In 1986, in recognition of the economic importance of protecting computers from unauthorized access, Congress passed the Computer Fraud and Abuse Act (CFAA). The CFAA imposes criminal liability on outsiders who access computers to steal information or to disrupt or destroy computer functionality. In 1994, the CFAA was amended to give computer owners the right to bring a civil action, which requires proof that a company has policies and practices that restrict access.

In general, there are three types of unauthorized access of concern to companies:

  1. A non-employee (a hacker) may trespass into the system.
  2. An employee may access a restricted zone or use information from a permissible zone in an impermissible manner, known as a “user exceeding authorization.”
  3. An unauthorized user may give access to an authorized user, known as a “permissive intrusion.”

Although a clear company policy restricting access is important with respect to each of these, it is especially significant with respect to the third—namely, a case of “permissive intrusion”—insofar as the absence of such a policy might prove fatal to a CFAA claim.

Examples of permissive intrusion are all too easy to imagine. For instance, an employee who is traveling may need information that is on the company server, but may be unable to access the server via the Internet from his location. In such a situation, the employee might call his wife and provide her with his password, asking her to log in to his account. Alternatively, a company might provide a network password to a vendor, allowing the vendor to obtain needed specifications. Although these uses seem perfectly innocent, problems could arise if this permissive access can harm the company. In that case, the company would have to prove that the access, though permissive, was not authorized within the meaning of the CFAA.