Source: http://barnespc.com/blog/theft-of-trade-secrets-and-the-computer-fraud-abuse-act/
Timestamp: 2019-04-19 10:17:55+00:00

Document:
Mr. Barnes gratefully acknowledges the assistance of Sprios Avramidis, a 3L at St. John’s Law School, in the preparation of this column.
In the modern world, computers have revolutionized the way business is conducted, but such technological innovation inevitably led to novel methods of conducting crime and civil torts. In 1986, to protect the public from such crime, Congress enacted The Computer Fraud and Abuse Act (“CFAA”). Originally, the statute made punishable, under federal law, various acts aimed at certain “protected computers.” In 1994, Congress amended the CFAA and made available a civil remedy. In recent years, prosecutors and employers alike have used the CFAA to pursue employees who steal trade secrets.
While the statute, at first glance, seems to primarily prohibit external hacking into a computer to steal information, prosecutors and civil plaintiffs have used the CFAA to pursue employees when an employee has authorized access to a computer, but uses such authorized access for an impermissible purpose, such as stealing trade secrets. These cases usually focus on whether the CFAA is triggered when an employee violates his employer’s computer use policy. Recently, in U.S. v. Nosal, the Ninth Circuit held that using a computer with authorized access for an impermissible purpose does not give rise to liability under the CFAA.
In U.S. v. Nosal, Defendant, David Nosal, was employed by Korn/Ferry, an executive search firm. Nosal later quit Korn/Ferry to start his own executive search firm, and he convinced Korn/Ferry employees to supply him customer information from Korn/Ferry’s confidential database. Although Korn/Ferry had a policy that forbid disclosing confidential information, the employees still supplied Nosal with the information. Nosal was charged with aiding and abetting others in exceeding authorized use.
The Ninth Circuit, sitting en banc, held that Nosal did not violate the CFAA because “the CFAA does not extend to violations of use restrictions.” The court based its conclusion on the text and legislative history of the CFAA. It found that the purpose of the CFAA is to “is to punish hacking—the circumvention of technological access barriers—not misappropriation of trade secrets.” Therefore, it concluded that “‘exceeds authorized access’ in the CFAA is limited to violations of restrictions on access to information, and not restrictions on its use.” Then, according to the Nosal Court (and contrary to a more broad interpretation espoused by other courts), the focus is on whether the employee had access to the information used, not that the purpose for which the information was used. Furthermore, the majority held that interpreting the CFAA broadly would create liabilities not intended by Congress. For instance, if an employee, authorized to use a computer, uses that computer to check Facebook, in violation of his employer’s policy, that employee could, in theory, be criminally liable under the CFAA because the employee exceeded his authorized access by violating his employer’s policy.
Although the narrow interpretation provided by the Ninth Circuit was met with criticism as being too lenient, the Fourth Circuit explicitly adopted the Ninth’s Circuit narrow interpretation. In WEC Carolina Energy Solutions LLC v. Miller, Defendant, Mike Miller, was employed by Plaintiff, WEC Carolina Energy Solutions LLC. In April 2010, he resigned from his position and, twenty days later, gave a presentation on behalf of WEC’s competitor to a potential customer. During this presentation, Miller used WEC proprietary information, which he acquired while working for WEC.
Although the narrow interpretation is more favorable towards employees, the majority of the Circuits, as pointed out by the Nosal dissent, have adopted a broad interpretation. Specifically, the First, Fifth, Seventh, and Eleventh Circuits have embraced a broad interpretation. In those circuits, the court is more likely to focus on what purpose the information was accessed for, not whether the person accessing the information had the sufficient authorized access. Therefore, in those circuits, the theft of trade secrets by an employee authorized to access the trade secrets may trigger CFAA liability.
In EF Cultural Travel BV v. Explorica, Inc., defendant Phillip Gormley, vice president of Explorica had a confidentiality agreement with his former employer, plaintiff EF Cultural Travel BV. To gain an advantage over the competition, Gormley created a scraper program using proprietary information of Plaintiffs, which was not easily obtainable by outsiders. The scraper program utilized this proprietary information to scan Plaintiffs website to create a database of prices of tours offered by Plaintiff in previous years. Using this database, defendants were able to undercut Plaintiff’s prices.
The First Circuit held that using this proprietary information, in violation of Gormley’s confidentiality agreement, was a violation of the CFAA because Gormley exceeded his authorized access. By violating the confidentiality agreement, Gormley had exceeded the authorization that Plaintiff gave him. Defendants further argued that the information was not proprietary because any outsider could gather the information given enough time. The court did not accept this argument because defendant’s use of the proprietary information amounted to abuse that went beyond any authorized use of Plaintiff’s website.
In United States v. John., Defendant, Dimetriace Eva–Lavon John, was employed as an account manager at Citigroup. In this position, Defendant had access to the computer system and the customer account information contained within. With this access, she supplied her brother with information relating to numerous corporate accounts. This information enabled her brother to fraudulently charge the accounts.
The Fifth Circuit held that Defendant violated the CFAA because she exceeded authorized use given to her by Citigroup. The court found that “when an employee knows that the purpose for which she is accessing information in a computer is both in violation of an employer’s policies and is part of an illegal scheme, it would be ‘proper’ to conclude that such conduct ‘exceeds authorized access.’” Furthermore, the court found that “an employer may ‘authorize’ employees to utilize computers for any lawful purpose but not for unlawful purposes and only in furtherance of the employer’s business.” Any use going against such a policy would be exceeding authorized access.
In International Airport Centers, L.L.C. v. Citrin, Defendant, Citrin, was employed by plaintiffs-affiliated companies to record data on potential real estate transactions. They lent him a laptop to aid him in this job. After collecting data, Citrin decided to quit his job and become self-employed. Before returning the laptop to plaintiffs, he copied all the real estate data from the computer and irreversibly erased the data from the laptop.
The Seventh Circuit used agency law to find that Citrin violated the CFAA. Citrin’s authority to access the laptop arose from his relationship (employment) with plaintiffs. This relationship ended when he violated the duty of loyalty by failing to disclose his adverse interests. Accordingly, the Court found that Citrin had no authority to access the computer “because the only basis of his authority had been that relationship” and the relationship ended when he violated the duty of loyalty.
In United States v. Rodriguez, Defendant, Rodriguez, was employed by the Social Security Administration. As part of his duties, Rodriguez has access to the social security database, which contains sensitive information such as social security numbers, annual incomes, date of births, addresses, etc. Rodriguez was aware of a policy that prohibited obtaining information from the database for a non-business use. Contrary to this policy, Rodriguez used the database for non-criminal purposes such as satisfying his curiosity about relatives and to send letters, flowers, and other goods to females.
The Eleventh Circuit held that Rodriguez violated the CFAA because he exceeded authorized access by not following established business policy. The Administration’s policy stated that the database may only be used for business purposes, but Rodriguez admittedly used the database for personal purposes. The court held that, since Rodriguez went against this policy, he exceeded the authorized access. Rodriguez also tried to argue that he did not exceed authorized access because his use of the information was not criminal as required by John in the Fifth Circuit. The court was not persuaded by this argument because it stated that the CFAA does not focus on how the information is used, but, instead, it focuses on how the information is obtained.
Counsel confronted with a potential CFAA claim with regards to a theft of trade secret claim must first determine whether the local jurisdiction has adopted a narrow or broad view of liability pursuant to the CFAA. If the jurisdiction follows a narrow interpretation, one critical question is whether the employee actually had authorization to use and access the information, not what purpose the information was used for. On the other hand, if the jurisdiction follows a broad interpretation, the employee has less protection and any breach of a computer use policy may lead to CFAA liability.
 Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (2012).
 See Matthew Andris, Comment, The Computer Fraud and Abuse Act: Reassessing the Damage Requirement, 27 John Marshall of Computer & Information Law 279, 283 (2009).
 Andris, supra n. 2, at 285.
 LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009).
 See United States v. John, 597 F.3d 263 (5th Cir. 2010); United States v. Rodriguez, 628 F.3d 1258 (11th Cir.2010); Int’l. Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006); EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001); WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199 (4th Cir. 2012); United States v. Nosal, 676 F.3d 854 (9th Cir. 2012)(en banc); MSCI Inc. v. Jacob, 946 N.Y.S.2d 565 (1st Dep’t. 2012); JBCHoldings NY, LLC v. Pakter, 2013 WL 1149061 (S.D.N.Y. 2013).
 United States v. Nosal, 676 F.3d 854, 863-64 (9th Cir. 2012)(en banc).
 EF Cultural, 274 F.3d at 579.
 United States v. John, 597 F.3d 263, 269 (5th Cir. 2010).
 Int’l. Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418, 419 (7th Cir. 2006).
 Id. When data is normally deleted, the data is still recoverable using special software.. Instead of normally deleting the files, Citrin used a special secure-eraser program that makes erased data irrecoverable. Id.
 United States v. Rodriguez, 628 F.3d 1258, 1260 (11th Cir.2010).
 Compare United States v. Aleynikov, 737 F. Supp. 2d 173, 191-94 (S.D.N.Y. 2010) (narrow interpretation), Univ. Sports Publ’ns Co. v. Playmakers Media Co., 725 F. Supp. 2d 378, 383-84 (S.D.N.Y. 2010) (narrow interpretation) with Mktg. Tech. Solutions, Inc. v. Medizine LLC, No. 09 Civ. 8122(LLM), 2010 WL 2034404, at *7 (S.D.N.Y. May 18, 2010) (broad interpretation), Register.com, Inc. v. Verio, Inc., 126 F.Supp.2d 238, 253 (S.D.N.Y.2000) (broad interpretation).
 See Nexans Wire S.A. v. Sark-USA, Inc., 166 Fed. App’x 559, 563 (2d Cir. 2006)(affirming the district court’s reading of CFAA provision to exclude losses incurred as a result of plaintiffs misappropriation of proprietary information).
 MSCI Inc. v. Jacob, 96 A.D.3d 637, 946 N.Y.S.2d 575, 575 (1st Dep’t. 2012).

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 § 1030
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.