When Is Employee Hacking a Crime?

Two weeks earlier, the U.S. Court of Appeals for the Ninth Circuit issued another opinion in the long-running litigation Nosal v. United States, holding that Nosal violated the CFAA in 2004 by using a former colleague's password to access his former employer's computer after his own access had been terminated. United States v. Nosal, — F.3d —-, 2016 WL 3608752 (9th Cir. July 5, 2016). Nosal had initially been charged with conspiracy, theft of trade secrets, and three computer fraud counts. His sentence included prison time, probation and nearly $1 million in fines and restitution.

Though other federal appeals courts have weighed in on what is access “without authorization” under the CFAA, the latest Nosal opinion appears to be the first that decides this question in the framework of arguable hacking of an employer database. The scope of the holdings in Nosal could be far broader, as noted in the dissent, which protested that the majority may have granted prosecutors excessive discretion, and unwittingly criminalized alleged misuse of a website's terms and conditions (which has already occurred elsewhere) and password sharing. In the aftermath of the Nosal dissent, other commentators have argued that password sharing has not suddenly become criminalized, as the scenario posited in the dissent merely pertains to a speculative future situation.