ROYAL TRUCK & TRAILER SALES AND SERVICE, INC., Plaintiff-Appellant, v. MIKE KRAFT; KELLY MATTHEWS, Defendants-Appellees.
No. 19-1235
United States Court of Appeals for the Sixth Circuit
September 9, 2020
20a0301p.06
Before: GILMAN, KETHLEDGE, and READLER, Circuit Judges.
RECOMMENDED FOR PUBLICATION Pursuant to Sixth Circuit I.O.P. 32.1(b). Appeal from the United States District Court for the Eastern District of Michigan at Port Huron. No. 3:18-cv-10986—Robert H. Cleland, District Judge. Argued: December 12, 2019.
COUNSEL
ARGUED: Anthony M. Sciara, KOTZ SANGSER WYSOCKI P.C., Detroit, Michigan, for Appellant. Salvatore J. Vitale, VARNUM LLP, Novi, Michigan, for Appellees. ON BRIEF: Anthony M. Sciara, Mark F.C. Johnson, KOTZ SANGSER WYSOCKI P.C., Detroit, Michigan, for Appellant. Salvatore J. Vitale, Richard T. Hewlett, VARNUM LLP, Novi, Michigаn, for Appellees.
CHAD A. READLER, Circuit Judge. Following the abrupt resignation of two employees, Royal Truck & Trailer discovered that the employees, prior to resigning, had accessed confidential company information from their company-issued computers and cell phones and then utilized the information in violation of company policy. Royal responded by filing suit against the emplоyees, alleging violations of the federal Computer Fraud and Abuse Act (CFAA) as well as Michigan law.
The conduct at issue might violate company policy, state law, perhaps even another federal law. But because Royal concedes that the employees were authorized to access the information in question, it has failed to satisfy the statutory requirements for stating a claim under the CFAA. Accordingly, we AFFIRM the district court‘s judgment.
BACKGROUND
Royal employed Defendants Mike Kraft and Kelly Matthews as a part of the company‘s sales team. In conjunction with their employment, Defendants received a copy of Royal‘s employee handbook. With respect to the use of company equipment, the handbook prohibited a range of conduct, including: personal activities; unauthorized use, retention, or disclosure of any of Royal‘s resources or property; and sending or posting trade secrets or proprietary information outside the organization. Royal also had a cell phone “GPS Tracking Policy.” In accordance with that policy, “[e]mployees may not disable or interfere with the GPS (or any other) functions on a company issued cell phone,” nor may employees “remove any software, functions or apps.” R.8, Am. Compl., ¶ 18.
Before her resignation, Matthews did much the same. From her Royal email account, Matthews sent to Kraft‘s personal email acсount a Royal “Salesperson Summary Report” that contained confidential and proprietary sales information. She likewise forwarded an email from her Royal account to her personal one that contained customer pricing information. And as Kraft did with his company laptop, Matthews reset her company-issued cell phone to factory settings, rendering all data on the phone unrecoverable. Matthews then returned her company-issued laptop and cell phone to Royal‘s corporate headquarters and resigned, announcing her resignation more broadly through social media by sharing a link to a video of Johnny Paycheck‘s hit song, “You Can Take This Job and Shove It.”
Unamused, Royal hired a “forensics expert” to conduct a “comprehensive and costly damage assessment” in an effort to restore the deleted data on the now former employees’ devices. R.8, Am. Compl., ¶¶ 25–26. It later filed suit against Kraft and Matthews in federal court, alleging that their conduct violated the CFAA as well as Michigan law.
The district court, however, did not see things Royal‘s way. It concluded that because Kelly and Matthews were authorized to access the information obtained from their company-issued computers and cell phones, the two did not “exceed[]” their “authorized access,” as those terms are used in the CFAA, by later using the information accessed on those devices in violation of company policy. Royal filed a timely appeal.
ANALYSIS
Under our familiar standard for reviewing a district court‘s decision granting a motion to dismiss, we “cоnstrue the complaint in the light most favorable to the plaintiff, accept its allegations as true, and draw all reasonable inferences in favor of the plaintiff.” Jones v. City of Cincinnati, 521 F.3d 555, 559 (6th Cir. 2008) (quoting Directv, Inc. v. Treesh, 487 F.3d 471, 476 (6th Cir. 2007)). Against that backdrop, we ask whether the complaint “contain[s] sufficient factual matter . . . to ‘state a claim to relief that is plausible on its face.‘” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)).
The CFAA claims. As the basis for its federal claims against Kraft and Matthews, Royal invokes
1. Taking all of this together, to allege a violation of
We can narrow our foсus even more. Royal acknowledges that Defendants had authorization to access company information through their company email accounts, and thus does not assert that Defendants’ access was without authorization. What remains for our resolution then is whether Defendants nonetheless “exceed[ed] [their] authorized access” by misusing the accessed information in violatiоn of company policy.
In answering that question, we begin with the CFAA‘s definitional provisions. The Act defines “exceeds authorized access” as “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”
Now the term “access.” It is commonly defined as some variation of “entry,” generally the initial entry into something. Dictionaries include several variations of “access,” one of which is “[t]he power, opportunity, permission, or right to come near or into contact with someone or something; admittance; admission.” Access, Oxford English Dictionary Online (3d ed. 2011). Another definition describes how “access” customarily is used in a digital setting: “[t]he opportunity, means, or permission to gain entrance to or use a system, network, file, etc.” A related definition describes “access” as “[t]he process or act of obtaining or retrieving data from storage.” Id. Further reflecting how “access” is used in our technology-based society, Oxford includes a sample use of the
Reading these definitional provisions together, it follows that in utilizing the phrase “exceeds authorized access,” the CFAA targets one who initially “gain[s] entrance to . . . a system, network, or file” with “sanction or permission,” and then “gain[s] or attаin[s]” “information” that, in the words of the statute, she is “not entitled so to obtain . . . .”
The CFAA‘s “damages” and “loss” provisions further confirm the Act‘s narrow scope. They too appear aimed at preventing the typical consequences of hacking, rather than the misuse of corporate information in the manner alleged by Royal. “Damages” is defined with reference to the “impairmеnt to the integrity or availability” of data, programs, systems, or information.
Collectively, these interpretive clues defeat Royal‘s CFAA claims. The CFAA prohibits accessing data one is not аuthorized to access. United States v. Nosal, 676 F.3d 854, 858 (9th Cir. 2012). And Royal has not contested either Kraft‘s or Matthews‘s authorization to access the company files in question. Because Defendants had authorization to access that information, their conduct did not “exceed” their “authorized access,” as those terms are used in
Indeed, Congress surely knew how to say “exceeds authorized use” or otherwise proscribe using data for unauthorized purposes. See, e.g.,
We arrived at a similar conclusion as to the CFAA‘s scope in interpreting the phrase “without authorization” as used in
Given this plain understanding of the CFAA‘s terms, we need not rely on the rule of lenity, as Defendants urge. Statutory interpretation starts (and customarily ends) with the text of the statute. Out of respect for Congress‘s textual choices, we turn to the rule of lenity оnly when, unlike here, statutory language cannot otherwise be reconciled. See United States v. Adams, 722 F.3d 788, 804 n.8 (6th Cir. 2013) (the rule of lenity “comes into operation at the end of the process of construing what Congress has expressed, not at the beginning” (quoting Callanan v. United States, 364 U.S. 587, 596 (1961))). Nor is there need to resort to legislative history, an often treacherous path in its own right. See United States v. Woods, 571 U.S. 31, 46 n.5 (2013) (“Whether or not legislative history is ever relevant, it need not be consultеd when, as here, the statutory text is unambiguous.“); Conroy v. Aniskoff, 507 U.S. 511, 519 (1993) (Scalia, J., concurring) (“[Legislative history] is not merely a waste of research time and ink; it is a false and disruptive lesson in the law. . . . The greatest defect of legislative history is its illegitimacy.“). But see United States v. Valle, 807 F.3d 508, 525 (2d Cir. 2015) (utilizing legislative history to conclude that the CFAA was intended to address hacking, as that history consistently references “trespass” into computer systems or data as the problеm the Act was meant to remedy).
2. Our interpretation today, we acknowledge, might not be the final word. The Supreme Court recently granted certiorari in Van Buren v. United States, 940 F.3d 1192 (11th Cir. 2019), cert. granted, 206 L. Ed. 2d 822 (Apr. 20, 2020) (No. 19-783). Although set in a criminal posture, Van Buren presents the Supreme Court with the opportunity to resolve the meaning of “exceeds authorized access” as used in the CFAA.
That the Supreme Court agreed to hear Van Buren is likely a reflection of the lower courts’ dueling interpretatiоns of this critical passage in the CFAA.
That said, today‘s deсision is in tension with those from the First, Fifth, Seventh, Eighth, and Eleventh Circuits, all of whom have more broadly interpreted “exceeds authorized access.” Those courts read § 1030‘s statutory terms as encompassing situations where an employee has authorization to access company information but uses that information in violation of company policy. See United States v. Rodriguez, 628 F.3d 1258, 1263–64 (11th Cir. 2010) (holding that an employee exсeeded authorized access by obtaining company information for non-business purposes); Int‘l Airport Ctrs., LLC. v. Citrin, 440 F.3d 418, 420 (7th Cir. 2006) (utilizing principles of agency law to find that an employee accessed his computer “without authorization” where his authorized access was terminated once he used the information improperly); United States v. John, 597 F.3d 263, 271–72 (5th Cir. 2010) (finding an employee liable for exceeding authorized access even wherе he had access for other purposes); EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 581–83 (1st Cir. 2001) (holding that a former employee exceeded authorized access by violating a confidentiality agreement and accessing his former employer‘s website).
In addition to being less faithful to § 1030‘s text, this latter interpretation has the odd effect of allowing employers, rather than Congress, to define the scope of criminal liability by opеration of their employee computer-use policies. Had Congress intended the seemingly sweeping result of effectively criminalizing violations of an employee handbook, it would have said so in clear terms. See Jones v. United States, 529 U.S. 848, 858 (2000) (“[U]nless Congress conveys its purpose clearly, it will not be deemed to have significantly changed . . . the prosecution of crimes.” (internal quotation marks omitted)). Yet the CFAA dоes not mention such policies. Absent clear instruction, we should be hesitant to impose federal sanctions for conduct as pedestrian as checking one‘s private social media account on a work phone. With corporate policies sometimes written in broad and arguably vague terms, treating violations as criminal acts also risks a lack of statutory notice to employees over the precise nature of conduct now criminalized. See, e.g., United States v. Lopez, 929 F.3d 783, 785 (6th Cir. 2019) (penal statutes must define the criminal offense with “sufficient definiteness that ordinary people can understand what conduct is prohibited” (quoting Kolender v. Lawson, 461 U.S. 352, 357 (1983))). And it risks “arbitrary and discriminatory enforcement” given the variation in those policies between companies and across industries. Nosal, 676 F.3d at 860; United States v. Dunning, 857 F.3d 342, 348 (6th Cir. 2017). All of this counsels in favor of our narrow reading of the CFAA.
Data deletion. One additional issue of federal law deserves mention. Royal also alleges that Kraft and Matthews deleted data from their work devices. And unlike the Royal customer information Kraft and Matthews were authorized to access for some purposes, Royal contends that Kraft and Matthews had no authorization to engage in data deletion.
As compared to misusing cоnfidential information one is at least authorized to obtain, data deletion, in some circumstances, might fairly be characterized as more akin to “exceed[ing one‘s] authorized access.” But even if Kraft and Matthews “excee[ded their] authorized access” by deleting data from their company devices, Royal‘s complaint does not allege that the two “thereby obtain[ed] information from [a] protected computer,” a required element
State-law claims. In the absence of a viable federal claim by Royal, the district court dismissed Royal‘s state-law claims without prejudice. It did so in accordance with the settled rule that when a district court dismisses all claims over which it has original jurisdiction (here the CFAA claims), it may also dismiss any state-law claims before it based on supplemental jurisdiction.
CONCLUSION
For the aforementioned reasons, we AFFIRM the judgment of the district court.