Webinar: Computer Fraud and Abuse Act - What do you need to know?

Tomorrow - January 28, 2010, 10 A.M. PDT

Our previous webinars have covered the basics of trade secrets and trade secret litigation.  The third in our webinar series will focus on claims under the federal Computer Fraud and Abuse Act.  The CFAA has, over the last decade, gained traction as a powerful weapon for companies to obtain injunctive and monetary relief when employees steal their employers' proprietary information.  However, asserting a CFAA claim is not as straightforward as it seems.  Over the years, some courts have expanded its applicability in the misappropriation context, while others have tried to limit use of the CFAA.  Our webinar, The Computer Fraud and Abuse Act:  What You Need To Know, will, among other things, describe the basics of a CFAA claim, identify the various interpretations of certain key elements of a CFAA claim as it is asserted in the misappropriation context, and discuss best practices for asserting and defending CFAA claims.  We are joined by a computer forensic expert who will describe the various means of obtaining computer evidence to support a CFAA claim and will provide you with tips on preserving electronic evidence.  You may register here.

Brekka decision continues to get press attention

Amy E. Bivins recently published another article in the Daily Labor Report addressing the effects of the Ninth Circuit's Brekka decision, which we have posted about previously.  Ms. Bivins quotes Seyfarth attorney Carolyn Sieve on the issue.  Carolyn reminded employers that they "should not rely solely on a potential CFAA claim to protect their proprietary information."  Indeed, employers will need to consider what access to computer systems is "authorized." 

"Establishing CFAA Violations By Former Employees," published in Employment Law 360

On October 27, 2009, Robert Milligan and Carolyn Sieve published their article, "Establishing CFAA Violations By Former Employees," in the Employment Law 360.  The article further examines the Brekka decision we have posted about previously.  In particular, Robert and Carolyn point out that the Brekka decision may require employers to "rethink their strategies" for protecting company property. 

More on Brekka

The BNA publication, Electronic Commerce & Law Report, recently quoted our own Carolyn Sieve, discussing the Brekka decision.  The Electronic Commerce & Law Report article, "Brekka Case Shows Need for Comprehensive Strategy to Shield Data from Insider Misuse," discussed how the Ninth Circuit recently joined a trend disfavoring Computer Fraud and Abuse Act (CFAA) claims brought by companies against disloyal employees. In LVRC Holdings LLC v. Brekka, the court resolved disagreement among federal district courts within the circuit about how the CFAA’s "authorization" standard applies to cases involving data theft by disloyal employees.

According to the article, the court explained that employers may be able to pursue claims under the CFAA, but only if employees violate clearly defined limits on access to company networks in the course of stealing proprietary information. Carolyn commented that the message from Brekka is that employers should not rely solely on potential CFAA claims to protect their proprietary information. She also noted, "The Brekka decision places more responsibility on the employer’s shoulders to provide notice to employees as to what is ‘authorized access.’" Carolyn recommended that employers determine what information they want to protect, implement security protocols to safeguard that information, and combine those efforts with systemic employee education regarding confidential and data use policies.

 A full copy of the article is available here.  It is reproduced with permission from Electronic Commerce & Law Report, 14 ECLR 1381 (Sept. 20, 2009). Copyright 2009 by The Bureau of National Affairs, Inc. (800-372-1033) http://www.bna.com

The Ninth Circuit Holds that "Authority" Requirement Prevent Employer From Bringing Computer Fraud and Abuse Act Claim Against Former Employee

In a recent decision, the federal Ninth Circuit Court of Appeals joined a growing number of federal courts that have limited the use of the Computer Fraud and Abuse Act ("CFAA") in suits brought against former employees accused of taking data from a company’s computer system before leaving the company.

In LVRC Holdings LLC v. Brekka, Case No. 07-17116, 2009 WL 2928952 (9th Cir. September 15, 2009), the Court held that an employer could not maintain its claim under the CFAA, 18 U.S.C. § 1030, against a former employee accused of e-mailing company property to his personal e-mail account because the employer could not establish that the former employee accessed its computer system “without authorization” or “in excess of authorization,” causing a loss. The employee argued that he was authorized to access the computer system in connection with his job duties, and was, therefore, authorized to access the computer system. 

In its opinion in Brekka, the Ninth Circuit explicitly rejected the Seventh Circuit Court of Appeals’ reasoning in International Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006) (Judge Posner, presiding), in which the Seventh Circuit held that a defendant employee’s authorization to access his employer’s computer files terminated when he violated his duty of loyalty to his employer.

Concluding that “[n]o language in the CFAA supports [plaintiff’s] argument that authorization to use a computer ceases when an employee resolves to use the computer contrary to the employer’s interest,” the Ninth Circuit switched the focus of inquiry from the former employee’s motive to an objective standard: What actions did the employer take to define what was authorized access and what was not? “If the employer has not rescinded the defendant’s right to use the computer, the defendant would have no reason to know that making personal use of the company computer in breach of a state law fiduciary duty to an employer would constitute a criminal violation of the CFAA.” 

In Brekka, plaintiff allowed its employee to e-mail company documents to his personal computer in the course of his duties. In addition, plaintiff promulgated no employee guidelines to prohibit employees from e-mailing company documents to personal computers. These were facts fatal to its CFAA claim and may provide a basis to distinguish subsequent cases where employers attempt to assert CFAA claims against former employees accused of e-mailing company information to their personal accounts, provided that they have clear policies prohibiting such activities.

The Brekka Court held “that a person uses a computer ‘without authorization’ under §§ 1030(a)(2) and (4) when the person has not received permission to use the computer for any purpose (such as when a hacker accesses someone’s computer without any permission), or when the employer has rescinded permission to access the computer and the defendant uses the computer anyway.” 

The Brekka decision is a wake-up call to employers to take measures to define for their employees the type of computer activity that is permissible (and impermissible) so that the employers can, to the extent allowable, avail themselves of a CFAA claim.

Alleged Cyberbully Acquitted Of Charges For Violation Of The Computer Fraud And Abuse Act

By Tim Nelson and Robert Milligan

A highly publicized cyberbullying case recently came to an apparent end with the acquittal of a Missouri woman who was accused of violating the Computer Fraud and Abuse Act (“CFAA”).

In the case, a Central District of California court addressed the novel issue of whether a computer user’s violations of an Internet website’s terms of service constitute a crime under the CFAA, 18 U.S.C. § 1030. United States v. Drew, --- F.R.D. ---, 2009 WL 2872855 (C.D. Cal. Aug. 28, 2009).

According to the indictment in Drew, Lori Drew, a resident of O’Fallon, Missouri, allegedly was a member of a conspiracy to intentionally access a computer used in interstate commerce without (and/or in excess of) authorization in order to obtain information for the purpose of committing the tortious act of intentional infliction of emotional distress upon a 13-year old girl named Megan Meier, also a resident of O’Fallon, Missouri. Id.at *1. 

Megan was a classmate of Drew’s daughter, Sarah. Pursuant to the conspiracy, the conspirators established a profile for a fictitious 16 year old male named “Josh Evans” on the website www.myspace.com, on or about September 20, 2006. The conspirators also posted a photo of a boy on this website without that boy’s knowledge or permission. This conduct violated the terms of service of the Myspace website, which prohibited providing information that the user knew was false or misleading, and also prohibited including a photograph of another person that was posted without that person’s consent. 

The conspirators contacted Megan and flirted with her through the Myspace website using the “Josh Evans” profile over several days. Eventually, the conspirators informed Megan that “Josh” was moving away. The conspirators also informed Megan that “Josh” no longer liked her and that “the world would be a better place without her in it.” Later the day this message was delivered, Megan committed suicide. After learning that Megan had killed herself, Drew caused the “Josh Evans” Myspace account to be deleted. Id.

Lori Drew was charged with one count of conspiracy in violation of 18 U.S.C. § 371 and three counts of violating a felony portion of the CFAA (18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(B)(ii)), which prohibits accessing a computer without authorization or in excess of authorization and obtaining information from a protected computer where the conduct involves an interstate or foreign communication and the offense is committed in furtherance of a crime or tortious act. 

The jury was instructed that they could consider whether Drew was guilty of the lesser included misdemeanor CFAA violation (which involved accessing a protected computer without authorization or in excess of authorization). The jury deadlocked on the conspiracy charge, and found Drew not guilty on the three felony counts of violating the CFAA. The jury did, however, find Drew guilty of the three misdemeanor counts of violating the CFAA. Drew’s attorneys filed a motion for a judgment of acquittal under Federal Rule of Criminal Procedure 29(c).

Judge Wu of the Central District of California addressed the central question raised by Drew: whether a computer user’s intentional violation of one or more provisions in an Internet website’s terms of service satisfies the first element of section 1030(a)(2)(C) (whether the computer access was without authorization or exceeded authorized access). Id.at *6.  The court  noted that the latter two elements of section 1030(a)(2)(C) (obtaining information from a “protected computer” and the accessing of the computer must involve an interstate or foreign communication) would always be met when an individual using a computer contacts or communicates with an Internet website. Id.

To address the central question raised in Drew, the court analyzed and applied the void-for-vagueness doctrine, which has two prongs: 1) a definitional/notice sufficiency requirement; and 2) a guideline setting element to govern law enforcement. Id.at *12. 

The court, quoting Justice Holmes, observed that, as to criminal statutes, there is a “fair warning” requirement:

Although it is not likely that a criminal will care-fully consider the text of the law before he murders or steals, it is reasonable that a fair warning should be given to the world in language that the common world will understand, of what the law intends to do if a certain line is passed. To make the warning fair, so far as possible the line should be clear.

Id. (citing McBoyle v. United States. 283 U.S. 25, 27 (1931)).

The court found that basing a CFAA violation upon the conscious violation of a website’s terms of service runs afoul of the void-for-vagueness doctrine, because of the absence of minimal guidelines to govern law enforcement and because of actual notice deficiencies. Id.at *14. The court found that if any conscious breach of a website’s terms of service is sufficient to constitute a violation of the CFAA, the law would afford too much discretion to the police and too little notice to citizens who wish to use the Internet. Id.at *17.

The Drew decision is significant because it recognizes the limitations of the CFAA and is a victory for internet privacy proponents. According the court, the government’s interpretation of the CFAA in Drew “would convert a multitude of otherwise innocent Internet users into misdemeanant criminals.” Id.at *16. The court recognized that breaching a website’s terms of service, alone, was not sufficient to violate the CFAA.

One news source has indicated that the U.S. Attorney will determine whether the government will appeal after reviewing the written ruling. 

Competitor Allegedly Steals E-mails from its Rival

The Courthouse News reported on an interesting new Computer Fraud and Abuse Act case.   It appears from the article that Duncan Solutions diverted internal and external e-mails directed to its competitor Affiliated Computer Services' employees for the purposes of obtaining not only competitive and confidential internal information but also to obtain information regarding Affiliated Computer Services' clients.  According to The Courthouse News, Affiliated Computer Services sued in Texas and "seeks damages under the Computer Fraud and Abuse Act, Wiretap Act, Stored Communication Act and Texas Harmful Access By Computer Act."  Affiliated Computer Services "is represented by John Cox with Lynn Tillotson."  This could be an interesting case to watch. 

District Court Rejects Employer's Attempt to Use the Computer Fraud & Abuse Act against Former Employees

In Lasco Foods, Inc. v. Hall and Shaw Sales, Marketing & Consulting, LLC, 600 F. Supp. 2d 1045 (E.D. Mo. 2009), the United States District Court for the Eastern District of Missouri dismissed an employer’s claim that two former employees violated the Computer Fraud & Abuse Act (“CFAA”), 18 U.S.C. § 1030, et seq., by deleting information from and refusing to return their company laptops after resigning. Lasco brought claims against former sales representatives Ronald Hall and Charles Shaw, as well as their new company, Hall and Shaw Sales, Marketing & Consulting. Included in the action were claims under the CFAA and the Stored Wire and Electronic Communications Act (“SECA”), 18 U.S.C. § 2701, et seq., as well as a number of claims under Missouri law. 

Lasco alleged that Shaw “deleted confidential and trade secret information from Lasco’s computer” and “unlawfully copied or otherwise downloaded Lasco’s Trade Secret Information for his own personal use and for the use of HSSMC.” Lasco further alleged that Hall refused to return his Lasco laptop and that Lasco anticipated that a forensic examination of Hall’s laptop would reveal that he also deleted information from the laptop.

Hall and Shaw moved to dismiss the SECA and CFAA claims. The District Court found that federal courts have found that the general purpose of these two statutes “was to create a cause of action against computer hackers (e.g., electronic trespassers),” rather than rogue employees. Accordingly, because Lasco alleged that Hall and Shaw had unrestricted access to Lasco’s information on its computers, the District Court dismissed the claims under the CFAA and SECA because Lasco had not alleged that Hall and Shaw accessed Lasco’s information without authorization.

The District Court did find that Lasco had alleged sufficiently that it had suffered damage and loss by virtue of Hall and Shaw deleting information and forcing Lasco to take remedial measures. The District Court also found that Lasco had alleged interruption of service by asserting that Hall and Shaw had delayed before returning their computers. However, because Lasco could not show that Hall and Shaw were unauthorized users, its claim under the CFAA was dismissed, leaving Lasco to pursue state law claims.

Damage Assessment Not Enough: For Purposes of the CFAA, Apparently "Loss" Does Mean "Damage"

 

BY JASON STIEHL

            In recent years, courts in the Northern District of Illinois have made clear that without actual harm to data, a plaintiff cannot claim “damage” under the Consumer Fraud and Abuse Act, 18 U.S.C. 1030 et seq. (“CFAA”). See, e.g., Garelli Wong & Assoc. v. Nichols, 551 F. Supp. 2d 704, 704 (N.D. Ill. 2008) (holding there was no “damage” because the defendant’s “unauthorized acts of copying and e-mailing [Plaintiff’s] computer files did not impair the integrity or availability of the information in the Database and did not cause any interruption of service.”) To circumvent this strict reading of the CFAA, companies have used the term “loss” in the statute, arguing that a company suffered a “loss” by undertaking efforts to investigate and assess what “damage” may have been caused.   18 U.S.C. 1030 (e)(11) (defining “loss” to include “conducting a damage assessment.”).  A recent case calls into question whether such allegations will continue to suffice.

            In Kluber Skahan & Associates, Inc. v. Cordogan, Clark & Assoc., Inc., the court addressed whether allegations of a “loss” suffered within two years were sufficient to toll the limitation period under the CFAA, which requires a case to be brought within two years of discovery of any “damage.” In answering in the negative, Judge Zagel further shortened the reach of the CFAA. In Kluber, the court defined the elements of CFAA as requiring proof of: (1) damage or loss, (2) as a result of (3) a violation of some other provision of section 1030, and (4) conduct involving one of the facts set forth in section 1030 (c)(4)(A)(i). Kluber Skahan & Associates, Inc. v. Cordogan, Clark & Assoc., Inc., No. 08-cv-1529, 2009 WL 466812, * 6 (N.D. Ill. Feb. 25, 2009). The court undertook an analysis of the definitions of “loss” and “damage” under Section 1030, finding that the words were not only different in definition, but different in concept. Specifically, the court stated “whereas ‘damage’ contemplates harms to data and information, ‘loss’ refers to monetary harms.” Id. at * 7. The court went one step further, announcing that “Section 1030(g) does not require damage for a CFAA claim to arise.” Id. at *8 n. 14.   It is ironic that with such an emphasis on the distinction between these harms, the court would later take effort to amalgamate them.

            Ultimately, the court refused to toll the limitations period, holding that Congress explicitly chose to provide a two-year limitation for injury-discovery regardless of whether a “loss” had occurred. Id. at * 8 (“It was well within Congress’ power to include a separate two-year limitation of the discovery of loss. The text of the CFAA reflects that Congress declined to do so, and so will I.”). It supported its decision by emphasizing that the purpose of the statute is primarily criminal and that the statute was not meant to “cover the disloyal employee who walks off with confidential information.” Id (citing Am. Family Mut. Ins. Co. v. Rickman, 554 F. Supp. 2d 766, 771 (N.D. Ohio 2008)). Thus, it concluded that “[l]osses are monetary harms attenuated from the underlying concern of the Act: damage to data.” Id. 

 
            Thus, although courts have been quick to distinguish, both by definition and concept, “damage” and “loss,” it appears that, at least in the Northern District of Illinois, a plaintiff will need to demonstrate some “damage” to prove a “loss” for purposes of pursuing a CFAA claim.

New Jersey Federal Court Rules That Allegation of "Time-Bomb" in Software Is Sufficient to Survive Motion To Dismiss Computer Fraud and Abuse Act Claim

Kalow & Springnut, LLP v. Commence Corp., No. 07-3442, 2009 WL 44748 (D.N.J. Jan. 6, 2009).

The federal district court in New Jersey has declined to dismiss a claim under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, concluding that plaintiff’s allegation that defendant’s software product contained a “time-bomb” causing it to stop working after a period of time sufficiently alleged the statute’s required element of intent to cause harm. 

Plaintiff Kalow & Springnut filed a class action suit claiming that software manufacturer Commence Corp. had inserted a hidden “time-bomb” code in a software program purchased by the class members that caused damage to their protected computers when the code caused the program to stop working after a certain period of time. Among other claims, Plaintiff alleged that this conduct violated the CFAA, which imposes liability on a person “who knowingly causes the transmission of a program, information, code or command, and as a result of such conduct intentionally causes damage…” 18 U.S.C. § 1030(a)(5)(A)(i). However, in June 2008, the court dismissed this count of the complaint with leave to amend because it failed to allege the element of intentional harm required by the CFAA.

Kalow & Springnut subsequently filed an amended complaint that made additional factual allegations, including that because computer software does not “wear out or fail like a mechanical device…for software to stop working, it must either have been intentionally designed to stop working, or the environment in which it is operating must have been altered.” Plaintiff further alleged that it had not altered its computer system immediately before the software stopped working, thus the software must have been intentionally designed to stop working by way of a “time-bomb” in the software’s code.

In ruling on Commence’s motion to dismiss the amended claim, the district court rejected Commence’s argument that the claim relies on faulty logic which fails to consider other possible explanations, such as a programming error in the software. Citing to the Supreme Court’s decision in Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007), and its Third Circuit progeny, which articulate a somewhat more lenient pleading standard than had previously been applied, the court noted that the standard “simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence of the necessary element.” A plaintiff is required only to allege sufficient facts to give fair notice of its claims, the court concluded, and thus a defendant cannot defeat an allegation upon a motion to dismiss by simply offering an alternative explanation, as Commence did. 

This case serves as a reminder to litigants asserting or defending trade secrets-related claims under the CFAA that, particularly in light of Twombly, the notice pleading standard makes it difficult to defeat a CFAA claim at the motion to dismiss stage based solely on challenges to the logic or plausibility of plaintiff’s factual assertions concerning intent.

Federal District Court Declines Supplemental Jurisdiction In An Employment-Related Dispute Where The CFAA Was The Sole Basis For Federal Jurisdiction

 In Contemporary Services Corp. v. Hartman, 2008 WL 3049891 (C.D. Cal.), the United States District Court for the Central District of California recently declined supplemental jurisdiction over state law claims removed to the court where federal jurisdiction was based solely on the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. Finding that state issues substantially predominated, the court noted that the “[e]lements and facts that Plaintiffs must prove to establish their CFAA claim are different from what they must prove to establish their other claims.”   

 The court retained jurisdiction over the CFAA claim and remanded all of the state law claims.

Plaintiffs filed suit in state court against defendant Hartman, asserting seven claims for relief: (1) violation of the CFAA; (2) Breach of Fiduciary Duty; (3) Conversion; (4) Breach of Contract; (5) Fraud; (6) Intentional Interference with Prospective Economic Advantage; and (7) Breach of Fiduciary Duty.   Defendant removed the case to federal district court.  Defendant moved to remand the case to state court.  Defendant also moved to dismiss several of plaintiff's claims.

Plaintiffs filed a First Amended Complaint in which they abandoned their sixth and seventh causes of action. Defendant answered and filed five counterclaims arising under state law for: (1) Unpaid Wages; (2) Waiting Time Penalties; (3) Violation of Cal. Lab. Code § 2802; (4) Indemnification under Cal. Lab Code § 2802 and Cal. Corp. Code § 317; and (5) Unfair Competition Under Cal. Bus. & Prof. Code § 17200.

Turning to plaintiffs’ motion for remand, the district court held that “[i]n all important respects, this action involves an employment dispute between the parties that has given rise to nine state law claims and counterclaims which substantially predominate over the sole federal claim.” Continuing, the court noted that all of the claims and counterclaims derived from the facts triggered by defendant's decision to leave plaintiffs' employment, including that defendant allegedly breached her fiduciary duties owed to plaintiffs by deleting work product stored on her work computer and defrauding plaintiffs by making false representations about the information contained on plaintiffs' shared drive and computer. 

Defendant's counterclaims for unpaid wages and unfair competition arose from Plaintiffs' alleged conduct after defendant ended her employment.   

Distinguishing the CFAA from the other claims in suit, the court noted “[T]he elements and facts that Plaintiffs must prove to establish their CFAA claim are different from what they must prove to establish their other claims.” Plaintiffs' claims for breach of fiduciary duty and breach of contract derive from the parties' rights and responsibilities under the employment contract. Plaintiffs' claim for fraud arises from Defendant's alleged misrepresentations during her employment. Defendant's counterclaims for unpaid wages and indemnification were based on Plaintiffs' conduct after defendant returned the computer and left their employment.

In contrast, to prove a CFAA claim, one must show that the computer in question was a “protected computer,” and that the conduct involved one of five categories of harm that are a necessary element of a civil action under the CFAA. As plaintiffs did here, claimants most often meet the “harm” element by alleging a loss of at least $5,000 in value. When relying on this element, under 18 U.S.C. § 1030(a)(5)(B), plaintiffs are limited to economic damages.

Finally, the court found it “[n]oteworthy that the relief Plaintiffs seek under the CFAA is not unique to that claim; Plaintiffs also seek compensatory damages and injunctive relief pursuant to all four of their state claims for relief. *** In short, even as to the array of remedies that Plaintiffs seek, their state claims predominate; indeed, rather than “trailing” the federal remedies, the state-based claims encompass additional prayers for relief, such as punitive damages.”

       

Federal Court in North Carolina Upholds CFAA Claim as Pleaded

Although the trial court's analysis was not extensive, it clearly found that allegations in a complaint that an employee used a computer program to delete information from a laptop and knowingly deleted information without authorization sufficiently states a Computer Fraud and Abuse Act claim so as to survive a motion to dismiss for failure to state a claim.

In Alliance International Inc. v. Todd, Civ. Action No. 5:08-CV-214-BR (E.D.N.C. July 22, 2008), the parties contested whether the former employees (now defendants) could be held liable for deleting information from company computers.  Defendants argued, ultimately unsuccessfully, that plaintiff could not bring a cause of action under CFAA Subsection (a)(5)(A)(i) against two of the individual defendants because Alliance did not plead that those individuals downloaded a file erasure program.   Subsection (a)(5)(A)(i) provides a cause of action against someone who

knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer . . .

18 U.S.C. § 1030(a)(5)(A)(i). 

Defendants argued that "[a]n employee's act of knowingly deleting files by hitting the 'delete' key could not plausibly give rise to criminal and civil liability under the CFAA."  (Defs.' Mem. of Law in Support of Mot. to Dismiss at 24 (filed May 29, 2008) (emphasis added).   Not taking the bait to argue whether hitting the delete key constitutes a "command," Alliance merely contended that it met its pleading obligation under the CFAA by alleging that the defendants permanently deleted/destroyed information from Alliance computers. 

The Court side-stepped both parties' arguments, however, and found that the specific allegations in Alliance's complaint, to wit that the defendants

(1) "deleted, removed and destroyed information, documents and/or data contained on . . . protected computers" and

(2) "knowingly caused the transmission of a program, information, code or command, including but not limited to, Net Eraser Trial, and as a result of such conduct, intentionally caused damage without authorization, to a protected computer"  (citing paragraphs 62 & 63 of the complaint),

were sufficient to state a CFAA claim.  Although clearly tailored to the facts at hand, the court's decision could be persuasive authority for a plaintiff to withstand a Rule 12(b)(6) motion targeting similar allegations.

 Not long after the Court's ruling, on August 12, 2008, Alliance filed a stipulation of dismissal of the case, with prejudice, signaling a likely settlement with the defendants following the Court's ruling in Alliance's favor.  The court's opinion, nonetheless, as well as the parties' briefing, is a ready resource for case citations on the issue of deletion as well as "authorization" under the CFAA, as the parties and the court cite to numerous federal cases on these issues.

 

Recent Headlines Underscore Need for Protective Measures

A company's trade secrets may be some of its most important assets.  Recent headlines underscore their importance, and vulnerability:

  1. Recently, an employee was arrested at the airport and over 1,000 company proprietary documents containing trade secrets were seized that the employee was attempting to transport with her to her new job.
  2.  A national retailer recently was hit with a $21.5 million verdict after a jury found the retailer liable for stealing the design of a popular home improvement tool. 
  3. A former employee recently pleaded guilty in a U.S. District Court in California to stealing proprietary technologies from his former employer and selling or offering them for sale to foreign governments and military contractors.

A survey of companies estimated that in just one year, companies likely were to have lost as much as $53 to $59 billion dollars in proprietary information and intellectual property through theft and misappropriation.  Seeking trade secret counseling and an audit can assist clients to determine best practices to help protect their most important assets.