When a Departing Employee Attacks Your Computer System
The Sixth Circuit United States Court of Appeals (which covers Ohio) handed down an interesting decision a couple weeks ago that limits the ability of employers to go after departing employees who misused the company’s computers.
Two employees left Royal Truck & Trailer Sales to go to work for a competitor. One employee forwarded from his Royal email account to his personal one quotes for Royal customers and Royal paystubs; contacted a Royal customer through Royal’s email server to ask the customer to send all the new vendor information to his personal email account; then deleted and reinstalled the operating system on his company-issued laptop, rendering its data unrecoverable.
The other employee did much the same and announced her resignation on social media, sharing a link to an infamous song.
Given that the company had a fairly stringent policy pertaining to the use of its computer equipment, including a prohibition against turning off GPS tracking on company issued cell phones, it’s not surprising that the company sued the employees for their actions. One of the claims in the lawsuit was that the employees violated federal law — the Computer Fraud and Abuse Act (CFAA) which was intended by Congress to combat computer hacking and theft of information stored on computers.
The court focused on whether or not the employees exceeded their authorized access to the system. Defined as accessing a “computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter”, the Court determined there was no liability because the employees had the authority to access the data. This contrasts to a hacker who has no authority to access protected data or to an employee who accesses parts of a system that are off-limits.
While there are many other ways for a business to recover from such improper behavior, including tort law, the courts have made it clear that the CFAA is inapplicable.
