. W e theref o re hold that Nosal, a former employ ee whose computer ac c ess credentials were revoked by Korn/Fe r r y acted “without authoriz at i o n ” i n violation of the CF AA when he or his former employ ee co-conspirators used the log in cred e ntials of a c urrent employ ee to g a in access to computer data owned by the former employ e r and to circumvent the revo c at i o n o f

access.

C. Jury Instruction on “Without Authorization”

W ith respect to t h e m eaning of “ without authoriz ation,” the district court instructed the jury as follows:

W h ether a person is authoriz e d to access the computers in this case depends on the a ctions taken by Korn/F erry to g rant or deny permission to that person to use the computer. A p e rs o n uses a comput e r “ w i t h o u t authoriz ation” whe n the person has not received permis s i o n from Korn/F erry to use the computer for any purpose (such as when a hacker accesses the computer without a n y p e r m i s s i on), or w h e n Ko r n / Fe r r y h a s rescinded permission to use the computer a nd the person uses the computer any way

.

The instruction i s d erived directly from our decision in Brekka and is a fair and accurate characteriz ation of the plain meaning of “without authoriz at i o n.” Althoug h the term “without authoriza

t i o n” is unambig uous, it does not mean that the facts don’t matter; the source and scope of authoriz ationU N I T E D S T A T E S V

. N O S A L 25

m a y w ell be at issue. Here, it was not disputed th at Korn/F erry was the source of permiss i o n to g rant authoriz ation. The jury instruction left to th e j u r y to determine whether such permission was g iven.

Nosal chal leng e s the instruction on the basis that the CF AA only criminaliz es access w here the party circumvents

a technolog ical access barrier. 1 3 N ot o n ly is such a requirement missing from the statutory lang uag e, but it would make little sense because some § 1 030 offenses do not require

access t o a computer at a ll. F or e x ample, § (a)(6) imposes penalti e s for trafficking in passwords “throug h which a computer can b e a ccessed without authoriz ation

. . . . ” 18 U.S.C. § 1030(a).

I n a ny event, N osal’s a

r g um e n t misses the mark on the technolog ical access point. Even if h e were correct, any instructional error was without consequence i n l i gh t of the evidence. The password sy stem adopted b y Korn/F erry is unquestionably a technolog ical barrier d esig ned to keep out those “without auth o r i zation.” Had a thief stolen an employ e e’s password and then used it to rifle throug h Searche r , without doubt, access would have been without authoriz ation.

The s a m e principle holds true here. A password requirement is desig n ed to be a technolog ical access barrier.

13 No sal d i d n o t o b

j ect to th is in stru ctio n at th e j u ry in stru ctio n

co n f eren ce. He d id

, h o w ev er, raise th e i ssu e an d o f f er a circu m

v en tio n in stru ctio n earlier in th e p ro ceed in g s an d o b j ected to an earlier v ersio n of th is in stru ctio n

. W h et h e r w e rev iew th e i n stru ctio n d e n o v o o r f o r p lain

erro r, th e resu lt is th e sam e b ecau s e th e in s tru ctio n w as co rrect.U N I T E D S T A T E S V

. N O S A L 26

D. Accom plice Liability Under the CF AA

Nosal’s convictions under the CF AA rest on accomplice liability

. Nosal claims the go v ernment failed to prove the requisite mens rea. Two instructions bear on this issue:

a i d i n g and abetting and deliberate ig n orance. As to the former, which is n ot challeng e d on a ppeal, the court instructed that the g overnment must prove Nosal “knowing ly and intentionally aided, cou n seled, commanded, induced o r procured [ a] person to commit each element of the crime” a nd did so “before the crime was comple t e d

. . . with the knowledg e and intention of help i n g that person c ommit the

c r i m e

. ” T he court also instructed that the defendant acted “knowing ly ” if he was “aware of the act and [ did] not act o r fail to act throug h ig norance, mistake, or a ccident.” The adjunct deliberate ig norance instruction read: the defendant acted “knowing ly ” if he “ was aware o f a hig h probability that [ Christian, J acobson, or F H] had g ained unauthoriz e d access to a computer

. . . or misappropriated trade secrets

. . . without authoriz ation

. . . and deliberately avoided learning the truth.”

At trial, Nosal objected to the deliberate i gnorance instruction o n the g round that the facts alleg ed d id not p ermit

a deliberate ig n or a n c e theory

. On appeal, for the first time, he arg ues that the instruction is e r ro neous because it undermines the requiremen t that Nosal had advanceU N I T E D S T A T E S V

. N O S A L 27

knowledg e of the crime. 1 4 W e review this challeng e for plain

error. See Jones v. United States
, 527 U.S. 373, 388 (1999).

W e have repeatedly held that a statutory requirement that

a criminal defendant a ct e d “knowing ly ” is “not limited to positive knowledg e , but includes the state of mind of one w ho does not possess pos i t ive knowledg e only because he consciously

avoided it.” United States v. Heredia

, 483 F .3d 913, 9 18 ( 9th Cir. 2007) (internal citation and alterations omitted); see also U

nited States v

. Jewell

, 532 F

. 2d 697, 700 (9 t h C i r

. 1976) (“To act ‘knowing ly ,’ therefore, is not necessarily to act o nl y w i t h positive k nowledg e, but also to act with an awareness of the h ig h probability of the ex istence of the f act in question. W h e n such awareness is present, ‘positive’ knowledg e is not requir ed.”). W e have equated positive knowledg e and d e liberate ig norance in upholding conspiracy convictions and see n o r e ason to disting uish aiding a nd a betting liability

. See, e.g. , Un i t e d S t ates v

. Ramos-Atondo

, 732 F .3d 1113, 1120 (9th Cir. 2013) (holding the district court did n ot abuse its discretion b y instructing the jury on a theory of deliberate ig nora n c e in the contex t of a conspiracy to import marijuana as “‘[ t] he J e well standard eliminates the need to e stabli s h such positive knowledg e to obtain a conspiracy conviction’” (a lterations in orig inal) (quoting United States v

. Nicholson

, 677 F .2d 706, 711 (9th Cir. 1982))).

14 T h e d i strict co u rt acco m m o d ated No sal’ s m an y o b j e c t io n s to th is in stru ctio n

. In p articu lar, at h is req u est, th e i n stru ctio n in clu d ed th e n am es

o f t h e co

- co n s p i rato rs. W h en th e co u rt ask ed if th i s in clu d ed “ th e th ree p eo p le,” No sal’ s co u n s el s aid

, “ Rig h t.” T h e i n stru ctio n th u s in co rp o rated

, w ith n o f u rth er o b j ectio n or co m

m en t, F H’ s n am e. No s al th u s w aiv ed an y ch allen g e t o in clu sio n o f h er n am e, w h ich w as n o t p lain erro r in an y ev en t.U N I T E D S T A T E S V

. N O S A L 28

Nor does the r ece n t case Rosemond v. United States counsel a different result. 134 S. Ct. 1240 ( 2 0 1 4 )

. I n Rosemond

, the Supreme Court held that an accomplice must have “advance knowledg e” of the c rime the principa l is planning to commit, “knowledg e that enables him to make the relevant leg a l (and indee d

, moral) c hoice.” Id. at 1249. Nosal arg ues that t h e d i strict court erred in not including Rosemond ’ s a d vance knowledg e requirement. B ut as the Supreme Court notes, an advance knowledg e requirement for accomplice liability is n ot new. Id. at 1248–49. Nothi n g i n Rosemond sug g es ts that the Court foreclosed a deliberate ig norance instruction, which was not a n issue i n t he c ase. I nstead, Ros e m o n d focuses o n when a defendant must have advance k nowledg e, meaning “knowledg e at a time the accomplice can do something w ith it—most notably

, opt to walk away

. ” Id

. at 1249–50

. The instructions here a re perfectly consonant with our line of cases ex tending back to Jewell. I f the Supreme Court had c hosen to overturn decades of jurisprudence, we would ex p ect clea r e r d irection. See United S tates v. Ford

, No. 15-1303, 2016 W L 145 8938, at *10 (1st Cir. Apr. 13, 2016) (holding that “willful blindness,” including ig noring “red flag s,” meets the mens r ea element o f aiding and abetting liability

, a nd d iscussing the impact o f Rosemond

elsewhere in the opinion).

Apart from t h e i nstruction, Nosal challeng e s the sufficiency of the evidence, c laiming e vidence of intent was insufficient because h e didn’t h ave advance knowledg e that Christian and J acobson would use F H’s p assword. This attack fails because, “aft er viewing the evidence in the lig ht
most favorable to the prosecuti o n , any rational trier of fact could have found the essential elements of the crime bey ond

a reasonable d oubt.” Jackson v. Virginia
, 443 U.S. 307, 319 (1979) (emphasis in orig inal). Ex tensive testimony revealedU N I T E D S T A T E S V

. N O S A L 29

that Nosal w anted his team to obtain information from Searcher all w hile maintaining his d i s t ance from their activities.

Althoug h the conviction may be u pheld solely under Pinkerton

, which “‘render s a ll co-conspirators criminally liable f o r reasonably fore seeable overt acts committed b y others in furthe r a n c e o f the conspiracy ,’” United S tates v

. Bingham

, 653 F .3d 983, 997 (9th Cir. 2011) (quoting United States v

. He r nandez-Orellana

, 539 F

. 3d 994, 1006–07 (9th Cir. 20 0 8 )), sufficient evidence independently supports the aiding and abetting counts.

Christian’s testimony

is illustrative:

Q. Did the d e f

endant k n o w y ou were using [ F H ’ s ] p a s s w o r d

, a f t e r y o u l e f

t Korn/F erry , to g et source lists and other documents from Korn/F erry ?

A. Yes.

Q. Any doubt in y our mind that he knew that?

A. No.

This unequivocal statement, which more than sat i sfies the Jackson v. Virginia standard, is b olstered by other evidence, including e x tensive testimony that Nosal wanted his team to obtain information f

rom Searcher while maintaining his dis t a n c e from their a ctivities b ut k new and understood that

none of them had access credentials. A juror also could have easily surmised that Nosal, having worked with F H f o r y earsU N I T E D S T A T E S V

. N O S A L 30

on a d aily basis, would have known that she had herself never

run custom r eports, d e v eloped source lists o r p u l l ed old

source l ists. When Nosal specifically directed Christian to

access Korn/F erry ’s computer sy stem to “[ g ] et what I n eed,” Nosal knew that the only w a y C hristian and J acobson could

access the source lists was “without authoriz ation” because Korn-F erry

had revoked their access credentials.

W e affirm Nosal’s conviction on the CF AA counts.

II. C O N V I C T I O N S U N D E R T H E E C O N O M I C E S P I O N A G E A C T (EEA)

The jury con v icted Nosal of two counts of trade secret theft under the EEA: Count 5 charg ed “unauthoriz ed downloading

, copy ing a

nd duplicatin g of trade secrets” in violation of 18 U.S.C. §§ 1832(a)(2) & (a )( 4 ) ; and Count 6 charg ed unauthoriz ed receipt and possession o f s tolen trade
secrets in violation of 18 U.S.C. § 1832(a)(3) & (a)(4). B oth
counts r elate to Christian’s u se of F H’s log in credentials to obtain three source lists of CF Os from Searcher. Count 6 also included a “cut and paste” of a list of ex ecutives derived from Searcher. Christian email ed Nosal the resulting lists, which contained candidate names, c o m pany positions and phone numbers. Nosal primaril y challeng es the sufficiency of the evidence on the trade secret counts.

A. Suf f iciency of

the Evidence—Counts 5 and 6

Vi o l a tion of the EEA requires, among other thing s, “intent to convert a trade secret” and “ intendi n g or knowing that the o ffense will[ ] injure [ an] owner of that trade secret

. . . .” 18 U.S.C. § 1832(a). The jury instruction for Coun tU N I T E D S T A T E S V

. N O S A L 31

5—downloading

, copy ing and duplicating trade secrets—set out the following elements:

1. At least one o f t h e three source lists is a tra d e secret (requiring ag reement on which one);

2. Nosal knew that the source list was a trade secret;

3. N o s a l k n o w i n g l y , a n d w i t h o u t authoriz ation, d ownloaded, copied o r duplicated the trade secret;

4. Nosal intended to convert the trade secret to the economic benefit o f someone other than the owner;

5. Nosal knew o r i ntended that the offense would injure the trade secret owner; and

6. The trade secret was related to or included in a product in interstate commerce.

The instruction for Count 6—receiving and possessing trade

secr e t s

— replaced the third element w ith a requirement o f knowing r e c e ipt or possession of a trade secret w ith the knowledg e that i t w a s “stolen or appropriated, obtained, o r converted without authoriz ation” and added the “cut a nd paste” list as one of the possible trade secrets.

Nosal a rg ues that the g overnm e nt failed to prove: 1) secrecy and difficulty of development, because the search informa t i o n w as d erived f rom p ublic sources and becauseU N I T E D S T A T E S V

. N O S A L 32

there was no evidence the source lists had not been circulated outside Korn/F erry ; 2) knowledg e of trade secret status; and 3) knowledg e of injury

to, or an intent to injure, Korn/F e rry

.

The notion of a t r a d e secret often conjures up mag ic formulas, like Coca Cola’ s p r oprietary formula, technical drawing s or scientific data. So it is no surpr i s e t h at such technically c omplex c ases have b een b r oug ht under the E E A

. See, e.g. , United States v. Chung

, 659 F

. 3d 815, 819 (9th Cir. 2011) (docum e n ts related to space shuttles and rockets); United States v

. Y

a n g , 281 F .3d 534, 540 (6th Cir. 2 002) (scientific research in adhesiv e s ); United States v

. H su , 155 F

. 3d 189, 191–92 (3d Cir. 1998) (processes, methods a nd formulas for manufacturing an anti-cancer drug ).

B u t the scope of the EEA is not limited to these categ ories and the EEA, by its terms, includes finan c i a l and business information. The EEA defines a trade secret as

all forms and ty

pes of financial, business, scientific

, technical, economic, or eng ineering information, including

. . . compilations

. . . if (A) the owner thereof has taken reasonable

measures to keep such information secret; a nd (B ) the information derive s independentU N I T E D S T A T E S V

. N O S A L 33

economic value, actual or potential, from not being g enerally known to, and not being readily ascertainable throug h proper means b y the public . . . .

18 U.S.C. § 1839(3). 1 5

The thrust of Nosal’s arg ument is that the source lists a re composed larg ely

, if not entirely

, of public information a nd therefore couldn’t p ossibly be trade secrets. B ut he overlooks the principle that a trade secret may consist of a compilation of d a t a , public sources or a c o mbination of proprietary a nd public sources. I t is well recog niz e d that

it is the secrecy o f

the claimed trade secret as

a whole that is d eterminative. The fact that

some or all of the components of the tr a de

s ecret are well-known does not preclude
p r o t e c t i o n f

o r a s e c r e t c o m b i n a t i o n , compilation, or integ ration o f the individual elements.

. . . [ T] he theoretical possibility o f reconstructi ng the secret from published materials c o ntaining scattered references t o portions of the information or of ex tracting it from public materials u nlikely to come to the attention of the appropriator will not preclude relief ag ainst the wrong ful conduct . . . .

15 T h is w as th e tex t o f § 1 8 3 9 at th e tim e th e o f f en ses w ere co m

m itted

. Co n g ress recen tly am en ded § 1 83 9
, rep lacin g “ th e p u b lic” w ith “ an o th er p erso n w h o can o b tain eco n o m ic v alu e f ro m t h e d isclo su

re o r u se o f th e in f o rm atio n .” Def

e n d T r a d e Secrets A ct o f 2 0 1 6
, P u b

. L

. N o

. 1 1 4

- 1 5 3
, § 2 (b )(1 )(A ), 1 3 0 Stat. 3 7 6 , 3 8 0

.U N I T E D S T A T E S V

. N O S A L 34

Restatement (Third) of Unfair Competition § 39 cmt. f (1995); see also Computer Care v. S er v

. Sys. E

nters., Inc.
, 982 F

. 2d 1063, 1074 (7th Cir. 1992) (“A trade secret c an ex ist in a combination of c haracteristics and components, each o f which, by itself, is in the public d omain, but the un i f i ed
process desig n and operation of which in unique combination affords a competitive advantag e and is a protectabl e t r a de secret” ( i n ternal citation omitted)); Boeing Co. v. Sierracin Corp.
, 738 P.2d 665, 675 (W ash. 1987) (holding th a t “trade
secrets frequently contain elements that by them s e lves may be in the public domain but tog ether q u alify as trade secrets”). Ex pressed differently

, a compilation that affords a competitive advan t a g e a

nd is not readily ascertainable f alls within the definition of a trade secret.

The source lists in question are classic ex amples of a trade
secret that derives from an amalg am of public and proprietary

source data. T o be sure, some o f the data ca m e f rom public

sources and other d ata came from internal, c o n fidential

sources. B u t cumulatively

, the Searche r d a tabase contained

a massive confidential compilation o f d a t a , the product o f
y ears of effort a

nd e x pense. E a ch source list was the result o f

a query run throug h a propriety a lgorithm that g enerates a custom subset of possible candidates, culled from a database of over o ne million ex ecutives. T h e source lists were not unwashed, pu b l ic-domain lists of all financial ex ecutives in the U nited States, nor otherwise related to a search that could be readily completed using public sources. Had t h e q u ery been “who is the CF O of General Motors” or “who are all o f the CF Os in a particular industry ,” our analy sis m i gh t b e different. I n stead, the nature of the trade secret and its value stemmed from the u nique integration, compilation,

c ultivation, a

nd sorting of, and the ag g ressive p rotections applied to, the Searcher database.U N I T E D S T A T E S V

. N O S A L 35

Nosal takes the view that the source lists are mere l y customer lists that cannot be protected as trade secrets. This characteriz ation a ttempts to sidestep the unique nature of the

source lists, which are the c u s tomiz e d product of a massive database, not a list of well-known c u stomers. Reg ard l e s s , courts have deemed customer lists protectable trade s e crets. See, e.g. , Hollings w o r th Solderless Terminal Co. v. Turley

, 622 F .2d 1324, 1332–33 (9th Cir. 1980) (setting out in detail how to analy

z e whether a customer list is a trade secret); Hertz v. Luzenac Grp.
, 576 F .3d 1103, 1114 (10th Cir. 2 009) (holding that a customer list may be a trade secr et w h ere “it is t h e e n d r e sult o f a long process of culling the relevant information from leng thy and div e r s e s ources, even if the orig inal sources are publicly available”).

Our approach is not novel. This case is remarkably similar
to Conseco F

inance Servicing Corp. v. Nor t h American Mortgage Co.
, 381 F .3d 811 (8th Cir. 2004). Conseco was a financial services company that issued subprime mortg ag es. Id. at 814. I t g enerated potential custom e r l e ads throug h a database of information on over 4 0 million individuals. Id. at 815. A computer prog ram compiled lists of potential customers, which were sent to branch o ffic e s as “customer lead sheets, ” co d ed from most p romising (red) to decent (blue). Id. S ev er a l departing staff took copies of the lead sheets and we n t t o work for a competitor. Id. at 8 16. Even
t h o u g h all the information in the lead sheets was public, t h e Eig hth Circuit held that they were trade secrets: th e y “ are a product of a s p e cializ ed—and a pparently quite e ffective—U N I T E D S T A T E S V

. N O S A L 36

computer prog ram that was u ni q uely Conseco’s.” Id. at 819. 1 6

Nosal also takes aim a t t h e s e crecy of the three source lists in question, a

n argu m e n t t hat is intertwined with his public domain/compilation c laim. The jury heard more than
enoug h e vidence to support its v erdict. Christian acknowledg ed that the only p lace she could obtain the source lists she n eeded w a s on Korn/F erry ’s computer sy stem. Notably

, some of the downloaded information came from a

source list f

or an e n g ag e ment t h a t was opened only twelve day s p rior to the April 12 down l o a d s u nderlying the trade
secret counts.

Althoug h Nosal claims that Korn/F e rry ’s sharing o f lists with clients and others undermined t h i s claim of secrecy , witnesses who worked at Korn/F e rry did not b udg e in terms of procedures undertaken to keep the data secret, both in
terms of technolog y protections built into the computer sy stem a nd the limitations on distribution of the search results. F or ex ample, the Vice-President of I n formation Services testified that, to her knowledg e, the source lists h ad

never b een released by

Korn/F erry

to any third parties. As a matter of practice, Korn/F e r r y did not show source lists to clients. I n the occasional instance when a client was g iven a

source list or shown one a t a pi t c h

, i t was provided on an understanding of confidentiality

, and disclosing the lists was

16 S ee a lso Riven d

ell Fo rest Pro d

s., Ltd

. v. Ga .-Pa c. Co rp

. , 2 8 F.3 d 1 0 4 2
, 1 0 4 6 (1 0 t

h Cir. 1 9 9 4) (d ef

i n in g a trad e secret as in clu d in g “ a sy stem

w h ere th e e l em en ts are in th e p u b lic d o m ain

, b u t th ere h as b een

acco m plish ed an ef

f ectiv e, su ccessf

u l an d v alu ab le in teg ratio n o f t h e p u b lic do m ain elem en ts an d th e trad e secret g av e t h e claim an t a

co m petitiv e ad v an tag e w

h ich is p ro tected f

ro m m isap p ro p riatio n ”).U N I T E D S T A T E S V

. N O S A L 37

c o ntrary to company policy

. I t is also w ell established t h at “confidentia l d isclosures to employ e e s, licensees, o r others will n ot destroy the information’s status as a t r a de secret.” Restatement (Third) of Unfair Competition § 39 cmt. f (1995).

I n lig ht o f the above, it wo u l d b e naive to conclude that Nosal w as unaware that the information pirated by Christian inclu d ed trade secrets or that the piracy would harm Korn/F erry

. A s a former senior ex ecutive a t Korn/F e rry , Nosal was deepl y f

a m iliar with the c ompetitive advantag e Searcher provided, a n d was cog niz a n t of the measures the
company took to protect the source lists g enerated. He sig n ed

a confidentiality ag r eement stating that “information databases and company records are ex tremely valuable a ssets of [ Korn/F erry ’s] business a n d a re accorded the leg al protection applicable to a company ’s t r a d e secrets.” The

source lists were also marked “Korn/Fe r r y Proprietary & Confidential.” W hile a label or p ropri e t a r y marking alone does not confer trade secret status, the notice and p r o t e c t i v e

measures taken by Korn/F erry sig n i f icantly undermine Nosal’s claim he was unaware the source lists were trade secret information.

Nosal’s arg ument that he and his colleag u e s were

unaware their actions w ould harm Korn/F erry a l s o holds no water. They

launched a direct competitor to Korn/F erry and
went to g reat leng ths to access the source lists, fully aware o f the competitive advantag e Searcher g ave Korn/F e rry as they attempted to populate their o w n database. Christian underscored the value of the lists throug h her testimony that she and Nosal used the s o urce lists to complete searches faster and g ain credibility w ith clients. They recog niz ed that the r equired substantial investment of time, money and elbowU N I T E D S T A T E S V

. N O S A L 38

g rease to even try to replicate the source lists would have destroy e d their prime value—immediacy

.

At trial, Nosal’s counsel endeavored to attack the secrecy , knowledg e and other e lements of the trade secret counts. The jury heard e x tensive testimony and arg ument. Construing the evidence in the lig ht most f a v orable to the g overnment, a rational juror could have concluded that the evidence supported convictions under §§ 1832(a)(2), (3) and (4) of the EEA. A s the Supreme Court ex p lained just this y ear, our “limited review does not intrude on the jury ’s role ‘to resolve conflicts in the testimony

, to weig h the e vidence, and to draw

r e asonable inferences from basic facts to u ltimate facts.’” Musacchio

, 136 S. Ct. at 715 (quoting Jackson

, 443 U.S. at 319). I t was no stretch f

or the jury to conclude that the source lists were trade secrets, that N osa l k new they were trade
secrets and that Nosal knew stealing the source l i sts would harm Korn/F erry by helping a competitor—Nosal’s o wn company

.

B. Conspiracy Jury Instruction

W ith r espect to trade secrets, the c onspiracy j u ry instruction stated that “the g over n ment need not prove the

ex istence of actual trade secrets and that D efendant knew that the information in question was a trade secret. However, the
g overnment must p rove that Defendant firmly be l i ev e d that certain information constituted trade secrets.” Nos a l a rg ues that the court constructively amended the indictment because the indictment alleg es the f t of actual trade secrets while the jury instruction did not require proof o f actual trade secrets. Constructive amendment occurs where “the crime charg e d is substantially chang ed at trial, so that it is impossible to know whether the g rand jury would h a v e indicted for the crimeU N I T E D S T A T E S V

. N O S A L 39

a c t u ally proved.” United States v. Howick

, 263 F .3d 1056
, 1063 (9th Cir. 2001) ( c itations and alterations omitted). Here, there was no constructive amendment. I n indicting N osal for theft o f trade secrets under 1 8 U.S.C. § 1832(a), the g rand jury necessarily considered whether N osal “knowing ly ” stole the source lists; “firmly b e lieved” is a lesser stan d ard. A
g rand jury that indicted on this more inclusive “knowing ” standard would necessarily have indicted o n t h is lesser standard.

I n a related vein, N osal claims that the instruction unfairly

removes the requirement to prove an actual trade secret. The instruction reflects o ur circuit’s precedent o n conspiracy charg es—a conviction may be upheld even where the object of the crime was not a leg al possibility

. See United S tates v

. Rodriguez

, 3 60 F

. 3d 949, 95 7 ( 9th Cir. 2004) (upholding convictions for conspiracy to rob cocaine traffi c k ers where “neither the n arcotics nor the narcotics traffickers actually

ex isted” since “[ i] mpossibility is not a d e f e n se to [ a] conspiracy charg e”). We ag ree with the o t h e r circuits that have applied this same p r inciple to trade secrets. S ee Y ang , 281 F .3d a t 544 (holding that the g overnment did not need to prove theft of actual trade secrets because the defendants “intended to commit the crime and took a substantial step towards c ommission of the crime”); United States v. Martin
, 228 F .3d 1, 1 3 (1st Cir. 2 000) (holding the “key q uestion is whether [ the defendant] int e n ded to steal secrets,” not whether h e actually did); Hsu
, 155 F .3d at 204 (“A defendant

can b e convicted of attempt or c onspir a cy p u rsuant to 18 U.S.C. §§ 1832(a)(4) or (a)(5) even if h is intended acts

were leg ally impossible.”). I n any event, the jury found theft of actual trade secrets, and therefore any error was harmless. See Neder v. United States , 527 U.S. 1, 19 (1999).U N I T E D S T A T E S V

. N O S A L 40

C. Evidentiary Challenges

Nosal disputes e v identiary ruling s made reg arding his non-competition ag reement. A lthoug h Nosal was permitted
to testify that he believed the ag reement was illeg al, the court struck certain testimony by g overnment witnesses abo u t the
ag reement and also preclude d evidence about the enforceability of the ag reement under California l a w. The jury was instructed that whether “Mr. Nosal breached or did
not breach t h is covenant is not relevant to the question o f whether h e is g uilty of the c r imes charg ed in this case.” The district court did not abuse its discretion.

I n c losing rebutt a l

, the g overnment arg ued that Nosal’s

use of the name “David Nelson” showed his intent to conspire
to steal information from K o rn /F erry

. I mportantly

, the
g overnment did not link Nosal’s charade to the leg ality of the non-competition ag reement. This pass i n g reference, which

was not objected to at trial, was harmless and certainly does not rise to the level of plain error.

III. R E S T I T U T I O N O R D E R

The district court awarded Korn/F erry $827,983.25 in restitution. W e review de novo the leg ality of the restitution order and r eview for clear error t h e f actual finding s that support the order. U

nited States v

. Luis
, 765 F .3d 1 061, 1065 (9th Cir. 2014), cert. denied

, 1 35 S. Ct. 1572 (2015) (citations omitted). I f the order is “‘within t h e b o u nds of the statutory framework, a restitution order is reviewed fo r abuse o f discretion.’” Id. (citation omitted).

The r esti t u tion order identified three categ o r ies o f recoverable losses: 1) K o r n /F e rry ’ s internal investig ationU N I T E D S T A T E S V

. N O S A L 41

costs incurred in attempting to ascertain the nature and scope of Nosal’s breach, in the amount o f $27,400; 2) the value of Korn/F erry ’s emp l o y e e time spent participating in a nd

as sisting the g overnment’s investig a tion and p rosecution, in the amount of $247,695; a n d 3) the attorney s’ f ees incurred by Korn/F erry in aid of the investig ation o r prosecution of the

o f f ense, in the amount o f $595,758.25. W hile t h e g overn ment asked for a hig her amount, the district court reduced the award, primarily by cutting the req u est for attorney s’ f

e es from $964,929.65 to $595,758.25 for invoices “not demonstrably reasonably necessary to the g overnment’s investig ation and prosecution,” f or “ staffing inefficiencies,” and for “tim e s p e n t o n ‘press’ and file/order reviewing charg es.”

Th e district court relied on the Mandatory Victim Restitution Act (MVRA), which “ma kes restitution mandatory for particular crimes, incl u d ing those o ffenses which involve fraud o r deceit.” Unite d S t a t es v. G ordon

, 393 F

. 3d 1044, 1048 (9th Cir. 2004) (citing 18 U .S.C. § 3663A(c)(1)(A)(ii)). The MVRA requ i r e s that restitution awards “reimburse the victim for los t i n c ome and necessary child care, transportation, and other ex penses incurred during participation in the investig ation or prosecution of the offense

or attendance at proceeding s r elated to the offense.” 18 U.S.C. § 3663A(b)(4). Althoug h the MVRA was passed

as part of the Violence Ag ainst W omen Act and d i rected in part to concern s r elated to women victims o f crime, such a s child care costs, see Pub. L

. 103-322, § 40504, 1 0 8 Stat. 1796, 194 7 (1 994), w e have joined other circuits in holding tha t t h e lang uag e “other ex penses incurred d uring the
p a rticipation in the investig ation o r prosecution” a l s o authoriz es the a

ward o f investig ation costs and attorney s’ fees in some c ircumstances. See, e.g. , United States v. Abdelbary

,U N I T E D S T A T E S V

. N O S A L 42

746 F .3d 570, 574–79 (4th Cir. 2014); United States v. Elson

, 577 F .3d 7 13, 728 (6th Cir. 2009); United States v. W aknine

, 543 F .3d 546, 558–59 (9th Cir. 2 008); Unite d S t a t e s v

. Amato
, 5 40 F .3d 153, 159–62 (2d C ir. 2008); G ordon

, 393 F .3d at 1056–57.

W e must initially d ecide w hether, as Nosal urg e s, th e restitution award is invalid because it ex ceeds the actual loss that the district court determined for the purpos e s of the Sentencing Guidelines U.S.S.G. § 2B 1.1(b)—calculated at $46,907.88. T he a

nswer to that question is found in our observation that “calculating loss under the g uidelines is not necessarily identical to loss ca l c u l ation for purposes o f restitution.” United States v. Hunter
, 618 F. 3 d 1062, 1065 (9th Cir. 2010). Rat h e r, restitution loss is g overned not b y the c riteria of the Sentenc i n g G u idelines, but by the MVRA’s p urpose o f “mak[ ing ] the v i c tim[ ] whole.” Gordon

, 393 F .3d a t 1052 n.6. To this end, t h e plain l a ng uag e o f 1 8 U.S.C. § 3 663A(a)(1) makes restitution mandatory “[ n] otwithstanding any other pro v i sion o f law” and “in addition to

. . . any other penalty authoriz ed by law,” including the Sentencing Gui d e lines. S ee also Amato
, 540 F .3d at 160–62.

I n contrast with the MVRA, w h ich includes ex penses rela t e d to investig ation and prosecution, such costs a re categ orically ex cluded under the Sentencing Guide l i nes applicable here. The g

uidelines provision for actual loss for crimes of fraud ex plicitly ex cludes “costs incurred by v ictims primarily to aid t he g overnment in[ ] the prosecution a nd criminal investig ation of an o f fense.” U .S.S.G. § 2 .B .1.1 cmt. 3(D)(ii). F r om that, Nosa l a p pears to assume, without any support, that “actual loss” is a term-of-art, s u c h that in this categ ory of offenses a restituti on order could never includeU N I T E D S T A T E S V

. N O S A L 43

investig ation costs or a ttorney s’ f ees in aid of the
g overnment. T h a t a ssumption is not warranted under the plain lang uag e of the MVRA, which notably never u s e s the terminolog y

of actual loss.

I n an effort to overcome t h e d ifferences between the MVR A and the g uidelines, Nosal points to our d ecision in United S t a t e s v. Stoddard

, 150 F .3d 1140, 1147 (9th Cir. 1998), which states that “[ r] estituti o n can only be based on actual loss. ” W e a c knowledg e that Stoddard ’s use of the phrase “ a c t ual loss” in discussion of restitution g enerates

some confusion, but Stoddard do es n ot answer the question
at hand. I n Stod

d a r d

, the difference b etween the loss under the Sentencing Guidelines and the restitution award ($30,000

versus $116,223) related to profits that the defendant received from a b usiness opportunity li n k e d t o the fraud, not for
any thing r emotely resembling the investig ation costs at issue here. See id. at 1147–48 (F erg uson, J

. , dissenting ).

Nosal is also mistaken that this reading of the statute creates a circuit split with the Seventh C i r c u it. See United St a t e s v. Dokich

, 614 F .3d 3 14, 318–20 (7th Cir. 2010). Dokich addressed whether a $55.9 mi llion restitution award

was calculated using intended loss or actual loss. B ased on

an unclear record

, t h e c o urt was forced to conclude that the restitution award (which was hig her than the $20–$50 million loss used for sent e ncing under the g uidelines) was based on intended loss, not actual loss, and therefore barred. Id. As in Stoddard

, the case had n othing to do with inclusion o f investig ation costs as part of the restitution loss calculation.

Having determined that the restitution award was “within the bounds of the statuto r y framework,” we turn to whether the district court neverthel e s s abused its discretion inU N I T E D S T A T E S V

. N O S A L 44

awarding nearly $1 million in restitution

. S ee W aknine

, 543 F .3d at 555 (quot i n g Gordon

, 393 F .3d at 1051). W ith respect to investig ation c osts a nd attorney s’ fees, our rule is clear: restitution for such losses “‘may be recoverab l e ’” where the harm was the “‘direct and foreseeable result’ of the d e f endant’s wrong ful conduct

. . . .” G ordon

, 393 F. 3 d at 1057 (quoting United States v

. P h illips

, 367 F .3d 8 4 6
, 863 (9th Cir. 2004)). But see Amato
, 540 F

. 3d at 162 (disag reeing

w ith Gordon ’s approach o f basing restitution o n t h e foreseeable results o f the criminal conduct). W e require the
g overnment to present evidence “demonstrat[ ing ] that it was reasonably

necessary for [ the victim] to incur attorney s’ and investig ator’s fees to p articipate in the investig ation o r prosecution of th e o ffense.” W aknine

, 543 F .3d at 559. Unlike some other circ u i t s, see, e.g. , United S tates v

. Papagno
, 639 F .3d 1093, 10 9 9

– 1100 (D.C. Cir. 2011), we have “‘adopted a broad

view of the restitution authoriz ation [ for investig ation costs]

. ’” Gordon

, 3 9 3 F .3d at 1056–57 (alteration in orig inal) (quoting P hillips , 367 F .3d at 863).

W e appl a ud the district court’s thoroug h review of the voluminous time and fee records s u bmitted by the
g overnm ent and Korn/F erry

. W e ag ree with the award for internal investig ation costs to uncover the ex tent of the breach and for the v alue of employ ee time spent participating in the
g o v e r n m ent’s investig ation and prosecution. See, e.g. , U nited States v. De La Fuente
, 353 F .3d 766, 773 (9th C ir. 2 003) (upholding an award for a “clean u p a nd decontamination”
costs in resp o n s e to an anthrax scare); United States v

. Hosking

, 567 F .3 d 329, 332 (7th Cir. 2009) (holding that restitution inclu d e d t h e v alue of “[ t] he time and effort spent b y the bank’s employ ees and outside professionals i n

u n r aveling the twelve-y ear embez z lement scheme ” ).U N I T E D S T A T E S V

. N O S A L 45

However, we part way s with the district court a nd t h e g overnment with respect to Korn/F e rry ’ s attorney s’ fees.

W h ile the district court’s reduction of the fee award was

a step in the rig ht directi o n , our review o f the record convinces us that the court should have g one further. Several principles g uide this conclusion. To beg in, the fees must be the direc t a n d foreseeable result of the defendant’s conduct. Gordon

, 393 F .3d at 1057 (quoting Phillips

, 367 F .3d a t 863). Nex t, as in o ther attorney s’ fee awards, reasonableness is the touchstone. Reasonableness is benchmarked aga inst the necessity o f the fees under the terms of the s t a tute, thus

ex c luding duplicate effort, time that is disproportionate to the task and tim e t h a t does not fall within the MVRA’s mandate

. 1 7 F inally

, fees are only recoverable if incurred du r ing “ participation in the investig ation or prosecution o f the offense.” 18 U .S.C. § 3663A( b )(4) (emphasis added). The company ’s attorney s are not a substitute for the work of the prosecutor, nor do they serve the role of a shadow prosecutor. To be sure, nothing is w rong wi t h proactive participation. B ut p articipation does not mean substitution o r duplication.

Even after reduction, the total amount of fees awarded is striking, particularly g iven that the trial ultimately involved only three discrete incidents o f criminal behavior. Althoug h resulting in multiple count s , at bottom the events were temporally circumscribed and limited in scope. W e note that

a hig hly dis p roportionate p ercentag e of the fees arose from

17 W e ag ree w ith th e d istrict co u rt’ s d ecisio n to accep t th e h o u rly rate of Ko rn /Ferry ’ s atto rn ey s. Reco g n izin g t h e im p o rtan ce an d im

p act o f th e b reach

, Ko rn /Ferry c a n n o t b e f au lted f o r selectin g an “ ex cellen t ,” or

“ prem iu m ,” law

f irm

.U N I T E D S T A T E S V

. N O S A L 46

responding to requests and inquiries r el a t ed to sentencing

, damag es, a

nd restitut i o n

. The reasonableness of the fees needs to be reex amined to consi d er ( i ) whether the siz eable fee related to restitution matters was reasonable; (ii) whether there was unnecessary dupli c a t i on of tasks b etween Korn/F erry staff and its attorney s since the c ourt a w a rded a substantial sum for the ti me o f Korn/F erry employ e es; a nd (iii) whether the outside attorney s were substituting for o r duplicating the work of the prosecutors, r ather than serving in a participatory

capacity

.

W e vacate the restitution a w ard wi t h respect to the attorney s’ fees and remand for reconsideration in lig ht of the principles and observations set out above.

AF F IRMED, EXCEP T VACATED IN P ART AND R E M A N D E D W I T H R E S P E C T T O T H E RESTITUTION AWARD.

REI NHARDT, Circuit J udg e, dissenting :

This case is a

bout password s h a r ing

. People f requently share their passwords, n otwithstanding the fact that websites and employ ers have p olicies prohibiting it. I n my view, the Computer F raud and Abuse Act (“CF AA”) does not make the millions of people who eng ag e in this ubiquitous, useful, a nd
g enerally harmless conduct into unwitting federal criminals. W h atever other liability

, criminal or c ivil, Nosal may have incurred in his improper attempt to compete with his former employ e r, he has not violated the CF AA.U N I T E D S T A T E S V

. N O S A L 47

The first time this c ase came before u s we e x a m ined

w h e t h e r N o s al’s former c o lleag ues ac t e d “ wi t h o u t authoriz ation, or ex ce e d [ ed] authoriz e d access” w hen they downloaded information from Searcher while still employ ed
at Korn/F erry and shared it with Nosal in violation o f the firm’s policies. United States v. Nosal ( Nosal I)

, 676 F .3d 854, 864 (9th Cir. 2012) (en banc). W e said “ n o , ” r e j ecting the a pproach of a few other circuits which had interpreted the CF AA looking “only at the culpable be h a v ior o f the defendants before them, and fail[ ing ] to consider the effect on millions of o rdinary citiz ens.” Id. at 862. I n doing so, we stat ed that they turned the CF AA into a “sweeping I nternetpolicing man d a t e,” instead o f maintaining its “focus on hacking .” Id. at 8 5 8

. W e emphatically refused to turn violations o f use restrictions imposed by employ ers o r websites into crimes under the C FAA, declining to put so many c itiz ens “at t h e m ercy of [ their] local prosecutor.” Id.
at 862. Since then, both circuits to rule on the po i n t have
ag reed w ith our interpretation. See United Sta t es v. Valle

, 807 F .3d 5 08, 526–28 ( 2d Cir. 2015); W EC Carolina Energy Sols. LLC v. Miller

, 687 F .3d 199, 204 (4th Cir. 2012).

Today

, addressing onl y s l ig htly different conduct, the majority repudiates im portant parts of Nosal I
, jeopardiz ing
most password sharing

. I t loses s i g ht of the anti-hacking
purpose of the CF A A, and despite o u r w arning

, threatens to criminaliz e all sorts o f innocuous conduct eng ag ed in daily b y ordinary citiz ens.

At issue are three incidents of password sharing

. On these occasions while F H wa s still employ ed a t Korn/F e rry , she g ave her password to J a cobson or Christian, who h ad left the company

. Her former colleag ues then used her password
to d ownload information from Searcher. F H was authoriz edU N I T E D S T A T E S V

. N O S A L 48

to access Searcher, but she did not download the information herself b ecause it was easier to let J acobson or Ch r i s t i an do it than to have them ex plain to her how to f i n d i t

. I t would

n ot have been a violation of the CF AA if they had s i m p l y g iven F H step-by -step directions, which she then foll o wed. Thus the question is w hether because J acobson and Christian ins t e ad used F H’s password with her permission, they a re criminally liable for access “without authoriz ation” under the Act. 1

Th e majority finds the answer is “y es,” but in doing so commits the same error as the c ircuits whose v iews we rejected in Nosal I

. My colleag ues claim tha t t h ey do not have to address the effect o f the i r d e c i s ion on the wider population because Nosal’s infelicitous conduct “bears little resemblance” to every

day password sharing

. Notably this is the ex act arg ument the dissent made in No s a l I : “ This case has nothing to do with play ing sudoku, checki n g e mail, [ or] fibbing on d ating sites

. . . . The r o l e of the courts is neither
to issue advisory opinions nor to de clare rig hts in hy pothetical cases.” 676 F .3d at 864, 866 (Silverman, J
., dissenting ) (internal quotation and citation omitted).

W e , of course, rejected the dissent’s arg ument in Nosal I

. W e d i d so because we recog niz ed that the g overnment’s theor y made a ll violations of u se restrictions criminal under the CF AA, whether the vio l a t i o n was innocuous, like checking y our personal email a t w ork, or more objectionable like that at issue here. B ecause the statute was susceptible to

a narrower interpretation, we rejected the government’s

1 No sal w as ch arg ed as cr i m i n ally cu lp ab le f o r J aco b so n ’ s an d Ch ristian ’ s alleg ed v io latio n s u n der a th eo ry o f eith er aid in g an d ab ettin g

o r co n sp iracy

.U N I T E D S T A T E S V

. N O S A L 49

broader reading under which “millions of unsuspecti n g individuals would fin d that they are eng ag ing in criminal conduct .” Id. at 859. The same is true here. The majority does not provide, nor do I s ee, a workable line which separates the consensual password sharing in this case from the consensual password s h a ring of millions of leg itimate
account h olders, wh i ch may also be contrary to the policies of sy stem o w ners. There simply is no limiting principle in the m a j ority ’s w orld of lawful and unlawful password sharing

.
Therefore, despite the majority ’s attempt to c o nstrue Nosal I as only applicable to “ ex ceeds authoriz ed access,” the case’s c entral lesson that the CF AA should not be interpreted
to criminaliz e the ordinary c o nduct of millions of c it i z ens applies equally strong ly h ere. According ly

, I would hold that consensual p assword sharing is n o t t h e kind of “hacking ” covered by the CF AA. That is the cas e w h e ther or not the voluntary password sharing is with a fo r m e r employ ee a nd whether or n o t the f

ormer employ ee’s own password h ad

ex p ired or been terminated.

I.

“Cong ress enacted the CF AA in 1 984 primarily to address the g rowing problem of computer hacking ,” Nosal I
, 6 76 F .3d
at 858. U nited States v. Morris
, the first appellate case under the CF AA, illus t r a t es the core ty pe of conduct criminaliz ed by the Act. 9 28 F

. 2d 504 (2d C i r

. 1991). There a student created a worm which g uessed passwords and ex ploited bug s in computer p rog rams to a c cess military a nd u niversity computers, e ventually causing them to crash. The Second Circuit f ound that the student had accessed those computersU N I T E D S T A T E S V

. N O S A L 50

“ w ithout authoriz ation” in violation o f the Act. I d

. at 5 0 6
, 509–511.

“W ithout authoriz ation” is used in a number o f places
t h r o ug h out the CF A A, but is not defined in the Act. T h e p h r ase appears in two subsections relevant to this case: § 1030(a)(2)(C) and (a)(4). Subsection (a)(2)(C) criminaliz e s “intentionally a c c e ss[ ing ] a computer without authoriz ation

or ex ceed[ ing ] authoriz ed access, a nd thereby obtain[ ing ]

. . . information f

rom any protected compute r.” This is the “broadest provision” of the CF A A. Nosal I
, 676 F .3d at 859. S u bsection (a)(4) in e ssence increases the penalty f o r violating (a)(2)(C) if the perpetrator also acts “with intent to defraud,” and “obtains a n y thing of value.” 2 Nosal was charg ed and convicted under (a)(4).

Our definition of “ w ithout authoriz ation” in this c ase will apply not o nly to (a)( 4 ), b ut also to ( a)(2)(C) and the rest o f the Act. I n Nosal I

, the g overnment contended that “ex ceeds authoriz ation” could b e interpreted more n arrowly in (a)(2)(C) than in (a)(4), b ut w e c onclud e d : “ This is just not

so: Once w e define the phrase for t h e p urpose of subsection 1030(a)(4), that definitio n m u s t apply equally to the r est o f the statute pursuant t o t h e ‘standard principle of statutory construct i on

. . . that identical words and phrases within the

same statute should n ormally be g iven the sam e m ea ning .’” 676 F .3 d at 859 (quoting Powerex Corp. v. Reliant Energy Servs., I nc. , 551 U.S. 224, 23 2 (2007)). That holds h ere. I ndeed, the g overnment so concedes.

2 T h e p en alty f

o r v io latin g § 1 0 3 0 (a)(2 )(C) m ay also b e in creased if th e g o v ern m en t p ro v es an ad d itio n al elem en t u n d er (c)(2 )(B ).U N I T E D S T A T E S V

. N O S A L 51

I t is thus necessary t o c onsider the potential breadth o f subsection (a)(2)(C) if we constru e “without authoriz ation” with less than t h e u tmost care. Subsection ( a)(2)(C)

c riminaliz e s nearly all intentional access of a “prote c t e d

c omputer” w ithout authoriz ation. 3 A “‘protected comput e r ’ is defined a s a computer affected by or involved in interstate commerce—effectively all c o mputers with I nternet access.” See Nosal I

, 676 F .3d at 85 9

. T h i s means that nearly all desktops, l a p tops, servers, smart-phones, a s well as any

“ i P ad, Kindle, Nook, X-box

, B lu-Ray play er or any ot h e r I nternet-enabled device,” incl u d ing even some thermostats qualify as “protected.” Id. at 861. Thus § 1 0 3 0 ( a ) ( 2 )(C)

covers untold millions of Americans’ interactions with these objects every day

. Crucially

, violating (a)(2)(C) does n o t require “any c ulpable intent.” Id

. Th erefore if w e interpret “without a

uthoriz ation” in a way that includes common practices like password sharing

, millions of our citiz ens would become potential federal criminals overnig ht.

3 Co m p u t er is d ef in ed u n d er th e A ct as “ an electro n ic, m ag n etic, o p tical, electro ch em ical, or o th er h ig h sp eed d ata p ro cessin g d ev ice p erf o rm in g lo g ical, arith m etic, o r s t o r a g e f u n ctio n s, an d i n clu d es an y d ata sto rag e f acility o r co m

m u n icatio n s f

acil i t y d i rectly related to or o p eratin g in

co n j u n ctio n w ith su ch d ev ice.” 1 8 U.S.C. § 1 0 3 0 (e)(1 ). S ee a lso Un ited S ta tes v. M

i tra , 4 0 5 F.3 d 4 9 2 (7 th Cir. 2 0 0 5 ) (f in d in g a rad io s y stem is a

co m pu ter); Un i t ed S ta tes v. Kra mer , 6 3 1 F.3 d 9 0 0
, 9 0 2 (8 th Cir. 20 1 1) (n o tin g th e A ct’ s d ef

in itio n of a co m

p u t er “ is ex c eed in g ly bro ad ,” an d

co n clu d i n g an o rd in ary

cell p h o n e is a co m

p u ter).

T o v i o late § 10 3 0 (a)(2 )(C) a p erso n m u st also “ o b tain i n f

o rm atio n ,” b u t it is n earl y i m

p o ssib l e to access a co m p u ter w ith ou t also o btain in g in f o rm atio n

. A s w e n o ted in No sa l I
, o b t a i n i ng in f

o rm atio n in clu des lo o k in g u p a w eath er rep o rt, read in g th e sp o rts sectio n o n l in e, etc. S ee a l so Sen

. Rep

. No

. 1 0 4

- 3 5 7
, at 7 (1 99 6 ) (“ ‘ [O]b tain in g in f o rm atio n ’ in clu des

m erely read in g it.”).U N I T E D S T A T E S V

. N O S A L 52

II.

The majority is wrong to conclude tha t a person

n e c e s s a r i l y a c c e s s e s a com p u t e r a c c o u n t “ wi t h o u t authoriz ation” if he does so without the permission o f t h e sy stem owner. 4 Take the case of an office worker a s k ing a friend to log onto his email in order to print a boarding pass, in violation of the sy stem o wner’s access policy ; or the case of one spouse asking the other to log i n t o a bank website to p ay a b ill, in violation o f the bank’s password shar i n g prohibi t i o n

. There are other e x amples that readily come to mind, such as log g ing onto a c omputer o n b ehalf of a colleag ue who is out o f the office, in violation of a corporate computer access p o l i c y , to send him a document he needs

r i gh t away

. “F acebook makes it a violation of the ter m s o f service to let any one log into y our a c c o u nt,” w e noted in Nosal I
, but “it’s very common for people to let close friends and relatives check their email or acces s t h ei r online accounts.” 676 F .3d at 861 (citing F a c e book Statement o f Rig hts and Responsibilities § 4.8). 5

W a s access in these ex amples authoriz ed? Most people would say “y es.” Althoug h the sy stem owners’ policies

4 T h e term “ sy s tem o w

n er” ref ers to th e cen tral au th o rity g o v ern in g u s er

acco u n ts, w

h eth er th e o w

n er o f a sin g le co m

p u ter w ith o n e o r sev eral u s er

acco u n ts, a w o rk

p lace n etw o rk w i th d o zen s, o r a so cial n e t w o r k in g site, b an k w eb site, o r th e lik e, w ith m illio n s o f

u ser acco u n ts.

5 Fo r ex am

p le, a recen t su

rv ey sh ow ed th at 4 6 % o f p a r e n t s h a v e th e p assw o rd to th eir ch ild ren ’ s so cial n etw o rk in g site, d esp ite th e f act th at th e larg est s ite, Faceb o o k

, f

orb id s passw or d s h arin g

. S ee USC A n

n en berg S c h o o l Cen ter f

o r th e Dig ital Fu tu re, 2 0 1 3 Dig ita l Fu tu re Rep o rt 1 3 5 (2 0 1 3), h ttp ://w

w w .d ig italcen ter.o rg /

w p

- co n ten t/u

p lo ad s/2 0 1 3 /0 6 /2 0 13

- Rep o rt.p d f

.U N I T E D S T A T E S V

. N O S A L 53

prohibit password sharing

, a l eg itimate account holder “authoriz e d” t h e a ccess. Thus, the best reading of “without authoriz ation” in the CF AA is a narrow one: a person

accesses an account “wi t h o u t authoriz ation” if he does so without having the permission of either the sy stem owner or a leg itimate account holder.

This narrower reading is more consistent with the purpose of the CF AA. The CF AA is essentially an anti-hacking statute, and Cong ress intended it as such. Nosal I
, 676 F .3d
at 8 58. Under the preferable construction, the statute would

cover o n l y t hose w hom we would colloquially think of a s hackers: individuals who steal or g uess passwords o r otherwise f

orce their w ay into computers without the consent of an authoriz ed user, not persons who are g iven the rig ht o f

access by those w ho themselves possess that rig ht. There is

no doubt that a ty

p ical hacker accesses an accou nt “without authoriz ation”: the hacker g a ins access without permission

– either from the sy stem owner or a leg itimate account holder. As the 1984 House Report on the CF AA ex plained, “it is

n o teworthy that Section 1030 deals with an unauthori z e d

access concept of computer fraud rather than the mere use o f

a computer. Thus, the conduct prohibited is analog ous to that

o f ‘breaking a

nd e ntering .’” H.R. Rep. 98-894, 20, 19 8 4 U.S.C.C.A.N. 3689, 3706. W e would not convict a man for breaking a

nd entering if he had been i n v i t e d in by a houseg uest, e ven if the homeowner objected. Neither should we convict a man under the CF AA for accessing a computer account w i t h a shared p assword with the consent of the password holder.

Nosal’s cond u c t was, of course, unscrupulous. Nevertheless, a s the Second Circuit found in interpreting the CF AA, “whatever the apparent merits of imposing criminalU N I T E D S T A T E S V

. N O S A L 54

liability may seem to be in this case , w e m u st construe the
statute knowing that our interpretation of [ authoriz ation] will
g overn many

other situations.” V

a lle

, 8 0 7 F .3d at 528. The

c onstruction that we adopt in Nosal’s case will apply w i t h
equ a l f orce to all others, and the reading of “without authoriz ation” we adopt for subsection (a)(4) will apply with equal f orce to subsection (a)(2)C). I would, therefore, hold that h owever r eprehensible Nosal’s conduct may have been, he did not violate the CF AA.

III.

The majority insists that the tex t of the statute requires its broad construction, b ut that is simply not s o

. Citing our d ecision in Brekka

, the majority defines “authoriz atio n ” a s “permission or power g rante d b y an authority .” After appealing to “ordinary meaning ,” “common sense meaning

, ” and multiple dictionaries to corroborate this definition, the majority asserts that the term is “not ambig uous.”

The majority i s w rong

. T h e majority ’s (somewhat

c i r c u l a r ) d i c t i onary definition of “authoriz a t i o n ”

– “permission conferred by an authority ” – hardly clarifies the meaning of the tex t

. W h ile the majority reads the statute to criminaliz e access by those without “permiss i on conferred by ” the sy stem owner, it is also proper (and in fact preferable)
to read t h e t ex t to criminaliz e access only by those without “permission conferred by ” either a leg itimate account holder

or the sy stem owner. The question that matters is not what authoriz ation is but w ho is entitled to g ive it. As one scholar noted, “there are two parties that have plausible claims to [ g ive] authoriz ation: the owner/operator of the computer, a nd th e l e g itimate computer account h older.” O rin S. Kerr,U N I T E D S T A T E S V

. N O S A L 55

Computer Crime Law 48 ( 3 d ed. 2013). Under a proper construction o f the statute, either one can g ive authoriz ation.

The cases the majority cites to support its contention that the statute’s tex t requires a b r oad construction merely repeat dictionary definitions of “without authoriz ation.” Those

cas e s d o n othing to support the majority ’s position that authoriz ation can be g iven only by the sy stem owner. The F ourth Circuit, quoting the Oxford English Dictionary
, f ound that “based on the ordinary

, contemporary , common meaning of ‘authoriz ation,” an empl o y e e “accesses a computer ‘without authoriz ation’ when he g a ins a d m ission to a compu t er without approval.” W EC Carolina Energy S o l u t ions LLC v. Miller

, 687 F .3d 199, 204 (4th Cir. 2012 ). The Six th Circuit, also quo t i n g the Oxford English Dictionary
, ex plained that “[ t] h e plain me a n ing o f ‘authoriz ation’ is ‘[ t] he conferment of leg ality ’ ” a nd concluded t hat “a d efendant who accesses a computer ‘without authoriz a tion’ does so without sanction o r permission.” Pulte Homes, Inc. V. Labo r e r s ’ Int’l Union of N. Am.
, 6 4 8 F .3d 295, 303–04 ( 6th Cir 2011). I n b o t h o f these cases, the important q u estion in Nosal’s c ase

– authoriz ation f

rom wh o m – w ent unanswered. The Second Circuit consulted the Random House Dictionary instead a nd concluded that the “common usag e of ‘ authoriz ation ’
sug g ests that one ‘accesses a computer without authoriz a tion’ if he a ccesses a computer w ithout permission to do so at all

. ” Valle

, 807 F .3d 508, 524 (2nd C i r

. 2 015) (emphasis added). W ith that, I a g ree. Contrary to the majority ’s sug g estion,

none of the cases on which it relies h olds that the requisiteU N I T E D S T A T E S V

. N O S A L 56

permission must come f r o m t he sy stem owner and not a leg itimate account holder. 6

A t worst, the tex t of the statute is ambig uous a s t o w h o may g ive authoriz ation. The F irst Circuit concluded that the meaning of the term “without aut horiz ation” in the CF A A “has proven to be elusive,” EF Cult u r a l Travel B V v

. Explorica

, Inc.
, 274 F .3d 577, 582 n .10 (1 s t C i r

. 2001), a nd

an unambig uous definition eludes the majority e ven n ow. I n that circumstance, t h e rule of lenity requires u s to adopt the

narrower c onstruction – e x actly the construction that is appropriate in lig ht of the CF AA’s anti-hacking purpose a nd

concern for the s t atute’s effect on the innocent behavior o f millions of citiz ens. The tex t provides no r e f u ge for the majority

.

As the Supreme Court has repeatedly held, “where there is ambig uity in a criminal statute, doubts are resolved in favor of the d efendant.” United States v

. Bass
, 404 U.S. 336, 348 (1971); see also United States v. Santo s , 5 5 3 U.S. 507, 514 (2008) (“The rule of lenity r equires ambig uous criminal laws
to be interpreted in favor of the d efenda n ts subjected to them.”). I f a “choice has to be made between two reading s o f what conduct Cong ress h as made a c r ime, it is appropriate, before we choose the h arsher alternative, to r e q u ire that Cong r ess should have spoken in lang uag e that i s c lear a nd definit e

. ” Jones v. United States
, 529 U.S. 848, 858 (2000) (quoting United States v. U niversal C.I.T. Cre dit Corp.
,

6 T h e T en th C ircu i t c a s e t h e m aj o rity cites, Un ited S ta tes v. W i llis

, 4 7 6 F.3 d 1 1 2 1 (1 0 th C ir. 2 00 7 ), h as n o t h in g to d o w ith th e m ean in g of

“ w ith o u t au th o rizatio n .” In f

act, W illis d i d “ n ot co n test th at h e p ro v i ded

. . . u n au th o rized access” to th e w eb site at issu e. “ He m erely arg u e[d ] th at h e h ad n o in ten t to d ef

rau d in so d o in g . . .” Id . at 1 1 2 6

.U N I T E D S T A T E S V

. N O S A L 57

344 U.S. 218, 221–22 (1952)) ( internal q uotation marks omitted). W e are therefore bound t o a d o p t the c onstruction of CF A A that criminaliz es access only b y th ose without
p ermission f

rom either an account holder or the sy s t e m

owner. S ee a lso, e.g. , Nosal I

, 676 F .3d at 863 (apply

ing the rule of lenity to the C FA A); Valle

, 8 07 F .3d at 527 (same); Miller , 687 F .3d at 204 (same).

The “venerable” r

ule of lenity ensures that individuals a re

on notice when they act. Santos
, 553 U

. S

. at 514. I t “vindicates the fundamental principle that no citiz en should b e held accountable for a violation o f a statute w ho s e commands are uncertain. . . .” Id

. W e must, therefore, read the CF A A not just in the harsh lig h t of the courtroom b ut also f r o m the perspective of its potential violators. 7 I n t h e every day situation that should concern us a l l

, a friend o r colleag ue accessing an a ccount with a shared password would
most certainly believe – and with g o o d reason – that his

access h ad been “ authoriz ed” by the account hol d er w ho shared his password with him. Such a p e r s o n , accessing an account with the ex press a uthoriz ati o n o f its holder, would

7 Mo ska l v. Un ited S ta tes , 4 9 8 U.S. 1 0 3 (1 9 9 0), relied o n b y t h e m aj o rity f o r th e claim th at “ th e ru le o f len ity is n o t trig g ered [sim p ly ] b ecau s e i t is

‘ p o ssib le to articu late’ a n arro w er co n stru ctio n o f th e statu t e,” is f u lly

co n sisten t w i th m

y read in g

. H ere, t h e n arro w er read in g rises ab o v e th e p o ssib le an d ev en th e plau s ib le : i t is th e n atu ral read in g f

ro m th e p ersp ectiv e o f a n

u m b er o f th e law ’ s p o ten tial v io lato rs. Mo r e o v er, b ecau se th e n arro w er i n terp retatio n b etter h arm o n i zes w ith th e an t ih ack in g pu rp o se o f th e C FA A
, t h e am b ig u ity h ere i s e x a ctly th e k in d Mo ska l said d

o e s t r i g g er th e ru le o f l en ity : “ reaso n ab le d o u b t p ersists ab o u t [th e] statu te’ s in ten ded s co p e ev en after reso rt to ‘ th e lan g u ag e an d

s t r u ctu re, leg islativ e h isto ry , an d m o tiv atin g p o licies’ o f t h e statu te.” Mo ska l v. Un ited S ta tes , 4 9 8 U.S. 1 0 3
, 1 0 8 (1 9 9 0 ) (citin g Bifu lco v. Un ited S ta tes , 4 4 7 U.S. 3 8 1, 3 87 (1 9 8 0 )).U N I T E D S T A T E S V

. N O S A L 58

believe that he w as acting not just law fully but ethically

. 8 “I t' s very c ommon for people to let close friends and relatives check their email or access their online accounts,” we said in N o s a l I

. “Some may be aware that, if discovered, they m a y suffer a rebuke from the I S P or a loss of access, but few imag ine they mig ht be marched off to f ederal prison for doing

so. ” 676 F .3d at 861. T he majority ’s construction thus conflicts with the natural interpretation its freshly minted CF AA violator s w o u ld have g iven to “without authoriz ation.” That alone should defeat the majority ’s conclusion.

W o rse, however, the majority ’s construction would base criminal liability

on sy stem owners’ access policies. That is

ex a c tly what we rejected in Nosal I

. See 67 6 F. 3 d at 860. P recisely because it is unacceptable in our leg al sy st e m t o im p ose criminal liability o n a ctions that are not p roscribed “plainly and u nmistakably ,” Bass
, 4 04 U.S. at 3 48–49, it is also unacceptable to base “criminal liability on violations of private computer use policies.” Nosal I
, 676 F .3d at 8 60. Not only are those policies “leng thy

, opaqu e , s u bject to chang e and seldom r ead,” id. at 860, they are also p r i v a t e – b y definition not addressed and perh a p s n ot even accessible to shared password recipients who are no t o f f icial users themselves. J ust as the rule of lenity e nsures that Cong ress, not the judiciary

, creates f ederal crimes, Bass
, 404 U.S. at 348, the r u le also ensures that the clear (and public) words o f

8 It i s ev id en t th at No sal is n o t su ch a perso n

. T h is case, h o w ev e r , d if f ers f ro m Bu sh v. Go re , 5 3 1 U .S. 9 8 (2 0 0 0). It is n o t “ a tick et f o r on e train o n l y .” L i n d a Green h o u s e, T h in kin g Ab o ut Th e S

u p reme Co u r t After B us h v

. Go re, 3 5 In d

. L

. Rev

. 4 3 5
, 4 3 6 (2 0 0 2 ). T h e m aj o rity ’ s o p i n i o n crim in alizes th e co n d u c t o f all th e f rien d s an d co lleag u es m en tio n ed ab o v e.U N I T E D S T A T E S V

. N O S A L 59

Cong r ess – not the obscure po l i ci e s o f sy stem o wners

– delimit their scope.

I f this were a civil statute , i t m ig ht be possible to ag r ee with the majority , but it is not. The plain fact is that the Act unquestionably supports a narrower interpretation th a n the maj o r i t y w ould afford it. Moreover, the CF A A is not the only criminal law that g ove r n s c omputer crime. A ll fifty
states have enacted laws prohibiting computer trespassing

. A conclusion that Nosal’s actions do not run afoul of the CF A A need not mean that Nosal is free from criminal liability

, a nd adopting the prope r construction of the statute need not thwart society ’s ability to deter computer crime and punish computer criminals – ev en t h e “industrious hackers” a nd “bank robbers” that so alarm the majority

. 9

IV.

I n construing any statute, we must be wary of the r isks o f “selective or arbitrary enforcement.” U nited S t a tes v

. Kozminski

, 487 U.S. 931, 952 (198 8 )

. The majority ’s construction o f the CF AA threatens ex actly t h at. I t

9 In f act, th e u biq u ity o f state reg u latio n targ etin g co m p u ter tresp assin g

co u n sels in f

av o r o f t h e n arro w er in terp retatio n o f th e f ed eral statu te.

“ C o n g ress h a s t r ad itio n ally b een relu ctan t to def in e as a f ed eral crim e

co n d u ct read ily d en o u n ced as crim in al b y th e States.” Bo n d v. Un ited S ta tes , 1 3 4 S. Ct. 2 0 7 7
, 2 09 3 (2 0 1 4 ) (q u o tin g Ba ss , 4 0 4 U.S. at 3 4 9 ). A s

su ch

, “ w e w i l l n o t b e q u ick to assu m e th at C o n g ress h as m ean t to ef f ect

a sig n if ican t ch an g e in th e sen s itiv e relatio n b e t w een f ed eral an d state crim in al j u risd ictio n .” Id

. at 2 0 8 9

. B ecau se th e s t a t e s are alread y reg u latin g su ch co n du ct, w e d eem ed it ap p ro p riate in No sa l I to p resu m e th at “ C o n g ress act[ed ] in terstitially ” in p assin g th e CFA A

. W e th eref ore ref u sed t o ad o pt a b ro ad er in terp retatio n o f th e A ct in th e ab s en ce o f a clear in dicatio n f

ro m Co n g ress th at su ch a read i n g w as w arran ted

. 6 7 6 F.3 d at 8 57 . T h e sam e is as tru e o f N o sa l II as o f No sa l I

.U N I T E D S T A T E S V

. N O S A L 60

criminaliz es a broad categ ory of common actions that nobody

w o u l d ex pect to be federal crimes. L ooking at the fallo u t from the majority opinion, it is clear that the decision will have “far-reaching effects unintended by Cong ress. ” S ee Miller

, 687 F

. 3d a t 206 (rejecting a broad interpretation o f the CF AA producing

such unintended effects).

Simply p u t, the majority opinion contains no limiting principle. 1 0 A lthoug h the majority disavows the effects of its decision aside from dealing w i t h former employ ees, it may not by fiat order that the reasoning of its decision stop, like politics u sed to, “at the w ater’s edg e.” The s t at u t e say s nothing about employ

ment. Similarly

, Nosal I discussed use restrictions, w hether imposed by an employ er or a third-party website, all in the same wa y

. I t did not even hint that employ ment was somehow special. 1 1 676 F .3d at 860–61.

10 T h e g o v ern m en t h as n o t o ffe red a w o rk ab le stan d ard f or d istin g u ish in g N o sal’ s case f ro m in n o cu o u s p assw o rd sh arin g eith er in th e

co n tex t o f em

p lo y m en t o r o u tsid e o f it. W ith resp ect t o t h i n g s lik e Faceb o o k p assw o r d sh arin g , f o r ex am ple, t h e g ov ern m en t g am ely states th at in o th er “ categ o ries o f co m pu ter u sers,” asid e f

ro m em p lo y ees, d ef en d an t s mig h t b e a b l e to claim p assw ord sh arin g g av e th em

au th orizatio n ev en if it w as ag ain st th e p o licy o f th e w eb site, b u t d o es n o t

o f f er an y l i n e o f i t s o w

n o r ev en a h in t as to w

h at in th e statu t e p erm its

su ch a d istin ctio n

.

1 1 T h e m aj o rity tries to d ism i ss No sa l I as irrelev an t b ecau se in th e en d it o n ly in terp rets “ ex ceed s au th o rized access.” T h is is w ro n g f o r tw o

reaso n s

. First, w

h ile No sa l I ’ s h o l d in g ap p lies directly o n ly to “ ex ceed s

au th orized access,” its d iscu ssio n o f p assw o rd sh arin g af f ects th e m ean in g

o f “ w ith o u t au th o rizatio n ” as w ell. T h i s i s b ecau se th e “ clo se f rien d s [o r] relativ es ” h av e n o rig h t to access F aceb o o k ’ s o r th e em ail p ro v id er’ s

serv ers, u n less th e acco u n t h o ld er’ s p assw o r d s h arin g co n f ers su ch

a u th o rizatio n

. A lth o u g h in No sa l I w e rej ected th e Sev en th Ci r c u i t ’s h o ld in g in In t'l Ai r

p o r t C en ters, L.L.C. v. C itrin
, t h at co u rt co rrectly

o b serv ed th at th e d i stin ctio n b etw een “ ex ceed s a u t h o rized access” an dU N I T E D S T A T E S V

. N O S A L 61

I t is impossible to d iscern from the majority opinion what principle disting uishes author i z ation in Nosal’s case from o ne in w h ich a bank h as clearly told customers that no one but the
customer may access the c ustomer’s a ccount, b ut a husband nevertheless shares his password with his wife to allow her to pay a bill. So long as the wife knows that the bank does not g ive her permission to access its servers in an y m a n n e r, she is in the same position a s Nosal a nd his associates. 1 2 I t is not “advisory ” to ask wh y the majority ’s opinion does not criminaliz e this under § 1030 ( a ) (2)(C); y et, the majority
sug g ests no answer to why it does not.

Even if the majority opinion could be limited solely to employ ment, the c o n sequences would b e equally untoward. Very often password s h a ring b etween a current and past employ e e serves the interest of the em p l oy er, even if the
current employ ee is technically fo r b idden by a corporate policy from sharing his password. F or ex ample, if a current Korn/F erry employ ee were looking for a source list for a pitch meeting which his f ormer colleag u e had created before retirement, he mig ht contact him to a sk where the file h ad been saved. The former employ e e mig h t say “it’s too complicated to ex plain where it is; send m e y our password

a n d I ’ll find it for y ou.” W hen the current e m p l o y e e

“ w ith o u t au th o rizatio n ” is of

ten “ p ap er t

h in .” 4 4 0 F.3 d 4 1 8
, 4 2 0 (7 th Cir. 2 0 0 6 ); see a lso M

iller

, 6 8 7 F .3 d at 2 0 4 ( r e c o g n izin g t h e “ d i stin ctio n b etw een t h ese t erm s is arg u ab ly

m in u te”). Seco n d , an d m o re im po rtan t, No sa l I ’ s cen tral m essag e th at w e m u s t co n s id er th e ef

f ect o f o u r d ecisio n

o n m i llio n s o f o rd in ary citizen s ap plies w ith eq u al f o rce to “ w ith o u t

au th orizatio n ” an d “ ex ceed s au th o rized access.”

12 T o m ak e th e an alo g y ex act, assu m e th e w if

e h ad recen tly

clo sed h er

acco u n t w ith

th e b an k o r w ith d raw

n as a m em b er o f a j o in t- acco u

n t w i th h er h u sb an d an d th u s h ad h er cred en tials rescin d ed

.U N I T E D S T A T E S V

. N O S A L 62

complied and the former employ ee located the file, both would become federal criminals under the majority ’s opinion. I am confident that such innocuous password sharing a mong

c urrent and former employ ees is more frequent than t h e i m p roper password sharing at issue here. B oth employ e e s and Cong re s s w ould be quite surprised to find that the innocent password sharing constitutes criminal c o n d u c t u nder the CF AA. 1 3

Brekka

, cited repeatedly in t h e m a jority opinion, did not threate n to criminaliz e the e very day conduct of millions o f citiz ens. Nor does that case foreclose the preferable construction of t he statute. Brekka primarily addressed the question of whether an employ ee’s violation o f t h e duty o f loy alty could itself render his a ccess unauthoriz ed. 581 F .3d
at 1134–35. Althoug h w e found that a u t h oriz ation in that

case depended “on actions taken by the em p l oy er,” that was to disting uish it from p laintiff’s claim that a uthoriz ation “turns on whether the defendant breached a state law duty o f loy alty to an e mploy er.” Id. B rekka’s a l l e ge d use of an

ex p ired log -in presented a very diffe r e n t situation. B rekka had no possible source of authoriz ation, and acted without having p ermission from e ither an authoriz ed user o r the
sy stem owner. W e therefore had no cause to consider whether authoriz ation from a current employ ee for the u se o f his passwor d (i.e. password sharing ) w ould constitute “author i z a t i on” under the Act. Moreover, it is far less

common for people to use an ex pired or rescinded log

- in

13 T h i s e x am

p le also dem o n s trates th e p ro b lem w ith th e m aj o rity ’ s relian ce o n th e f

act th at

 ̄ l ik e all f

o rm er Ko rn /Ferry em

plo y ees

 ̄ Ch ristian an d Jaco b so n ’ s cred en tials h ad ex p ired

. T h e ex p iratio n of

so m eo n e’ s cred en tials is n o t a reliab le in dicato r o f crim in al cu lp ab ility in
a p assw o rd sh arin g case.U N I T E D S T A T E S V

. N O S A L 63

innocuously than to s h are passwords contrary to the rules promulg a ted by employ ers or website operators. Thus, unlike this case, B rekka did not place ordinary cit i z ens in jeopardy for their every

day conduc t

. That difference alone is dispositive in lig ht of Nosal I

.

I n sum, § 1030(a) ( 2 ) ( C ) covers so larg e a swath of our daily lives that the majority ’ s c onstr uction will “ criminaliz e

a broad rang e o f day

- to-day activity .” Kozminski

, 487 U .S. at 949. Such “[ u] biquitous, sel dom-prosecuted crimes invite arbitrary and discriminatory enforcement.” Nosal I
, 676 F .3d at 861.

V.

Nosal’s case illustrates some o f t he special dang ers inherent in c riminal laws which are frequently violated in the commercial world, y et seldom e nforced. To q uote a recent comment by a justice of the Supreme Court with reg ard to a

s t a t u t e t h a t s i m i l a r l y c o u l d b e u s e d t o p u n i s h indiscriminately : “I t puts a t risk b e h avior that is common. That is a reci p e fo r g iving the J ustice Department a nd prosecutors e normous power over [ individuals] .” Transcript of Oral Arg ument at 38, M cDonnell v. United States , 136 S. Ct. 891 (2016) ( No. 15-474) (B rey e r, J

. )

. I n deed, as this opin ion is being filed, the Supreme Court has issued its decision in McDonnell and reiterated that “we c a n not

co n strue a criminal statute on the assumption that the Government will use it responsibly .” McDonnell v

. U n i ted States , 579 U.S.

__ (J une 27, 2016) (citation o mitted). Here it is far worse. B roadly interpreted, the CF AA is a recipe for
g iving larg e corporations undue power over their rivals, their

e mploy e es, and ordinary citiz ens, as well as affording suchU N I T E D S T A T E S V

. N O S A L 64

indiscriminate power t o the J ustice Department, should we have a president or attorney g eneral who desires to do so.

No s a l w as a senior member of Korn/F erry and intended
to start a competing bus i n e ss. He was also due a million dollars from Korn/F erry if h e abided by his d e p arture ag reement. W hen Ko rn/F erry beg a n its investig a tion o f Nosal’s p ossible malfeasance, it broug ht on ex -F B I ag ents to search throug h Christian’s g a r bag e and follow J acobson around. I t also hired a leading i n t ernational corporate law firm consisting of over 600 lawy ers, O’Melveny and My ers, which charg ed up to $ 1,100 p er h our f o r the time o f some its partners. 1 4 One of O’Melveny ’s lead attorney s had recently left the office of the United States Attorney who would prosecute any case ag ainst Nosal. She referred the case to her former colleag ues personal l y

. O’Melveny also told the prosecutor that the case w as “time-s e n sitive” because Korn/F erry w o uld have to file its civil case shortly

, but that it would provide the prosecutor with the f a c t s n ecessary to “demonstrate the criminal c ulpability of those involved.” The law firm also provided the g overnment w ith the liability theories it believed necessary to convict N osal under the CF AA. L ess than a month a fter O’Melveny a pproached the
go v e rnment, the F B I searched the residences of J acobso n , Christian, and the offices of Nosal’s new business. That same day Korn/F erry filed its civil complaint. I n total, K o rn/F erry soug h t almost a million d ollars in a ttorney s’ fees from N osal

14 It w a s recen t ly rep o rted th at m o re th an a f ew co rp o rate f

irm s, in clu d in g O’ Melv en y ’ s riv al Gib so n , Du n n an d Cru tch er, ch arg e a s

m u ch as $ 2 ,0 0 0 p er h o u r f o r so m e partn ers’ tim e. Natalie Ro drig u ez, Mee t th e $ 2,0 0 0 An Ho u r Atto rn ey , L aw 3 6 0
, J u n e 11
, 2 0 1 6
, h t t p : / / w w w

. l a w 3 6 0

. c o m

/ a r t i c l e s / 8 0 4 4 2 1 /

m e e t

- t h e

- 2

- 0 0 0

- a

n

- h o u r

- a t t o r n e y

.U N I T E D S T A T E S V

. N O S A L 65

to compensate it for the work O’Melveny did to “assist” with the criminal prosecution.

To be clear, I am not impl y ing that there is any misconduct on the part o f t h e prosecution in this c ase. Nevertheless, private assistance of such mag nitude blurs the line between criminal and civil law. Courts h ave long h eld that “a private citiz e n lacks a judicially cog niz able interest in the prosecution or nonprosecution of another.” Linda R.S. v

. Richard D.
, 410 U.S. 614, 6 19 ( 1 9 7 3 )

. Korn/F erry a nd its

co u nsel’s employ

ment o f their overwhelming resources to persuade prosecutors to bring charg es ag ainst an economic competitor has un h e althy ramifications for the leg al sy stem. Civil suits ordinarily g overn economic controversies. T h ere, private p arties may initiate any g ood-faith action at their o wn

ex p ense. I n criminal cases, h owever, the prosecutor w ho “seeks truth and not victims, [and] who serves the law and not factional p urposes” must decide which cases g o f orward a nd which do not. Robert H. J ackson, The Fe de ral Prosecutor
, Address B e f

ore Conference of U .S. Attorney s (April 1, 1940), in 24 J

. Am. J udicature Soc’y 1 8
, 2 0 ( 1 940). These decisions are inevitably a f fected by a va r i e t y of f actors including the severity of the crime a n d the amount o f available resources that must be dedicated to a prosecution.

Prosecutors c annot help but be influ e n ce d b y knowing that they can count on an interested private party to p erfo r m and finance much of the work required to convict a business rival. A s t h e Supreme Court f ound recently : “ Prosecutorial discretion invol v e s carefully weig hing the benefits of a prosecution ag ainst the evidence needed to convict, [ and] the

resources of the public fisc.” Bond v. United States
, 134 S.U N I T E D S T A T E S V

. N O S A L 66

Ct. 2077, 2093 (2014). 1 5 The balance weig hs differentl y when a major international corporate firm will bear much o f the cost w hich w ould otherwise have to be b o r n e b y the prosecutor’s o f

fice. Prosecutors will also be able to use the work product of the coun t ry ’s f inest and most hig hly p aid corporate litig ators, rather than investing its meage r h uman

resources in developing a c omplex commercial case different in kind from the cases it is ordinaril y u s e d to preparing

. 1 6 Undertaking such third-party financed c ases which a United States attorney mig ht not have prosecuted otherwise g ives the appearance of well-financed business interests obtaining the services of the p r osecutorial branch of g ove r n m ent to accomplish their own p rivate purposes, influencing the vast discretio n vested in our prosecutors, and causing the enforcement of broad and ill-defin e d criminal laws seldom enforced ex cept at the behest of th o s e who can afford it. Moreover, to the ex tent that decisions to pursue s u c h c ases

a r e influenced by such ex traneous c oncerns, and p rosecutorial discretion is tilted toward their enforcement, other c r iminal

cases that mig ht otherwise be chosen for p rosecution may well be neg lected and the criminal justice sy s tem itself become distorted.

15 In deed

, th e Co u rt h as reco g n ized th at l i m i ted g ov ern m en t f u n d s

s o m e tim es p l ay an im

p ortan t p art in restrain in g p o t en tial ex ecu ti v e

o v erreach

. S

ee Illin o is v. Lid

ster , 54 0 U.S. 4 1 9
, 4 2 6 (2 0 0 4 ) (f in d in g th at l im ited p o l i ce reso u rces w o u l d b e a p ractical im p ed im en t t o th e

“ pro lif eratio n ” o f

so b riety ch eck p o i n ts); see also Un ited

S ta tes v. Jo n es , 1 3 2 S. Ct. 9 4 5
, 9 5 6 (2 0 1 2) (So to m ay o r, J
., co n c u rrin g ) (arg u in g th at tech n o l o g i e s lik e GP S w h ich lo o sen th e ch eck o f lim ited en f orcem en t b u d g ets m ay

n ecessitate g reater j u d icial o v ersig h t).

16 T h e f act th at th e in terested p arty m ay b e ab le to reco v er its atto rn ey s ’ f ees if th e p ro secu tio n

is su ccessf

u l d o es n ot af

f ect th is an aly sis.U N I T E D S T A T E S V

. N O S A L 67

VI.

“There is n o doubt that this ca s e is d istasteful; it may be far worse than that.” McDon n e l l v

. United S tates, 579 U.S.

__ (J une 27
, 2 0 16). As the Supreme Court said in McDonnell

, “our concern is not w ith tawdry tales of F erraris, Rolex es, and ball g owns. I t is instead with the broader leg al implications of the Government’s boundless interpr e tation” of a federal s tatute. Here, our concern is not with tawdry
t a l es of corporate thievery and ex ecutive searches g o n e wrong

. “I t is instead w ith the broader leg al imp l i cations o f the Gov ernment’s boundless interpretation” of the CF AA. Nosal may have in c urred substantial civil liability

, and may even be subject to criminal prosecution, but I do not believe he has violated the C FA A
, p roperly construed. 1 7 I respectfully

dissent.

1 7 No sal arg u es th at b ecau se th e j u ry w as in stru cted u n d er Pin kerto n , if th e c o n s p i racy co u

n t an d su

b stan tiv e CFA A co u n ts are v acated or

rev ersed

, s o to o m

u st b oth th e trad e secrets co u n ts. T h e g o v ern m en t d oes

n o t co n test th is assertio n in its an sw erin g b rief

. I w o u ld t

h eref o re v acate th e trad e s ecrets co u n ts. S e e Un ited S ta t es v. Ga m b o a -Ca rd en a s , 5 08 F.3 d 4 9 1
, 5 0 2 (9 th Cir. 2 0 0 7 ) (“ A p p ellees

. . . d id n o t raise th e

. . . arg u m en t in th eir b rief

s an d th u s th ey

h av e w aiv ed it.”). Fo r th at reaso n I ex p ress n o in d ep en den t v iew o n th e trad e secrets co u n t s, alth o u g h I h av e su

b stan tial

co n cern s ab ou t th e leg ality o f th e co n v ictio n s o n

th o se co u

n ts as w ell.