United States v. David Nosal

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, Nos. 14-10037 Plaintiff-Appellee, 14-10275

v. D.C. No. 3:08-cr-00237-EMC-

DAVID NOSAL,

Defendant-Appellant. OPINION

Appeal from the United States District Court for the Northern District of California Edward M. Chen, District Judge, Presiding

Argued and Submitted October 20, 2015 San Francisco, California

Filed July 5, 2016

Before: Sidney R. Thomas, Chief Judge and Stephen Reinhardt and M. Margaret McKeown, Circuit Judges.

Opinion by Judge McKeown; Dissent by Judge Reinhardt SUMMARY*

Criminal Law

The panel affirmed convictions for knowingly and with intent to defraud accessing a protected computer “without authorization,” in violation of the Computer Fraud and Abuse Act (CFAA), and for trade secret theft, in violation of the Economic Espionage Act (EEA); and vacated in part and remanded the restitution order for reconsideration of the reasonableness of the attorneys’ fees award.

The panel held that the defendant, a former employee whose computer access credentials were revoked,…

Dissent by Judge REINHARDT

OPINION

This is the second time we consider the scope of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 , with respect to David Nosal. The CFAA imposes criminal penalties on whoever “knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value.... ” Id. § 1030(a)(4) (emphasis added).

Only the first prong of the section is before us in this appeal: knowingly and with intent to defraud accessing a computer “without authorization.” Embracing our earlier precedent and joining our sister circuits, we conclude that “without authorization” is an unambiguous, non-technical term that, given its plain and ordinary meaning, means accessing a protected computer without permission. This definition has a simple corollary: once authorization to access a computer has been affir-. matively revoked, the user cannot sidestep the statute by going through the back door *869 and accessing the computer through a third party. Unequivocal revocation of computer access closes both the front door and the back…

dissenting:

This case is about password sharing. People frequently share their passwords, notwithstanding the fact that websites and employers have policies prohibiting it. In my view, the Computer Fraud and Abuse Act (“CFAA”) does not make the millions of people who engage in this ubiquitous, useful, and generally harmless conduct into unwitting federal criminals. Whatever other liability, criminal or civil, Nosal may have incurred in his improper attempt to compete with his former employer, he has not violated the CFAA.

The first time this case came before us we examined whether Nosal’s former colleagues acted “without authorization, or exceeded] authorized access” when they downloaded information from Searcher while still employed at Korn/Ferry and shared it with Nosal in violation of the firm’s policies. United States v. Nosal (Nosal I), 676 F.3d 854, 864 (9th Cir.2012) (en banc). We said “no,” rejecting the approach of a few other circuits which had interpreted the CFAA looking “only at the culpable behavior of the defendants before them, and failing] to consider the effect on millions of ordinary citizens.” Id. at 862 . In doing so, we stated that they turned the CFAA into…