Protecting Electronic Files from Disgruntled Employees

One of the biggest threats to an employer's competitive edge is the potential theft of the employer's trade secrets. Trade secrets include an employer's customer list, vendor list, market research, and financial projections. With the proliferation of computer networks in the workplace, including remote access, a disgruntled employee could steal the employer's trade secrets simply by downloading them to a disc or emailing them to a personal email account.

When an employee steals trade secrets, many employers have turned to the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. §1030, for injunctive relief and damages. The CFAA is essentially a criminal statute that permits some victims of computer hackers to maintain civil lawsuits against the hackers.

A person who accesses a computer "without authorization" or "exceeds authorized access" could be found liable under the CFAA. But while the CFAA provides a definition for the term "exceed authorized access" (to access a computer with authorization to obtain or alter information that the accesser is not entitled to obtain or alter), the CFAA does not provide a definition for the term "without authorization."

Because the CFAA has both criminal and noncriminal applications, courts are resolving any ambiguities in the statute in favor of lenity. See, e.g. LVRC Holdings v. Brekka, -- F.3d ----, 2009 WL 2928952 (9th Dist. Sept. 15, 2009, Case No. 07-17116) (employee who had emailed employer trade secrets to his personal computer did not violate the CFAA). The courts are narrowly construing the CFAA's terms so as to prevent convicting a criminal defendant under novel interpretations of the CFAA. Therefore, courts are generally interpreting "without authorization" as meaning with absolutely no permission to access the computer, such as an outside hacker. "Exceeds authorized access" generally means that the person had permission to access the computer but did not have permission to access the specific information.

If a disgruntled employee makes an electronic copy of an employer's trade secrets, these interpretations of the CFAA would not help the employer who gave the employee permission to access the trade secrets on the computer. Therefore, it is of the utmost importance that employers clearly define what information an employee is allowed to access. Employers should consult with their attorneys to prepare the documents that inform the employees which trade secrets they have permission to access.