Fourth Circuit Adopts Reasoning From U.S. v. Nosal in Limiting CFAA Application

In my opinion, the civil remedy provisions of the CFAA - outside those applicable to hackers - are totally useless.

The Act is nothing more than a jurisdictional hook to get into federal court, where a host of state law claims are the real focus of a case. In a case where there is diversity of citizenship, the Act is uber-useless.

The Fourth Circuit in WEC Carolina Energy Solutions LLC v. Miller, 2012 U.S. App. LEXIS 15441 (4th Cir. July 26, 2012), affirmed the dismissal of a CFAA complaint arising out of an allegation that an ex-employee improperly downloaded confidential business information and used that information to make a presentation on behalf of a competitor following termination of employment.

The court agreed with the Ninth Circuit's narrow view of "without authorization" in United States v. Nosal and disagreed with the Seventh Circuit's expansive application of the CFAA under common-law agency principles in Int'l Airport Centers, LLC v. Citrin. Readers may recall that Nosal was written by Judge Kozinski and Citrin, the "cessation-of-agency" theory, was the work of Judge Posner.

The Fourth Circuit did not extend liability to so-called use-policy violations. In other words, if an employee obtains or access information from a protected computer to which he or she is not entitled to retrieve in the first place, then the CFAA would provide a remedy under the plain text of the statute. Conversely, misusing information to which the employee had a right to access falls outside the Act's scope.

Because the CFAA is both a criminal and civil statute, the Fourth Circuit relied on the rule of lenity to chose an interpretation of the statute that would not result in criminal sanctions. The court indicated its holding would "disappoint employers hoping for a means to rein in rogue employees," but it also noted that other legal remedies exist. Indeed, these types of disputes are fundamentally the province of state contract and tort law. Just as much of trade secret law is in fact duplicative of common law remedies, so too is the CFAA. WEC Carolina - the plaintiff - has a state court complaint pending against the same defendants in the federal case, a case that has nine other claims for relief.