3rd Circuit: CFAA Does Not Turn Workplace Policy Infractions into Federal Crimes [pdf] (opens in new tab)

SCOTUS addressed this in some form already in Van Buren v. United States:

https://en.wikipedia.org/wiki/Van_Buren_v._United_States

The 3rd Circuit ruling here does reference the SCOTUS ruling a number of times so that makes sense.

----------

The quote in the ruling also fits the SCOTUS ruling's spirit:

"In the wrong hands, the law becomes a hammer in search of a nail. This is one such case."

In the case you had someone saving workplace passwords in a spreadsheet against policy (as well as some other activity on a computer that could be deemed against workplace policy).

The idea that workplace policy about password usage, or document access would trigger CFAA and make these people eligible for being prosecuted for federal crimes is ABSURD and the court here saw that as well.

Apologies for the PDF link. The opinion is amusing, and has some benefits. If it's appealed and this decisions is upheld, the blast zone around the CFAA will be diminished.

The key point is rather simple.

> In doing so, we hold for the first time that, (a) by its text and purpose, the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, does not turn these workplace-policy infractions into federal crimes, and (b) passwords that protect proprietary business information are not themselves trade secrets under federal or Pennsylvania law.

Footnote 2 is also amusing: "To the dismay of IT professionals everywhere, the document was titled "My Passwords.xlsx." App. 2770"

I regret that I can only upvote this one once!