Computer Fraud and Abuse Act Doesn't Prohibit Computer Fraud and Abuse!
In an interesting case out of the 9th Circuit, the court determined that employees (usually ex-employees) are not liable under the Computer Fraud and Abuse Act (CFAA) for damages for accessing the employer’s computer for unauthorized purposes (taking data for their own purposes,) when they were authorized access in the first instance. The typical facts are that an employee wishing to set up a competing business will download customer lists, and other information owned by the employer. Then a new business is started without the necessity of developing an original customer list, or other information deemed valuable by the departing employee.
The case,LVRC Holdings v. Brekka et al., eliminates a powerful weapon for the employer, at least in the 9th circuit. Damages have always been an issue under the act (CFAA), but the courts ruling that the act does not cover actions by employees that already have access to the computer files, is interesting. The court does not hold that if the ex-employee gained access to files that the employee was not authorized to view, there would be no violation. In this case the employee had full access. This case is about an employee with complete access, that took the information for his own purposes. The employer made no attempt to protect the data.
The holding would seem to require employers to carefully control employee's access to data, even though employees have the greatest need to use the data. I don't know if the congress will consider any changes to the statute; I doubt it, but employers have lost a good counter-claim when sued for wrongful termination. I don't think the intent of the statute was to protect employers from their own employees. Employers are fully capable of protecting themselves. The intent was to criminalize the theft of data by others.
Thanks toThreat Level, a Wired Blog, for the heads up.
