Back to the Basics... The Computer Fraud and Abuse Act
By Russell Beck and Stephen Riden
The Computer Fraud and Abuse Act (the "CFAA"), 18 U.S.C. ยง 1030, has recently come into vogue as the tool of choice among trade secret (and noncompete) litigators. Why? Because it provides a relatively easy to prove claim. In very (and I do mean very) simplistic terms, the statute (which is, in reality, a criminal statute, although it gives private individuals and companies the right to sue too) requires a showing of only: intentional access to a protected computer without authorization or beyond authorization causing damage. If you can prove those five elements, you have made out your case. The significance? No need to prove that a trade secret was taken.
So, what do those words mean? Well, the statute provides some guidance, but leaves many issues unanswered - and the courts are now starting to fill in the balance, as these cases become more prevalent. Suffice it to say, if you login to a computer, you have probably just satisfied the first two elements (intentional and access). If the computer is used in interstate commerce, you have satisfied the second element (a protected computer). What is interstate commerce? Well, in today's world, it's almost a theoretical question, as any computer connected to the internet will likely qualify.
That leaves two issues (authorization and damages). First the hard one: authorization. The statute applies equally to someone who never had authorization and to someone who had authorization, but exceeded the scope of that authorization. The issue making headlines (well, legal headlines anyway) is whether the following qualifies: an employee who obtains access within the bounds of what he is permitted to do, but accesses the computer for his own gain - not for the benefit of the employer. In some federal circuits (think states), the answer is that it does qualify. In others, it does not.
So, all of that must cause damage, right? Seems easy enough. Well, the question is what qualifies under the CFAA? The value of any misappropriated property - perhaps surprisingly - does not qualify. But, the cost of the forensic investigation to assess the harm, probably does. Go figure.
That's it, in a nutshell. Like everything else, however, a little knowledge can be dangerous - so, be careful. The CFAA is far more complicated than this post makes it seem - and it should be carefully evaluated before its power is indiscriminately wielded, lest, for example, you find yourself in federal court, when you wanted to remain in state court.
While state laws vary with regard to what will constitute a trade secret, most states have adopted the Uniform Trade Secret Act (UTSA), which provides the following definition:
Common Types of Agreements: