I.  INTRODUCTION

The federal Computer Fraud and Abuse Act (“Act”), 18 U.S.C. § 1030, gives employers a helpful tool to use against former employees who wrongfully use information from the employer’s computer system to assist competitors in competing unfairly.   As the Third Circuit recently noted “[e]mployers . . . are increasingly taking advantage of the [Act’s] civil remedies to sue former employees and their new companies who seek a competitive edge through wrongful use of information from the former employer’s computer system.[1]”

II.  BACKGROUND

The Act makes it unlawful for anyone to access a “protected computer” “without authorization” or in excess of authorized access and thereby obtain, alter or damage information or data.   18 U.S.C. §1030(a)(2)(c).   The Act also   makes it unlawful to knowingly, and with intent to defraud, access a “protected computer” without authorization or in excess of authorization and thereby further the fraud and obtain anything of value.   18 U.S.C. § 1030 (a)(4).   The Act defines a “protected computer” as any computer “used in interstate or foreign commerce or communication.”  18 U.S.C. §1030(e)(2)(B).  Because virtually all corporate computer systems and laptops are connected to the internet, virtually any misuse of a corporate computer system will involve a “protected computer.”[2]

Since 1994, the Act has provided for a private federal cause of action in favor of any person who suffers “damages” or “loss” as a result of a violation of the Act, entitling them to “maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief.”  18 U.S.C. § 1030(g).   To bring a civil claim under the Act, the plaintiff must show damage or loss related to the computer in excess of $5,000.  18 U.S.C. § 1030(a)(5)(B)(1).  Employers have successfully used the Act to obtain injunctions against both former employees who have violated the Act and the competitors who hire them.[3]

This article surveys recent federal case law construing the Act.   The Seventh Circuit has issued a very recent decision making it easier under the Act for employers to sue employees who used existing corporate authorization to steal data by holding that such employees are acting “without authorization” for purposes of the Act.  Courts have been stricter in construing what constitutes “damages” or “loss” within the meaning of the Act.   Courts in the Second Circuit, in particular, have foreclosed use of the Act as a vehicle for recovery of loss of goodwill or business caused by a former employee’s unfair competition based on misuse of computer data.   Nonetheless, no other circuit has as of yet foreclosed a plaintiff from seeking damages for lost profits or goodwill under the Act, and it remains an effective tool to obtain injunctive relief from a federal court.

        A.  Courts Liberally Interpret When an Employee Acts “Without Authorization” or “With Intent to Defraud.”

                1.  “Without Authorization” means contrary to the employer’s interests.

In order to state a claim under the Act the employer must prove that the employee acted “without authorization,” in excess of authorization or with “intent to defraud.”   Clearly, a former employee who uses knowledge of a former employer’s computer system post termination to obtain non-public information from that system on behalf of a new employer is acting without authorization or in excess of authorization.[4]  More commonly, however, an employer discovers only after an employee resigns that shortly before the resignation the employee downloaded or copied information he or she was authorized to access.   Can such action really be deemed to be “without authorization” or to “exceed[] authorized access?”

The Act defines “exceeds authorized access” as:

to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.

One might plausibly argue that use of existing corporate authorization to obtain (as opposed to destroy or alter) data to which the employee is otherwise entitled to access is not “unauthorized” and hence not subject to the Act.[5]  

Several federal courts have rejected such literalistic application of the term “unauthorized” or in excess of authorization.   In Shugard Storage Centers, Inc. v. SafeGuard Self Storage, Inc., 119 F. Supp. 2d 1121 (W.D. Wash 2000) the district court relied on common law principles to find that an employee who abused corporate authorization to copy data for purposes of competing unfairly was acting “without authorization” for purposes of the Act.  Under the common law an employee who acts adversely to the interests of the employer, without the employer’s knowledge, or who is otherwise guilty of a serious breach of loyalty has effectively terminated the agency relationship and lost whatever authorization he or she might otherwise have enjoyed.[6]  This expansive interpretation of “without authorization” arguably renders all pre-termination computer misuse hostile to the employer’s interests “unauthorized” within the meaning of the Act.

Very recently, the United States Court of Appeals for the Seventh Circuit, in an opinion authored by Judge Posner, endorsed the Shugard court’s theory of “without authorization.”[7]   In Citrin, an employee of a real estate company decided to compete against his former employer.   Before returning his laptop he completely wiped it clean, using a data erasure program.   As a consequence, all the information on the computer, including information on real estate acquisition opportunities and data which would have revealed improper conduct engaged in by the employee prior to leaving was irretrievably lost.   440 F.3d at 419.  The Seventh Circuit ruled that the employee acted “without authorization,” even though he was technically authorized to access his laptop at the time of the misuse [8]:

For his authorization to access the laptop terminated, when having already engaged in misconduct and decided to quite IAC in violation of his employment contract, he resolved to destroy files that incriminated himself and other files . . . in violation of the duty of loyalty that agency law imposes on an employee.”

Other courts have simply concluded that acts contrary to the employer’s stated policies are per se unauthorized.[9]  It appears courts will employ a common sense approach and conclude that access for improper reasons is in fact “without authorization” regardless of whether the access was achieved using pre-existing authorization.

                2.  “Intent to Defraud” requires only use of dishonest means.

The Shugard court also expansively construed the section of the Act prohibiting the “knowing and with intent to defraud” access[ing of] a protected computer.”   In Shugard, the employer alleged that while still employed, the former employee sent e-mails containing its confidential information to a competitor, whom the employee went to work for shortly thereafter.  The Shugard court ruled these allegations were sufficient to state a claim of accessing a protected computer “with intent to defraud.”  The Shugard court rejected the argument that it was necessary to allege the common law elements of fraud (i.e., misrepresentation or omission, justifiable reliance, etc).   Instead, all that was necessary was that the plaintiff allege the defendant “participated in dishonest methods of obtaining information,” which it had done.[10] Another court has adopted the Shugard interpretation of “intent to defraud.[11]”  Such an interpretation makes it easier to plead and prove a claim of intent to defraud.  These decisions evidence a penchant towards liberal construction of the Act in favor of employers harmed by a broad variety of computer misconduct.

        B.  Courts Permit Assertion of Claims Under the Act Against Competitors Who Hire Employees Who Have Engaged in Computer Misuse.

Because the Act provides sanctions against those who unlawfully access the computer, a question arises as to whether a competitor who hires a former employee who has stolen information from the employer’s computer can also be subject to liability under the Act.  An early decision from a federal court in New Hampshire indicated that the Act could only be applied against the individuals who actually engage in the computer misconduct, and not their employers.  In that case, however, a physician of a hospital accessed a patient’s records without authorization, but in so doing, acted directly contrary to the employer hospital’s policies and thereby victimized the hospital.[12]  Subsequent decisions have allowed claims to be asserted against competitors who hire employees who have engaged in misconduct under a theory of vicarious liability, where the employer pleads an agency relationship between the former employee and the competitor at the time of the computer misuse.[13]    The trend clearly permits assertion of claims against both former employees who engage in computer misconduct and the competitors who hire them.

        C.  Courts are More Restrictive in Interpreting “Damages” and “Loss”.

Courts have been more restrictive in evaluating whether particular financial outlays qualify as “damages” or “loss” sufficient to meet the Act’s $ 5,000 threshold. The Act defines “damages” as “any impairment to the integrity or availability of data, a program, a system, or information, that . . . causes loss aggregating at least $5,000 in value during any one year period.”   18 U.S.C. §1030(e)(8).   “Loss” is defined as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.”   18 U.S.C. § 1030(e)(11).

Courts have interpreted “damages” and “loss” to include virtually all reasonable out expenses and costs incurred by the employer in responding to the employee’s misconduct, other than attorneys fees, so long as the expenses and costs can in some fashion be directly tied to the computer or computer system at issue.  Examples include:   (1) the costs of diagnostic measures taken by the employer after it learns of the potential misuse, including expenses for fees paid to consultants;[14] and (2) costs of subsequent prophylactic measures the employer takes to prevent future infiltration of its system.[15]  Courts have however refused to credit towards the $5,000 threshold any expenses not directly related to the computer system at issue.[16]  Courts are divided on whether claims for lost profits or goodwill are damages recoverable under the Act.   Courts in the Second Circuit interpret the Act narrowly in terms of compensable losses.[17]  Other Courts are more liberal.[18]  To the extent an employer has incurred damages from an employee’s computer misuse  which are not recoverable under the Act, these can usually be recovered under standard common law remedies such as trade secret misappropriation  and/or breach of fiduciary duty.

III.  CONCLUSION

In order to meet the $5,000 jurisdictional threshold, employers are well-advised to keep meticulous time records of computer technicians and consultants must spend of the time investigating misconduct, as well as the cost of any fixes to upgrade system security once potential misconduct has been identified.  Assuming that an employer can demonstrate that it has or will have to expend at least $5,000 to investigate and remedy the damage to its computer system caused by a former employee, the Act provides both a federal forum and the right to injunctive relief against former employees and the companies who hire them.  While use of the Act as a vehicle for recovering of economic damages caused by former employees is less certain, frequently injunctive relief is more critical than damages.  To the extent former employee has caused significant damages, those usually can be recovered under traditional common law or statutory principles of trade secret law, tortious interference with contract, breach of fiduciary duty and unfair competition against employees who engage in computer misuse.   Alleging a violation of the Act will enable the employer to litigate its claims against the former employee in federal court, which may be a more desirable forum under appropriate circumstances.

483004