The Ninth Circuit Court of Appeals recently held that a federal offense may be committed when an employee exceeds the employer's authorization to access his/her work computer, and does so with the intent to defraud the employer.

In United States v. Nosal, an employee who was authorized to access the employer's database but gathered information for personal use was charged with a violation of the Computer Fraud and Abuse Act, 18 U.S.C. Section 1030.  That statute, among other things, makes it a crime where a person "knowingly and with intent to defraud accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value."

Here, it was undisputed that the employees who were charged obtained were authorized to access the employer's database., but the employer's policy restricted the use of such information for "legitimate" employer business.

Thus, the Court was required to determine whether the the taking of information by these employees for their own personal purposes rather than the business of the employer  fell within the statute's provision making it a crime to "exceed authorized access" because the  statute defined the phrase to mean "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled to obtain or alter."  The Court reasoned that because the statute is violated where the employer has placed limitations on the employee's permission to use the computer and the employee has violated or exceeded those limitations.

This does not mean that the mere violation of an employer's use restrictions is automatically a federal crime.  Rather, the Act is violated only if the employee (1) violates an employer's restriction on computer access, (2) with an intent to defraud, and (3) by that action furthers the intended fraud and obtains anything of value.