In the Courts

Northern District of California Dismisses CFAA Counts Against Software Developer

The Northern District of California dismissed three counts alleging violations of the Computer Fraud and Abuse Act (“CFAA,” 18 U.S.C. ' 1030(a)(4)), against Suibin Zhang for failure to allege a valid offense. United States v. Zhang, No. CR-05-00812, 2010 WL 4807098, *1 (ND Cal. Nov. 19, 2010).

Zhang was a product developer for Netgear, Inc. As a part of his job, he received access to a supplier's (Marvell Superconductor) password-protected Web site. Zhang later interviewed for positions at Marvell and one of its competitors, Broadcom, Inc. He declined a Marvell offer and accepted a position at Broadcom. Before leaving Netgear, he accessed Marvell's Web site using his password, and downloaded proprietary documents. Id.

Zhang was indicted on nine counts, three of which alleged violations of CFAA. The latter makes it a crime to “'knowingly and with intent to defraud, access[] a protected computer without authorization, or exceed[] authorized access, and by means of such conduct further[] the intended fraud and obtain[] anything of value ' .” Id. at *2. The government alleged that Zhang violated CFAA by exceeding his authorized access.

The court identified a split on this issue. Some courts have found that any access of an employer's computer with intent to defraud occurs “without authorization,” while others have found that the CFAA violation only occurs when the initial access is not permitted. The court found that the Ninth Circuit had taken the more narrow approach.

However, the government argued that Zhang exceeded his authorized access because the specific limits of his access were outlined by “the terms of the nondisclosure agreement, the extranet terms of use, and a limited use license agreement” governing his use of the Marvell site. Id. at *3.

Although the court agreed that those documents limited what use Zhang could make of the documents, it found that “[w]ithin the meaning of CFAA, Zhang wa entitled to download the relevant documents because Marvell authorized his access to those documents.” As a result, the government had not alleged a valid offense under CFAA. The court looked to the Ninth Circuit's ruling in LVRC Holdings, LLC v. Brekka, 581 F.3d 1127, 1133-34 (9th Cir. 2009) and the District Court's recent opinion in United States v. Nosal, 2010 WL 934257 (N.D. Cal. Jan. 6, 2010) for guidance. Id. at *4.

In the Courts and Business Crimes Hotline were written by Associate Editor Kenneth S. Clark and Matthew J. Alexander, respectively. Both are associates at Kirkland & Ellis LLP, Washington, DC.

Northern District of California Dismisses CFAA Counts Against Software Developer

The Northern District of California dismissed three counts alleging violations of the Computer Fraud and Abuse Act (“CFAA,” 18 U.S.C. ' 1030(a)(4)), against Suibin Zhang for failure to allege a valid offense. United States v. Zhang, No. CR-05-00812, 2010 WL 4807098, *1 (ND Cal. Nov. 19, 2010).

Zhang was a product developer for Netgear, Inc. As a part of his job, he received access to a supplier's (Marvell Superconductor) password-protected Web site. Zhang later interviewed for positions at Marvell and one of its competitors, Broadcom, Inc. He declined a Marvell offer and accepted a position at Broadcom. Before leaving Netgear, he accessed Marvell's Web site using his password, and downloaded proprietary documents. Id.

Zhang was indicted on nine counts, three of which alleged violations of CFAA. The latter makes it a crime to “'knowingly and with intent to defraud, access[] a protected computer without authorization, or exceed[] authorized access, and by means of such conduct further[] the intended fraud and obtain[] anything of value ' .” Id. at *2. The government alleged that Zhang violated CFAA by exceeding his authorized access.

The court identified a split on this issue. Some courts have found that any access of an employer's computer with intent to defraud occurs “without authorization,” while others have found that the CFAA violation only occurs when the initial access is not permitted. The court found that the Ninth Circuit had taken the more narrow approach.

However, the government argued that Zhang exceeded his authorized access because the specific limits of his access were outlined by “the terms of the nondisclosure agreement, the extranet terms of use, and a limited use license agreement” governing his use of the Marvell site. Id. at *3.

Although the court agreed that those documents limited what use Zhang could make of the documents, it found that “[w]ithin the meaning of CFAA, Zhang wa entitled to download the relevant documents because Marvell authorized his access to those documents.” As a result, the government had not alleged a valid offense under CFAA. The court looked to the Ninth Circuit's ruling in LVRC Holdings, LLC v. Brekka , 581 F.3d 1127, 1133-34 (9th Cir. 2009) and the District Court's recent opinion in United States v. Nosal, 2010 WL 934257 (N.D. Cal. Jan. 6, 2010) for guidance. Id. at *4.

In the Courts and Business Crimes Hotline were written by Associate Editor Kenneth S. Clark and Matthew J. Alexander, respectively. Both are associates at Kirkland & Ellis LLP, Washington, DC.