Supreme Court: Bad Intent Not Enough to Violate the Computer Fraud and Abuse Act

In an unlikely 6-3 decision where Justices Barrett, Gorsuch, and Kavanaugh joined the three so-called “liberal justices,” the United States Supreme Court held on June 3, 2021, that a police officer did not violate the Computer Fraud and Abuse Act, 18 U.S.C. §1030(a)(2) (“CFAA”), by accessing a law enforcement database to retrieve information to commit a crime. This case may have far-reaching implications for companies that provide access to trade secrets and confidential information to employees, and it’s probably time for them to review their contracts and policies.

The CFAA makes it a crime and prescribes civil liability to a person who “intentionally accesses a computer without authorization or exceeds authorized access.” 18 U.S.C. §1030(a)(2). See Van Buren v. United States, 593 U.S. ___ (2021) ( Slip Op.). The CFAA defines the phrase “exceeds authorized access” to mean “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” Id. at §1030(e)(6). Prior to the Van Buren decision, the Eleven Circuit followed the interpretation in its circuit and that mere misuse of information available in a computer networks violates the statute, and, on that ground, affirmed Van Buren’s conviction for violating the CFAA. Slip Op. at 4.

Consistent with the Supreme Court’s decision, the CFAA must now be interpreted as leading to criminal or civil liability where a person “accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him.” Slip Op. at 20. Therefore, if someone is authorized to access an area of a computer and uses information in that area of the computer—even for unlawful purposes, that person has not run afoul of the CFAA. That is what Officer Van Buren did when he accessed license plate records, of which he had unauthorized access, to illegally sell them to a known criminal for profit. On the other hand, the CFAA will still impose both civil and criminal liability if the person uses a computer to access areas of the computer or a network to access information to which he is not authorized. That is the way courts in the Second, Sixth, and Ninth Circuits had already interpreted the CFAA, and it previously was not the binding interpretation everywhere. See Slip Op. at 4, n. 2.

Companies that provide their employees and/or contractors with network access to trade secrets or confidential business information will need to update their policies and contracts following this case.  This case limits a company’s ability to use CFAA to remedy unauthorized access or trade secret theft.  As a result, contracts and/or handbooks should be revised to make clear that the information contained in the company’s databases or electronic records may qualify as a trade secret and define the parameters of authorized access.  Additionally, do not forget to amend your electronic terms of service agreements to reflect the restrictions on access to company data and information.

Bruce Paul is a Member of McBrayer law practicing in the firm's Louisville office.  His law practice primarily focuses on intellectual property, copyright law, trademarks, commercial and business litigation, employment law, and infringement litigation. Mr. Paul can be reached at bpaul@mcbrayerfirm.com or (502) 783-6245. 

Cynthia L. Effinger, Member with McBrayer, is located in the firm’s Louisville office. Ms. Effinger’s practice is concentrated in the areas of employment law and commercial litigation. Her employment law practice is focused on drafting employment manuals and policies, social media, wage and hour, non-compete agreements and workplace discrimination. Ms. Effinger can be reached at ceffinger@mcbrayerfirm.com or (502) 327-5400, ext. 2316.

Services may be performed by others. This article does not constitute legal advice.