9th Circuit decision on "exceeds authorized access" in criminal Computer Fraud and Abuse Act case

Yesterday the 9th Circuit (in a 2-1 decision) held that a criminal defendant "exceeded authorized access," as set forth in the Computer Fraud and Abuse Act, 18 U.S.C. 1030 et seq., when he or she "violates the employer's computer access restrictions--including use restrictions." Does that sound pretty broad to you? Sounds that way to me.

And it sounds that way to others, too. If you ever "Google" anything at work, I commend this blog post in The Volokh Conspiracy (a blog run by a group of (mostly) libertarian law professors) on this recent 9th Circuit decision (United States v. Nosal, No. 10-10038, (Apr. 28, 2011)). It has been my experience almost every civil action for trade secret misappropriation in the last ten years (and lots of other IP and employment cases) potentially implicate the CFAA one way or another, and this is yet another decision -- others are discussed in the opinion -- that shows just how broadly the criminal provisions of the Act can be read.

10th Circuit decision (unpublished) on the phrase "anything of value" in the Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (18 U.S.C. § 1030) provides a private civil cause of action against one who "knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value" (there are other required elements as well). In Triad Consultants, Inc. v. Wiggins, No. 07-1007 (10th Cir. Sept. 17, 2007) , it was alleged that fired President and COO (Wiggins), who was required by agreement to return all Triad property, unsuccessfully tried to get a third-party to restore a back-up tape of Triad computer data into a useable format.

The 10th Circuit held that Triad failed to state a claim because the "complaint set forth a sequence of facts showing that [Wiggins] never obtained any information from the tapes." Accordingly, "[b]ecause Triad alleged no facts showing that Wiggins accessed the information on the tape, it cannot establish one of the elements of a claim under § 1030(a)(4), that Wiggins obtained "anything of values." The court rejected the argument that the tapes themselves had intrinsic value, because "value is relative to one's needs and objectives," and if Wiggins couldn't use the information on the tapes, then they had no value to him.

Seventh Circuit decision concerning Computer Fraud and Abuse Act

I know this isn't strictly trademark, copyright, or trade secret law, but the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 et seq., does seem to pop up in many trade secret-related disputes I've worked on.

The Seventh Circuit issued a decision under the CFAA about a month ago that got me thinking about a potentially new way to use the CFAA. Before I get into the new way, the decision in International Airport Centers, L.L.C. v. Citrin, No. 05-1522 (7th Cir. March 8, 2006), primarily concerned whether the defendant in this civil case under the CFAA, who had intentionally erased important data from his company-issued laptop just before he got canned, had caused the "transmission" of a command or program that caused damage and whether he was "authorized" to have erased the data. (The data was important to the employer and it didn't have any copies of the data, and the ex-amployee, after deleting the critical information, then started up his own competing business.)

The district court had dismissed the case, but Judge Posner, writing for the panel, held that such conduct would violate the CFAA.

But this got me thinking about spoliation of evidence during the course of litigation. Normally, when that happens, lawyers tend to think of it in terms of discovery sanctions and "adverse inference" jury instructions. But if, during the course of litigation, someone is found to have intentionally deleted or erased relevant computer data, might that not fall under the CFAA? Section 1030(a)(5)(A)(i) prohibits the intentional transmission of a program or command that causes damage to the computer so long as he wasn't "authorized" to do so. Section 1030(a)(5)(A)(ii) & (iii) prohibit intentional access to a protected computer that recklessly causes damage, or just causes damage, all without "authorization."

So if under the Federal Rules governing discovery, a party has a duty not to destroy potentially relevant information, does that mean the party isn't "authorized" under the CFAA? That would look to be the key question. Further, if the adverse party needed to spend more than $5000 to retrieve (or try to retrieve) the data (whether lawyer time or computer forensics experts or whatever), the adverse party might even be able to amend his claims or counterclaims to assert a CFAA claim in that case, thus maximizing the chances that the jury or the judge gets to hear, in excruciating detail, about the evidence that was destroyed.

Is this a possibility? Anyone spot any bone-headed flaw in my thinking?

2d Circuit decision on "loss" requirement in Computer Fraud and Abuse Act action

I usually don't bother commenting on unpublished circuit court decisions, particularly in circuits like the Second Circuit where you can't even mention them as precedent, but this one is worth noting.

In Nexans Wires S.A. v. Sark-USA, Inc., No. 05-3820-cv (2d Cir. Feb. 13, 2006), the Second Circuit issued an unpublished opinion (they call them "summary orders") affirming summary judgment against a plaintiff on its claim under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030 et seq. The CFAA is a neat little criminal statute, with an express but limited civil right of action, aimed generally at unauthorized access to protected computers with the intent to defraud or cause damage.

The key issue was whether the damage claimed by the plaintiff caused a qualifying "loss," as that term is specifically defined in the CFAA, of over $5,000 in any 1 year period. The plaintiffs claimed that the defendants misappropriated confidential data from their computers that caused the plaintiffs to lose over $10 million in profits. Well over the statutory threshold, right? Not so fast, said the court.

The CFAA defines loss as "any reasonable cost to any victim . . . and any revenue lost . . . because of interruption of service" from the unauthorized computer access. It was this last limitation on causation that did in the plaintiff. The court held that there was no evidence that the lost alleged $10 million in lost revenue was due to any "interruption of service." The plaintiffs' "Plan B" argument was that they spent $8000 to fly their German execs over to the US to investigate the defendants' misappropriation, but the court said there was no evidence that the German execs actually performed any computer investigation or repair, or any other type of preventative security measures, for that matter. Rather, the evidence was that they were in the US solely to assess the business loss associated with the misappropriation.

The moral is, remember this important limitation on the $5,000 loss threshold when assessing potential CFAA claims.