|
Here's a real life example showing the value of having written agreements.
Your employees can be your biggest asset and your biggest liability. Two recent Ninth Circuit (California's federal circuit) cases have addressed the consequences, if any, of a current or former employee accessing proprietary information for interests adverse to their employer.
United States v. Nosal
Defendant Nosal worked as an executive for Korn/Ferry, an executive search firm, for approximately eight years. When Nosal left in 2004, he signed a Separation and General Release Agreement and Independent Contractor Agreement, wherein he agreed to serve as an independent contractor to Korn/Ferry and not to compete with Korn/Ferry for one year. In exchange, Korn/Ferry agreed to pay Nosal two lump-sum payments in addition to twelve monthly payments of $25,000.00. Shortly after leaving his employment, Nosal engaged three current Korn/Ferry employees to help him start a competing business. The United States' indictment alleges that these employees obtained trade secrets and other proprietary information by using their user accounts to access the Korn/Ferry computer system. Specifically, the employees transferred to Nosal source lists, names, and contact information from the "Searcher" database, a "highly confidential and proprietary database of executives and companies." The district court, relying on LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009), dismissed several counts of the indictment, inter alia, numerous violations of the Computer Fraud and Abuse Act (CFAA). The Ninth Circuit Court of Appeals reversed the district court's dismissal, and held that "an employee 'exceeds authorized access under � 1030 when he or she violates the employer's computer access restrictions - including use restrictions.'" The CFAA prohibits a number of different computer crimes, the majority of which involve accessing computers without authorization or in excess of authorization, and then taking specified forbidden actions, ranging from obtaining information to damaging a computer or computer data. The CFAA is generally used to target computer hackers and other third-party criminals who attempt to target sensitive information to which they have no right of access. The CFAA has been increasingly invoked against individuals with some right of access, such as employees, who exceed the authority granted to them by their employers. There have also been attempts to expand the coverage of the CFAA to ordinary violations of an online service providers terms of use[1]. While the CFAA does not define the phrase "without authorization," it does state that "exceeds authorized access" means "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." In determining the plain meaning of this portion of the statute, the Court determined that someone has exceeded authorized access when they overstep limitations imposed on their access, such as by computer-use or other employment policies. In Brekka, the court held that it is the employer's actions that determine whether an employee acts without authorization to access a computer in violation of � 1030. Specifically, Brekka was an employee who was negotiating the purchase of an interest in his employer's business. During the course of these negotiations, Brekka emailed several business documents to his and his wife's personal email accounts. After negotiations broke down, and Brekka left his job, his former employer sued Brekka alleging that the emails Brekka sent to himself constituted a violation of � 1030(g), which allows for a private right of action under the CFAA. To decide Brekka, the Ninth Circuit rejected the Seventh Circuit's approach to this type of action, namely, that any act by an employee that violates their duty of loyalty to their employer is necessarily an act "without authorization." Instead, the Ninth Circuit held that an employer must notify an employee of its intent to rescind an employee's, or former employee's, access to a computer. Because the CFAA provides for criminal penalties, the Brekka court determined that an employee should have such explicit notice before any violations can be said to have occurred. In Brekka, the employer did not have the employee sign an employment agreement and there were no formal computer use policies in place. In the present case, however, there was a clear computer use policy that placed conspicuous restrictions on an employee's access both to the system in general and to the specific database in question. All of Korn/Ferry's employees had signed a written agreement outlining the company's computer use policy and acknowledging that certain information was considered protected and proprietary. Korn/Ferry also took considerable steps to maintain the confidentiality of its information by issuing unique access accounts and passwords and labeling all sensitive information as confidential or proprietary. Nosal's accomplices were in violation of specific provisions of the company's computer use policy and therefore had "fair warning that they were subjecting themselves to criminal liability."[2] The Court of Appeals reversed the district court's dismissal of the United States' indictment based on the CFAA and held that Nosal and his accomplices had exceeded their authorized access when they violated Kern/Ferry's computer use policy. The case was remanded to the district court with instructions to reinstate the dismissed counts of the indictment. In summary, the CFAA does not criminalize the use of work computers by employees for personal use[3], or other innocuous uses by employees, whether or not their employer has a computer use policy strictly prohibiting such use. An employee violates the CFAA only where (1) they violate an employer's restriction on computer access, (2) with an intent to defraud, and (3) by that action "furthers the intended fraud and obtains anything of value."
HOW THIS CASE CAN HELP YOU PROTECT YOUR SENSITIVE INFORMATION
There are a number of lessons to be learned from this case, especially in comparison to the decision in Brekka:
(1) Always have formal, written employment agreements that clearly outline the permissions given to each employee and acknowledge what information and/or practices are proprietary, if any.
(2) Marking certain information as proprietary or confidential is just as important internally as it is when sending things out to third-parties. While your employees' interests may be currently aligned with your own, that can change quickly.
(3) Remind your employees of your confidentiality procedures and security measures; after they have signed their agreements continue to post policies and send memos on best practices.
(4) When an employee is leaving the company be sure to explicitly (and in writing) rescind their access to sensitive materials.
These simple steps can go a long way to avoid a situation where a highly trained, former asset of your company becomes one of your newest competitors.
[1] See United States v. Lori Drew - Ms. Drew, who violated the MySpace Terms of Service when making a fake online persona that ultimately led to the suicide of a teenage girl, was acquitted after a jury verdict finding her guilty under the CFAA. The court determined that the vagueness doctrine, which bars the enforcement of statutes that cannot be reasonably interpreted thereby preventing an average person from having "fair warning" of the conduct that will constitute a violation, prevented a criminal penalty being imposed on Ms. Drew for breaching the MySpace Terms.
[2] The Ninth Circuit's interpretation of this case, while at odds with the current rule in the Seventh Circuit, is consistent with recent holdings in both the Fifth and Eleventh circuits; United States v. John, 597 F.3d 263 (5th Cir. 2010) and United States v. Rodriquez, 628 F.3d 1258, 1263 (11th Cir. 2010), respectively.
[3] Consider, however, State v. Wolfe, No. 08-CA-16 (Ohio Ct.App. April 28. 2009), where the Ohio Court of Appeals determined that while using your office computer for personal business may not constitute theft, you may be liable for felony unauthorized access if that personal business is illegal conduct.
|
