Guilty Verdict In Critical Computer Fraud And Abuse Act Trial

After a two-week trial before United States District Court Judge Edward Chen of the Northern District of California, David Nosal—the named defendant in the seminal Ninth Circuit case, United States v. Nosal—was convicted of three counts of violating the Computer Fraud and Abuse Act ("CFAA").1 Mr. Nosal's conviction demonstrates that, despite the Ninth Circuit's narrow interpretation of the "exceeds unauthorized access" element of the CFAA, the CFAA is still a useful tool to prevent trade secret misuse.

CFAA Allegations Against Nosal

Mr. Nosal's road to trial neatly illustrates the shifting scope of the CFAA. The CFAA imposes both criminal and civil liability on a person who "intentionally accesses a computer without authorization" or "exceeds authorized access" in using a computer, thereby obtaining "information" from a computer that is "used in or affecting interstate or foreign commerce."2 The CFAA is often used in civil litigation as a tool in combination with state law trade secret claims to prevent the misuse of trade secrets and to obtain federal court jurisdiction over such a dispute.

In 2004, Mr. Nosal left the executive search firm Korn/Ferry International and was found to have persuaded current and former employees of the firm to download confidential information from the company's computers and transfer the information to Mr. Nosal to help him start a competing business. After an investigation of Mr. Nosal's conduct that stemmed from an email from Mr. Nosal intercepted by the FBI, he and some of the employees who assisted him in the transfer of information were indicted. The indictment against Mr. Nosal alleged two categories of CFAA violations. Counts 2 and 4-7 alleged that current employees of Korn/Ferry accessed the company's internal database and disclosed competitively sensitive information to Mr. Nosal (the "Insider Counts"). Counts 3 and 8-9 alleged that former employees of Korn/Ferry, including Becky Christian, used a current employee's password to access Korn/Ferry's "Searcher" database and provide Mr. Nosal with confidential source lists (the "Outsider Counts"). The government brought a total of eight criminal counts against Mr. Nosal under the CFAA, accusing him of "aiding and abetting the Korn/Ferry employees in 'exceed[ing] authorized access with intent to defraud.'"3

The Long Road to Trial

The case against Mr. Nosal was filed in the United States District Court for the Northern District of California in 2008. In...