IP: Why companies need clear policies against giving computer access to non-employees
Companies should have a clearly stated, consistently enforced policy prohibiting authorized users from giving access to third parties for any reason whatsoever.
February 19, 2013 at 04:30 AM
7 minute read
The original version of this story was published on Law.com
In 1986, in recognition of the economic importance of protecting computers from unauthorized access, Congress passed the Computer Fraud and Abuse Act (CFAA). The CFAA imposes criminal liability on outsiders who access computers to steal information or to disrupt or destroy computer functionality. In 1994, the CFAA was amended to give computer owners the right to bring a civil action, which requires proof that a company has policies and practices that restrict access.
In general, there are three types of unauthorized access of concern to companies:
- A non-employee (a hacker) may trespass into the system.
- An employee may access a restricted zone or use information from a permissible zone in an impermissible manner, known as a “user exceeding authorization.”
- An unauthorized user may give access to an authorized user, known as a “permissive intrusion.”
Although a clear company policy restricting access is important with respect to each of these, it is especially significant with respect to the third—namely, a case of “permissive intrusion”—insofar as the absence of such a policy might prove fatal to a CFAA claim.
Examples of permissive intrusion are all too easy to imagine. For instance, an employee who is traveling may need information that is on the company server, but may be unable to access the server via the Internet from his location. In such a situation, the employee might call his wife and provide her with his password, asking her to log in to his account. Alternatively, a company might provide a network password to a vendor, allowing the vendor to obtain needed specifications. Although these uses seem perfectly innocent, problems could arise if this permissive access can harm the company. In that case, the company would have to prove that the access, though permissive, was not authorized within the meaning of the CFAA.
The situation is made all the more confusing because the CFAA does not provide a definition of the phrase “without authorization.” The 9th Circuit has held that “a person uses a computer 'without authorization' . . . when the person has not received permission to use the computer for any purpose . . . or when the employer has rescinded permission to access the computer and the defendant uses the computer anyway.” Whether this definition also applies to the third type of unauthorized access—the “permissive intruders”—requires us to consider the law of agency.
Generally, an agency relationship exists when one person contracts to act on behalf of another. Thus, when an employee receives access to a computer to further the interests of his employer, the employee is an agent of the employer. The law of agency treats an act of an agent as “unauthorized” if it is beyond the express, implied or apparent authority of the agent. Thus, the company should set forth a clear policy regarding the authority of its employees to give access to company computers. Such a policy should be included in each employee's employment contract. Then, if an employee gives another person access to company computers in violation or in excess of what company policy allows, that employee would be regarded as acting outside of the scope of his agency. In that case, the element of “unauthorized access” of the CFAA would be satisfied, because access that an employee gives to an intruder outside of the scope of agency would render the authorization invalid under the general law of agency.
Although the CFAA and its interpretation pose a number of legal issues, this discussion underscores the importance of one simple rule: Companies should have a clearly stated, consistently enforced policy prohibiting authorized users from giving access to third parties for any reason whatsoever.
In 1986, in recognition of the economic importance of protecting computers from unauthorized access, Congress passed the Computer Fraud and Abuse Act (CFAA). The CFAA imposes criminal liability on outsiders who access computers to steal information or to disrupt or destroy computer functionality. In 1994, the CFAA was amended to give computer owners the right to bring a civil action, which requires proof that a company has policies and practices that restrict access.
In general, there are three types of unauthorized access of concern to companies:
- A non-employee (a hacker) may trespass into the system.
- An employee may access a restricted zone or use information from a permissible zone in an impermissible manner, known as a “user exceeding authorization.”
- An unauthorized user may give access to an authorized user, known as a “permissive intrusion.”
Although a clear company policy restricting access is important with respect to each of these, it is especially significant with respect to the third—namely, a case of “permissive intrusion”—insofar as the absence of such a policy might prove fatal to a CFAA claim.
Examples of permissive intrusion are all too easy to imagine. For instance, an employee who is traveling may need information that is on the company server, but may be unable to access the server via the Internet from his location. In such a situation, the employee might call his wife and provide her with his password, asking her to log in to his account. Alternatively, a company might provide a network password to a vendor, allowing the vendor to obtain needed specifications. Although these uses seem perfectly innocent, problems could arise if this permissive access can harm the company. In that case, the company would have to prove that the access, though permissive, was not authorized within the meaning of the CFAA.
The situation is made all the more confusing because the CFAA does not provide a definition of the phrase “without authorization.” The 9th Circuit has held that “a person uses a computer 'without authorization' . . . when the person has not received permission to use the computer for any purpose . . . or when the employer has rescinded permission to access the computer and the defendant uses the computer anyway.” Whether this definition also applies to the third type of unauthorized access—the “permissive intruders”—requires us to consider the law of agency.
Generally, an agency relationship exists when one person contracts to act on behalf of another. Thus, when an employee receives access to a computer to further the interests of his employer, the employee is an agent of the employer. The law of agency treats an act of an agent as “unauthorized” if it is beyond the express, implied or apparent authority of the agent. Thus, the company should set forth a clear policy regarding the authority of its employees to give access to company computers. Such a policy should be included in each employee's employment contract. Then, if an employee gives another person access to company computers in violation or in excess of what company policy allows, that employee would be regarded as acting outside of the scope of his agency. In that case, the element of “unauthorized access” of the CFAA would be satisfied, because access that an employee gives to an intruder outside of the scope of agency would render the authorization invalid under the general law of agency.
Although the CFAA and its interpretation pose a number of legal issues, this discussion underscores the importance of one simple rule: Companies should have a clearly stated, consistently enforced policy prohibiting authorized users from giving access to third parties for any reason whatsoever.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllInternal Whistleblowing Surged Globally in 2024, So Why Were US Numbers Flat?
6 minute readInside Track: AI Is Sure to Fray Big Law's Devotion to Billable Hour
Trending Stories
- 1New York-Based Skadden Team Joins White & Case Group in Mexico City for Citigroup Demerger
- 2No Two Wildfires Alike: Lawyers Take Different Legal Strategies in California
- 3Poop-Themed Dog Toy OK as Parody, but Still Tarnished Jack Daniel’s Brand, Court Says
- 4Meet the New President of NY's Association of Trial Court Jurists
- 5Lawyers' Phones Are Ringing: What Should Employers Do If ICE Raids Their Business?
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250