LVRC Holdings LLC v. Brekka
| LVRC Holdings v. Brekka | |
|---|---|
 | |
| Court | United States Court of Appeals for the Ninth Circuit |
| Full case name | LVRC HOLDINGS LLC v. Christopher BREKKA; Employee Business Solutions Inc.; Carolyn Quain; Stuart Smith; Brad Greenstein; Frank Szabo. |
| Decided | September 15, 2009 |
| Citation(s) | LVRC Holdings v. Brekka, 518 F.3d 1127 (2009)., |
| Case history | |
| Prior action(s) | Summary judgment for defendant, unreported (D. Nev.) |
| Court membership | |
| Judge(s) sitting | M. Margaret McKeown, Sandra Segal Ikuta, and James V. Selna |
| Case opinions | |
| The district court granted summary judgment in favor of the defendants holding that "authorisation" was not dependent on employees' motives or loyalty. The Court of Appeals affirms. | |
| Keywords | |
| Computer Fraud and Abuse Act (CFAA) | |
LVRC Holdings v. Brekka is an ongoing lawsuit in the U.S. federal courts that deals with the scope of the concept of "authorization" in the Computer Fraud and Abuse Act. Specifically, it considers the ability of employees to access and use company data for their own purposes. A district court came to the conclusion that what was legal or illegal for employees to do was decided chiefly by the access policies put in place by the employer, not just federal or state law.[1]
It has been upheld by the Ninth Circuit Court of Appeals. Since it adopted a narrower standard for authorization than the Seventh Circuit did in a similar case, it is likely to be heard by the Supreme Court in the future.
Factual background
LVRC Holdings, LLC (LVRC) operated an addiction treatment center in Nevada. [1] In April 2003, LVRC hired Christopher Brekka. Part of his duties included interacting with LVRC's email provider (Load, Inc.) and conducting Internet marketing programs. When Brekka was hired, he owned and operated EBSN and EBSF, two consulting businesses that provided referrals of potential patients to rehabilitation facilities. LVRC's owner was aware of Brekka's businesses.
During his time at LVRC, Brekka commuted between his home state, Florida, and Nevada, where LVRC and his first business were located.[1] His second business is based in Florida. Brekka was assigned a computer at LVRC headquarters. Because of this frequent commute between Florida and Nevada, he emailed documents he obtained or created for his work at LVRC to his own personal computer. LVRC and Brekka had no written employment agreement. LVRC had no internal policy which would prohibit the transfer of LVRC documents to personal computers.
In June 2003, he emailed the administrative password for the LVRC's email system to his personal account.[1] In August 2003, Brekka and LVRC began discussions regarding the possibilities of Brekka investing in an ownership interest in LVRC. At the end of the month, Brekka emailed to his wife and himself a number of documents including a financial statement for the company, LVRC's marketing budget, and admission reports for patients. On September 4, 2003, he emailed a master admission report containing the names of all the past and current patients at LVRC.
The negotiation regarding Brekka's investment in LVRC broke down mid-September 2003.[1] He stopped working for LVRC and left his LVRC computer at the company as is, without deleting any emails.
On November 2004, LVRC noticed that someone was accessing its website using Brekka's login[1]. LVRC then sued Brekka in federal court, alleging that he violated the Computer Fraud and Abuse Act (CFAA) when he emailed LVRC's documents to himself.
Court proceedings
District court
In its complaint, LVRC claims that Brekka violated the Computer Fraud and Abuse Act (CFAA), which punishes intentional access to a computer without authorisation to obtain information[1]. Both crimes are defined under 18 U.S.C. §§ 1030(a)(2) and (a)(4). To be successful, LVRC has to show that Brekka acted without authorisation or exceed its authorisation. The district court held that Brekka had authorization when he accessed LVRC's computer to transfer documents. Furthermore, there were no evidence that Brekka agreed to keep LVRC documents confidential, or to return or destroy them. Finally, the district court concluded that LVRC was unable to provide evidence that Brekka logged into the LVRC website after its contract was terminated.
The Nevada district court granted summary judgment in favour of Brekka; LVRC contested both rulings in its appeal[1].
Court of appeals
LVRC argued that Brekka transferred documents to his computer to further his own interests rather than LVRC's and that such access was "without authorisation"[1]. This is in line with the reasoning of the Seventh Circuit in International Airport Centers LLC v. Citrin.[2] However, the Ninth Circuit found that plain language of the Computer Fraud and Abuse Act provided no support for such interpretation, and did not follow the Seventh Circuit. [3][4] More precisely, the Ninth Circuit held that "authorization" depends on "actions taken by the employer" and is orthogonal to the loyalty or duties of the employee (Brekka is this case).[4]
The Ninth Circuit affirmed the ruling of the district court.[1]
Consequences
The Ninth Circuit interpretation of "authorization" is significantly narrower than the Seventh Circuit's. Given the split between the two high courts, it is likely that the Supreme Court will get involved eventually.[3] However, LVRC has not appealed this case further; no reconciliation is expected in the near future.[citation needed]
The CFAA has been used to sue employees who have used a computer toward unethical goals. After, the Ninth Circuit ruling, such cases will be harder to rest on the CFAA alone.[5] For companies, this ruling highlights the importance of disabling ex-employees' accounts.[6]
See also
References
- ^ a b c d e f g h i j LVRC Holdings v. Brekka, 518 F.3d 1127 (2009).
- ^ International Airport Centers Llc v. Citrin, 440 F.3d 418 (2006).
- ^ a b Campbell, Dale C.; Muradyan, David (January 27, 2010). "The Seventh And Ninth Circuits Split On What Constitutes "Without Authorization" Within The Meaning Of The Computer Fraud And Abuse Act". The IP Law Blog. Retrieved February 9, 2011.
- ^ a b Brenton, Kyle W. (Fall 2009). "Trade Secret Law and The Computer Fraud and Abuse Act: Two Problems and Two Solutions". University of Illinois Journal of Law, Technology & Policy. 2009 (2).,
- ^ Cheng, Jacqui (September 18, 2009). "Disloyal employees are not hackers, says court". Ars Technica. Retrieved February 9, 2011.
- ^ Johnson, Kurt (February 24, 2010). "LVRC Holdings v. Brekka - Legal Impact of Zombie Accounts". Courion. Retrieved February 9, 2011.