PHILADELPHIA - Resigning from a company doesn’t necessarily end an employee’s legal access to company computers, a federal court ruled in a case involving a contractor who downloaded thousands of documents and then demanded $150,000 to give them back.
Employers must take an “affirmative step” to end access in order to trigger the Computer Fraud and Abuse Act, the Third Circuit Court of Appeals ruled. That law makes it illegal to intentionally access someone else’s computer “without authorization.”
“The statute does not define `authorization,’” wrote in a Dec. 9 opinion. “We have.”
In 2014, Jude Denis started a job helping Neil Rodin, a director of the Prostate Cancer Foundation, plan a fundraising event. PCF installed a link on her computer to access Rodin’s email account without using his password.
After a few days “her relationship with PCF deteriorated,” the court said. Denis thought she’d been hired for a permanent full-time position and PCF thought it was a temporary job. Denis quit and submitted an invoice for several thousand dollars, which PCF refused to pay.
So Denis enlisted a friend, Frances Eddings, to download thousands of emails and PCF documents. She then threatened to release the documents unless PCF paid her $150,000 plus a 25% fee for Eddings. PCF responded by locking her out of Rodin’s account and reporting the incident to the FBI.
The pair were indicted in September 2019 on charges of violating the Computer Fraud and Abuse Act and a jury convicted them on all counts in 2022.
Denis died soon after but Eddings appealed, arguing the judge should have dismissed the case because Denis had access to PCF’s computers until the group locked her out, so no one accessed them “without authorization.” The judge decided that was a fact question for the jury to decide.
The Third Circuit reversed her conviction, ruling Denis could only violate CFAA if PFC affirmatively revoked her permission to access its computers.
“Absent more, an employee’s resignation does not cancel her employer’s authorization,” the court ruled. “The reason: an employee’s resignation is not her employer’s action. It is her own.”
Even though prosecutors introduced evidence Denis thought she was doing something wrong – in a text message, she said she deleted the link to Rodin’s computer because she “didn’t want to be tempted” – that wasn’t enough for the jury to find she violated CFAA.
“The instruction opened the door for the jury to find Denis accessed Rodin’s account without authorization simply because she accessed it after she resigned,” the court said. “And there is every reason to think the jury walked through that door.”
The court said it wasn’t deciding whether an employer can revoke authorization by firing someone. And employers can revoke it with an email or some other notification.
Judge Tamika Montgomery-Reeves dissented, saying “Without” means “not having.” And a jury could easily find ceasing employment, either by resignation or firing, could fit the definition of accessing a computer without permission, she wrote.