On July 5, 2016, the Ninth Circuit Court of Appeals issued its highly anticipated decision in the most recent chapter of
United States v. Nosal, holding that an individual acts "without authorization" as used in the Computer Fraud and Abuse Act ("CFAA") when, after his/her own access has been revoked, the individual utilizes legitimate log‑in information of another to access company databases. This decision has important consequences for organizations as they consider how to implement policy and technical controls on user access to ensure they are protected against unauthorized access under the CFAA.
Background
The case arose out of the post-departure activities of former employees of the Korn Ferry executive recruiting firm. In 2005, David Nosal left Korn Ferry after nearly a decade to start a competing venture. In the process of doing so, Nosal obtained confidential Korn Ferry information in two ways. First, after leaving, he convinced Korn Ferry employees to supply him information the current employees had access to via the firm's database. Second, and relevant to this phase of the case, after some of those employees joined Nosal's competing venture, they obtained log-in credentials of Nosal's former executive assistant (with her permission) who was still at Korn Ferry and used them to directly access the Korn Ferry database. Both acts indisputably violated Korn Ferry policy, which restricted use of the company database to Korn Ferry business.
Prosecution and Appeals
Prosecutors charged Nosal with violating the CFAA—the federal hacking statute— under the theory that Nosal (and the accomplices he solicited) accessed Korn Ferry's database "without authorization" or by "exceed[ing] authorized access"
[1] to the database. After the district court threw out the "exceed[ing] authorized access" charges and the Ninth Circuit affirmed that determination en banc ("
Nosal I"),
[2] the prosecution proceeded to trial ("
Nosal II") on charges that use of a Korn Ferry employee's log-in credentials by Nosal and his employees to gain access to the Korn Ferry database was "without authorization," and thus a violation of the CFAA. The jury again convicted Nosal, and the district court upheld the convictions, explaining that use of an employee's credentials, even with the employee's permission, may qualify as "circumvention of a technological barrier because 'password protection is one of the most obvious technological access barriers that a business could adopt.'" The Ninth Circuit affirmed the convictions, explaining that Nosal and his cohort acted "without authorization" under the CFAA when they circumvented Korn Ferry's revocation of access by using a current employee's credentials to gain access to computer data. As the Court stated, a "person uses a computer without authorization . . . when the employer has rescinded permission to access the computer and the defendant uses the computer anyway."
Implications
Although
Nosal II strengthens the CFAA's prohibition on access without authorization, organizations should consider reviewing technical and policy-based access controls. In addition to having clear policies on access restrictions and prohibiting password sharing, companies should consider implementing an identity access management program and use of privileged identity management software (PIMS) to limit access to company-sensitive information to employees on a need-to-know basis. Organizations should also review employee separation protocols to ensure that access credentials are quickly terminated after an employee departs a company. Finally, employers would be well-served to implement protocols (consistent with employee privacy considerations) that monitor employee searches, if for no other reason than the strong deterrent effect that accompanies putting employees on notice that their inquiries are being reviewed. Doing so would also allow organizations to identify aberrant usage that could signal nefarious activity.
Though the Court's decision in
Nosal II should put companies slightly more at ease, organizations are still at considerable risk because
Nosal I simply creates an incentive for competitors to find current employees to do their bidding—another reason to limit employee access to information through technical limitations rather than rely solely on policy-based restrictions.
Given that
Nosal was reheard en banc the first time around, there remains a distinct possibility the same could occur in
Nosal II. We will keep you apprised of any developments in
Nosal and any related cases concerning interpretation of the CFAA. On that front, we previously reported on the Second Circuit's recent decision in
Valle and the circuit split that has developed regarding the interpretation of "exceed[s] authorized access." Orrick's Cybersecurity and Privacy teams regularly work with companies to enhance protocols and policies to ensure protection of critical, confidential information.
[1] The phrase "exceeds authorized access" is defined as "access[ing] a computer with authorization and . . . us[ing] such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 15 U.S.C. § 1030(e)(6).
[2] Specifically, the district court concluded that Korn Ferry employees' use of their own passwords to access and obtain confidential information did not "exceed authorized access." The Ninth Circuit then affirmed en banc, holding that the phrase "exceeds authorized access does not extend to violations of use restrictions" but rather requires a showing that the defendant circumvented a "technological access barrier."