In a decision handed down yesterday, the Supreme Court held that civil liability under the Computer Fraud and Abuse Act (“CFAA”) does not attach for employees who abuse or misuse their access credentials in accessing their current or former employers’ computer networks. Rather, to be liable under the CFAA, the employees must access databases or other electronic materials that are outside of their access rights and otherwise off-limits to them.
The Case
The case, Van Buren v. United States, arose out of the actions of a former police sergeant. The former officer, Van Buren, used his valid login credentials to search his police department database for a particular license plate number in exchange for a bribe, but was caught by an FBI sting operation. Van Buren was charged with a felony violation of the CFAA—18 U.S.C. § 1030(a)(2). An individual is liable under this section (which can carry both civil and criminal penalties) if he “intentionally accesses a computer without authorization or exceeds authorized access.” The statute defines “exceeds authorized access” to mean “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6).
Continue reading “Supreme Court Limits Application of the Computer Fraud and Abuse Act Against Employees Who Abuse Their Network Access Credentials”