Month: August 2021

On June 3, 2021, the United States Supreme Court issued a long-awaited decision on the scope of the Computer Fraud and Abuse Act (“CFAA”). Van Buren v. United States, _ U.S. __, 141 S. Ct. 1648, 2021 WL 2229206, 2021 U.S. Lexis 2843. The Court held that the CFAA prohibited only the gathering of information from sources to which access was not permitted. The Court held that the CFAA did not cover the gathering of information from databases to which access was authorized, even if the information gathering had an improper purpose.

Congress enacted the CFAA in 1986. The original law provided criminal sanctions for computer hacking. The law created criminal liability for (1) obtaining information from intentional access to a computer without authorization and (2) exceeding authorized access and thereby obtaining information. The law defined “exceeds authorized access” as access to a computer with authorization and using such access to obtain or alter information in the computer. Civil remedies for CFAA violations were enacted in 1994, allowing victims of CFAA violations to recover money damages and obtain equitable relief in federal court.

The CFAA’s civil remedies led to increased use of the federal courts for litigation that had previously been confined to state courts. One such example was employee mobility litigation where the ex-employer and ex-employee resided in the same state (precluding diversity jurisdiction). If an employee accessed client information and then used the information to solicit business for a new employer, the CFAA before Van Buren enabled the ex-employer to claim in federal court that the employee exceeded authorized access to a business computer. The CFAA’s low damage thresholds did very little to limit federal suits. The expansive view of “exceeds authorized access” even allowed state court staples such as family law cases to find their way into federal court. The fact that the CFAA had criminal as well as civil sanctions attached an additional stigma to any parties accused of CFAA violations.

Conflicts arose between various federal circuit courts on what actions exceeded authorized access. Some circuits adopted a more restrictive view of the CFAA, holding that an individual with permitted access to data did not violate the CFAA by using the data for an improper purpose, such as misappropriation of confidential information for a new employer. Other circuits took a less restrictive view that an employee who accessed a computer for the purpose of misusing information violated CFAA by exceeding authorized access.

It was in this context that Van Buren, a criminal CFAA case, reached the Supreme Court. Van Buren, a Georgia police officer, had authority to access vehicle registration data through his patrol car computer. But Van Buren accepted payment from a citizen for turning over registration data about a stripper whom the citizen suspected of being an undercover police officer. After Van Buren and the citizen completed the transaction, the FBI arrested Van Buren in a sting operation. The United States charged Van Buren with violating the CFAA for “exceeding authorized access” to a computer by using the computer for personal use. A District Court jury convicted Van Buren, and the Eleventh Circuit upheld the conviction. The Supreme Court accepted review of the case, given the conflict between four federal circuits that upheld the more restrictive view of the law and four circuits that adopted the broader view of the law. (The Third Circuit had not taken a stand either way but District Court decisions within the circuit were conflicting.)

The Supreme Court, in a 6-3 decision that split the Court’s conservative justices, supported the less expansive view of the CFAA. New Justice Barrett wrote the majority opinion in a tightly reasoned analysis of the statute’s wording. Barrett noted that the parties agreed that Van Buren accessed the computer with authorization when he logged into the law enforcement automobile license database. The parties also agreed that Van Buren obtained information from the computer. The narrow question was whether Van Buren was entitled to obtain the information. Van Buren argued that the CFAA allowed him to obtain the information if he was allowed access to the computer. The prosecution argued that since the officer intended to use the information for personal purposes, authorized access was exceeded and the law was violated. Justice Barrett rejected the broader view. She stated that the broader CFAA interpretation would criminalize a “breathtaking amount of commonplace computer activity”, such as sending a personal email or reading the news on an office computer. Therefore, the term “exceeds authorized access” meant to enter a database that was off limits to the user.

The Supreme Court’s narrow interpretation of the law will have effects in the workplace and the court system. Employers may decide cut back on authorized access to computer data. If fewer employees have authorized access, the CFAA may gain back some teeth. The Van Buren decision will leave parties to state disputes with one less access point to federal court. This effect may be mitigated in the employee mobility area where trade secrets are at issue, given the Federal Defend Trade Secrets Act. And for Supreme Court watchers, the decision provides insight into a possible split between Justices who will rely on the plain meaning of a statute and those who will look beyond the meaning to the purpose of the acts covered by the law. Time will tell.

In 2018, I blogged about the Pennsylvania Superior Court decision in Pittsburgh Logistics Services v. Beemac Trucking, LLC, invalidating a no-hire contract between two transportation firms. Earlier this year, the Pennsylvania Supreme Court affirmed the Superior Court. See Pittsburgh Logistics Systems, Inc. v. Beemac Trucking, LLC, _ A.3d , 2021 WL __, 2021 Pa. Lexis 1853 (April 29, 2021). The Court held that the no-hire contracts were an unreasonable restraint of trade in violation of public policy.

The Supreme Court’s decision continues the Pennsylvania appellate courts’ movement to limit employers’ restrictions on ex-employees’ ability to work. As the Pennsylvania Supreme Court held in Hess v. Gebhard & Co., 808 A.2d 912 (Pa. 2002), a restrictive employment covenant may not be used to prevent competition or to keep employees from earning a living. In 1995, the Superior Court refused to enforce a noncompete against an employee who was fired through no fault of his own (Insulation Corp. of America v. Brobston, 667 A.2d 729, 733 (Pa. Super. 1995)). Hess v. Gebhard followed in 2002, refusing to allow a purchaser of a business’ assets to enforce a noncompete where the asset seller did not assign the noncompete to the buyer. Socko v. Mid-Atlantic Systems of CPA, Inc., 126 A.3d 1266 (Pa. 2015), refused to enforce a noncompete when the employer offered the employee no consideration for the noncompete other than continued at-will employment.

In the Pittsburgh Logistics case, Pittsburgh Logistics engaged in the business of arranging for the shipping of goods. Beemac was a transporter of goods. The companies entered into a motor carriage contract in which Beemac would transport goods of shippers arranged by Pittsburgh Logistics. The contract provided that Beemac would not solicit or hire Pittsburgh Logistics’ employees during the contract term and for 2 years after the contract ended. Beemac hired four of Pittsburgh’s employees while the motor carriage contract was still in effect. Pittsburgh sued both Beemac and the departing Beemac employees. The trial court found that the non-hire contracts were void as against public policy. The Superior Court upheld the trial court, first in a panel decision and then in a decision of the court en banc.

The state Supreme Court accepted review to address the question of whether contractual no-hire provisions in a service contract between sophisticated business entities were enforceable under Pennsylvania law. The Court analyzed the law of other states since Pennsylvania had not addressed this issue. The Court found a division between the various states, but held that the trend in other states and at the federal level ran against enforcement of the agreement. The Court noted the Department of Justice’s interest in a case challenging no-poach agreements in the railway industry in the Western District of Pennsylvania (In re Railway Industry Employee No-Poach Antitrust Litigation, 395 F.Supp.3d 464 (W.D. Pa. 2019)). Farther afield, the Court referred to the class action challenge to no-poach agreements between the Duke University and University of North Carolina Medical Schools. See Seaman v. Duke University, 2019 WL 4674758, 2019 U.S. Dist. Lexis 163811 (M.D. N.C. Sept. 25, 2019) (approving class action settlement). Also important, but not noted by the Court, are the recent federal criminal indictments of businesses for wage fixing and no-poach agreements.

In rejecting the no-hire agreement, the Supreme Court employed the traditional reasonableness analysis for restrictive covenants. The Court found that the agreement was ancillary to a shipping contract and Pittsburgh Logistics had a legitimate interest in preventing poaching of employees. But the Court concluded that the no-hire clause was more than what PLS needed to protect this interest. The no-hire provision prevented Beemac from hiring any PLS employee, even those who had not worked with Beemac. The no-hire clause also created a harm to the public. The clause created potential harm to third parties by cutting off possible employment to PLS employees who were not parties to the contract. The restrictions deprived employees of the ability to earn their livelihoods and undermined free competition in the labor market. Finally, restrictive contracts of this sort contributed to slow wage growth and rising wage inequality. The Court noted that wages are 4-5% higher in states that do not enforce worker non-compete agreements.

Pittsburgh Logistics was a narrow ruling on a harsh restriction. The future will tell whether the state’s highest court’s public policy concerns will open the door to further erosion of post-employment restrictions in Pennsylvania.