Opinion ID: 215637
Heading Depth: 1
Heading Rank: 1

Heading: lvrc holdings llc v. brekka

Text: We must now address Nosal's argument that Brekka requires us to decide this appeal in his favor notwithstanding the plain meaning of the phrase exceeds authorized access. We held in Brekka that it is the employer's actions that determine whether an employee acts without authorization to access a computer in violation of § 1030. Brekka was an employee at an addiction treatment center who was negotiating with his employer, LVRC Holdings, for the purchase of an ownership interest in the business. During the course of those negotiations, Brekka emailed several business documents to his and his wife's personal email accounts. The negotiations broke down, and Brekka left his employment with LVRC. Brekka, 581 F.3d at 1129-30. LVRC later discovered the emails Brekka had sent to himself and sued him under § 1030(g), which provides for a private right of action under the CFAA. Relying primarily on International Airport Centers, LLC v. Citrin, 440 F.3d 418 (7th Cir.2006), LVRC argued that Brekka acted without authorization because by accessing and emailing the documents he acted contrary to his employer's interest. In Citrin, the Seventh Circuit held that an employee loses authorization to use a computer when the employee violates a state law duty of loyalty because, based on common law agency principles, the employee's actions terminated the employer-employee relationship and with it his authority to access the [computer]. Id. at 420-21. In the Seventh Circuit, therefore, an employee accesses a computer without authorization the moment the employee uses a computer or information on a computer in a manner adverse to the employer's interest. We rejected the Citrin approach as inconsistent with our conclusion that, for purposes of § 1030, it is the action of the employer that determines whether an employee is authorized to access the computer: If the employer has not rescinded the defendant's right to use the computer, the defendant would have no reason to know that making personal use of the company computer in breach of a state law fiduciary duty to an employer would constitute a criminal violation of the CFAA. It would be improper to interpret a criminal statute in such an unexpected manner. Brekka, 581 F.3d at 1135. How is an employee supposed to know when authorization has been revoked if the employer does not inform the employee of the revocation? It was this concern that motivated us to apply the rule of lenity, `which is rooted in considerations of notice [and] requires courts to limit the reach of criminal statutes to the clear import of their text and construe any ambiguity against the government.' Id. at 1135 (quoting United States v. Romm, 455 F.3d 990, 1001 (9th Cir.2006)). Because LVRC had not notified Brekka of any restrictions on his access to the computer, Brekka had no way to know whetheror whenhis access would have become unauthorized. Therefore, as long as an employee has some permission to use the computer for some purpose, that employee accesses the computer with authorization even if the employee acts with a fraudulent intent. In determining that the phrase without authorization encompassed only those situations where a defendant had no authorization to access a computer at all, we also relied heavily on the statutory definition of the phrase exceeds authorized access. Id. at 1133. We rejected the argument that accessing a computer without authorization could mean accessing the computer for unauthorized purposes because to accept such an argument would effectively remove the exceeds authorized access language from the statute entirely. Rather, the sensible interpretation we adopted in Brekka gives effect to both prongs: As this definition [in § 1030(e)(6)] makes clear, an individual who is authorized to use a computer for certain purposes but goes beyond those limitations is considered by the CFAA as someone who has exceed[ed] authorized access. On the other hand, a person who uses a computer without authorization has no rights, limited or otherwise, to access the computer in question. Id. (emphasis added) (second alteration in original). Our decision today that an employer's use restrictions define whether an employee exceeds authorized access is simply an application of Brekka 's reasoning. As we held in that case, [i]t is the employer's decision to allow or to terminate an employee's authorization to access a computer that determines whether the employee is with or `without authorization.' Id. at 1133. Based on the `ordinary, contemporary, [and] common meaning' of the word authorization, id. at 1132 (quoting Perrin v. United States, 444 U.S. 37, 42, 100 S.Ct. 311, 62 L.Ed.2d 199 (1979)), we held that an employer gives an employee `authorization' to access a company computer when the employer gives the employee permission to use it, id. at 1133. Therefore, the only logical interpretation of exceeds authorized access  is that the employer has placed limitations on the employee's permission to use the computer and the employee has violatedor exceededthose limitations. We do face a substantial factual distinction in this case: the existence of access restrictions instituted by the employer. The employee in Brekka had unfettered access to the company computerLVRC and Brekka did not have a written employment agreement, nor did LVRC promulgate employee guidelines that would prohibit employees from emailing LVRC documents to personal computers. Id. at 1129. Therefore, Brekka did not exceed his authorized access any more than he acted without authorization: he was entitled to obtain the information because he had not acted in a way that violated any access restrictions. By contrast, Korn/Ferry employees were subject to a computer use policy that placed clear and conspicuous restrictions on the employees' access both to the system in general and to the Searcher database in particular. By using their authorized access to defraud Korn/Ferry in violation of Korn/Ferry's access restrictions, Nosal's accomplices certainly had fair warning that they were subjecting themselves to criminal liability. For this reason, we conclude that the rule of lenity, which applied with particular force in interpreting the phrase without authorization, does not support ignoring the statutory language and the core rationale of Brekka. Nosal's argument that the government's Orwellian interpretation would improperly criminalize certain actions depending only on the vagaries and whims of the employer is foreclosed by Brekka, which held unequivocally that under § 1030 the employer determines whether an employee is authorized. Id. at 1133, 1135. Therefore, as long as the employee has knowledge of the employer's limitations on that authorization, the employee exceeds authorized access when the employee violates those limitations. It is as simple as that.
The other circuits that have addressed the meaning of exceeds authorized access in the context of employers' access restrictions have also determined that the phrase encompasses such restrictions. In United States v. John, 597 F.3d 263 (5th Cir.2010), the Fifth Circuit held that an employee of Citigroup exceeded her authorized access when she accessed confidential customer information in violation of her employer's computer use restrictions and used that information to commit fraud. The Fifth Circuit stated that at least when the user knows or reasonably should know that he or she is not authorized to access a computer and information obtainable from that access in furtherance of or to perpetrate a crime, the user is subject to prosecution under § 1030. Id. at 271. The Eleventh Circuit recently held that an employee of the Social Security Administration exceeded his authorized access under § 1030(a)(2) when he obtained personal information about former girlfriends and potential paramours and used that information to send flowers or to show up at women's homes. United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir.2010). In so doing, the court distinguished Brekka along the same lines that we do here: [In Brekka, the] treatment center had no policy prohibiting employees from emailing company documents to personal email accounts, and there was no dispute that Brekka had been authorized to obtain the documents or to send the emails while he was employed. Brekka is distinguishable because the Administration told [Defendant] Rodriguez that he was not authorized to obtain personal information for nonbusiness reasons. Id. (citations omitted) (emphasis added). See also EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 583-84 (1st Cir. 2001) (holding that an employee likely exceeded his authorized access when he used that access to disclose information in violation of a confidentiality agreement into which the employee voluntarily entered). For all of the foregoing reasons, we now join our sister circuits.
We do not dismiss lightly Nosal's argument that our decision will make criminals out of millions of employees who might use their work computers for personal use, for example, to access their personal email accounts or to check the latest college basketball scores. But subsection (a)(4) does not criminalize the mere violation of an employer's use restrictions. Rather, an employee violates this subsection if the employee (1) violates an employer's restriction on computer access, (2) with an intent to defraud, and (3) by that action furthers the intended fraud and obtains anything of value. 18 U.S.C. § 1030(a)(4) (emphasis added). The requirements of a fraudulent intent and of an action that furthers the intended fraud distinguish this case from the Orwellian situation that Nosal seeks to invoke. Simply using a work computer in a manner that violates an employer's use restrictions, without more, is not a crime under § 1030(a)(4).
Brekka held that a person accesses a computer without authorization when the person has not received permission to use the computer for any purpose. 581 F.3d at 1135. Today, we clarify that under the CFAA, an employee accesses a computer in excess of his or her authorization when that access violates the employer's access restrictions, which may include restrictions on the employee's use of the computer or of the information contained in that computer. We reaffirm our previous conclusion that an individual who is authorized to use a computer for certain purposes but goes beyond those limitations is considered by the CFAA as someone who has `exceed[ed] authorized access.' Id. at 1133 (alteration in original). Therefore, we REVERSE the district court's decision and REMAND with instructions to reinstate Counts 2 and 4-7 of the superseding indictment.