Ninth Circuit Will Rehear Important Employee Data Theft Case Under The Computer Fraud And Abuse Act

On October 27, 2011, the United States Court of Appeals for the Ninth Circuit agreed to rehear the appeal in United States v. Nosal, 642 F.3d 781 (9th Cir. Apr. 28, 2011). Nosal involves a prosecution under the Computer Fraud and Abuse Act for alleged employee theft of confidential data from an employer's network for the benefit of a competitor. The circumstances under which an insider with a disloyal purpose, such as an employee who has permission to use the employer's network resources, can be charged either civilly or criminally under the CFAA with unauthorized access to a network, or access exceeding authorization, has been the subject of disagreement in the federal courts

As we wrote last April, the panel in Nosal ruled that an employee exceeds authorized access within the meaning of the CFAA "when he or she obtains information from the computer and uses it for a purpose that violates the employer's restrictions on the use of the information." The Nosal ruling narrowly interpreted a prior Ninth Circuit panel opinion in a civil action under the CFAA, LVRC Holdings, LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009). (See prior blog post here.) There, a different panel ruled that under the plain language of the CFAA, an act of disloyalty to an employer, e.g., access to a employer's network for purposes of providing data to a competitor, does not render the employee's access unauthorized within the meaning of the CFAA. The key distinction that the panel in Nosal made from the facts of LVRC v. Brekka, was the existence in Nosal of "a computer use policy that placed clear and conspicuous restrictions on the employees' access" both to employer's...