Supreme Court Ruling Limits CFAA Reach

Vinson & Elkins LLP
Contact

Vinson & Elkins LLP

In a notable decision on June 3, 2021, the Supreme Court resolved a circuit split about the reach of the Computer Fraud and Abuse Act of 1986 (“CFAA”), a statute that allows for potential civil and criminal penalties against those who have “exceed[ed] authorized access” in obtaining and/or using information from company computer systems. The law is sometimes used by employers to pursue claims against employees (or ex-employees) who have misappropriated trade secrets or otherwise misused sensitive information stored on company computers. Writing for an unusual six-justice majority, Justice Barrett — joined by Justices Breyer, Sotomayor, Kagan, Gorsuch, and Kavanaugh — significantly limited the scope of the statute.

The CFAA prohibits accessing a computer either without authorization or in such a way that “exceeds authorized access.” Prior to last week’s decision in Van Buren v. United States, there was a division among the federal circuit courts of appeals about whether “exceeding authorized access” applied only to the act of accessing files to which an individual did not have proper access, or also to the misuse of files to which an individual had lawful access. For example, Van Buren (a former police officer) accessed his patrol car’s computer and looked up a license plate number, intending to sell the information. There was no dispute that he was authorized to access the license plate database. The question was whether, in using the information within that database for personal use and in violation of department policy, he “exceed[ed] authorized access” under the CFAA.

In an opinion that provided a detailed analysis of the CFAA text, the Supreme Court majority held that he did not. Instead, the Court determined that the CFAA only prohibits obtaining information from computer files that one does not have access to in the first place, and not misusing access that one otherwise properly has. While the majority’s opinion focused on a plain language reading of the statute (and the importance of the word “so” within a particular sentence), it also emphasized the practical implications of its holding, emphasizing that an expansive reading of the law could have resulted in the criminalization of a large amount of behavior, including reading the news on a work computer when an employer has a business-only policy with regard to how those computers may be used.

While the Van Buren ruling does not foreclose employers’ (or the government’s) ability to pursue CFAA claims in some instances, it has overruled the broad reading of the statute that had applied in some circuits (including the Fifth Circuit), and it should result in significantly diminished CFAA-related litigation.

Christina Peterman, 2021 Summer Associate, contributed to this series post.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Vinson & Elkins LLP | Attorney Advertising

Written by:

Vinson & Elkins LLP
Contact
more
less

Vinson & Elkins LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.