New Tools for Companies Against Cybercrime

This is because the CFAA allows companies victimized by violations of the statute to bring civil actions against the perpetrators. 18 U.S.C. 1030(g). The CFAA, among other things, makes it a crime when an individual “accesses” a computer “without authorization or exceeds authorized access” to steal data. “Without authorization” typically relates to an outside hacker, whereas “exceeds authorized access” typically relates to a company insider, like any employee who has authority to access the company computer but exceeds that authorized access.

There is a split among the circuit courts of appeals over whether employees who access company computers to steal data exceed their authorized access. The Fourth Circuit (following the Ninth Circuit), for example, in WEC Carolina Energy Solutions v. Miller, No. 11-1201 (4th Cir. July 26, 2012, cert dismissed Jan. 2, 2013) narrowly interpreted “exceeds authorized access” not to apply to employees who are “authorized to access a computer when his employer approves or sanctions his admission to that computer.” In contrast, the Seventh Circuit, in International Airport Ctrs. v. Citrin, No. 06-2073 (7th Cir. July 25, 2006), applied the CFAA to an employee who accessed the company computer for the purpose of “further[ing] interests that are adverse to his employer,” i.e., stealing company data to take to a competitor. The Fifth and Eleventh circuits follow this interpretation.