'Don't Go There': Second Circuit Makes It Harder To Bring Claims Against Former Employees Who Take Company Information Without Permission

On December 3, the Second Circuit Court of Appeals became the most recent entrant into the circuit conflict on the question of when and under what circumstances an employee's use of a computer to gain access to unauthorized information constitutes a violation of the Computer Fraud and Abuse Act. Over a dissent, the Court held that an employee cannot be convicted of violating the CFAA when he uses a database, to which he has been granted access, in a manner that is prohibited by company policy. With the Second Circuit joining the Fourth and Ninth Circuits in the minority on the issue, the answer continues to turn on the jurisdiction in which the suit was brought. Employers should take note because the decision reinforces the need to consider carefully whether and how to limit employee access to sensitive company information within its network—e.g., by use of written policy or technical access restrictions—and how those protections will play out in court if an employee takes company information for use in future employment.

Background

The CFAA is the primary tool used by federal prosecutors against criminal hackers. However, it also gives private plaintiffs the right to bring a civil action for compensatory damages and injunctive relief against individuals who cause damage or loss in connection with a violation of the CFAA. 18 U.S.C. §　1030(g). Specifically, the CFAA creates liability for "intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing] . . . information from any protected computer." 18 U.S.C. §　1030(a)(2). In the civil context, the statute is frequently implicated when employees—particularly, departing employees—access company computers for non-company purposes, including to gather information to help a new or prospective employer. Because employees generally have some access to their employer's computer systems, employers bringing suit under the CFAA must typically rely on the "exceeds authorized access" prong of the statute to make out a claim—a harder showing to make than proving one accessed a computer without any authorization.

Exceeding Unauthorized Access

In Valle, the Second Circuit was confronted with the principal question that has divided the federal courts in these cases: Does an employee "exceed authorized access" when, in the course of utilizing his computer (as he is permitted to do for his job), the employee accesses information for unauthorized purposes...