In the News…

Newspaper Stands

Cases and issues making the headlines*:

More Noncompetes and Celebrities (January 25)
CBS’s radio morning personality in DC, Donnie Simpson, is reportedly leaving CBS.  According to the story in the Washington Post (here), Simpson will be prevented from joining a competitive station for 13 and ½ months as a result of a noncompete agreement with CBS. 

Fashion and the Computer Fraud & Abuse Act (January 25)
Magazine publisher Conde Nast is reportedly pursuing information from third-party providers about unknown individuals who have allegedly improperly used other people’s usernames and passwords to access and obtain files from Conde Nast’s computers.  Story here.

China Prosecuting Alleged Trade Secret Theft (January 23)
Chinese police have reportedly arrested four employees of Australian company Rio Tinto Ltd on charges of, among other things, trade secret infringement.  Story here.

Cloud Computing and the CFAA – a Call to Arms (January 23)
As more people are cloud computing, Microsoft has reportedly called on the federal government to “modernize the laws” (including the Computer Fraud and Abuse Act) to ensure greater security.  Stories here, here, and here.

Trade Secret Settlement (January 23)
The trade secret lawsuit between semiconductor competitors, Applied Materials Inc. and Advanced Micro-Fabrication Equipment Inc. (founded by former Apple employees), has reportedly been settled.  Story here (paid subscription).

MA Noncompete Bill (January 23)
The Massachusetts Bar Association will be holding a roundtable on the proposed MA Noncompete legislation.  Speakers are the bill’s sponsors, State Representative Lori Ehrlich and State Representative Will Brownsberger; lawyer and lead author/advisor on the bill, Russell Beck, and lawyer Andrea Kramer.  Information here

Conan O’Brien’s Noncompete Resolved (January 23)
Almost as quickly as it started, Conan O’Brien is reportedly leaving The Tonight Show and, as a result of a noncompete agreement, off the air until September 2010.  Of course, he did reportedly receive $45 million for the trouble – of which he is said to be giving $12 million to his staff.  Stories here, here, and here

The Muffin Man (or Woman) and Trade Secrets (January 23)
Bimbo Bakeries USA Inc. has reportedly sued a former executive who left for competitor Hostess Brands Inc.  The case was brought in Pennsylvania and seems to rely on the inevitable disclosure doctrine as the basis for a request to enjoin the former executive – who is supposedly one of the few people in the world who knows the recipe for Thomas’ English Muffins.  Story here (paid subscription).

No Heart When it Comes to Trade Secrets (January 23)
Berkeley Heartlab Inc. has reportedly filed a lawsuit alleging trade secret misappropriation (among other things) by its former employees and their new employer.  Story here (paid subscription). 

Motorola Sues Former Exec (January 23)
Motorola has reportedly sued a former executive who left to join Nokia.  The reported basis for the lawsuit is the protection of Motorola’s trade secrets.  Story here

Foley’s 5 Part Trade Secret Series (January 23)
Foley & Lardner’s Trade Secret / Noncompete Practice just completed a 5-part web conference series on trade secret protection.  The series will be available here.  Each part is a “stand alone” topic, but all 5 combine together for a comprehensive overview of trade secret / noncompete issues.  Enjoy!

*For earlier stories, go to the In the News (archives) page.

Tried and True: Breach of the Duty of Loyalty – An Important Weapon in Fight Against Misappropriation and Unfair Competition by Former Employees

A great deal of discussion has taken place in the legal press recently about the use of the Computer Fraud and Abuse Act as a cause of action against those who take with them information from their former employers for use in subsequent competitive activities.  And rightly so, given the explosion in the number of civil claims brought pursuant to the statute in recent months.  Much less discussion has been heard, however, about a long-recognized cause of action – breach of the duty of loyalty – that can be a crucial component of a well-thought-out attack against the misuse of confidential information by a former employee and his/her new employer.  The importance of this cause of action was highlighted in a recent decision of the Wisconsin Court of Appeals, InfoCorp, LLC v. Hunt, Case No. 2007AP2887, 2009 WL 4800140 (Wis. Ct. App. Dec. 8, 2009).

InfoCorp, LLC (d/b/a “InfoCor”) is a reseller of so-called “SMART Boards,” interactive whiteboards that combine the functions of an overhead projector, computer projector and a chalkboard.  Hunt started work at InfoCor in 2005.  Before that, he worked for 2 InfoCor competitors selling the same product and had developed a particularly strong relationship with a customer (“CESA 2”) that, among other things had a cooperative purchasing program representing a number of Wisconsin school districts.  Hunt was employed by InfoCor for a year.  During that time, CESA 2 entered into an agreement with the manufacturer of the SMART Boards to purchase its products at reduced prices and InfoCor was the only reseller authorized by CESA 2 to provide those products to its member school districts.

In 2006, Hunt approached a sales manager at one of InfoCor’s competitors, and was ultimately hired.  During his last month at InfoCor, Hunt attempted to divert a number of customers to his soon-to-be new employer and helped arrange for the new employer to become another authorized reseller of SMART Boards to CESA 2.  A few months later, after Hunt’s employment with InfoCor had ended, CESA 2 terminated InfoCor’s status as an authorized reseller of SMART Boards.

InfoCor sued Hunt and his new employer alleging trade secret misappropriation, violation of Wisconsin’s computer crime statute, tortious interference, common law and statutory conspiracy claims, conversion and breach of the duty of loyalty.  The trial court dismissed all of InfoCor’s claims on a motion for summary judgment except its claim for tortious interference based on Hunt’s interference in InfoCor’s customer relationship with CESA 2 prior to terminating his employment at InfoCor.  InfoCor appealed the dismissal of its duty of loyalty, conspiracy and the portion of InfoCor’s tortious interference claim relating to Hunt’s post-termination activities.

The Court of Appeals reversed, with the bulk of its discussion focusing on the duty of loyalty claim.  While the decision is unpublished and, therefore, not binding (under a recent change in Wisconsin’s rules, however, it may be cited for its persuasive effect), its historical discussion of when a duty of loyalty exists is helpful and identifies the issues that generally arise in those cases.  The result highlights why the claim can be such an effective one for a company seeking to protect its information in the hands of a former employee and its competitors.

The Court’s analysis was primarily addressed to the question whether Hunt owed InfoCor a duty of loyalty in the first instance.  The trial court had held that Hunt did not owe any such duty because he was a mere employee and not a corporate officer or the “’policy-making’ equivalent” of an officer.  In the trial court’s view, it was clear under Wisconsin law that only officers or policy making employees owe a duty of loyalty and that a salesman, like Hunt, did not fit into either category.

The Court of Appeals rejected that conclusion.  Relying on a line of Wisconsin cases going back to the early 1960’s, the Court of Appeals held that the test was not the authority of the employee with respect to the business as a whole which determined whether a duty exists, but whether the actions at issue were “within the scope of the employee’s responsibilities” and “directly contrary to the employer’s interest.”  Put another way, “an employee who uses the power of his employment responsibilities to harm his employer breaches his duty of loyalty” but an employee who was not a corporate officer and who “merely explored the possibility of starting a competing business, but did no actual harm” to the employer does not.  The Court of Appeals referred to this analysis as determining whether the employee’s duties make him a “key employee” giving rise to a duty of loyalty in relation to the performance of those duties.

Thus, even a “mere” salesman, like Hunt, can owe a duty of loyalty to his employee not to use his position to further his own or another’s competitive interests at the expense of his current employer.  Hunt’s actions in helping his future employer become an authorized reseller of SMART Boards to his primary customer, in direct competition with and ultimately to replace InfoCor breached that duty.

The utility of a breach of loyalty claim in dealing with employees who have taken crucial information and “jumped ship” should not be underestimated.

For example, while businesses often place significant value on customer information, courts have been relatively hostile to misappropriation of trade secret claims based on the use of such information.  A duty of loyalty claim, however, does not turn on whether the information or activities at issue involve trade secrets.

Similarly, the claim does not depend on the often-difficult task of justifying the precise terms of a contractual non-compete, particularly in states, like Wisconsin, where an overbroad employee non-compete is void in its entirety and cannot be enforced even to the extent reasonable.  Another advantage is that the claim sounds in tort as well as contract, opening up the possibility of punitive damages for particularly egregious conduct.

Another advantage of such a claim is that it focuses on the information at issue and the actions of the employee with respect to that information, i.e. it is easily tailored to the specific facts of the case.  It does not require the sometimes contortionist tactics needed to shoehorn the facts into a specific statutory cause of action like the CFAA or its state equivalents, which can be particularly problematic when the law under those statutes is changing quickly as the limits of the statutes are being tested and developed in a number of cases.

Finally, in those cases where the employee’s activities, like Hunt’s in the InfoCorp case, cause damage to the employer during his/her employment, the employer can also seek to recover the compensation paid to the employee during the period of the breach, including the value of benefits paid.  Combined with a conspiracy claim against the new employer where appropriate, the addition of a claim for punitive damages and return of employment compensation amounts can add significant dollars to the amounts at issue and, in general, increase leverage in negotiations to get back or prevent the use of the information.

1976 Toxic Substances Control Act May be Revised to Limit Secrecy Provisions

The Toxic Substances Control Act (TSCA) was enacted by Congress and signed into law by President Gerald Ford in 1976, in response to concerns that there was no comprehensive framework for the prevention of risks that might be posed by the approximately 60,000 chemical substances in commercial use at that time.  The TSCA addressed three policy goals: (1) the manufacturers of chemicals should develop data about the effect of those chemicals on health and the environment, (2) the government should have authority to regulate chemicals to prevent “an unreasonable risk of injury to health or the environment” and (3) the government’s authority should be exercised in a way that does not “unduly impede or create unnecessary economic barriers to technological innovation.”  The EPA was given the power to track, test and regulate chemicals used in the U.S.

Under the TSCA, manufacturers are required to file a report with the federal government disclosing the new chemicals they intend to market.  The report is called a pre-manufacture notice.  The form on which the notice is submitted contains a box that can be checked to claim competitive business information.  The ability to claim that the notice contains confidential business information was intended to balance the goal of preventing unreasonable risk of injury to health or the environment with the goal of not impeding or creating unnecessary economic barriers to technological innovation.  The TSCA prohibits the EPA from sharing confidential business information with states or other governmental entities, including state health regulators, environmental regulators, emergency responders and foreign governments.

Approximately 700 chemicals are introduced annually.  In the past several years, approximately 95% of the pre-manufacture notices for these new chemicals requested some secrecy, claiming that the notice contained competitive business information.  Because of that claim, information about the new chemicals was kept confidential.

Critics claim that the secrecy has grown out of control, making it impossible for regulators to control potential dangers.  Additionally, consumers concerned about the chemicals they could be exposed to, are unable to find out what is meant by “inert ingredients” or “proprietary ingredients” on labels.

During 2009, the U.S. House of Representatives held two subcommittee hearings on legislative reform of the TSCA.  In December 2009, the Senate also held a hearing on the TSCA.  While no bill is yet pending, it is anticipated that such a bill will be introduced in 2010.  Both Senator Lautenberg (D-NJ) and Senator Boxer (D-CA) have indicated that this is a priority.

Steve Owens, who became Assistant Administrator for the EPA’s Office of Prevention, Pesticides and Toxic Substances in July 2009, ended confidentiality protection for 530 chemicals just a week after taking the job.  This support by the Obama administration, along with pressure from environmental groups, is a sign that chemical companies may soon have to prove the need for secrecy, and not merely check a box if they intend to keep their chemicals secret.

The Massachusetts Noncompete Debate… Continuing Coverage

2010 Resolution – A Trade Secret Protection Program

As we wind down the holiday season and prepare for next year, it’s time to look forward with an eye on the past.  2009 has seen a remarkable number of decisions that chipped away at the enforceability of a company’s noncompete agreements with its employees. Noncompete agreements are no longer reliable or effective measures against the loss of valuable innovations, products and services. In 2010, a company’s need to protect its valuable information (“trade secrets” = formulas, devices, methods, techniques, or processes) requires a different approach. What steps are available to your company to shore up its ability to keep valuable secrets from your competitors?

An essential New Year’s resolution is development and implementation of a Trade Secret Protection Program, tailored to your company’s products and services. This year start a company-wide initiative that focuses on identification and protection of valuable and secret information and keep the basics in place. 

1. Review standard form agreements and policies.  Employee policy manuals regarding noncompete, non-disclosure, confidentiality, invention assignment and ownership, nonsolicitation, antiraiding, privacy, computer use provisions, and, most importantly, departing employee procedures and policies will require updates.  Are these provisions consistent?  Are they easy to understand by the employee?  Are the provisions reasonable in scope?

2. Review existing agreements with current employees.  Do you have signatures of your key inventors, innovators and technical employees on the agreements?  Signed acknowledgments of the policy statements?  Again, updates are most likely needed, especially for long-term employees.

3. Identify each Trade Secret and its value. Make a list if you don’t already have one. What are the inventions and innovations that create value for your company? What innovations are in the pipeline on the way to commercial use? Why do these innovations have value? What is the cost of development? What revenues, present or future, are derived from the innovation? What is the value to the marketplace? What about value to your competitors?

4. Confidentiality. Is each invention or innovation a secret from the marketplace? Who has access to information about the development? Is the company taking ‘reasonable’ steps to keep information secret? Are there multiple levels of security to limit access on a need to know basis? Are you able to document the security measures taken to protect information?

5. Record Keeping.  Where is the “vault” that tracks the trade secrets?  What information is kept in the “vault” and who has access?  How is the information identified, tracked, and updated?  How often?

Development and implementation of a Trade Secret Protection Program is a cross-disciplinary activity that involves legal, IT, HR, finance, and key technical personnel. There are good resources available to develop a trade secret protection program for your company. One such resource is the ISO/IEC 27001, an Information Security Management System with standardized protocols for information security management.

Trade secrets are often the life blood of a company and protectable with reasonable protocols and resolve.

Enjoy the First Day at Your New Job

Gene Codes Corporation, an international software firm specializing in bioinformatics software for DNA sequence analysis, filed suit on December 1 against its former Global Manager: Customer Care and Training.  The complaint includes allegations of breach of contract and misappropriation of trade secrets under MUTSA (Michigan Uniform Trade Secret Act, MCL s. 445.1901 et seq.), and requests entry of a temporary restraining order, preliminary and permanent injunction, and attorneys fees.  Among other things, MUTSA provides for injunctive relief to prevent threatened misappropriation of trade secrets.  See, MCL s. 445.1903.

According to the complaint, the manager was one of four Gene Codes employees who had access to both of two highly sensitive databases: the database of bugs, bug fixes and feature proposals, and the customer, sales and lead tracking database.  The manager submitted her resignation to Gene Codes on November 12, 2009, and indicated that she would begin a new job with CLC bio on December 1.  CLC bio is also an international company that, among other things, provides bioinformatics software for DNA sequence analysis.

The manager is alleged to have signed an employment agreement while at Gene Codes.  That agreement, attached to the complaint, prohibits solicitation of Gene Codes clients as well as competition with Gene Codes for a period of two years.  In Michigan, the validity of a noncompete agreement is governed by section 4a of the Michigan Antitrust Reform Act, and related cases.  Reasonable noncompete agreements will be enforced, and the specific facts of the case, such as the duration and geographical scope of the restriction, and the type of employment or line of business, will be analyzed to assist in the determination of reasonableness.  See MCL s. 445.774a. 

The manager has not yet filed an answer to the complaint.

Protecting Trade Secrets Under The Revised Illinois FOIA, Effective January 1, 2010

By John Zabriskie and Benno Weisberg 

Imagine the following scenario: After a bidding contest against all of its major competitors, Company X wins a contract with a small city in downstate Illinois to fill the city’s need for widgets over the next 3 years. The city’s RFP called for detailed information about the bidders’ operations. Before the ink has dried on the contract, the city receives two Illinois Freedom of Information Act (“FOIA”) requests for copies of Company X’s winning bid. One is from Company Y—a losing bidder and a fierce competitor of Company X. The other is from a reporter for the local newspaper who is writing an investigative report about possible corruption in the city’s procurement practices. What can Company X do to prevent release of the detailed information about its operations (which Company X considers trade secret) to Company Y and the reporter?

The answer is likely to change as of January 1, 2010, when a substantially revised version of Illinois’ FOIA will take effect. FOIA will still contain an exemption for trade secrets. However, Company X’s ability to claim the exemption, and the time frame in which it must do so, may be different.

Substantively, the revised FOIA contains two noteworthy changes that may impact the city’s determination of what information it will produce in response to the FOIA requests. First, a new section of the Act, Section 2.5, provides that “[a]ll records relating to the obligation, receipt, and use of public funds of the State, units of local government, and school districts are public records subject to inspection and copying by the public.” At first glance, this provision echoes the definition of “public records” in the former version of the Act, which listed seventeen specific categories of information constituting public records, including “all information in any account, voucher, or contract dealing with the receipt or expenditure of public or other funds of public bodies.” However, the new language more closely echoes article VIII, section 1(c), of the Illinois Constitution, which provides that “[r]eports and records of the obligation, receipt and use of public funds of the State, units of local government and school districts are public records available for inspection by the public according to law.” In this regard, it’s worth noting that the Illinois Supreme Court’s recent decision in Stern v. Wheaton-Warrenville Cmty. Unit Sch. Dist, 233 Ill. 2d 396 (2009), expressly left unanswered the question of whether that constitutional provision required that a school superintendent’s employment contract be disclosed in response to a FOIA request. Instead, the Court decided the case on the narrower grounds that the employment contract did not fall within the exemption for “personnel files” simply because the contract was contained in the superintendent’s personnel file. Thus, new FOIA Section 2.5 may simply be a legislative effort to clarify that the category of public records designated by article VIII, section 1(c) of the Illinois Constitution is subject to FOIA and to provide the public with a defined tool for requesting such records within the framework of FOIA.

Second, the trade secrets exemption has been modified so that, to be considered exempt, information claimed to be trade secret or “commercial or financial information obtained from a person or business,” must be “furnished under a claim that [it is] proprietary privileged or confidential, and that disclosure of the trade secrets or commercial or financial information would cause competitive harm to the person or business.” In light of these changes, what Company X must do (at least going forward) is fairly plain: from now on, when Company X submits documents to an Illinois government entity, it must pre-designate information contained in those documents as trade secret and proprietary in order to be able later to claim the trade secrets exemption.

Other changes will make it easier for parties like Company X to protect their information, and others will make it harder. For instance, under the new law the city has different response times for responding to Company Y’s and the reporter’s respective requests. Company Y’s request will likely be treated as a “commercial purpose” request, which means that the city has 21 business days to either produce the bid and contract, reject the request by citing an exemption, or provide the requester an estimate of the time it will take the city to provide the requested records and the cost of processing the request. Assuming that the phrase “solicitation . . . for sales or services” in the new definition of “commercial purpose” is construed as including a competitor’s efforts to obtain contract and bid documents, Company X will have more time to marshal its factual and legal arguments for non-release and to work with the city to produce a redacted version of the requested documents.

By contrast, the reporter’s request must now be answered within five business days (as opposed to seven business days under the current FOIA) and the city will be penalized if it fails to timely respond. Importantly, under both the former and the revised versions of the Act, the city is under no statutory obligation to give Company X notice of any FOIA request for its information. Thus, to the extent it can, Company X should secure a contractual requirement that it receive notice of any FOIA requests for its information. (Further, to the extent such a contractual obligation is not feasible—i.e., in the case of a losing bidder—it is prudent for private parties submitting information to government entities to stress the importance of receiving such notice, even as a courtesy.)

These changes (as well as numerous other changes in the Act) are part of a deliberate effort to overhaul what the new Act’s most prominent advocate, Illinois Attorney General Lisa Madigan, referred to as the State’s prevailing FOIA “culture” at a recent forum on the new law held at the Chicago Kent School of Law. Madigan and her deputy Chief of Staff, Kara Smith, emphasized at the forum that the amendments are designed to make it easier for the press and the public to gain access to information by requiring that the government respond more quickly to FOIA requests, providing additional consequences for State agencies that do not timely comply with requests, and narrowing the scope of certain exemptions.

Just what all of this means for Company X and other private parties doing business with Illinois government entities remains to be seen, but clients seeking to protect their trade secrets should be vigilant.

A redlined version of the statute, highlighting the differences between the old and new FOIA laws, is available on the Attorney General’s website here.

Good News for Holliday Shoppers – Barnes & Noble Wins Injunction Fight

Technophiles (and their loved ones) can breathe a little easier, as Judge Ware of the Southern District of California won’t be playing the part of the Grinch this year.

As we’ve discussed in prior posts (herehere, and in our “In the News…” posts), Barnes & Noble’s hot new Nook e-reader, which has pretty much become the must-have gadget of the season (Barnes & Noble sold out their original inventory by late October, and has announced that it will be moving more product into “select stores” early next week), had also landed the bookseller in some legal hot water.  On November 2, Spring Designs, a California technology company, sued Barnes & Noble.  Spring Designs claimed that the Nook was developed from trade secrets relating to Spring’s own “Alex” e-reader, which it had disclosed to Barnes & Noble under an NDA, and, not surprisingly, moved for a preliminary injunction.

Just yesterday, Judge Ware issued his order (which you can read in full by clicking on the link) on the motion.  Judge Ware ruled that, based on the evidence before him, there was “a genuine dispute over whether the nook(TM) was derived from information disclosed by Plaintiff to Defendant or was the product of earlier independent development by Defendant.”  On that basis, he found that Spring Designs had not established a likelihood of success on the merits.  He also noted that, because the motion was heard while Barnes & Noble’s product had already been launched while Spring Designs had not yet released its own e-reader, the requested injunction would “alter the status quo, not preserve it.”

As such, he denied the injunction.  Which is good news since, if anyone was wondering, I’d love a Nook for Chanukah.

Georgia Supreme Court Limits Noncompete Injunction

The Georgia Supreme Court recently narrowed the scope of a noncompete injunction prohibiting a former employee of a retina surgery practice from marketing certain software in competition with his ex-employer.  Coleman et al. v. Retina Consultants PC et al. (GA S. Ct.).

Prior to his employment by The Retina Eye Center (“TREC”), Coleman — a software engineer — wrote and marketed a medical billing program called Clinex. While at TREC, he tailored the program to suit that company’s business and developed a separate retinal practice application, Clinex-RE.  As the lower court found, it is undisputed that Coleman incorporated TREC’s proprietary information and trade secrets in developing Clinex-RE, and that Clinex-RE only operates in conjunction with Clinex. The parties allocated the rights to Clinex and Clinex-RE in a software agreement that also restricted Coleman’s ability to distribute the Clinex software or any applications competitive with Clinex-RE to ophthalmologists or optometrists without TREC’s consent.

Following his resignation from TREC, Coleman attempted to distribute or license the Clinex and Clinex-RE software to other ophthalmologists; he refused to disclose to TREC necessary passwords to read and revise copies of the software; and  he used or attempted to use TREC’s proprietary information and trade secrets to compete with a company owned by Coleman and TREC that was formed to market Clinex and Cline-RE.

TREC brought suit for breach of contract and moved for an injunction to enforce the software agreement’s noncompete provision, and to enjoin Coleman from retaining and using access codes, source codes, other information, and passwords required to read and revise copies of Clinex and Clinex-RE.

Finding the lower court improperly enforced the noncompete clause at issue as it is unenforceable as a matter of law because of the failure to specify a time limitation, the Supreme Court nonetheless held that the former employee could be prohibited from marketing Clinex and Clinex-RE together because — as the trial court determined — Clinex-RE includes proprietary information and trade secrets.  Coleman would not, however, be restricted from using and marketing his own version of Clinex as that software is his own property.

Further, the Supreme Court ruled that the injunction preventing Coleman from retaining any and all information and documentation related to Clinex was too broad and went beyond the scope required by the software agreement as it would foreclose him from access to information related to his own software to which he is entitled.

Back to the Basics… The Computer Fraud and Abuse Act

By Russell Beck and Stephen Riden

The Computer Fraud and Abuse Act (the “CFAA”), 18 U.S.C. § 1030, has recently come into vogue as the tool of choice among trade secret (and noncompete) litigators. Why? Because it provides a relatively easy to prove claim. In very (and I do mean very) simplistic terms, the statute (which is, in reality, a criminal statute, although it gives private individuals and companies the right to sue too) requires a showing of only: intentional access to a protected computer without authorization or beyond authorization causing damage. If you can prove those five elements, you have made out your case. The significance? No need to prove that a trade secret was taken.

So, what do those words mean? Well, the statute provides some guidance, but leaves many issues unanswered – and the courts are now starting to fill in the balance, as these cases become more prevalent. Suffice it to say, if you login to a computer, you have probably just satisfied the first two elements (intentional and access). If the computer is used in interstate commerce, you have satisfied the second element (a protected computer). What is interstate commerce? Well, in today’s world, it’s almost a theoretical question, as any computer connected to the internet will likely qualify.

That leaves two issues (authorization and damages). First the hard one: authorization. The statute applies equally to someone who never had authorization and to someone who had authorization, but exceeded the scope of that authorization. The issue making headlines (well, legal headlines anyway) is whether the following qualifies: an employee who obtains access within the bounds of what he is permitted to do, but accesses the computer for his own gain – not for the benefit of the employer. In some federal circuits (think states), the answer is that it does qualify. In others, it does not.

So, all of that must cause damage, right? Seems easy enough. Well, the question is what qualifies under the CFAA? The value of any misappropriated property – perhaps surprisingly – does not qualify. But, the cost of the forensic investigation to assess the harm, probably does. Go figure.

That’s it, in a nutshell. Like everything else, however, a little knowledge can be dangerous – so, be careful. The CFAA is far more complicated than this post makes it seem – and it should be carefully evaluated before its power is indiscriminately wielded, lest, for example, you find yourself in federal court, when you wanted to remain in state court.