The Computer Fraud and Abuse Act (‘‘CFAA’’) was passed by Congress in 1984 to address the unauthorized access and use of computers and computer networks. Although the CFAA is primarily a criminal statute, the 1994 amendment to the CFAA allowed individuals and companies to bring a private civil suit against a person who accessed a protected computer ‘‘without authorization’’ or while ‘‘exceed[ing] authorized access.’’ Increasingly, employers have used the CFAA to bring suit against former employees or agents (‘‘insiders’’) who have absconded with company data. Within this context, there is currently a widening split among circuit and district courts over whether insiders can be held liable under the CFAA for accessing data without or in excess of authorization. This diversity of viewpoints is currently playing out in the Ninth Circuit, where an en banc panel is considering whether to affirm a definition of authorization that will allow employers a remedy against insiders who exceed their authorized access, or whether to define to term narrowly.

Please see full article below for more information.