LVRC Holdings LLC v. Brekka
|LVRC Holdings v. Brekka|
|Court||United States Court of Appeals for the Ninth Circuit|
|Full case name||LVRC HOLDINGS LLC v. Christopher BREKKA; Employee Business Solutions Inc.; Carolyn Quain; Stuart Smith; Brad Greenstein; Frank Szabo.|
|Decided||September 15, 2009|
|Citation(s)||LVRC Holdings v. Brekka, 581 F.3d 1127 (2009). ,|
|Prior action(s)||Summary judgment for defendant, unreported (D. Nev.)|
|The district court granted summary judgment in favor of the defendants holding that "authorisation" was not dependent on employees' motives or loyalty. The Court of Appeals affirms.|
|Judge(s) sitting||M. Margaret McKeown, Sandra Segal Ikuta, and James V. Selna|
|Computer Fraud and Abuse Act (CFAA)|
LVRC Holdings v. Brekka is an ongoing lawsuit in the U.S. federal courts that deals with the scope of the concept of "authorization" in the Computer Fraud and Abuse Act. Specifically, it considers the ability of employees to access and use company data for their own purposes. A district court came to the conclusion that what was legal or illegal for employees to do was decided chiefly by the access policies put in place by the employer, not just federal or state law.
It has been upheld by the Ninth Circuit Court of Appeals. Since it adopted a narrower standard for authorization than the Seventh Circuit did in a similar case, it is likely to be heard by the Supreme Court in the future.
LVRC Holdings, LLC (LVRC) operated an addiction treatment center in Nevada. In April 2003, LVRC hired Christopher Brekka. Part of his duties included interacting with LVRC's email provider (Load, Inc.) and conducting Internet marketing programs. When Brekka was hired, he owned and operated EBSN and EBSF, two consulting businesses that provided referrals of potential patients to rehabilitation facilities. LVRC's owner was aware of Brekka's businesses.
During his time at LVRC, Brekka commuted between his home state, Florida, and Nevada, where LVRC and his first business were located. His second business is based in Florida. Brekka was assigned a computer at LVRC headquarters. Because of this frequent commute between Florida and Nevada, he emailed documents he obtained or created for his work at LVRC to his own personal computer. LVRC and Brekka had no written employment agreement. LVRC had no internal policy which would prohibit the transfer of LVRC documents to personal computers.
In June 2003, he emailed the administrative password for the LVRC's email system to his personal account. In August 2003, Brekka and LVRC began discussions regarding the possibilities of Brekka investing in an ownership interest in LVRC. At the end of the month, Brekka emailed to his wife and himself a number of documents including a financial statement for the company, LVRC's marketing budget, and admission reports for patients. On September 4, 2003, he emailed a master admission report containing the names of all the past and current patients at LVRC.
The negotiation regarding Brekka's investment in LVRC broke down mid-September 2003. He stopped working for LVRC and left his LVRC computer at the company as is, without deleting any emails.
On November 2004, LVRC noticed that someone was accessing its website using Brekka's login. LVRC then sued Brekka in federal court, alleging that he violated the Computer Fraud and Abuse Act (CFAA) when he emailed LVRC's documents to himself.
In its complaint, LVRC claimed that Brekka violated the Computer Fraud and Abuse Act (CFAA), which punishes intentional access, without authorization, to a computer to obtain information, violating 18 U.S.C. §§ 1030(a)(2) and (a)(4). To prevail, LVRC had to show that Brekka acted without authorization or exceed its authorization. The federal district court held that Brekka had authorization when he accessed LVRC's computer to transfer documents, and that there was no evidence that Brekka agreed to keep LVRC documents confidential or to return or destroy them. Finally, the district court concluded that LVRC was unable to provide evidence that Brekka logged into the LVRC website after Brekka's contract was terminated.
Court of appeals
LVRC argued that Brekka transferred documents to his computer to further his own interests rather than LVRC's and that such access was "without authorization". The Ninth Circuit found that plain language of the Computer Fraud and Abuse Act provided no support for such interpretation, a holding inconsistent with the reasoning of the Seventh Circuit in International Airport Centers, L.L.C. v. Citrin. More precisely, the Ninth Circuit held that "authorization" depends on "actions taken by the employer" and is orthogonal to the loyalty or duties of the employee (Brekka).
The Ninth Circuit affirmed the ruling of the district court.
The Ninth Circuit interpretation of "authorization" is significantly narrower than the Seventh Circuit's. Given the split between the two high courts, it is likely that the Supreme Court will eventually address the issue. LVRC did not appeal this case further, and no reconciliation is expected in the near future.
The CFAA has been used to sue employees who have used a computer for unlawful ends. After the Ninth Circuit ruling, it will be more difficult for such cases to succeed based on the CFAA alone. For companies, this ruling highlights the importance of disabling ex-employees' accounts.
- Computer Fraud and Abuse Act
- United States v. Lori Drew
- United States v. Nosal
- International Airport Centers, L.L.C. v. Citrin
- LVRC Holdings v. Brekka, 581 F.3d 1127 (2009).
- International Airport Centers, L.L.C. v. Citrin, 440 F.3d 418 (2006).
- Campbell, Dale C.; Muradyan, David (January 27, 2010). "The Seventh And Ninth Circuits Split On What Constitutes "Without Authorization" Within The Meaning Of The Computer Fraud And Abuse Act". The IP Law Blog. Retrieved February 9, 2011.
- Brenton, Kyle W. (Fall 2009). "Trade Secret Law and The Computer Fraud and Abuse Act: Two Problems and Two Solutions". University of Illinois Journal of Law, Technology & Policy 2009 (2).,
- Cheng, Jacqui (September 18, 2009). "Disloyal employees are not hackers, says court". Ars Technica. Retrieved February 9, 2011.
- Johnson, Kurt (February 24, 2010). "LVRC Holdings v. Brekka - Legal Impact of Zombie Accounts". Courion. Retrieved February 9, 2011.