Although the Computer Fraud and Abuse Act (CFAA) is mainly a criminal statute designed to prevent hacking, it also prohibits an employee from accessing an employer’s computers “without authorization” or in a manner that “exceeds authorized access.”  Employers typically attempt to invoke the CFAA when an employee downloads or emails confidential information to use for the benefit of a competitor.  In the “disloyal employee” scenario, the employer may file a CFAA claim—often with a claim for misappropriation of trade secrets—because the CFAA provides a basis for federal court jurisdiction, triggers the possibility of enhanced sanctions, and arguably provides a means of protecting confidential information that does not rise to the level of a “trade secret.”  

In this situation, a common question is whether an employee provided with unlimited access to the employer’s computer system, but who uses that access to misappropriate the employer’s data, has accessed the employer’s computer “without authorization” or in a manner that “exceed[ed] authorized access.”  In Robinson v. State of New Jersey, Civ. No. 11-6139 (Jul. 26, 2013), a New Jersey district court answered that question in the negative and therefore rejected a CFAA claim.

To put Robinson in context, federal appellate courts are generally split into two camps when evaluating whether an employee’s actions were without or exceeded authorization.  One school of thought, typified by International Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006), provides an affirmative answer under a cessation-of-agency theory.  Courts falling under this school reason that an employee violates the CFAA whenever he uses the employer’s computer to misappropriate the employer’s confidential information or to facilitate another breach of the duty of loyalty.  Under this view, breach of the duty of loyalty immediately terminates the agency relationship and with it any authority to access the employer’s computers.  The opposing school of thought, exemplified by WEC Carolina Energy Solutions L.L.C. v. Miller, 687 F.3d 199 (4th Cir. 2012), reasons that the plain meaning of the terms “without authorization” or “exceeds authorized access” does not encompass a scenario where the employer allows the employee access to data, and the employee then uses that information improperly.

Until recently, the U.S. Court of Appeals for the Third Circuit seemed to fall within the former camp.  In P.C. Yonkers v. Celebrations The Party and Seasonal Superstore, L.L.C., 428 F.3d 504 (3d Cir. 2005), the Third Circuit confronted a “disloyal employee” scenario and noted “[i]t is undisputed that the conduct complained of falls under” the provision of the CFAA prohibiting an employee from accessing an employer’s computers “without authorization” or in a manner that “exceeds authorized access.”   Because this observation was arguably dicta, the door was left open a crack for district courts within the Third Circuit to reject CFAA claims predicated on the “disloyal employee” scenario.

In Robinson, a New Jersey district court walked through that door.  The court stated that,

[a]lthough the Third Circuit has not addressed the issue, district courts in this circuit have held, in the employer-employee context, that an employee who may access a computer by the terms of his employment is authorized to use that computer for purposes of [the CFAA] even if his purpose in doing so is to misuse or misappropriate the employer’s information.  

In rejecting the CFAA claim on this basis, the Robinson court joined two other district courts within the Third Circuit that have so ruled within the last two years.

Employers that operate in the Third Circuit and wish to pursue CFAA claims should draw three practical lessons from Robinson:

• When possible, file the lawsuit in a circuit that squarely recognizes CFAA claims based on the “disloyal employee” scenario, such as the Seventh Circuit.  CFAA claims are often based on actions that occurred in different circuits, which may provide an employer with various options regarding where to prosecute the claim.
• If you elect to proceed in the Third Circuit, predicate subject-matter jurisdiction on some basis other than a CFAA claim (if possible), as there is a realistic possibility that the CFAA count will be dismissed for failure to state a claim.
• Since Robinson serves as an example that district courts within the Third Circuit will not necessarily regard P.C. Yonkers as binding authority, do not simply cite to the case; instead, work to convince the court that the cessation-of-agency theory is better on the merits.

Photo credit: dra_schwartz