United States v. Nosal
661 F.3d 1180
9th Cir.2011Background
- Nosal left Korn/Ferry in October 2004 and agreed to not compete for one year under Separation/Independent Contractor agreements.
- He allegedly recruited three Korn/Ferry employees to help start a competing business and to obtain Korn/Ferry trade secrets.
- The employees allegedly used their Korn/Ferry credentials to access the Searcher database and transferred lists, names, and contacts to Nosal.
- Korn/Ferry protected the database with access controls, confidentiality agreements, and notices warning of disciplinary or criminal consequences for improper access.
- District court initially refused dismissal; after LVRC Holdings LLC v. Brekka, it dismissed several CFAA counts as improper under Brekka.
- The government appealed; the Ninth Circuit held that employer-imposed access restrictions define 'exceeds authorized access' and reversed to reinstate counts.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Does CFAA §1030(a)(4) reach employees who access information in violation of employer restrictions? | Government: exceeding authorization occurs when info is obtained in violation of use restrictions. | Nosal: Brekka controls; accessing information with permission cannot exceed authorization unless access itself is forbidden. | Yes; exceeding authorization includes violating employer restrictions. |
| Does Brekka govern whether an employee exceeds authorization when there are employer-use restrictions? | Government: Brekka is superseded by statutory language; employer may define authorization. | Nosal: Brekka already governs; if permission exists, no exceedance unless access is rescinded. | No single-sentence fallback; court holds employer restrictions define exceedance. |
| Is the majority reading of 'exceeds authorized access' compatible with the CFAA's text and purposes? | Government: text supports interpretation that employer restrictions matter. | Nosal: interpretation risks vagueness and over-criminalization; Brekka should control. | The court favors reading that employer restrictions define exceedance. |
Key Cases Cited
- LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009) (employer determines authorization to access; breach of restrictions can exceed authorization)
- United States v. John, 597 F.3d 263 (5th Cir. 2010) (employee exceeds authorization when accessing information in violation of restrictions)
- United States v. Rodriguez, 628 F.3d 1258 (11th Cir. 2010) (distinguishes Brekka; personal use in violation of policy can exceed authorization)
- EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001) (employee likely exceeded access when disclosing confidential information)
- Drew v. CSC Holdings, LLC, 259 F.R.D. 449 (C.D. Cal. 2009) (concerns vagueness of CFAA in context of website terms of service)