Trade Secrets

• Jurisdiction: United States,Federal
• Author: Catherine Lui, Krystal Anderson, Oliver McNicholas
• Publication year: 2021
• Citation: Vol. 46 No. 3

TRADE SECRETS

AUTHORS

Catherine Lui

Orrick, Herrington, & Sutcliffe LLP

Krystal Anderson

Orrick, Herrington, & Sutcliffe LLP

Oliver McNicholas

unknown

VAN BUREN: A NEW NATIONAL STANDARD FOR INTERPRETING THE SCOPE AND INTENT OF THE COMPUTER FRAUD AND ABUSE ACT (CFAA)

On June 3, 2021, in the significant and highly anticipated Van Buren decision, the Supreme Court handed down a new national standard for interpreting the scope and intent of the Computer Fraud and Abuse Act (CFAA), thus resolving a long-standing circuit split on the interpretation of the phrase "exceeds authorized access."¹ The Supreme Court held 6-3 that an individual "exceeds authorized access" under the CFAA when he accesses a computer that he has authorization to access but then obtains information located in particular areas of the computer—such as files, folders, or databases—that he does not have authorization to access. Crucially, the Court explicitly rejected the Eleventh Circuit's and the Government's broader interpretation of the CFAA by holding that an individual does not exceed authorized access by obtaining, even for improper reasons, material to which he is otherwise entitled, i.e., in files, folders, or databases that he has authorization to access. More simply, the Court ruled that it is not a violation of the CFAA to access material that you are authorized to access, even if you do so for an illegitimate purpose, and even if your subsequent use of that material is illicit. The impact of the decision is likely to be far-reaching, as although the CFAA is primarily a criminal statute, it has also been widely utilized in key areas of civil litigation such as in asserting misappropriation of trade secrets against departing employees.

The CFAA And the Underlying Circuit Split

The CFAA was first enacted in 1986 in response to the then-incipient problem of computer hackers and the public's fear of cyberwarfare. In fact, the Act was partially the result of certain members of Congress watching the hacker movie War Games² and fearing the destructive power of rogue computer wizards. Although the true intent of the CFAA was to protect against this traditional form of nefarious hacking, the ambiguous language of the statute broadened the possible applications of the Act. As a result, the CFAA became a potential weapon against a much wider realm of computer-based activity, including in civil courts.

[Page 89]

For example, because 18 U.S.C. § 1030(g) allows anyone who suffers damage or loss because of a violation of the CFAA to bring a civil action against the violator, the CFAA is often used against former employees who access proprietary information during their final days of employment for potentially improper purposes (for example, to share with competitors). Further, the CFAA is often used to combat unwanted attempts at web scraping.

The Van Buren decision put to rest an issue of CFAA ambiguity that has persisted for decades, engendered a great deal of legal debate, and precipitated an inconvenient 4-3 federal circuit split. The split, which had been simmering for several years, revolves around the central question of whether the CFAA's language of "exceeds authorized access" should be interpreted broadly or narrowly. The First, Fifth, Seventh, and Eleventh Circuits interpreted the phrase broadly to criminalize activity when a person accesses data or information in an area that the person is authorized to access, but for an improper purpose.³ This would include, for example, employees accessing proprietary information on their authorized computers. The...