|
The Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C § 1030, et seq., provides for both civil and criminal liability of a person intentionally accesses a computer without authoritzation and obtains any information from that computer. Subject to certain criteria, a person who has been damaged or experiences a loss as a result of such unauthorized access may maintain a civil action against the violator to obtain compensatory damages, injunctive relief, or other equitable relief. Although this statute is not very well known, it is increasingly used in trade secrete and non-compete agreement litigation. In a typical case, a business owner may allege that the an employee violated the CFAA by downloading files with the intention of using the files in ways not authorized by the business owner. Even though the employee may have been authorized to access computer files for some purposes, the employee is not authorized to access the computer files for other purposes, or so the argument goes.
Whether the employee's purpose for accessing the computer files vitiates any previously-granted authorization to access the computer is hotly disputed. Plaintiffs frequently argue that courts should adopt the reasoning in Int'l Aiport Ctrs., LLC v. Citrin, 440 F.3d 418, 420-21 (7th Cir. 2006), and hold that one's authorization to use an employer-provided computer ceases when the employee's interests are adverse to the interests of the employer. Defendants, in contrast, typically urge courts to follow the Ninth Circuit's holding in LVRC Holdings LLC v. Brekka, 581, F.3d 1127, and hold that when an employer gives an employee permission to use a company computer subject to certain limitations, the employee remains authorized to use the computer even if the employee violates those limitations.
The U.S. District Court for the District of Columbia has recently aligned itself with the Brekka line of cases. In Lewis-Burke Assocs. LLC v. Widder, the court expressed concern with the fluid nature of "authorization" following from the reasoning in Citrin. The court hypothesized that under the reasoning set forth in Citrin, an employee might generate a report during the course of employement to which he would have authorized access. If the emploee later sought employment elsewhere and accessed the report to refresh his memory about what he did in order to describe his experience on a resume, under the reasoning in Citrin he would have accessed the report without authorization. Then, if the employee decided against outside employment, and accessed the report to show a subordinate an example of a report, his interest would again be aligned with the employer and access to the report would be authorized. The uncertainty inherent in determining whether an activity was authorized led the court to reject this approach. Although it is not binding precedent even within the District of Columbia, it gives greater momentum to the Brekka line of cases and will, no doubt, help influence later circuit court decisions.
|
