The CFAA’s Double Life: Criminal Application of a Dual Use Statute When the Stakes Are High-Profile

Author: Katy M. Young

Unauthorized access of a computer system can be civilly or criminally actionable under the Computer Fraud and Abuse Act (“CFAA”). One of the most-cited CFAA cases is U.S. v. Nosal, a criminal case brought by the U.S. Attorneys’ Office against David Nosal, formerly a high-level recruiter with Korn-Ferry. The company that Mr. Nosal worked for was high-profile enough to catch the U.S. Attorney’s attention when Korn-Ferry alleged that after leaving his employment with the firm, Nosal accessed the firm’s computer data without authorization. The U.S. Attorney’s office thus brought suit against Mr. Nosal using the criminal application of the CFAA.

The most recent high-profile CFAA case that caught the U.S. Attorney’s attention and resulted in criminal charges was the St. Louis Cardinals/Houston Astros hacking scandal. The Scouting Director for the Cardinals, Chris Correa, plead guilty to five counts of criminal violations of the CFAA for illegally accessing the Ground Control database maintained by former Cardinals executive Jeff Luhnow in his capacity as an executive for the Houston Astros. You can read all about the guilty plea here:

Obviously, America’s pastime is high-profile enough to warrant the government spending resources to prosecute what is essentially private business espionage. But aside from baseball, what is it that catches the government’s attention in these kinds of cases? Ad Astra represents a law firm that has accused another law firm of hacking their third party cloud storage database of client files. The case is filed in State Court in Southern California but has not yet drawn the U.S. Attorney’s attention, although it has been covered by The Daily Journal and Law 360, both legal news outlets. Although not as high-profile as major league baseball, a hacking claim between opposing lawyers should draw the ire of government lawyers in the U.S. Attorney’s office who share Ad Astra’s concern for our esteemed profession. For the time being, Ad Astra will move forward with the civil claims under the CFAA and wait to see if the statute will be applied against the defendants in a criminal law context.

Leave a Reply

Your email address will not be published. Required fields are marked *