Sign Up
Stay current with GH&R Newsletters. Click here to sign up.
E-Commerce News
No CFAA Liability Absent Damage to Database; Employment Agreement Constitutes Binding Agreement on Data Security
March 4, 2008
NO CFAA LIABILITY ABSENT DAMAGE TO DATABASEFederal courts continue to wrangle over the scope of the Computer Fraud and Abuse Act (CFAA). In a recent decision, a federal trial court in Illinois held that absent an actual injury to a database, trade secret theft and data misappropriation do not satisfy the CFAA's damage requirement.
According to the court, a civil action under the CFAA requires a showing of both "loss" and "damage." The court interpreted "damage" as actual damage to a database, not just harm to the information. Thus, the theft of information would not qualify as CFAA "damage" if the database was never impaired or shut down.
The case arose when an employee left a temporary employment agency and allegedly misappropriated trade secrets of his ex-employer on the way out. The ex-employer brought a civil action under the CFAA.
Although the CFAA is a criminal statute, it permits victims to bring a private civil action in certain circumstances. According to the CFAA, a civil violation occurs when a person:
(5)(A)(i) knowingly causes the transmission of ... information ... and as a result, ...intentionally causes damage without authorization to a protected computer; or (ii) intentionally accesses a protected computer without authorization and ...recklessly causes damage; or (iii) intentionally accesses a protected computer without authorization and ... causes damage; and caused loss to 1 or more persons during any 1-year period ... aggregating at least $5,000 in value
From this language, the court found that the CFAA requires both damage and loss to sustain a civil action.
Because the CFAA defines "damage" as "impairment to the integrity or availability of data, a program, a system, or information" the court interpreted this section as applying only to databases, and rejected the plaintiff's argument that the integrity of its data was harmed by the misappropriation.
The court felt that the theft of confidential information, standing alone, could not constitute "impairment to the integrity or availability" of the data. In the case before it, even if the ex-employee illegally copied the information, that information was still available to the ex-employer. For this reason, the court dismissed the CFAA claim.
The Illinois court's ruling is not the universal rule. Other courts have found CFAA liability without actual damage to the database. Victimized employers should continue to assert this claim, in addition to common law misappropriation claims when data is stolen.
EMPLOYMENT AGREEMENT CONSTITUTES BINDING AGREEMENT ON DATA SECURITY
An employee who reads and signs an electronic security agreement (ESA) prohibiting employees from copying software or storage media, and who thereafter continues working for the company is bound by the terms of that agreement. That’s the recent ruling from a federal court sitting in Indiana. The only stumbling block to the pro-employer holding is whether an "integration clause" in the broad employment contract superseded the ESA.
The case arose when the plaintiff was terminated from his employment with the defendant, Option Care Enterprises. Before he left his job, the employee copied his Outlook folder onto a disk, and took it with him. When the employee sued Option Care for wrongful termination, Option Care counter-sued for violations of the ESA.
The employee contended that he was not bound by the ESA because that agreement did not arise from an "offer" and was not supported by consideration.
The court saw things differently. "The offer is not to copy or duplicate Defendant's software or storage media and to return Defendant's software, computer materials, etc. upon leaving employment," the court said.
According to the court, the employee accepted the offer by signing the ESA. The consideration was the employee’s continued employment. Under Indiana law, continued employment is adequate consideration to support an enforceable contract.
Having found all that, the court concluded that the ESA was enforceable, and that the employee breached the ESA when he copied his Outlook folder.
That finding, however, did not end the case. The employee also argued that the ESA was superseded by his employment contract's integration clause, which provided that "all communications and other agreements of the entities, whether oral or written, as to the subject matter hereof are hereby superseded."
This argument raised the issue whether the ESA fell within the "subject matter" of the employment contract. The court determined that this issue was "unclear" and "ambiguous," and would require the jury to determine the parties' intent. Accordingly, the court denied Option Care’s motion for summary judgment.
"Integration clauses" are pretty typical "boilerplate" in contracts. They typically serve their purpose of rendering agreements outside the written document meaningless. This time it may have backfired.
This Newsletter is a periodic publication of Graydon Head & Ritchey LLP and should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general information purposes only, and you are urged to consult your own advisor concerning your situation and any specific legal question you may have.