At Work: Solutions for Employers & Employees

The Computer Fraud and Abuse Act (“CFAA”) was enacted in 1986 to provide relief to those victimized by hackers and address federal computer-related offenses. But the issue of whether the CFAA can be used by an employer against an employee is unable to be affirmatively answered due to a split in application of the CFAA across the country. This results in employers being able to state a claim against an employee in some places and not in others. While there may be an answer for a company based in one location where the federal court has spoken, this issue presents greater difficultly for national business that cross over different federal court lines.
Recently the 4th Circuit joined the 9th Circuit in holding that the CFAA does not present a basis for an employer to sue an employee. This is contrary to the decisions of the 5th Circuit, Seventh Circuit and 11th Circuit which permit an employer to file a claim against an employee under the CFAA. According to the 4th and 9th Circuit courts, an employer is precluded from bringing such a claim because the CFAA is targeted at hackers engaging in illegal conduct not at employees who are authorized to access the computer system even if the employee misappropriates the employer’s confidential information.
The 4th Circuit decision also rejects the “cessation-of-agency” theory which provides that a worker instantaneously becomes an unauthorized user the minute he or she commits a bad faith action on an employer owned computer. The court reasoned that such a strict application of the theory could potentially criminalize a worker’s conduct for a mundane violation of the employer’s internal policies such as an employee checking social networking sites or for sports scores.
While the Circuit Split on the issue does present a basis for Supreme Court review, the U.S. department of Justice has decided not to seek Supreme Court review on the issue to determine the proper application of the CFAA to claims against employees. What this means is that while some District Courts have held that the CFAA applies to employees, others such as the 4th and 9th Circuits have held otherwise. New Jersey’s Court of Appeals, the 3rd Circuit has not yet addressed this issue. As a result, the matter is undecided in New Jersey and Pennsylvania and places employers in the position of having to weigh the risks of filing a CFAA action against an employee. Regardless of whether a legal action under the CFAA can be pursued against an employee, employers should enact computer policies and enforce such policies consistently to protect their confidential information as best they can.
Hill Wallack stands ready to assist with this issue or any of your employment law needs.