Source: https://newmedialaw.proskauer.com/2009/09/15/citing-plain-language-of-the-computer-fraud-and-abuse-act-ninth-circuit-rules-employees-disloyal-act-does-not-terminate-authorization-to-access-employers-computer/
Timestamp: 2019-04-24 10:04:05+00:00

Document:
The federal Computer Fraud and Abuse Act, 18 U.S.C. §1030, criminalizes access to a computer that is either "without authorization" or that "exceed[s] authorized access," and provides a civil right of action for violations as well. In the last several years, a split has developed in the federal courts on the question of whether an employee’s access to an employer’s computer, even if it was authorized in the ordinary course of business, ceases to be authorized if the purpose if the access is to further an act that is disloyal to the employer. The Ninth Circuit has now weighed in on the issue in an opinion rendered today in LVRC Holdings, LLC v Brekka, No. 07-17116 (9th Cir. Sept. 15, 2009), and has taken a position diametrically opposed to that of an influential Seventh Circuit opinion, International Airport Centers, LLC v. Citrin, 440 F.3d 418 (7th Cir. 2006).
The question of what effect an employee’s disloyalty has on authorization to access an employer’s computer has arisen in numerous cases in which employers have added civil claims under the CFAA in actions brought against employees alleged to have misappropriated of trade secrets. A typical scenario in which such a claim would be made is where, before departing for a new job, the employee is alleged to have copied or transmitted an employer’s computer files for the benefit of a new employer.
Often, what is at stake in such cases is the employer’s ability to maintain an action in federal court. A dispute over misappropriation of trade secrets is likely to involve only state law issues, and unless there is diversity of the parties, there is no basis for jurisdiction in a federal court. But, of course, federal courts have jurisdiction over a CFAA claim, and the trade secret misappropriation claims are then swept into federal court along with the CFAA claim as pendent state law claims.
The Seventh Circuit opinion in International Airport Centers v. Citrin is the ruling that is cited by employers seeking to press CFAA claims in such cases. In that case the circuit, in an opinion written by Judge Posner, ruled that under common law agency principles, an employee who breaches the duty of loyalty to an employer thereby becomes unauthorized to access the employer’s computer, at least for the purpose of furthering an act of disloyalty to the employer. In LVRC Holdings, LLC v Brekka, the Ninth Circuit ruled to the contrary, finding that under the plain meaning of the language of the CFAA, acts of disloyalty on the part of an employee do not render the employee’s access to the employer’s computer unauthorized within the meaning of the statute.
In this respect, the ruling echoes (but does not cite) the recent district court opinion in United States v. Drew, No. CR 08-0582-GW (C.D. Cal. Aug. 28, 2009) (the MySpace "cyberbullying" criminal prosecution). There, the court dismissed a misdemeanor charge of violating the CFAA that was predicated on a user’s alleged violation of the MySpace Terms of Service, finding that it would run afoul of the void for vagueness doctrine because individuals of ‘common intelligence’ arguably would not be on notice that a breach of the terms of a service contract could become a crime under the CFAA.
And conversely, the Ninth Circuit ruling appears to contradict the recent opinion in United States v. Nosal, 2009 U.S. Dist. LEXIS 31423 (N.D. Cal. Apr. 13, 2009), in which the district court declined to dismiss an indictment charging a violation of 18 U.S.C. § 1030(a)(4). The indictment alleged that the statute was violated when a former employee accessed an employer’s computer network to copy proprietary information for use in a competitive enterprise. The court found that the statutory element of intent to defraud in subsection 1030(a)(4) could be found in the employee’s knowing access of electronic records for uses outside their intended purpose. The court in Nosal also rejected the defendant’s argument that because subsection 1030(a)(4) had never been addressed in the criminal context the indictment should be dismissed under the rule of lenity. Citing International Airport Centers, LLC v. Citrin and a number of opinions following it, the court found that there was ample authority in civil cases construing this section to conclude that the CFAA was violated by the ‘access to the employers confidential and proprietary information to advance his own competitive enterprise.
No doubt more will be heard on this issue in the Ninth Circuit, and other courts as well. And eventually, perhaps, the U.S. Supreme Court.

References: §1030
 v. 
 v. 
 v. 
 v. 
 § 1030
 v.