Labor & Employment Law

Accessing computer to further employee's own personal interests was not "without authorization"

Today the 9th Circuit made it a bit more difficult for an employer to use the federal Computer Fraud and Abuse Act (CFAA) against an employee who uses the boss' computer to acquire confidential information.

LVRC Holdings v. Brekka (9th Cir 09/15/2009)

LVRC sued Brekka (its former employee) and others claiming a violation of the federal Computer Fraud and Abuse Act (CFAA) by accessing LVRC's computer "without authorization." The 9th Circuit affirmed summary judgment for Brekka and all defendants.

(1) While still employed by LVRC, Brekka had permission to use LVRC's computers. He used his employer's computer to email to himself and to his wife some LVRC documents, including a customer list and LVRC's financial statement. LVRC argued that this use of the computer was "without authorization" within the meaning of CFAA because Brekka obtained confidential information in order to further his own personal interests. The 9th Circuit found no language in CFAA to support this argument, saying that "authorization" means "permission."

The Court said:

"When an employer authorizes an employee to use a company computer subject to certain limitations, the employee remains authorized to use the computer even if the employee violates those limitations. It is the employer?s decision to allow or to terminate an employee?s authorization to access a computer that determines whether the employee is with or 'without authorization.'"

(2) There was insufficient evidence to establish that Brekka gained access to LVRC's computer after he left the company. Someone used his login credentials, and the login was from an ISP in a city near where Brekka was attending a convention, but this was not sufficiently probative to avoid summary judgment.

Full post as published by Ross' Employment Law Blog on September 15, 2009 (boomark / email).