- Emergency Consultation Services
- Risk Management Services
- Who We Are
- Our People
- What We Do
- Why We Are Different
- What’s New
- Where We Are
The Computer Fraud And Abuse Act (CFAA) is a federal law that provides it is a violation for an individual to “intentionally access a computer without authorization or exceed authorized access” to get protected information. Employers have attempted to rely upon the CFAA for years to pursue former employees who stole (or destroyed) confidential information from the employer’s computer system prior to leaving for a competitor.
The issue that courts have struggled with is as follows: Does an employee who lawfully accesses his employer’s computer system, but engages in actions with a nefarious intent within the confines of that access violate the Computer Fraud And Abuse Act? That is a lot to chew on, right? Numerous federal courts agree it is a rubbery issue, which is why there are varying decisions by both district and appellate courts across the United States dealing with CFAA claims against former employees.
On September 9, the Sixth Circuit weighed in on this dispute when it held (in Royal Truck & Trailer Sales v. Kraft) that employees who took proprietary information from the network their employer gave them access to prior to departing for a competitor did not violate the Computer Fraud and Abuse Act (“CFAA”). In this case, the Sixth Circuit initially observed that the employees were allowed to access Royal Truck’s system because they still were employees when they did so. So the meatier question for the Sixth Circuit is whether employees exceeded their authorization when they accessed information for an improper purpose.
The Sixth Circuit answered “no” because the language of the CFAA required Royal Truck to show that the employees used their permitted access to gain information that they were not entitled to have. The information they acquired—quotes for Royal Truck customers—was information they could have when they were employees. The Sixth Circuit joined the Second, Fourth, and Ninth Circuits in narrowly interpreting the statute in this manner.
The Royal Truck court acknowledged, however, that other circuit courts—the First, Fifth, Seventh, Eighth, and Eleventh—read the statute more broadly, and would likely find the Royal Truck employees liable under the CFAA. The Supreme Court has accepted a criminal case, Van Buren v. United States, to be heard in the October 2020 term. While Van Buren is a criminal case, it still allows the Supreme Court to resolve this conflict in how the statute is interpreted. Until then, employers will have to understand the circuit split when assessing whether to pursue this type of claim against former employees.