| LVRC Holdings v. Brekka 581 F.3d 1127, 1135 (9th Cir.2009) | |
| Court: | United States Court of Appeals for the Ninth Circuit |
| Full Name: | LVRC HOLDINGS LLC v. Christopher BREKKA; Employee Business Solutions Inc.; Carolyn Quain; Stuart Smith; Brad Greenstein; Frank Szabo. |
| Date Decided: | September 15, 2009 |
| Citations: | LVRC Holdings v. Brekka . 581 . F.3d . 1127 . 2009 . http://www.ca9.uscourts.gov/datastore/opinions/2009/09/15/07-17116.pdf., |
| Judges: | M. Margaret McKeown, Sandra Segal Ikuta, and James V. Selna |
| Prior Actions: | Summary judgment for defendant, LVRC Holdings, LLC, v. Brekka, No. 2:05-CV-01026-KJD-GWF, 2007 U.S. Dist. LEXIS 73662, 2007 WL 2891565 (D. Nev. Sept. 28, 2007). |
| Opinions: | The district court granted summary judgment in favor of the defendants holding that "authorisation" was not dependent on employees' motives or loyalty. The Court of Appeals affirms. |
| Keywords: | Computer Fraud and Abuse Act (CFAA) |
LVRC Holdings v. Brekka 581 F.3d 1127, 1135 (9th Cir. 2009) is a Ninth Circuit Court of Appeals Decision that deals with the scope of the concept of "authorization" in the Computer Fraud and Abuse Act. The major finding of this case is that even if an employee accesses a computer for an improper purpose, such as one that violates the duty of loyalty to their employer, the employee remains authorized to access the computer until the employer revokes the employee's access. The findings of this case were upheld by another Ninth Circuit decision in United States v. Nosal, 676 F.3d 854 (9th Cir.2012) (en banc) and are the current law in this circuit.
This case is noteworthy because the court differentiated itself from the Seventh's Circuit interpretation of "authorization" by assessing whether the employer made the computer system available to the employee during the employee's access, instead of examining the subjective intent the employee had when accessing the system. Since this decision limited the scope of when an employee could access a computer "without authorization" than the Seventh Circuit did in a similar case, this case defined a circuit split of authority on the scope of the term "authorization." This issue could be settled by the Supreme Court in the future. Van Buren v. United States is a pending United States Supreme Court case dealing with the Computer Fraud and Abuse Act and its definition of "exceeds authorized access" in relation to one intentionally accessing a computer system they have authorization to access.
LVRC Holdings, LLC (LVRC) operated an addiction treatment center in Nevada. In April 2003, LVRC hired Christopher Brekka. Part of his duties included interacting with LVRC's email provider (Load, Inc.) and conducting Internet marketing programs. When Brekka was hired, he owned and operated EBSN and EBSF, two consulting businesses that provided referrals of potential patients to rehabilitation facilities. LVRC's owner was aware of Brekka's businesses.
During his time at LVRC, Brekka commuted between his home state, Florida, and Nevada, where LVRC and his first business were located. His second business is based in Florida. Brekka was assigned a computer at LVRC headquarters. Because of this frequent commute between Florida and Nevada, he emailed documents he obtained or created for his work at LVRC to his own personal computer. LVRC and Brekka had no written employment agreement. LVRC had no internal policy which would prohibit the transfer of LVRC documents to personal computers.
In June 2003, he emailed the administrative password for the LVRC's email system to his personal account. In August 2003, Brekka and LVRC began discussions regarding the possibilities of Brekka investing in an ownership interest in LVRC. At the end of the month, Brekka emailed to his wife and himself a number of documents including a financial statement for the company, LVRC's marketing budget, and admission reports for patients. On September 4, 2003, he emailed a master admission report containing the names of all the past and current patients at LVRC.
The negotiation regarding Brekka's investment in LVRC broke down mid-September 2003. He stopped working for LVRC and left his LVRC computer at the company as is, without deleting any emails.
In November 2004, LVRC noticed that someone was accessing its website using Brekka's login. LVRC then sued Brekka in federal court, alleging that he violated the Computer Fraud and Abuse Act (CFAA) when he emailed LVRC's documents to himself.
In its complaint, LVRC claimed that Brekka violated the Computer Fraud and Abuse Act (CFAA), which punishes intentional access, without authorization, to a computer to obtain information, violating 18 U.S.C. §§ 1030(a)(2) and (a)(4). To prevail, LVRC had to show that Brekka acted without authorization or exceed its authorization. The federal district court held that Brekka had authorization when he accessed LVRC's computer to transfer documents, and that there was no evidence that Brekka agreed to keep LVRC documents confidential or to return or destroy them. Finally, the district court concluded that LVRC was unable to provide evidence that Brekka logged into the LVRC website after Brekka's contract was terminated.
The Nevada district court granted summary judgment in favor of Brekka; LVRC contested both rulings in its appeal.
LVRC argued that Brekka lost authorization to access the computer when he transferred documents to his personal computer to further his own interests rather than the company's. However, The Ninth Circuit found that this interpretation of "authorization" under the Computer Fraud and Abuse Act would not give defendants sufficient "notice as to which acts are criminal." "If the employer has not rescinded the defendant's right to use the computer, the defendant would have no reason to know that making personal use of the company computer in breach of a state law fiduciary duty to an employer would constitute a criminal violation of the CFAA. It would be improper to interpret a criminal statute in such an unexpected manner."
The Court differentiated itself from the Seventh Circuit in International Airport Centers, L.L.C. v. Citrin. In Citrin, the Court used agency principles to find that the employee violated his duty of loyalty to his employer when he set out to start a competing firm and accessed the company computer to further that interest, erasing data on his employer's computer. The Seventh Circuit found that Citrin's "breach of the duty of loyalty to his employer terminated the employee's agency relationship and with it his authority to access the laptop, because the only basis of his authority had been that relationship." See Brekka citing Citrin. However, The Ninth Circuit applied the rule of lenity to the term "authorization" and found that the Seventh's Circuit interpretation could criminalize a large swath of the population by looking to the subjective intent of the employee or the subsequent use of the information accessed. Instead, the Brekka Court held that "a person uses a computer 'without authorization' under §§ 1030(a)(2) and (4) when the person has not received permission to use the computer for any purpose (such as when a hacker accesses someone's computer without any permission), or when the employer has rescinded permission to access the computer and the defendant uses the computer anyway." Since Brekka, courts in the Ninth Circuit have generally foreclosed an employer's Computer Fraud and Abuse Act claim against former employees, unless the employees' access was conducted post-termination.
The Ninth Circuit's interpretation of "authorization" is significantly narrower than the Seventh Circuit's. Given the split between the two high courts, it is likely that the Supreme Court will eventually address the issue.
While the most significant consequence of Brekka was narrowing the scope of "without authorization" to exclude breaches of loyalty, the Brekka court opened a murky area of liability in the post-employment context. The court held that "a person uses a computer 'without authorization' ... when the employer has rescinded permission to access the computer and the defendant uses the computer anyway." This has led several courts to find that anyone can access a computer without authorization after employment, even if the employer has not technologically revoked the employee's access credentials.