This blog post was authored by Alison Carrinski


In May we reported on the case U.S. v. Nosal, in which the U.S. Ninth Circuit Court of Appeals examined whether an employee violates the federal Computer Fraud and Abuse Act (CFAA) when misappropriating data from an employer’s computer system in violation of the employer’s data use policies.  In general, the CFAA prohibits employees from knowingly, and with intent to defraud, accessing an employer’s computer without authorization or exceeding authorized computer access, to further their intended fraud.  Nosal, a former employee of an executive search firm, engaged three current employees to access the firm’s electronic database and misappropriate trade secrets.  While the employees used their own ID’s to access the databases, they violated clear employer policies restricting use of proprietary information.

The Ninth Circuit, in an opinion issued by a three judge panel, held that Nosal exceeded authorized access, for purposes of the CFAA, by misappropriating proprietary information in violation of the employer’s computer and data use policies.  Nosal argued that such a decision would broaden the scope of violations under the CFAA to include any employee who exceeds the authorization of an employer’s data use policy—for example, by checking personal email at work.  In response to this argument, the Court noted that liability under the CFAA only applies if the employee exceeds authorized access with the intent to commit fraud; for example, checking personal email or the latest news would not trigger liability, even if against employer policy, because there would be no fraudulent intent.

Recently, on October 27, 2011, the Ninth Circuit Court of Appeals voted to rehear this case en banc, which means that all of the justices will be present for the rehearing.  Because the Court granted rehearing en banc, its decision from May in U.S. v. Nosal may no longer be cited as precedent, as it will be superseded by the future en banc decision.  We will keep you posted on the status of this case.