En Banc Ninth Circuit To Consider Scope Of Computer Fraud And Abuse Act

On October 27, the U.S. Court of Appeals for the Ninth Circuit ordered rehearing en banc in United States v. Nosal, a case that presents the question of whether an employee who violates his employer's computer-use policy also "exceeds authorized access" to a protected computer in violation of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a)(4). The case raises important issues for private employers of all sizes, for companies concerned with protecting proprietary information, and for Internet companies and users concerned with whether violations of website terms of service will also create civil or criminal liability under the CFAA.

Background

According to a June 2008 indictment, Mr. Nosal previously worked as an executive at a recruitment firm. The Government contends that, after leaving the firm, and even though he was allegedly subject to various non-compete obligations, Mr. Nosal conspired with several remaining employees to obtain information about the firm's clients and contacts with the goal of creating a competing business. The remaining employees had permission to access the firm's computer systems, but only for official purposes and subject to disclosure limitations.

The Government charged Mr. Nosal with conspiring with the remaining employees to exceed their authorized access to the firm's computer systems in violation of 18 U.S.C § 1030(a)(4), which states that whoever knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period....

Mr. Nosal moved to dismiss the § 1030(a)(4) counts, arguing that the phrase "exceeds authorized access" precludes an individual from using access to one part of a computer network to enter an otherwise forbidden part of a network, but that it does not preclude an individual from accessing files that are otherwise freely available. Nosal asserted that the files at issue were open to all employees and that neither he nor his alleged co-conspirators exceeded their authorized access to those files.

The district court agreed with Mr. Nosal and dismissed the § 1030(a)(4) counts, holding that under the Ninth Circuit's decision in LVRC Holdings Inc. v. Brekka1, employees do not exceed...