The Computer Fraud And Abuse Act

Update handbooks and employment agreements to obtain the benefits of the computer fraud and abuse act (”CFAA”).

The CFAA outlaws the theft of data and permits a company that “suffers damage or loss” by reason of a violation to bring a civil action against the violator for damages and injunctive relief. Assuming a plaintiff can show loss, it must then allege that defendant either:

1. intentionally accessed a [protected] computer without authorization or exceeded authorized access;
2. knowingly and with intent to defraud, accessed a protected computer without authorization, or exceeded authorized access, and furthered the intended fraud and obtained anything of value;
3. knowingly caused the transmission of a program, information, code, or command, and intentionally caused damage to a protected computer;
4. intentionally accessed a protected computer without authorization and recklessly caused damage;
5. intentionally accessed a protected computer without authorization, and caused damage and loss.

In employee misappropriation cases, the difficulty under the CFAA is establishing that access was “without” or “exceeded” authorization. The employee usually had permission to use the computer as part of the job. Plaintiffs have argued that computer use by employees for other reasons was not authorized and therefore a CFAA violation. But courts are divided on this agency based argument.

An employer has a right to control access to its own computers through its company policies and employment agreements. Until the courts resolve the statutory issue, the easiest way to establish unauthorized access for purposes of a CFAA claim is through employee handbooks and agreements. It is therefore essential to update company rules and agreements to define authorization and access so as to maximize the ability to properly invoke the CFAA.

Written by Andre Castaybert | Download v-card