Soon after Matthew Broderick starred in the 1983 movie “WarGames,” Congress passed the precursor to what is known today as the Computer Fraud and Abuse Act (CFAA). When initially passed, this ominous-sounding statute was designed to criminally punish individuals who misused computer technology to obtain national security secrets or personal financial records or hacked into government computers (à la Broderick’s character). Today, this statute has been amended to protect against fraud and related activities in connection with access devices and computers, and to provide civil remedies. Put another way, the CFAA is to computers what trespassing and burglary are to real property.
The CFAA sprouts up fairly often in trade secrets cases. This likely stems from several roots. First, the CFAA provides easy access to federal court. Second, as companies often store their confidential data on computers, the CFAA extends liability without having to actually prove that the data or information misappropriated is confidential or is protected as a trade secret. Finally, the CFAA provides for injunctive relief. One challenge, however, to asserting a CFAA claim is the absence of any uniform interpretation of the statute by the various circuits. Until the Supreme Court steps in, the viability of a statutory claim in a particular circumstance can depend on the locale where the case is to be filed.
In plain English, the relevant sections of the CFAA apply when someone intentionally accesses a protected computer without authorization or exceeds authorized access. Completely clear and understandable? Let’s ask a few simple questions.
In this era of hand-held electronics, is a smartphone a computer? What about a traditional cell phone? What about an X-box, Nintendo, Leapster or other video game? Absolutely. Even websites have been found to fit within the definition of a computer. Recent case law supports the proposition that virtually everything that contains a microchip is a “computer.” Simply put, although likely not intended by Congress, the statutory definition encompasses modern coffee makers, watches, microwave ovens, children’s toys, heating and air conditioning units, and a plethora of other modern-day appliances.
Moving on, what constitutes accessing a computer “without authorization,” or “exceeding authorized access”? This issue, which is a threshold question to establishing a CFAA violation, is one of the most hotly litigated issues, and federal courts are literally all over the map in answering. The applicable legislative history suggests that Congress anticipated that those who exceed their authority are likely to be corporate insiders with some rights to the computer, and those who act without authorization are likely to be outsiders with no rights. Recent opinions, however, have blurred the lines between the two.
One line of decisions has imposed liability based on an individual’s wrongful use of information to which the individual otherwise had access. Federal circuits following this line of reasoning have imposed liability on individuals in situations involving a breach of an employer’s policies or contractual agreements with an employer, or a duty of loyalty by the individuals. Other circuits take a different and stricter view of the CFAA, rejecting the notion that the act is a federal data misappropriation or misuse statute. Instead, these courts have held that if access had been authorized in any way, there can be no liability notwithstanding any improper use of the information.
The implications of these differences can be outright dramatic, if not draconian. Because the CFAA also imposes both civil and criminal liability, under the former approach employees located in those circuits may find themselves subject to civil and possibly even criminal penalties for violating their employers’ confidentiality policies. In circuits adopting the latter interpretation, the CFAA may be far less relevant in civil litigation.
Another element of a CFAA civil claim is a “loss to one or more persons during any one-year period … aggregating at least $5,000 in value.” As with the access issue, courts are diverging on what constitutes a “loss.” Costs can include investigating the computer for damage (i.e., a forensic analysis), remedying the damage to a computer or to files stored on the computer, or losing computer function until a repair can be arranged. However, losing revenue due to a former employee’s transfer of trade secrets or the value of the misappropriated trade secret information are generally not considered losses. The case law on this point continues to evolve, which means further uncertainty for the near future.
Statistically speaking, computer fraud either already has been or will be an issue for most businesses in the coming years. New and more innovative threats are literally developing every day. Business decision makers often don’t appreciate the magnitude of the problem, and few corporate boards annually review company controls and policies to help protect against information technology privacy and security risks.
At this point in time, the CFAA provides a framework within which losses associated with computer fraud and abuse may be remedied. But at the same time, everyday activities may be caught within the ambit of the CFAA, as the courts do not offer clear and uniform guidance as to the boundaries between activities that are permissible and those that are not. The best that inside counsel can do is to stay tuned as the laws in this area continues to evolve.
