Nosal

*782 OPINION

The United States appeals from the district court’s dismissal of several counts of an indictment charging David Nosal with, inter alia, numerous violations of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 . 1 Subsection (a)(4), the subsection under which Nosal was charged, subjects to punishment anyone who “knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value.” Id. § 1030(a)(4). The indictment alleges that Nosal’s co-conspirators exceeded their authorized access to their employer’s computer system in violation of § 1030(a)(4) by obtaining information from the computer system for the purpose of defrauding their employer and helping Nosal set up a competing business.

The district court relied on our decision in LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir.2009), in determining that an employee does not exceed authorized access to a computer by accessing information unless the employee has no authority to access the information under any circumstances — in other words, an employer’s restrictions…

dissenting:

Because I believe that construing “exceeds authorized access” to include “violating an employer’s computer access restrictions — including use restrictions” does not further Congress’s stated purpose in enacting the CFAA, and in fact renders one of the statute’s provisions unconstitutionally vague, I must respectfully dissent.

The majority focuses on the intent requirement of 18 U.S.C. § 1030 (a)(4) to explain why its interpretation of “exceeds authorized access” does not “make criminals out of millions of employees who might use their work computers for personal use, for example, to access their personal email accounts or to check the latest college basketball scores.” The majority notes:

But it is a firm rule of statutory construction that “identical words used in different parts of the same statute are generally presumed to have the same meaning.” IBP, Inc. v. Alvarez, 546 U.S. 21, 34 , 126 S.Ct. 514 , 163 L.Ed.2d 288 (2005). “Exceeds authorized access” appears in other provisions of the statute, including the much broader § 1030(a)(2)(C), which has no intent requirement.

Under § 1030(a)(2)(C), a person who “intentionally accesses a computer without…