3rd Circuit Clarifies Scope of Computer Fraud Abuse Act With Employer's Policies - DataBreaches.Net

"The U.S. Court of Appeals for the Third Circuit clarified this week that an employee's purported violations of workplace computer use policies cannot be criminalized under federal law as long as there is no evidence of hacking or violations of trade secrets. On, the federal appellate court affirmed the U.S. District Court for the Middle District of Pennsylvania's decision finding that defendants Nicole Durenleau and Jamie Badaczewski didn't violate the Computer Fraud Abuse Act (CFAA) by violating computer policies of their employer, debt collection firm National Recovery Agency Group."

"National Recovery claimed that Durenleau and Badaczewski violated its computer policies and trade secrets when Durenleau sent her passwords to Badaczewski to access her work computer while she was out sick and working remotely. In a matter of first impression, the Third Circuit concluded the employees were authorized to access National Recovery's computer systems as employees of the company."

""Indeed, there are many other causes of action-breach of contract, business torts, fraud, negligence, and so on-that provide a remedy for employers when employees grossly transgress computer-use policies," said Judge Thomas L. Ambro, who authored the decision and was joined by Judges Thomas Hardiman and Theodore McKee. "The CFAA is the wrong tool for NRA's project. With today's holding, we mean to turn future litigants to other causes of action so that we do not make 'millions of otherwise law-abiding citizens [into] criminals.'""

The Third Circuit held that employees' alleged breaches of workplace computer-use policies do not constitute federal crimes under the Computer Fraud and Abuse Act absent evidence of hacking or trade-secret misappropriation. The court affirmed a lower court's ruling that Nicole Durenleau and Jamie Badaczewski did not violate the CFAA after Durenleau shared her work passwords with Badaczewski while working remotely. National Recovery alleged violations of computer policies and trade secrets. The court found the employees were authorized to access the company's systems as employees. The opinion directs employers to contract and tort remedies rather than the CFAA.

Read at DataBreaches.Net