Are employees who use their workplace computers contrary to the interests of their employers criminals under the Computer Fraud and Abuse Act? Yesterday, the Ninth Circuit Court of Appeals said disloyal keyboarding is not a crime in LVRC Holdings v. Brekka. In Brekka, the defendant emailed himself client files while working for the plaintiff. When the employment relationship ended, the plaintiff claimed that the defendant sent himself those files to benefit his competing business. The Ninth Circuit held that an employee’s mere breach of fiduciary duty is not “unauthorized access” under the CFAA. The decision is a welcome restraint on the federal computer crime statute, which has been overused to go after not only disloyal employees, but also people who disobey website terms of service and companies that collect information from publicly accessible websites when the owner wishes they would not.
Brekka holds that a person uses a computer “without authorization” when she has not received permission to use the computer for any purpose, or when the employer has rescinded permission to access the computer and she uses the computer anyway. Similarly, a person who is authorized to use a computer does not exceed authorization simply by acting contrary to the computer owner’s interest, but only by obtaining or altering information in the computer that she is not entitled to obtain or alter.
The Brekka opinion is in line with the more recent and better line of district court cases that have rejected a “thought crime” interpretation of the CFAA where the employee’s mental state determines whether she was authorized or not. Brekka says that neither the statutory language nor the canons of criminal law allow such a broad reading that leaves people uncertain of when this criminal statute would apply.
The opinion puts the Ninth Circuit at odds, however, with an older Seventh Circuit opinion in International Airport Centers v. Citrin, written by the well-known Judge Posner. Brekka and Citrin are the only appellate court decisions on the question of whether a breach of loyalty makes computer use criminal, but there’s now a circuit split. It will be interesting to see whether the plaintiffs in Brekka ask the Supreme Court to review the matter. For now, Brekka is solidly in line with current jurisprudence giving a proper, narrower scope to the CFAA.
