No, Violating Your Employer's Computer Use Policy Is Not Criminal Hacking

from the office-facebookers-everywhere-breathe-a-sigh-of-relief dept

You may remember a story from last year about David Nosal, a man who was essentially convicted of computer hacking because the Ninth Circuit Court of Appeals determined that he “exceeded authorized access” on his employer’s computer system when he broke the written rules regarding how data on that system could be used (in this case, by accessing said data before leaving the company for a competitor). Whether or not accessing the data was some other legally actionable offense, its prosecution under the Computer Fraud and Abuse Act (CFAA) set an alarming precedent for the rest of us.

As noted at the time, if breaking any arbitrary rule a company places on its IT system is “hacking”, then most office workers could be in big trouble. Did you check Facebook using a company computer? You could be charged with criminal hacking if the rules say you shouldn’t. To make matters worse, as Orin Kerr argued then, prosecutions like this aren’t necessarily limited to desktop computers, since the line for what constitutes a computer is so blurry these days. Did you use your company smartphone to call home and tell your wife that you’ll be late for dinner? That’s could be good for ten years in prison, if company policy prohibits making personal calls from it.

Of course, this isn’t the first time prosecutors have tried to abuse the CFAA. Recall, if you will, the infamous case of Lori Drew, who was prosecuted under the theory that violating a Terms of Service was also the same thing as hacking. Ridiculous, to be sure, but a jury convicted her anyway. That conviction was eventually overturned by the judge in the case, but others haven’t been so lucky, and given the last decision by the Ninth, things were looking pretty grim for common sense.

Happily, however, the Ninth decided to re-hear David’s case en banc (meaning with all the judges, rather than a small panel of them), and has now reversed the previous ruling. The analysis by the always-entertaining Judge Kozinski makes it perfectly clear where the line is drawn:

We construe criminal statutes narrowly so that Congress will not unintentionally turn ordinary citizens into criminals. […] This narrower interpretation is also a more sensible reading of the text and legislative history of a statute whose general purpose is to punish hacking—the circumvention of technological access barriers—not misappropriation of trade secrets—a subject Congress has dealt with elsewhere. Therefore, we hold that “exceeds authorized access” in the CFAA is limited to violations of restrictions on access to information, and not restrictions on its use.

Since decisions have gone the other way in other circuits, Kozinski goes even further, and says that other courts have “failed to apply the long-standing principle that we must construe ambiguous criminal statutes narrowly” and that they at the Ninth “respectfully decline to follow our sister circuits and urge them to reconsider instead.”

Hopefully, other courts will heed this message, but for now, this is a win for everyone on the west coast.

Filed Under: , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “No, Violating Your Employer's Computer Use Policy Is Not Criminal Hacking”

Subscribe: RSS Leave a comment
Joe Publius (profile) says:

Salting the Wound

I’ve always thought that it was just tacky to do it. Isn’t it enough that you can fire someone if you tell an employee how work software and hardware uses are allowed, but the employee abuses/misuses it?

Sending a tasteless joke via email can certainly be grounds for dismissal, but unless it’s hiding or distributing malware, there no hacking involved at all.

Berenerd (profile) says:

I do have some issue with this...

He accessed information that he had permissions to access? Or was it in a folder he should not have had access to? If he used someone else’s password or their system while they stepped away, yes this would be illegal and would warrant a trial. If he accessed his user drive and took that information, then no, not hacking. If you accessed facebook by typing in then no, no illegal, You found a way around the blocks put in place? This would be on the edge. You broke through the web filtering using an exploit? yes, illegal.

TtfnJohn (profile) says:

Re: I do have some issue with this...

You don’t even have to go to that extreme to get why he was prosecuted and it would have had little or nothing to do with hacking (more properly cracking) but almost all to do with his employment contract. It’s standard in any employment contract that an employee treat most documents they see as confidential unless expressly tagged as public. And very few are. Data an employee has access to in the normal course of their job is to be treated the same.

Nothing in the post indicates that he went around security features of the corporate network only that he took data with him to his new employer something he could have off-loaded onto a thumb drive or whatever or, even foolishly, zipped up and emailed home.

None of that involves going beyond his normal access except that he took it home to show to his new employer which, until he walks out the door for the last time, breaks his employment contract and his duty of confidentiality.

He didn’t have to crack anything to get the data. So what’s popularly called “hacking” never enters into it. It sounds more romantic to call it “hacking” but for the most part these sorts of things don’t involve that.

Chris-Mouse (profile) says:

Re: Re: I do have some issue with this...

But then why use the CFAA to prosecute? If the former employee violated an employment contract, then that would leave him open to a civil suit for breach of contract, would it not?

The only reason I can see for using the CFAA is to get the taxpayer to pick up the legal costs of enforcing a civil contract that may or may not exist.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...