In United States v. Nosal, 676 F.3d 854 (9th Cir. 2012), the Ninth Circuit found that under the Computer Fraud and Abuse Act (“CFAA”), the phrase “exceeds authorized access” does not extend to violations of employer-imposed use restrictions. There, the defendant, a former employee of an executive search firm, convinced some of his former co-workers to establish a competing business and to use their login credentials to download confidential information for the purpose of transferring the confidential information to defendant. The government indicted the defendant on, among other things, charges that he violated Section 1030(a)(4) of the CFAA (18 U.S.C. § 1030(a)(4)) by aiding and abetting his former colleagues in exceeding their authorized access with intent to defraud.
Under the CFAA, the phrase “exceeds authorized access” means “to access a computer with authorization and to use such access to obtain or alter information that the accesser is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6). Although the trial court initial denied defendant’s motion to dismiss, after the Ninth Circuit’s decision in LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Circuit 2009), the trial court held that the phrase “exceeds authorized access” did not extend to misappropriating information that an individual could legitimately access but where corporate policies limited the individual’s use of such information.
In upholding the district court’s decision, the Ninth Circuit found that extending the CFAA to include misappropriation of data that an individual was authorized to access “would transform the CFAA from an anti-hacking statute into an expansive misappropriation statute.” The Ninth Circuit recognized that its decision in this case was in contrast to decisions of its sister circuits which “interpret the CFAA broadly to cover violations of computer use restrictions or violations of a duty of loyalty.” However, the Ninth Circuit noted that “these courts looked only at the culpable behavior of the defendants before them, and failed to consider the effect on millions of ordinary citizens ….”
