Court offers little insight into the ongoing debate over whether the CFAA applies to an alleged faithless employee.
Not long ago, the Eleventh Circuit Court of Appeals upheld the conviction of an employee under the CFAA in United States v. Roberto Rodriguez. In that case, the Eleventh Circuit took on the question of whether an employee "exceeds authorized access" under the CFAA by accessing information on a computer in a manner contrary to an employer's written policies. The answer according to the Eleventh Circuit: Yes.
A few days ago, the United States Court of Appeals for the Sixth Circuit weighed in on the debate without offering much insight into its thought process. In United States v. Batti, the Sixth Circuit upheld a conviction under the CFAA of an information technology employee, Luay Batti, accused of stealing confidential data from and using his employer’s computers. According to the appellate court’s decision, Batti accessed his employer's computer systems and copied confidential electronically stored information belonging to the Chief Executive Officer. The electronically stored information contained information regarding executive compensation, financial data and strategic business plans.
On appeal, the court only addressed the issues of whether the United States proved that the value of the data stolen by Batti exceeded $5,000 and whether the district court had committed reversible error in awarding restitution to to Batti's employer in the amount of $47,565. In ruling that favors the employer and affirms Batti’s conviction, the appellate court did not squarely address the crux of the ongoing debate about whether a current employee who has permission to use a company's computers can violate the CFAA. For more on that debate as addressed by other courts, click here.
While side stepping the hot button issue under the CFAA, the appellate court stated that Batti accessed his employer's computers and copied its files without authorization. While this could be interpreted as signaling the Sixth Circuit's agreement with those courts that find the CFAA applies to employee's who access computers during the scope of their employment, there is room to wonder because the appellate court noted that Batti also accessed his employer's computers at least twenty-one times after his employment terminated. Consequently, the Batti opinion contains mixed signals on the issue of what constitutes “authorized” access by employees. A copy of the Sixth Circuit's opinion in Batti is available in pdf format below.