Friday, February 20, 2015

Obama Administration's Cybersecurity Proposal Would Broaden CFAA

The Obama Administration has been active in addressing concerns related to cybersecurity and trade secrets theft. In 2013, the Administration rolled its strategy to mitigate trade secrets theft - the first of its kind executive-level white paper that specifically identified trade secrets protection as part of a national economic security strategy.

In January of this year, the Administration went further than I anticipated by endorsing amendments to the somewhat controversial Computer Fraud and Abuse Act. As readers of the blog know, the CFAA can be a jurisdictional hook to bring trade secrets claims into federal court. It is broader than trade secrets law in some respects (it protects unauthorized access of any information contained in a protected computer, not just trade secret information) and much narrower in others (it contains a $5,000 damage or loss requirement).

Part of the controversy surrounding the CFAA has involved statutory language that bars someone from accessing a computer in a manner that "exceeds authorized access." That language has given courts fits, with circuit courts applying different interpretations to the statutory language. The controversy crystallized in United States v. Nosal, a federal prosecution of a Korn-Ferry executive recruiter that brought to the fore the various CFAA interpretations of "exceeds authorized access." My take on Nosal and a summary of circuit court treatment of the issue is found in this post.

The Administration's proposed set of amendments to the CFAA cuts against the Nosal approach and resolves a question where there's a split of authority: whether "exceeds authorized access" includes the misuse of information even if access to it was technically permitted. Example: copying data from a work computer to a personal thumb-drive for use at a new job.

The amendment would define "exceeds authorized access" to mean "to access a computer with authorization and to use such access to obtain or alter information: (a) that the accesser is not entitled to obtain or alter; or (b) for a purpose that the accuser knows is not authorized by the computer owner." Part (b) is the Nosal amendment and would resolve the circuit split in favor of what the employer-friendly jurisdictions, like the Seventh and Eleventh Circuits, endorse.

The impact of this proposed amendment is uncertain. On the one hand, if adopted, it almost surely would mandate corporate counsel to draft a computer usage policy so that a court would have some objective indication of what the computer owner authorizes.

On the other, it criminalizes a range of activity well below trade secrets theft, since there is no requirement that the information accessed be a trade secret or even lesser-protected "confidential" information. As long as the company can establish a value in excess of $5,000, the CFAA would apply. And on that score, the CFAA contains nothing to limit how a computer owner can establish that particular information is worth $5,000.

For a comprehensive take on the Administration's proposal, see Professor Orin Kerr's January 14 article in the Washington Post.

Friday, February 13, 2015

Fifield and the Northern District: A Stormy Marriage

The much-maligned Illinois decision of Fifield v. Premier Dealer Services, Inc. got a big jolt of life when another appellate district reaffirmed its essential holding: when an at-will employee signs a non-compete, continued employment can serve as adequate consideration for the agreement only if that employment continues for at least two years.

Before the Third District appellate court spoke in Prairie Rheumatology Assocs., S.C. v. Francis, there was a pretty legitimate debate brewing about whether Fifield was a one-off outlier that attorneys could take the chance of discounting. Francis gave Fifield credibility, as it is an awfully tall order for attorneys to criticize two separate appellate court rulings from different districts and argue Fifield did not represent the law of the state.

The Northern District of Illinois, though, apparently does not feel Francis did much to establish Illinois law on the adequacy of consideration for restrictive covenants.

Another federal court has declined to follow the Fifield-Francis two-year rule. Judge Shah's opinion in Bankers Life & Cas. Co. v. Miller, 2015 U.S. Dist. LEXIS 14337 (N.D. Ill. Feb. 6, 2015), found that the "the Illinois Supreme Court would ...reject a rigid approach to determining whether a restrictive covenant was supported by adequate consideration; it would not adopt a bright-line rule requiring continued employment for at least two years in all cases."

The reasoning for the court's analysis, in which it barely even cited Fifield, does not really mention that the Fifield-Francis rule applies in a limited factual circumstance: when the only consideration for an at-will employee's non-compete is continued employment itself. If the employee received a signing bonus, a contractual severance right, or stock options, then Fifield-Francis does not apply.

But in a great many cases - probably a majority - the rule will apply, because employers don't want to pay employees more than they have to, either in bonus, incentives, or equity. I am a little dubious of the proposition that "access to confidential information" or "training" qualifies as consideration, because employers probably will have a hard time showing they wouldn't have provided the employee these aspects of employment even without the non-compete. Further, it's somewhat illusory and intangible, hard to articulate really.

Judge Shah's opinion doesn't really address what else the employer may have offered the employees in Bankers Life, and perhaps the company threw in enough allegations to move beyond Fifield-Francis. But his opinion is the first to rely on the overall "totality of the circumstances" test that Illinois courts use to analyze a restrictive covenant's reasonableness. That rule does not, by its plain terms, implicate consideration at all.

Judge Shah appears to have looked at the logic underlying that test to conclude that courts would take a more holistic approach at assessing what consideration is adequate to support a restrictive covenant, depending on the employee and probably the terms of the covenant itself.

Or he may have read my dissenting opinion in Fifield and been persuaded.

Monday, February 9, 2015

Legislative Update: Washington Lawmaker Seeks to Ban Non-Competes

I missed my Friday post, meaning I only made it four weeks into the year before I abandoned my New Year's resolution to write and publish every Friday.

However, I took my daughter to Disney's "Frozen on Ice" on Thursday and needed a day to recover mentally. Although Frozen has officially taken over my life, it was worth it. The joy on that kid's face for two hours straight is something I won't forget. Nor will I forget the $12 icee in the Anna/Elsa tribute mug that she coaxed into me buying her. (See picture to the right. Dad drank most of it, thankfully.)

***

I wrote a few weeks back that we're seeing new legislation in Washington state on medical practice non-competes, a frequent and controversial subset of restrictive covenant disputes. We got new activity out of Washington this past week on the non-compete front, and this time the legislation is more sweeping.

Five legislators have introduced House Bill 1926, which would prohibit all non-compete agreements except those incidental to the sale of a business or dissociation from a partnership or limited liability company. The proposed law would apply only to covenants enacted after the passage date.

The language of HB 1926 is identical in all respects to Section 16600 of the California Business and Professions Code, which is the well-known bar to employee non-compete and non-solicitation agreements. Courts have interpreted Section 16600 to apply to non-solicitation covenants, which are in effect just as sweeping for salespersons whose contacts are their stock in trade.

This is what both HB 1926 and Section 16600 provide:

"...every contract by which a person is restrained from engaging in a lawful profession, trade, or business of any kind is to that extent void."

Incidentally, Montana also has a statute in place with the same language as the California code. However, the few Montana courts which have looked at and interpreted the statutory bar have concluded it does not extend to non-solicitation covenants, creating a clear conflict with the way California interprets the statute. The proposed Washington bill does not carve out any type of activity restraint, so if passed, it would be up to the courts to decide whether to follow the California interpretation or go the Montana route.

My personal opinion is that the language could be much clearer, and it certainly should be given the proliferation of lesser restrictive activity covenants. In that regard, Montana courts probably have the better interpretation of this statutory text, but the arguments are compelling for both sides.