New Jersey Opinion Calls Into Question Use Of Computer Fraud And Abuse Act To Prosecute Disloyal Employee In Third Circuit

Although the Computer Fraud and Abuse Act (CFAA) is mainly a criminal statute designed to prevent hacking, it also prohibits an employee from accessing an employer's computers "without authorization" or in a manner that "exceeds authorized access." Employers typically attempt to invoke the CFAA when an employee downloads or emails confidential information to use for the benefit of a competitor. In the "disloyal employee" scenario, the employer may file a CFAA claim—often with a claim for misappropriation of trade secrets—because the CFAA provides a basis for federal court jurisdiction, triggers the possibility of enhanced sanctions, and arguably provides a means of protecting confidential information that does not rise to the level of a "trade secret."

In this situation, a common question is whether an employee provided with unlimited access to the employer's computer system, but who uses that access to misappropriate the employer's data, has accessed the employer's computer "without authorization" or in a manner that "exceed[ed] authorized access." In Robinson v. State of New Jersey, Civ. No. 11-6139 (Jul. 26, 2013), a New Jersey district court answered that question in the negative and therefore rejected a CFAA claim.

To put Robinson in context, federal appellate courts are generally split into two camps when evaluating whether an employee's actions were without or exceeded authorization. One school of thought, typified by International Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006), provides an affirmative answer under a cessation-of-agency theory. Courts falling under this school reason that an employee violates the CFAA whenever he uses the employer's computer to misappropriate the employer's confidential information or to facilitate another breach of the duty of loyalty. Under this view, breach of the duty of loyalty immediately terminates the agency relationship and with it any authority to access the employer's computers. The opposing school of thought, exemplified by WEC Carolina Energy Solutions L.L.C. v. Miller, 687 F.3d 199 (4th Cir. 2012), reasons that the plain meaning of the terms "without authorization" or "exceeds authorized access" does not encompass a scenario where the employer allows the employee access to data, and the employee then uses that information improperly.

Until recently, the U.S. Court of Appeals for the Third Circuit seemed to fall within the former camp. In P.C. Yonkers v. Celebrations The...