U.S. Court of Appeals takes stance on stolen data.

• Position: CYBERCRIME

[ILLUSTRATION OMITTED]

An employee with valid access to corporate data cannot be held liable under the U.S. Computer Fraud and Abuse Act (CFAA) if he or she misuses or misappropriates the data. That was the ruling of the U.S. Court of Appeals for the Ninth Circuit earlier this spring.

"The CFAA expressly prohibits improper 'access' of computer information," said Chief Judge Alex Kozinski in the court's majority opinion. "It does not prohibit misuse or misappropriation."

Kozinski held that the term "exceed authorized access" under the CFAA applies to external hackers and violations of' "restrictions on access" to information and not restrictions on its use. The appellate court's decision upheld the ruling by the U.S. District Court for the Northern District of California. The case in question involved David Nasal, a former employee at a large executive recruitment firm, Korn/Ferry, in Los Angeles.

After leaving the firm, Nosal recruited some of his former colleagues to set up a competing firm. Before joining him, some of the employees used their login credentials to download contact information of executive candidates residing on Korn/Ferry's confidential database. The information was clearly marked as being for Korn/Ferry's internal use only and prohibiting disclosure.

The information was passed on to Nasal, who was consequently indicted on 20 counts, including mail fraud, trade secret theft, and violations of the CFAA. He was also accused under CFAA of...